COMPUTER NETWORK AND SECURITY

DNS

Short for Domain Name System (or Service or Server), an Internet service that translates domain names into IP addresses. Because domain names are alphabetic, they're easier to remember. The Internet however, is really based on IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the corresponding IP address. For example, the domain name www.abc.com might translate to 198.19.202.0

 

The DNS system is, in fact, its own network. If one DNS server doesn't know how to translate a particular domain name, it asks another one, and so on, until the correct IP address is returned.

 

ICANN (Internet Corporation for Assigned Names and Numbers) is responsible for managing the DNS on the internet.

 

How does DNS work?

• DNS recursor (RESOLVER) - The DNS recursor is a server designed to receive queries from client machines through applications such as web browsers. Typically the recursor is then responsible for making additional requests in order to satisfy the client’s DNS query.
• Root name server - The root server is the first step in translating (resolving) human readable host names into IP addresses. 
• TLD name server - The top level domain server (TLD) is the next step in the search for a specific IP address, and it hosts the last portion of a hostname (In example.com, the TLD server is “com”).
• Authoritative nameserver - The authoritative nameserver is the last stop in the nameserver query. If the authoritative name server has access to the requested record, it will return the IP address for the requested hostname back to the DNS Recursor that made the initial request.

 

COMPUTER---->RESOLVER----->ROOT SERVER----> TLD SERVER---->AUTHORITATIVE NAME SERVER

 

 

The complex process actually goes something like this:

• The user types “xyz.com” into the address bar of the browser and presses enter.
• The browser sends a request to that domain’s nameservers.
• The nameservers reply back with the IP address of the website’s server.
• Then the browser requests the website content from that IP address.
• The browser retrieves the content and shows it in your browser.

 

DNS Query Message 

Recursive Query

     In a recursive query, a DNS client provides a hostname, and the DNS Resolver “must” provide an answer—it responds with either a relevant resource record, or an error message if it can't be found. The resolver starts a recursive query process, starting from the DNS Root Server, until it finds the Authoritative Name Server (for more on Authoritative Name Servers see DNS Server Types below) that holds the IP address and other information for the requested hostname.

Iterative Query

In an iterative query, a DNS client provides a hostname, and the DNS Resolver returns the best answer it can. If the DNS resolver has the relevant DNS records in its cache, it returns them. If not, it refers the DNS client to the Root Server, or another Authoritative Name Server which is nearest to the required DNS zone. 

Non-Recursive Query

A non-recursive query is a query in which the DNS Resolver already knows the answer. It either immediately returns a DNS record because it already stores it in local cache.

 

 

HTTP and HTTPS

What is HTTP?

An HTTP stands for Hypertext Transfer Protocol. The HTTP protocol provides communication between different communication systems. When the user makes an HTTP request on the browser, then the web server sends the requested data to the user in the form of web pages. In short, we can say that the HTTP protocol allows us to transfer the data from the server to the client.

What is HTTPS?

The full form of HTTPS is Hypertext Transfer Protocol Secure. The HTTP protocol does not provide the security of the data, while HTTPS ensures the security of the data. Therefore, we can say that HTTPS is a secure version of the HTTP protocol. This protocol allows transferring the data in an encrypted form. The use of HTTPS protocol is mainly required where we need to enter the bank account details. The HTTPS protocol is mainly used where we require you to enter the login credentials. In modern browsers such as chrome, both the protocols, i.e., HTTP and HTTPS, are marked differently. To provide encryption, HTTPS uses an encryption protocol known as Transport Layer Security, and officially, it is referred to as a Secure Sockets Layer (SSL). 

 

The major difference between the HTTP

DHCP

 

A DHCP Server is a network server that automatically provides and assigns IP addresses, default gateways and other network parameters to client devices. It relies on the standard protocol known as Dynamic Host Configuration Protocol or DHCP to respond to broadcast queries by clients.

 

DHCP Operation

 

2.1.1. DHCP Discover Packet

• Sent by the DHCP client to the DHCP server (Broadcasting).

• A DHCP client (computer or device which wants IP) broadcasts a request for an IP address on its network. It does this by using a DHCP DISCOVER packet.

• Packet must reach the DHCP server.

• DHCP discovers packet is for checking weather DHCP server is available in network 

 

2.1.2. DHCP Offer Packet

• Sent by DHCP server to DHCP client (Unicasting)

• When a DHCP server receives a DHCPDISCOVER message from a client, which is an IP address lease request, the server reserves an IP address for the client and makes a lease offer by sending a

DHCPOFFER message to the client

• This message contains the client's MAC address, the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer

 

 

 

2.1.3. DHCP Request Packet

• Sent by DHCP client to DHCP servers (Broadcasting)

• In response to the DHCP offer, the client replies with a DHCP request, broadcast to the server, requesting the offered address.

• A client can receive DHCP offers from multiple servers, but it will accept only one DHCP offer

• Based on the required server identification option in the request and broadcast messaging, servers are informed whose offer the client has accepted.

• When other DHCP servers receive this message, they withdraw any offers that they might have made to the client and return the offered address to the pool of available addresses.

 

5.1.4. DHCP Acknowledgement Packet

• Sent by DHCP servers to DHCP client (Unicasting)

• When the DHCP server receives the DHCP REQUEST message from the client, the configuration process enters its final phase.

• The acknowledgement phase involves sending a DHCP ACK packet to the client.

• This packet includes the lease duration and any other configuration information that the client might have requested.

• At this point, the IP configuration process is completed

 

 

WWW

 

"World Wide Web " or "the Web", a hypertext system that operates over the Internet. 

The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web. Hypertext is structured text that uses logical links (hyperlinks) between nodes containing text.

