Internet

From Things and Stuff Wiki
Revision as of 21:26, 1 March 2021 by Milk (talk | contribs) (→‎ICMP)
Jump to navigation Jump to search



Layer 3/4

to sort




  • The History of Packets - This guide seeks to take you on the adventure of the changing packet, and how it has survived over the past four decades of networking hardware and computer software. The Internet started in the late 1960s as ARPANET.




Ports

Scanning

nmap -A 192.168.1.1
  scan machine and report

nmap -v -A 192.168.1.1-255
  verbose scan range and report

nmap -sT -sU -O -p 1-65535 localhost
  full port scan, to check args

nmap -p T:110,955

nmap -R -sL 209.85.229.99/27 | awk ‘{if($3==”not”)print”(“$2″) no PTR”;else print$3″ is “$2}’ | grep ‘(‘

"This command uses nmap to perform reverse DNS lookups on a subnet. It produces a list of IP addresses with the corresponding PTR record for a given subnet. You can enter the subnet in CDIR notation (i.e. /24 for a Class C)). You could add “–dns-servers x.x.x.x” after the “-sL” if you need the lookups to be performed on a specific DNS server. On some installations nmap needs sudo I believe. Also I hope awk is standard on most distros."


  • https://github.com/trimstray/sandmap - a tool supporting network and system reconnaissance using the massive Nmap engine. It provides a user-friendly interface, automates and speeds up scanning and allows you to easily use many advanced scanning techniques.

IP

  • onics - A suite of command line tools and libraries for manipulating packets in the style of cat, sed, awk, grep, diff, etc... [5]



ARP

Protocol to resolve IPv4 addresses to lower level addressed, i.e., ethernet MAC. 


arp -e
  # list arp table



arp-scan --interface=eth0 --localnet




Subnetting



  • https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing - CIDR, is a method for allocating IP addresses and IP routing. The Internet Engineering Task Force introduced CIDR in 1993 to replace the previous addressing architecture of classful network design in the Internet. Its goal was to slow the growth of routing tables on routers across the Internet, and to help slow the rapid exhaustion of IPv4 addresses. CIDR encompasses several concepts. It is based on the variable-length subnet masking' (VLSM) technique, which allows the specification of arbitrary-length prefixes. CIDR introduced a new method of representation for IP addresses, now commonly known as CIDR notation, in which an address or routing prefix is written with a suffix indicating the number of bits of the prefix, such as 192.0.2.0/24 for IPv4, and 2001:db8::/32 for IPv6. CIDR introduced an administrative process of allocating address blocks to organizations based on their actual and short-term projected needs. The aggregation of multiple contiguous prefixes resulted in supernets in the larger Internet, which whenever possible are advertised as aggregates, thus reducing the number of entries in the global routing table.

Addressing

Multicast
Anycast

Switching

Routing



  • https://en.wikipedia.org/wiki/Interface_Message_Processor - the packet-switching node used to interconnect participant networks to the ARPANET from the late 1960s to 1989. It was the first generation of gateways, which are known today as routers. An IMP was a ruggedized Honeywell DDP-516 minicomputer with special-purpose interfaces and software. In later years the IMPs were made from the non-ruggedized Honeywell 316 which could handle two-thirds of the communication traffic at approximately one-half the cost. An IMP requires the connection to a host computer via a special bit-serial interface, defined in BBN Report 1822. The IMP software and the ARPA network communications protocol running on the IMPs was discussed in RFC 1, the first of a series of standardization documents published by the Internet Engineering Task Force (IETF).






  • The BIRD Internet Routing Daemon Project - a fully functional dynamic IP routing daemon primarily targeted on (but not limited to) Linux, FreeBSD and other UNIX-like systems and distributed under the GNU General Public License.



