Group1_Charisma: Selective Repeat ARQ

Below is a link to an applet which animates the Selective Repeat ARQ protocol:

http://media.pearsoncmg.com/aw/aw_kurose_network_3/applets/SelectRepeat/SR.html

Group1_CHARISMA_Report(5)

Due to the upcoming internals, we didn’nt manage any susbstantial development to either projects.

Group1_CHARISMA_Selective Repeat Protocol: Introduction(4)

Selective Repeat ARQ is a specific instance of the Automatic Repeat-reQuest (ARQ) Protocol. It may be used as a protocol for

->The delivery and acknowledgement of message units, or

->The delivery of subdivided message sub-units.

When used as the protocol for the delivery of messages, the sending process continues to send a number of frames specified by a window size even after a frame loss. The receiving process will continue to accept and acknowledge frames sent after an initial error. The receiver process keeps track of the sequence number of the earliest frame it has not received, and sends that number with every ACK it sends. If a frame from the sender does not reach the receiver, the sender continues to send subsequent frames until it has emptied its window. The receiver continues to fill its receiving window with the subsequent frames, replying each time with an ACK containing the sequence number of the earliest missing frame. Once the sender has sent all the frames in its window, it re-sends the frame number given by the ACKs, and then continues where it left off.

When used as the protocol for the delivery of subdivided messages it works somewhat differently. In non-continuous channels where messages may be variable in length, standard ARQ or Hybrid ARQ protocols may treat the message as a single unit. Alternately selective retransmission may be employed in conjunction with the basic ARQ mechanism where the message is first subdivided into sub-blocks (typically of fixed length) in a process called Packet segmentation. The original variable length message is thus represented as a concatenation of a variable number of sub-blocks. While in standard ARQ the message as a whole is either acknowledged (ACKed) or negatively acknowledged (NAKed), in ARQ with selective transmission the NAKed response would additionally carry a bit flag indicating the identity of each sub-block successfully received. In ARQ with selective retransmission of sub-divided messages each retransmission diminishes in length, needing to only contain the sub-blocks that were NAKed.

In most channel models with variable length messages, the probability of error-free reception diminishes in inverse proportion with increasing message length. In other words it’s easier to receive a short message than a longer message. Therefore standard ARQ techniques involving variable length messages have increased difficulty delivering longer messages, as each repeat is the full length. Selective retransmission applied to variable length messages completely eliminates the difficulty in delivering longer messages, as successfully delivered sub-blocks are retained after each transmission, and the number of outstanding sub-blocks in following transmissions diminishes.

Applications:

->The ITU-T(International Telecommunication Union) G.hn (common name for the “next generation” home network technology standard being developed under the ITU) standard, which provides a way to create a high-speed (up to 1 Gigabit/s) Local area network using existing home wiring (power lines, phone lines and coaxial cables), uses Selective Repeat ARQ to ensure reliable transmission over noisy media.

->G.hn employs Packet segmentation to sub-divide messages into smaller units, to increase the probability that each one is received correctly.

Group1_CHARISMA_Network Protocol Analysis(3): Introduction to Wireshark

Wireshark is a tool that allows packet traces to be sniffed, captured and analysed. Before Wireshark (or in general, any packet capture tool) is used, careful consideration should be given to where in the network packets are to be captured.

Intended Purposes:

• network administrators use it to troubleshoot network problems
• network security engineers use it to examine security problems
• developers use it to debug protocol implementations
• people use it to learn network protocol internals

Features that Wireshark provides:

• Available for UNIX and Windows.
• Capture live packet data from a network interface.
• Display packets with very detailed protocol information.
• Open and Save packet data captured.
• Import and Export packet data from and to a lot of other capture programs.
• Filter packets on many criteria.
• Search for packets on many criteria.
• Colorize packet display based on filters.
• Create various statistics.

To use Wireshark, you must:

• Obtain a binary package for your operating system, or
• Obtain the source and build Wireshark for your operating system.

Let’s look at Wireshark’s user interface.The figure below shows Wireshark as you would usually see it after some packets are captured or loaded

Wireshark’s main window consists of parts that are commonly known from many other GUI programs.

