Summary

A lot of new and diverse topics have been jam-packed into this introductory chapter. Details aside, you need to take away some core concepts with you to understand the upcoming chapters on TCP/IP.

First, visualize the transfer of data between two networked hosts as a series of layers, much like a stack. On the sending end, the message to be delivered is encapsulated in a series of headers as it is passed down the stack. On the receiving end, the process is reversed and the encapsulating headers are stripped and delivered to the associated layer of the stack for processing. Each layer on the sending host really communicates with its peer layer on the receiving host. Data is exchanged and packaged in different bundles with different names depending on the purpose of the data and the layer at which it is found in the TCP/IP stack.

Hosts are addressed as both IP numbers and MAC numbers at different layers of the TCP/IP stack. Remember that port numbers are used with TCP and UDP to designate a specific application, such as sendmail or telnet. TCP is the connection-oriented protocol that promises delivery, whereas UDP makes no such promise and is considered unreliable. DNS is used to translate host names to IP addresses and vice versa. Finally, routing is responsible for transporting the datagram from source to destination host. TCP/IP is a vast and complex topic.Various aspects of it will be examined in more detail in subsequent chapters of this part of the book.

Chapter 2. Introduction to TCPdump and TCP

Now that you have learned a bit about Internet Protocol (IP), you can take a closer look at how it works by using a practical analysis tool known as TCPdump. Just as you cannot do any kind of intrusion detection or traffic analysis without knowledge of TCP/IP, you cannot do analysis without a tool of some sort. TCPdump, or its Windows cousin Windump, is a popular and widely used piece of software that can give you some insight into the traffic activity that occurs on a given network. This chapter teaches you how to manipulate the tool for your own purposes and explains the output that it displays. The discussion then turns to one of the most important and common protocols, TCP. You are introduced to some theory, but the real goal is to enable you to catch a visual clue about TCP's behavior by examining it using TCPdump.

An excellent free tool for packet sniffing and interpretation is known as Ethereal, which is available for both Windows and UNIX. It provides a GUI interface to interpret all layers of the packet and many times the payload. It is even protocol aware, meaning that it knows how to interpret the payload of many common protocols. For instance, it would know how to decipher a normally coded DNS query. You are probably wondering why Ethereal is not being used as the tool of choice in this book. First, it is more difficult to translate the Ethereal output to readable book format. TCPdump is more succinct and more easily viewed. Second, TCPdump is more primitive because it requires the user to do much of the interpretation of the output. The challenge is to make you think rather than hand you all the answers, as Ethereal does.

The second part of this chapter begins the discussion of network protocols with a discussion of TCP. All the chapters in this book that discuss network protocols follow a similar format. To