  • https://en.wikipedia.org/wiki/Bufferbloat - a cause of high latency in packet-switched networks caused by excess buffering of packets. Bufferbloat can also cause packet delay variation (also known as jitter), as well as reduce the overall network throughput. When a router or switch is configured to use excessively large buffers, even very high-speed networks can become practically unusable for many interactive applications like voice over IP (VoIP), online gaming, and even ordinary web surfing. Some communications equipment manufacturers designed unnecessarily large buffers into some of their network products. In such equipment, bufferbloat occurs when a network link becomes congested, causing packets to become queued for long periods in these oversized buffers. In a first-in first-out queuing system, overly large buffers result in longer queues and higher latency, and do not improve network throughput. The bufferbloat phenomenon was initially described as far back as in 1985. It gained more widespread attention starting in 2009.


  • https://en.wikipedia.org/wiki/Link_aggregation - applies to various methods of combining (aggregating) multiple network connections in parallel in order to increase throughput beyond what a single connection could sustain, and to provide redundancy in case one of the links should fail. A Link Aggregation Group (LAG) combines a number of physical ports together to make a single high-bandwidth data path, so as to implement the traffic load sharing among the member ports in the group and to enhance the connection reliability. Other umbrella terms used to describe the method include port trunking, link bundling, Ethernet/network/NIC bonding, channel bonding or NIC teaming. These umbrella terms encompass not only vendor-independent standards such as Link Aggregation Control Protocol (LACP) for Ethernet defined in IEEE 802.1AX or the previous IEEE 802.3ad, but also various proprietary solutions.


  • https://wiki.linuxfoundation.org/networking/bonding - The Linux bonding driver provides a method for aggregating multiple network interfaces into a single logical bonded interface. The behavior of the bonded interfaces depends upon the mode; generally speaking, modes provide either hot standby or load balancing services. Additionally, link integrity monitoring may be performed.

DHCP

  • dhclient - The Internet Systems Consortium DHCP Client, dhclient, provides a means for configuring one or more network interfaces using the Dynamic Host Configuration Protocol, BOOTP protocol, or if these protocols fail, by statically assigning an address.




  • https://en.wikipedia.org/wiki/Udhcpc - a very small DHCP client program geared towards embedded systems. The letters are an abbreviation for Micro - DHCP - Client (µDHCPc). The program tries to be fully functional and RFC 2131 compliant.It was once packaged with a similarly small DHCP server program named udhcpd, with the package called udhcp. It is now maintained as part of Busybox.Built for uClibc, the client executable is around 18k.


  • https://en.wikipedia.org/wiki/Peg_DHCP - a method defined in RFC 2322 to assign IP addresses in a context where regular DHCP wouldn't work. The "server" hands out wooden clothes-pegs numbered with the addresses to allocate and an additional leaflet with network information. The "client", typically the user, then configures their device accordingly. Even though this RFC, "Management of IP numbers by peg-dhcp" was published on the first of April 1998, it describes, unlike most other April Fools' Day RFCs, a regularly used protocol with a serious purpose. During the preparation of Hacking in Progress 1997, the organizers were looking for a robust way to assign IP addresses to the participants. The obvious first choice, DHCP, almost completely defenseless against rogue servers, was not retained considering the traditionally creative use of the network. [11]


NAT

  • https://en.wikipedia.org/wiki/Network_address_translation - a method of remapping one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. The technique was originally used as a shortcut to avoid the need to readdress every host when a network was moved. It has become a popular and essential tool in conserving global address space in the face of IPv4 address exhaustion. One Internet-routable IP address of a NAT gateway can be used for an entire private network. IP masquerading is a technique that hides an entire IP address space, usually consisting of private IP addresses, behind a single IP address in another, usually public address space. The address that has to be hidden is changed into a single (public) IP address as "new" source address of the outgoing IP packet so it appears as originating not from the hidden host but from the routing device itself. Because of the popularity of this technique to conserve IPv4 address space, the term NAT has become virtually synonymous with IP masquerading.As network address translation modifies the IP address information in packets, it has serious consequences on the quality of Internet connectivity and requires careful attention to the details of its implementation. NAT implementations vary widely in their specific behavior in various addressing cases and their effect on network traffic. The specifics of NAT behavior are not commonly documented by vendors of equipment containing NAT implementations.



  • https://en.wikipedia.org/wiki/Carrier-grade_NAT - or (CGNAT), also known as large-scale NAT (LSN), is an approach to IPv4 network design in which end sites, in particular residential networks, are configured with private network addresses that are translated to public IPv4 addresses by middlebox network address translator devices embedded in the network operator's network, permitting the sharing of small pools of public addresses among many end sites. This shifts the NAT function and configuration thereof from the customer premises to the Internet service provider network.