1. The menu is used to start actions.
2. The main toolbar provides quick access to frequently used items from the menu.
3. The filter toolbar provides a way to directly manipulate the currently used display filter
4. The packet list pane displays a summary of each packet captured. By clicking on packets in this pane you control what is displayed in the other two panes.
5. The packet details pane displays the packet selected in the packet list pane in more detail.
6. The packet bytes pane displays the data from the packet selected in the packet list pane, and highlights the field selected in the packet details pane.
7. The status bar shows some detailed information about the current program state and the captured data.

By next week, we intend to become familiar with the tolls provided with Wireshark and sucessfully analyse simple protocols.

Group1_CHARISMA_How the Internet works(1)

How did the Internet really get started? It all began with a satellite. In 1957 when the then Soviet Union launched Sputnik, the first man-made satellite, the cold war between the Russians and the Americans led to the then American President Dwight D. Eisenhower create the Advanced Research Projects Agency (ARPA) in 1958. ARPA’s purpose was to give the United States a technological edge over other countries. It created a computer network which connected four computers running on four different operating systems. They called the network ARPANET. ARPANET laid the foundation for the present day internet.

Nobody owns the Internet. The Internet Society, a non-profit group established in 1992, monitors how we interact with the Internet.

Internet Protocol: IP Addresses:
Every machine on the Internet has a unique identifying number, called an IP Address. The IP stands for Internet Protocol, which is the language that computers use to communicate over the Internet. A protocol is the predefined way that someone who wants to use a service talks with that service. The “someone” could be a person, but more often it is a computer program like a Web browser.

A typical IP address looks like this:

216.27.61.137

To make it easier for us humans to remember, IP addresses are normally expressed in decimal format as a dotted decimal number like the one above. But computers communicate in binary form. The same IP address in binary looks like this:

11011000.00011011.00111101.10001001

All of these networks rely on Network Access Points or NAPs, backbones and routers to talk to each other.The Internet backbone is made up of many large networks which interconnect with each other. These large networks are known as Network Service Providers or NSPs. What is incredible about this process is that a message can leave one computer and travel halfway across the world through several different networks and arrive at another computer in a fraction of a second!

The routers determine where to send information from one computer to another. Routers are specialized computers that send your messages and those of every other Internet user speeding to their destinations along thousands of pathways. A router has two separate, but related, jobs:

* It ensures that information doesn’t go where it’s not needed. This is crucial for keeping large volumes of data from clogging the connections of “innocent bystanders.”
* It makes sure that information does make it to the intended destination.

Protocol Stacks and Packets:
How does a computer with a unique IP address communicate with other computers connected to the Internet? An example should serve here: Let’s say your IP address is 1.2.3.4 and you want to send a message to the computer 5.6.7.8. Obviously, the message must be transmitted over whatever kind of wire connects your computer to the Internet. Let’s say you’ve dialed into your ISP(Internet Service Provider) from home and the message must be transmitted over the phone line. Therefore the message must be translated from alphabetic text into electronic signals, transmitted over the Internet, then translated back into alphabetic text. This is accomplished through the use of a protocol stack. Every computer needs one to communicate on the Internet and it is usually built into the computer’s operating system (i.e. Windows, Unix, etc.). The protocol stack used on the Internet is referred to as the TCP(Transmission Control Protocol)/IP protocol stack because of the two major communication protocols used.
The ISP maintains a pool of modems for their dial-in customers. This is managed by some form of computer (usually a dedicated one) which controls data flow from the modem pool to a backbone or dedicated line router. This setup may be referred to as a port server, as it ‘serves’ access to the network. Billing and usage information is usually collected here as well.

After your packets traverse the phone network and your ISP’s local equipment, they are routed onto the ISP’s backbone or a backbone the ISP buys bandwidth from. From here the packets will usually journey through several routers and over several backbones, dedicated lines, and other networks until they find their destination, the computer with address 5.6.7.8. This is how the internet works.

Group1_CHARISMA_Network Protocol Analysis and Protocol Analyzer(1)

Network protocol analysis is a process for a program or a device to decode network protocol headers and trailers to understand the data and information inside the packet encapsulated by the protocol. Traffic passing over a digital network or part of a network can be intercepted.To conduct protocol analysis, packets must be captured at real time for line speed analysis or later analysis. Such program or device is called a Protocol Analyzer.

