Part 1
             Networking recap
                                                                                                                                       2
  Introduction to Information Security, Tel-Aviv University                    Recitation 9: Wireshark, Scapy, and more networking
                                                   IP networks
         •    In the lesson, we talked about IP
         •    In practice IP addresses are not really unique
                o They only have to be unique within each network
                o “Network” is left vague on purpose, as size may vary
         •    Some IP ranges are designated for “local networks”
                o 192.168.X.X/16, 10.X.X.X/8, …
                o Multiple local networks may use these IP ranges – these are not unique
         •    Most IP ranges are meant for the “general” network
                o I.E. the internet
                                                                                                                                       3
  Introduction to Information Security, Tel-Aviv University                    Recitation 9: Wireshark, Scapy, and more networking
                                        Routing and layers
         •    Typically, every network interface (NIC) is assigned with an IP and a subnet
               o Use the relevant interface to communicate with an IP on those subnets
         •    For all other IPs (such as on the internet), we typically have a “default route”
         •    The default route is typically defined by marking a default network interface
               o For example – send all “other” traffic to eth0
         •    In the IP layer, we always write the IP of the final destination
         •    In the Physical layer (Ethernet), we write the physical address (MAC) of the 
              next “hop” of the packet
                                                                                                                                       4
  Introduction to Information Security, Tel-Aviv University                    Recitation 9: Wireshark, Scapy, and more networking
                                            Gateway routing
         •    When communicating with a machine in the local network, the physical 
              address (MAC) and IP address “agree”
                o That is - both of them point at the same machine
         •    When communicating with the “rest” of the world, the addresses 
              “disagree”
                o In the physical layer, we want to locally route the packet to a “gateway” machine
                o Globally, in the IP layer we want to specify the real target
         •    The gateway for each network (if exists) is part of the “basic” configuration
                o We should receive it together with the IP allocation and network mask
                o Can be set statically, or received dynamically (such as via DHCP)
                                                                                                                                       5
  Introduction to Information Security, Tel-Aviv University                    Recitation 9: Wireshark, Scapy, and more networking
                                         Network discovery
         •    When connecting to a new network, we must learn the network 
              configuration
                o Specifically, we need a matching IP configuration to communicate with other 
                    computers
                o This means getting a unique IP and learning the subnet mask (and gateway)
                o This is usually done with DHCP, which we won’t cover :/
         •    However, this is not enough
         •    Besides IP, we also need to know the physical address of other machines
                o For contacting other machines on the network
                o This includes the gateway!
                                                                                                                                       6
  Introduction to Information Security, Tel-Aviv University                    Recitation 9: Wireshark, Scapy, and more networking