  • https://en.wikipedia.org/wiki/NAT_traversal - a computer networking technique of establishing and maintaining Internet protocol connections across gateways that implement network address translation (NAT).NAT traversal techniques are required for many network applications, such as peer-to-peer file sharing and Voice over IP.




  • https://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol - a network protocol for establishing network address translation (NAT) settings and port forwarding configurations automatically without user effort. The protocol automatically determines the external IPv4 address of a NAT gateway, and provides means for an application to communicate the parameters for communication to peers. NAT-PMP was introduced in 2005 by Apple as an alternative to the more common ISO Standard Internet Gateway Device Protocol implemented in many NAT routers. The protocol was published as an informational Request for Comments (RFC) by the Internet Engineering Task Force (IETF) in RFC 6886. NAT-PMP runs over the User Datagram Protocol (UDP) and uses port number 5351. It has no built-in authentication mechanisms because forwarding a port typically does not allow any activity that could not also be achieved using STUN methods. The benefit of NAT-PMP over STUN is that it does not require a STUN server and a NAT-PMP mapping has a known expiration time, allowing the application to avoid sending inefficient keep-alive packets.NAT-PMP is the predecessor to the Port Control Protocol (PCP).


  • https://en.wikipedia.org/wiki/Internet_Gateway_Device_Protocol - a protocol for mapping ports in network address translation (NAT) setups, supported by some NAT-enabled routers.[2] It is a common communications protocol for automatically configuring port forwarding, and is part of an ISO/IEC Standard [3] rather than an Internet Engineering Task Force standard.
  • https://en.wikipedia.org/wiki/Port_Control_Protocol - a computer networking protocol that allows hosts on IPv4 or IPv6 networks to control how the incoming IPv4 or IPv6 packets are translated and forwarded by an upstream router that performs network address translation (NAT) or packet filtering. By allowing hosts to create explicit port forwarding rules, handling of the network traffic can be easily configured to make hosts placed behind NATs or firewalls reachable from the rest of the Internet (so they can also act as network servers), which is a requirement for many applications. Additionally, explicit port forwarding rules available through PCP allow hosts to reduce the amount of generated traffic by eliminating workarounds in form of outgoing NAT keepalive messages, which are required for maintaining connections to servers and for various NAT traversal techniques such as TCP hole punching. At the same time, less generated traffic reduces the power consumption, directly improving the battery runtime for mobile devices. PCP was standardized in 2013 as a successor to the NAT Port Mapping Protocol (NAT-PMP), with which it shares similar protocol concepts and packet formats.

ICMP






  • https://github.com/benjojo/sping - a tool that can tell you what direction packet latency or loss is on. This is handy for network debugging and locating congestion.


Tunnelling

  • iodine lets you tunnel IPv4 data through a DNS server. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed.




IPsec

IPv4

  • https://github.com/dtaht/unicast-extensions - The IPv4 unicast extensions project - Making class-e (240/4), 0/8, 127/8, 225/8-232/8 generally usable - adding 419 million new IPs to the world, and fixing various other slightly broken pieces of the IPv4 world


IPv6







  • https://en.wikipedia.org/wiki/Multicast_Listener_Discovery - a component of the Internet Protocol Version 6 (IPv6) suite. MLD is used by IPv6 routers for discovering multicast listeners on a directly attached link, much like Internet Group Management Protocol (IGMP) is used in IPv4. The protocol is embedded in ICMPv6 instead of using a separate protocol. MLDv1 is similar to IGMPv2 and MLDv2 similar to IGMPv3. The protocol is described in RFC 3810 which has been updated by RFC 4604.






  • IPv666 - set of tools that enables the discovery of IPv6 addresses both in the global IPv6 address space and in more narrow IPv6 network ranges. These tools are designed to work out of the box with minimal knowledge of their workings. [17]


Security


Retrieved from "https://wiki.thingsandstuff.org/index.php?title=Internet&oldid=57469"