TCP Protocol introduction - bin 0x1A

Key Takeaways

last episode we did our first networking challenge where we first reverse engineered how the server is listening on a port and then we connected to it with netkit this video we want to go one layer deeper and have a look at the TCP protocol this will be the first time that we have a look at what it means to send a packet over the [Music] network we have used netkit now multiple times we've used it in ctfs and last video to connect to challenges and in the web security series we used it to talk to a real web server so you know that netcat is a very handy tool to send TCP packets over the network so I suggest we download wire shark to analyze packets we sent with netcat when we open wire shock we select the network interface we want to capture packets in this case our traffic doesn't leave the machine do we can select the loop interface Loop is more like a virtual network interface it's not a real physical Network card stuck in your PC through this interface will go all our traffic that we sent around on our local machine and as you may know the own machine is always identified as local host or IP 12701 now let's use two terminal windows and in one window we start netcat in listening mode and a port in the other window we can then execute net like in the last video and we can list all processes that are currently listening on a port and here is our net cat process you know what let's execute our netcat server with estray so we can see all the sus calls that netcat uses to establish a server so it will first create a socket set some options then bind the port 1 2 3 4 and it's now listening on that port and it's waiting for a connection to be established with accept it's basically exactly what we reverse engineered in last video we can also quickly check wire shark and we don't see any packet being sent over the network yet okay okay now let's use the second window to connect to this netcat server you can see on the server that accept now returned because a client connected to the port and now we see three entries in wi shark we see a sun sunak and a packet let's quickly have a look at those as you can see in the lowest window a packet is just some binary data and that binary data has meaning which wies shck can parse and display us nicely so above we can see the decoded packet and it's divided by layers because this packet didn't leave our machine the ethernet layer is just all zeros usually you would find here your Mac address and the MAC address from your switch or router so that layer is only used between two direct connections besides the MAC address this layer also contains a type and the type is set to hex 800 which indicates that the next layer is an ipv4 layer wi shark sees that and knows how to decode the next next bytes when you click on the next layer wire Shar will highlight which bytes of the packet belong to that layer and you can see how it decides that it is an ipv4 version four layer because the first four bits of this bite here is four you can also see here the source and destination IP which in this case is the same so while the ethernet layer with Mach addresses was about direct connections the IP layer can contain an address very far away on the internet and the switches will make sure that this packet is forwarded until you reach the correct machine this layer also contains information about the layer afterwards and that is the protocol identifier in this case it's six which means the content of this IP layer is a TCP header IP and TCP are usually always together it's very common thus you have probably heard of TCP IP before which just says that there is a TCP layer over an IP layer so the ethernet layer helped to get from machine to machine the AP layer helped to identify which machine is the real destination of this and the TCP layer will now help identify which program or process on this machine should handle this packet and that is identified with the port number you can see here that the destination Port is set to 1 2 3 4 you can also see here a source Port which is required so you can receive answers from the server so when the server responds with a packet it will use this port so that the client machine knows which process gets this response and that's usually a random High port number anyhow now we understand how a full TCP packet is constructed now let's have a look at the protocol a protocol just refers to a set of rules on how to talk to another computer if a client and server agree on how to send data back and forth it will work so what we will see now is just what somebody came up with in an order to create a data connection just remember at the moment we have not sent any data with netcat so far we only establish a connection okay so we see that three packets were exchanged first the client sent a so-called Sun packet a synchronized packet and the server responded with a sunak packet meaning I acknowledge that I received it this is important because maybe the initial packet didn't arrive so when you as a client get a response you know that the server got message this means the client knows now that the connection works but from the perspective of the server the server doesn't know yet if the sending the packet was successful maybe the server can only receive but not send packets that's a client will respond to the sunac packet with an act packet acknowledging it so the server gets an answer and both parties are sure yes I successfully exchanged packet with this other machine now we can talk data and this is all done transparently you didn't have to construct these packets yourself you simply opened a socket and waited for a connection okay now let's send some data from the client to the server you can see that immediately the Ser was able to read the line you sent how does it look in W shark we see two new packets a PS packet for the client to the server and an act packet back the packet from the client also now has an additional data layer and that data layer is just contains the raw bytes we send and the serve responds with an act to confirm the client that the packet was successfully received now let's send the response from the server you see the server simply wrote the text to the file descriptor for which is the file descriptor that accept returned as you can see an application simply writes to that pseudo file that socket and the magic below sent that over the network now now let's have a look what it did it also just sent a push packet and the client acknowledged the arrival with an act packet back one more thing obviously the size of a packet is limited so what happens when you send a lot of data let's say you upload a huge file somewhere how will that work let's just copy a bunch of characters and send them ah see now there are more than just two packets you don't see it when you develop an application but somewhere in the kernel Network card or driver I don't really know it got split up you can also see that the second packet was not sent along with the first one the second packing was only sent out once the server acknowledges the first one let's see what happens when you kill the client even though we just control C netkit we can see in wies shck that fin packet was sent out to indicate we are done with this channel you can free up resources and you don't have to expect more packets from this connection and like during setup there are are three packets exchanged the server acknowledges the fin by the client now the client knows that the server knows that it's done but the server doesn't know yet if the client knows that it knows it's done so it also responds with neck now both know it's over now this whole exchange is referred to as a TCP stream we established a connection and then exchange data back and forth and then quit the connection and wi shck allows us to investigate the Stream for example with follow TCP stream here only the data is visible and color coded who sent what and now you should watch my HTTP protocol video from the web security series because you will understand now much better what it means to have a server and client and that HTTP is just data sent over TCP exactly how we send these messages a browser and a web server are just special programs that do special things with special messages over TCP [Music]