|
|
|

The Open System Interconnection (OSI) model was developed in the early 1980's by the International
Organization for Standardization (ISO) with the objective of standardizing communication process in a
heterogeneous environment. Each layer was made to independently handle a specific function in the
communication process. By independence we mean changes to any of the layers do not necessitate changes
to the other layers in the model. This model was however, very vague when it came to specifying the exact
details for implementations. It was developed before the protocols for each layer had been fully specified. It
was realized later that not all the layers were important. Therefore some of the layers are simply removed or
merged with the other layers as in the TCP/IP model which has only 4 layers as compared to the 7 layers in the
OSI. The OSI still serves as a good tool for studying the network processes and the protocols associated with
each layer.
Let us have a brief look at the layers and their interactions in the TCP/IP protocol suite.
Application Layer: This is the layer through which a user interacts with the network. It consists of various
applications like ftp, http, telnet and others. The application layer converts the information into a data stream
and sends it to the transport layer.
Transport Layer: This layer uses one of the two protocols Transmission Control Protocol (TCP) and User
Datagram Protocol (UDP) to determine the way the data has to be sent. TCP breaks the stream into pieces
and adds a header to each of the pieces forming a Segment.
The TCP protocol has the following features:
Connection Oriented: It makes uses of handshaking signals to ensure that the other host is ready
for communication and that the packet has reached its destination.
Error Detection and Correction: The header contains information, vital for ensuring that the data
received is free of errors, is assembled in proper sequence and is complete.
Because of these features, TCP is considered to be a reliable mechanism for transferring data. UDP on the
other hand concerns itself only with forwarding the segments and it does not care whether the data has been
received at the other end or not. UDP is mainly used for broadcasting messages over a network.
The Internet Layer: It is also known as the network layer and uses Internet Protocol (IP) as its primary
protocol. The main function of this layer is to break the segments into smaller packets of sizes that can be
handled by the next layer i.e. the network access layer. These packets are called datagram's. It then
encapsulates the datagram with a header. The header contains among other things the source and the
destination address, the sequence number of the fragmented segments and Time-To-Live (TTL) to ensure that
the packets do not move on the network forever.
Like UDP, IP is unreliable and connectionless. It simply transmits the data to the remote host without knowing
whether the host is ready or not to exchange the data. It does not have any error detection/correction facility.
The IP does not guarantee the receipt of the datagrams. There is always a possibility that a datagram is lost or
corrupted during transmission. The IP forwards the datagram in "as-is" condition to the TCP layer at the
receiving end. The TCP then has to make a request for datagrams that are either missing or contain errors.
The network layer uses another protocol called ICMP. The ICMP is used to relay error messages caused due
to a variety of situations such as a header failing the integrity test or a header with an expired TTL. One such
message is the "host unreachable", used to inform the non availability of the destination host. This informs the
source to not send the packets at this destination.
The Network Access Layer: Also known as the link layer, it mainly consists of network interfaces, device
drivers and other physical media and uses ARP (Address Resolution Protocol) as its main protocol. The main
function of ARP is to translate an IP addresses to a MAC address and vice versa. A MAC (Medium Access
Control) address is the 48-bit hard-wired address of the network card. The link layer then finally sends out the
datagram's in the form of frames to the wire. The advantage of having a separate link layer is that newer
physical network technologies can be introduced (such as Frame Relay and ATM added later) without having
to modify the higher stacks in the protocol.
A reverse process takes place at the receiving end. At each successively higher layer, the packet is stripped of
headers added by the corresponding layer at the sender. The whole communication process can be
summarized with the help of the following diagram.

To better understand the interaction between the various layers let us have a look inside the TCP and the IP packets.
|
Computer Security Home
The OSI and the TCP/IP Layers
TCP
IP
Network & Application Layer Attacks
Network Layer DoS
Syn Flood
Ack Flood
RESET Attack
FIN Attack
Teardrop Attack
IP Spoofing
Predicting TCP Sequence Numbers
Application Layer Attacks
Buffer Overflows
Trojans
Backdoors
Cross-site Scripting
CGI abuses
Firewalls
Packet Filters
Proxy Firewalls
Circuit Level Proxies
Application Level Proxies
Stateful Inspection Firewalls
Limitations of Firewalls
Intrusion Detection and Prevention Systems
Signature Based
Anomaly Based
Statistical Anomaly Based
Protocol Anomaly Based
Host Based IDS (HIDS)
Network Based IDS (NIDS)
Protocol Anomaly Based NIDS
Signature Based NIDS
Web Application Firewalls
Vulnerability Assesment
Host Based Scanner
Network Based Scanner
Web Application Vulnerability Scanner
Content Filters
Encryption
Conclusion
|
|