Screenshot of a Network Protocol Analyser tool

In the typical network architecture, a layered approach is used to design network protocols and communications. The most popular network architecture reference model is called the OSI model. The protocols at one layer should communicate with protocols at the same layer. The key function of a protocol analyzer is to decode the protocol at each layer. Protocol information of multiple layers may be used by protocol analyzer to identify possible problems in the network communication, which is called Expert Analysis.

Protocol analyzers may decode multiple layer protocols and packets to re-construct lower level packets (such as Link, IP or TCP level) into higher level (such as application level) messages for deep understanding of network traffic and user activities. This technique is used in protocol analyzers when network traffic monitoring and user surveillance are the primary goals. Javvin Packet Analyzer is a example of this type of tools.

Protocol Analyzer can be used both for legitimate network management or  for stealing information off a network. Network operations and maintenance personnel use Protocol Analyzer to monitor network traffic, analyze packets, watch network resource utilization, conduct forensic analysis of network security breaches and troubleshoot network problems. Unauthorized protocol analyzers can be extremely dangerous to a network’s security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker’s arsenal.

Uses

The versatility of packet sniffers means they can be used to:

• Analyze network problems
• Detect network intrusion attempts
• Gain information for effecting a network intrusion
• Monitor network usage
• Gather and report network statistics
• Filter suspect content from network traffic
• Spy on other network users and collect sensitive information such as passwords (depending on any content encryption methods which may be in use)
• Reverse engineer proprietary protocols used over the network
• Debug client/server communications
• Debug network protocol implementations

Example uses

A packet sniffer:

• can be used in education to demonstrate how network protocols work
• is often used in the development and debugging of networking software
• for a token ring network, can detect that the token has been lost or the presence of too many tokens (verifying the protocol)
• can detect that messages are being sent to a network adapter; if the network adapter did not report receiving the messages then this would localize the failure to the adapter
• can detect excessive messages being sent by a port, detecting an error in the implementation
• can collect statistics on the amount of traffic (number of messages) from a process detecting the need for more bandwidth or a better method
• can be used to extract messages and reassemble into a complete form the traffic from a process, allowing it to be reverse engineered
• can be used to diagnose operating system connectivity issues such as HTTP, FTP, SQL, Active Directory, etc.
• can be used to analyse data sent to and from secure systems in order to understand and circumvent security measures, for the purposes of penetration testing or illegal activities
• can passively capture data going between a web visitor and the web servers, decode it at the HTTP and HTML level and create web log files as a substitute for server logs and page tagging for web analytics

Group1_CHARISMA_Network Protocol Analysis(2): Report

Our objective in the previous week was to understand the basics of network protocol analysis, know more about the tools used and thier working,and we have accomplished the same.We have learnt that network protocol analysis is a process of decoding packets of information encapsulated by the protocol.This can be done using a network protocol analyser which can also be used to build protocols.In the typical network architecture, a layered approach is used to design network protocols and communications. The most popular network architecture reference model is called the OSI model. The protocols at one layer should communicate with protocols at the same layer.The regular computer communication class was of great help in making us understand these concepts better and get a vivid picture of how protocol stack works. The key function of a protocol analyzer is to decode the protocol at each layer. Protocol information of multiple layers may be used by protocol analyzer to identify possible problems in the network communication, which is called Expert Analysis.
With this background we learnt about the usage of the protocol analyser tool wireshark.These are some of the commands whose syntaxes and functions were understood by us:-
capinfos – Prints information about capture files
dumpcap – Dump network traffic
editcap – Edit and/or translate the format of capture files
idl2wrs – CORBA IDL to Wireshark Plugin Generator
mergecap – Merges two or more capture files into one
rawshark – Dump and analyze raw libpcap data
text2pcap – Generate a capture file from an ASCII hexdump of packets
tshark – Dump and analyze network traffic
wireshark-filter – Wireshark filter syntax and reference
wireshark – Interactively dump and analyze network traffic
We look forward to learn more about wireshark by next week.