Attacking the Foundation

IP is connectionless, and it never validates the source address. It was designed to deliver packets, not to track or manage flow; flow control belongs to TCP at Layer 4. As a result, threat actors can spoof the source and tamper with header fields.

When TTL reaches zero the packet is discarded and an ICMP Time Exceeded message is sent to the source. The Protocol field makes sure the payload reaches the right upper-layer protocol:

Identification, Flag and Fragment offset handle fragmentation. They are used when a route can't carry the packet's size: the packet is divided and reassembled later.

The IPv6 header is 40 bytes and has eight fields: Version, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, Source and Destination. Several replace IPv4 fields:

Extension headers carry optional information between the header and the payload, used for fragmentation, security and mobility. Routers do not fragment routed IPv6 packets.

There are six IP-related attacks: ICMP, DoS, DDoS, address spoofing, MiTM and session hijacking.

Actors abuse ICMP for reconnaissance (mapping the topology, finding reachable hosts, OS fingerprinting, determining firewall state) and for DoS and DDoS floods. Ping is a user-generated echo request. The messages attackers favour:

Limit probing with strict ICMP ACL filtering at the network edge. Analysts spot attacks in captured traffic and log files; in large networks, firewalls and IDS raise the alerts.

A Smurf attack amplifies to many and reflects back to one:

• —Amplification: echo requests go to many hosts, spoofed to appear to come from the victim.
• —Reflection: all those hosts reply to the victim at once.
• —Newer variants include DNS reflection and NTP amplification.

In address spoofing the question is whether the attacker can see the replies.

MAC spoofing fools a switch by exploiting its CAM table:

1. 1.The attacker sets their MAC to match the target's.
2. 2.The switch reads the source MAC on the frame.
3. 3.It overwrites the CAM entry to the attacker's port.
4. 4.Frames for the target now go to the attacker.

TCP provides three services: reliable delivery (acknowledgments and retransmission), flow control (many segments per acknowledgment) and stateful communication, established by the three-way handshake.

URG

Urgent pointer significant.

ACK

Acknowledgment significant.

PSH

Push function.

RST

Reset the connection.

SYN

Synchronize sequence numbers.

FIN

No more data from sender.

The three-way handshake is SYN, SYN-ACK, ACK. The client requests a client-to-server session, the server acknowledges and requests server-to-client, and the client acknowledges server-to-client, at which point the session is established.

A SYN flood fills the target with half-open connections that never complete. SYNs are sent with randomly spoofed source addresses, the target replies SYN-ACK and waits, and the final ACK never arrives. Legitimate users are denied service.

A TCP reset attack uses a spoofed RST to kill a session instantly. RST is an abrupt teardown, sent to one or both endpoints.

A normal close is a four-way exchange: FIN, ACK, FIN, ACK.

1. 1.Client sends FIN.
2. 2.Server ACKs: client-to-server closed.
3. 3.Server sends its own FIN.
4. 4.Client ACKs: server-to-client closed.

Session hijacking needs the attacker to spoof the IP, predict the sequence number and send an ACK. It takes over an already-authenticated host. The attacker can send but not receive data, and it is difficult to conduct.

UDP is chosen for low overhead in simple request-and-reply. It is connectionless, with no retransmission, sequencing or flow control, and has an 8-byte header: source port, destination port, length, checksum. DNS, DHCP, TFTP, NFS and SNMP use it, as do media streaming and VoIP. 'Unreliable' means reliability is not provided at the transport layer.

UDP's weaknesses:

• —No encryption, so traffic can be read and altered.
• —The checksum is optional and can be recomputed by the attacker.
• —A UDP flood (tools like UDP Unicorn and Low Orbit Ion Cannon) sweeps all ports; the server replies with ICMP port unreachable.
• —That resulting traffic eats the bandwidth, like a DoS.