HyperText Transfer Protocol Secure (HTTPS) is the secure version of HTTP, the protocol over which data is sent between your browser and the website that you are connected to. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications between your browser and the website are encrypted. HTTPS is often used to protect highly confidential online transactions like online banking and online shopping order forms.

Web browsers such as Internet Explorer, Firefox and Chrome also display a padlock icon in the address bar to visually indicate that a HTTPS connection is in effect.

TELNET

TELNET stands for Teletype Network. It is a type of protocol that enables one computer to connect to the local computer. It is used as a standard TCP/IP protocol for virtual terminal service which is provided by ISO. The computer which starts the connection is known as the local computer. 

The computer which is being connected to i.e. which accepts the connection known as the remote computer.

Telnet operates on a client/server principle. The local computer uses a telnet client program and the remote computers use a telnet server program. 

 

• TELNET uses the NVT (Network Virtual Terminal) system to encode characters on the local system.

• On the server (remote) machine, NVT decodes the characters to a form acceptable to the remote machine.

• TELNET is a protocol that provides a general, bi-directional, eight-bit byte oriented communications facility.

• Many application protocols are built upon the TELNET protocol

• Telnet services are used on PORT 23.

 

 

 

FTP

• FTP stands for File transfer protocol.
• FTP is a standard internet protocol provided by TCP/IP used for transmitting the files from one host to another.
• It is mainly used for transferring the web page files from their creator to the computer that acts as a server for other computers on the internet.
• It is also used for downloading the files to the computer from other servers.

Objectives of FTP

• It provides the sharing of files.
• It is used to encourage the use of remote computers.
• It transfers the data more reliably and efficiently.

Advantages of FTP:

• Speed: One of the biggest advantages of FTP is speed. The FTP is one of the fastest way to transfer the files from one computer to another computer.
• Efficient: It is more efficient as we do not need to complete all the operations to get the entire file.
• Security: To access the FTP server, we need to login with the username and password. Therefore, we can say that FTP is more secure.
• Back & forth movement: FTP allows us to transfer the files back and forth. Suppose you are a manager of the company, you send some information to all the employees, and they all send information back on the same server.

 

 

 ELECTRONIC MAIL:

 

E-mail (electronic mail) is the exchange of computer-stored messages by telecommunication. (Some publications spell it email; we prefer the currently more established spelling of e-mail.) E-mail messages are usually encoded in ASCII text.

 

Overview

 

SMTP, POP3 and IMAP are TCP/IP protocols used for mail delivery. If you plan to set up an email server such as MailServer, you must know what they are used for. Each protocol is just a specific set of communication rules between computers.

Email consists of two kinds of subsystems

1. Mail User Agents (also called MUA/email client programs): which allow people to read and send email (Ex: Outlook)

2. Message Transfer Agents(also called MTA/ Email Server) : which move the messages from the source to the destination (Ex: Gmail Server)

• Act of sending new messages into the mail system for delivery is called Mail submission (Email Client to Email Sever)

• The Process of transferring mail from one MTA to another (Ex : from gmail to yahoo server) is called Message Transfer

• Mailboxes store the email that is received for a user (Working all Protocols)

 

SMTP:

Simple Mail Transfer Protocol, SMTP − It lays down the rules and semantics for sending and receiving electronic mails (e-mails).

 

SMTP (Simple Mail Transfer Protocol)

• Message transfer form originator to the recipient mailbox is done with SMTP

• It uses TCP well known port 25

• SMTP server accepts incoming connections, subject to some security checks, and accepts messages for delivery

• If a message cannot be delivered, an error report containing the first part of the undeliverable message is returned to the sender

Features of SMTP

• SMTP supports sending of email 

• SMTP provides system for sending message to same (or different) servers (gmail to gmail / gmail to yahoo)

• SMTP provide a mail exchange between users on same (or different) server

SMTP supports:

1. Sending a message to one or more recipients

2. Sending message that includes text, voice, video or graphics

3. Sending message to users on other network

 

POP:

POP (Post Office Protocol)

• Post Office Protocol (POP) is an application-layer Internet standard protocol used by local e-mail clients to retrieve e-mail from a remote server over a TCP/IP connection

• POP has been developed through several versions, with version 3 (POP3) being the last standard

• E-mails are downloaded from the server's mailbox to your computer

• No copy of Email will be kept in mailbox after downloading the email

• E-mails are available when you are not connected

POP Working

• Working of POP servers is as following steps:

1. Connect to server

2. Retrieve all mail

3. Store locally as new mail

4. Delete mail from server*

5. Disconnect

Advantages of POP

1. Mail stored locally, i.e. always accessible, even without internet

connection

2. Internet connection needed only for sending and receiving mail

3. Saves server storage space

4. Option to leave copy of mail on server

IMAP:

IMAP (Internet Message Access Protocol)

• Protocols that is used for final delivery is IMAP

• IMAP is an Internet standard protocol used by e-mail clients to retrieve e-mail messages from a mail

server over a TCP/IP connection

• IMAP provides mechanisms for storing messages received by SMTP in a mailbox

• IMAP server stores messages received by each user until the user connects to download and read them

using an email clients

* Now a days IMAP replaced POP in all E-mail services

IMAP Working

• Working of IMAP servers is as following steps:

1. Connect to server

2. Fetch user requested content and cache it locally, e.g. list of new mail, message summaries, or content

of explicitly selected emails

3. Process user edits, e.g. marking email as read, deleting email etc.

4. Disconnect

 IMAP Advantage

1. Mail stored on remote server, i.e. accessible from multiple different locations

2. Internet connection needed to access mail

3. Faster overview as only headers are downloaded until content is explicitly requested

4. Mail is automatically backed up if server is managed properly

5. Saves local storage space

6. Option to store mail locally