2.4 Protocol Transport Layer udp, the aspect ratio of udp.

The protocol UDP (User Datagram Protocol) - is one of the two transport layer protocols that are used in the protocol stack TCP / IP. The task of transport protocol UDP is the transfer of data between application processes with no guarantee of delivery, so its packets can be lost, duplicated, or not come in the order in which they were sent.

The best-known services that are based on UDP, a BIND Domain Name System and Distributed File System NFS. A unit of data called the UDP packet or a UDP-User Datagram (user datagram). UDP-packet consists of header and data fields, which is located a package application layer. UDP-packet format is shown in Figure 10.

Fig. 10 Structure of the UDP-packet

The title has a simple format and consists of four two-byte fields: • Source Port - the port number of the sending process, • Destination Port - the port of destination, • Message length - length of the UDP-packet in bytes • Checksum - Checksum UDP-packet In the Application Data contains the data being transmitted. Not all fields of UDP-packet must be filled. If sent by the datagram does not suggest an answer, then place the sender's address may be placed zeros. You can abandon the checksum.

2.5 Transport layer protocol TCP, frame format Protocol TCP. If an application for quality control of data transmission over the network is important, in this case, the protocol is TCP. TCP is a reliable and connection-oriented protocol. In contrast to the protocol UDP, which simply delivers the data to a specific port, and provides no connection, TCP connection-oriented, ie first is to establish a connection. The reliability of TCP is that the data source repeats its premise, unless it receives a certain amount of time the addressee's acknowledgment of their successful delivery. This mechanism is called Positive acknowledgement with Retransmission (PAR). In a TCP header checksum field. If the data is corrupted during transmission, the checksum of the module, the articulation of the segments of the TCP-packet IP, can determine this. Corrupted packet is destroyed and nothing is sent to the source. If the data were not damaged, they passed on the message assembly applications, and the source of confirmation is sent.

Focusing on the connection from the fact that before sending the data segment, TCP modules source and destination exchange management information. This exchange is called a hand-shake. TCP is used in three-phase hand-shake: • Source establishes connection with the recipient by sending a packet with the flag of" synchronizing sequence numbers" (Synchronize Sequence Numbers - SYN). Number in the sequence determines the packet number in the message application. This does not necessarily have to be either 0 or a unit. But all the other numbers will use it as a base, which will collect the bags in the correct order; • The recipient meets the number in the receipt of the SYN, which corresponds to the number set by the source. In addition, the "number in the sequence" may also be communicated to a number that prompted for the source; • A source confirms that the recipient received the segment and sends the first chunk of data. Graphically, this process is shown in Figure 11.

Fig. 11 Setting up the TCP connection

Once the connection source sends data to the receiver and waits for a confirmation of their receipt, then sends the data and so on, until the message ends. Message ends when the flags field in the exposed bits of FIN, which means "no more data." The TCP packets are called segments and consist of a header and data block. Format of the TCP segment is shown in Figure 12

Fig. 12 Format of the TCP segment

The title segment has the following fields: • Source port (SOURS PORT) - 2 bytes, identifies the sending process; • Port of destination (DESTINATION PORT) - 2 bytes, the process of identifying the recipient;

• The sequence number (SEQUENCE NUMBER) - takes 4 bytes indicates the number of bytes that defines the offset of the segment relative to the flow of data being sent;

• Confirmed number (ACKNOWLEDGEMENT NUMBER) - takes 4 bytes contain the maximum number of bytes in the received segment, increased by unity, this value is used as a receipt; • Header Length (HLEN) - takes 4 bits to indicate the length of the segment header TCP, measured in 32-bit words. The length of the header is not fixed and may vary depending on the values ​​set by the Options field; • Reserve (RESERVED) - is a 6 bits field is reserved for future use; • The code bits (CODE BITS) - occupy 6 bits contain proprietary information about the type of the segment defined by setting the corresponding bits in a unit of this field: • URG - urgent message; • ACK - received a receipt for the segment; • PSH - a request to send a message without waiting for the buffer is full; • RST - a request for reconnection; • SYN - the message is used to synchronize the counters of data transferred when a connection; • FIN - a sign of the transmitting side reach the last byte in the stream of data transmitted. • Window (WINDOW) - 2 bytes contain the value declared by the window size in bytes; • The checksum (CHECKSUM) - 2 bytes, is calculated for the segment; • The urgent pointer (URGENT POINTER) - 2 bytes, is used in conjunction with the code a bit URG, indicating the end of the data that is urgently needed, in spite of the overflow; • Options (OPTIONS) - This field is variable in length and may be absent, the maximum field of 3 bytes, used for the solution of auxiliary problems, for example, when choosing the maximum segment size; • Filler (PADDING) - can be of variable length, is a fictitious field that is used to adjust the size of the header to an integer 32-bit words.

2.6 Ports of the protocol stack TCP / IP The task of the network layer is the transfer of data between arbitrary nodes in the network, the problem of the transport layer is to transfer data between any application processes running on all nodes of the network. Once the package by means of IP-delivered to the addressee, the data should be sent to the recipient a specific process. Each computer can run multiple processes, moreover, the application process can also have multiple entry points, acting as a destination for data packets. Packets arriving at the transport level, organized by the operating system as a set of queues at points of entry of various application processes. In the terminology of TCP / IP system queues are called ports. Thus, the destination address, which is used at the transport layer is the identifier (number) port an application service. The port number specified by the transport layer, in conjunction with the network number and the number of computers, given by the network layer, uniquely determine the application process online.

Assigning port numbers or application process is carried out centrally, if these processes are a popular public services, such as service remote file access TFTP (Trivial FTP) or remote management service telnet, or locally for those services that have not yet become so common that for them to fix the standard (reserved) numbers. Centralized assignment of port numbers is performed services organization Internet Assigned Numbers Authority. These numbers are then fixed and published in the standards Internet. For example, the above-mentioned service, remote access to files assigned to the standard TFTP port number 69. The local port number assignment is that the developer of the application of some simple links with any available randomly selected numeric identifier, paying attention to the fact that it was not included in the number of reserved port numbers. In the future, all remote requests to the application from other applications should be addressed with an indication of its assigned port number. Table 1 lists the most common port services. Table 1. A list of the most common ports and their associated services.

Service		Port / Transport	Comment
ftp-data		20/tcp	data path via FTP
ftp		21/tcp	FTP command channel
telnet		23/tcp	remote terminal emulator
smtp		25/tcp	e-mail server
whois		43/tcp	search on whois databases
domain		53/udp	Server DNS, service requests
domain		53/tcp	Server DNS, zone transfer to a secondary server
http		80/tcp	WWW server
sunrpc		111/udp	Remote Procedure Call
sunrpc	111/tcp
dhcp		67/udp	DHCP server
dhcp		68/udp	Client DHCP (server to communicate with the client)
tftp		69/udp	Server Trivial FTP
finger		79/tcp	Finger
pop3		110/tcp	Post Office Protocol - POP server
nntp		119/tcp	The server teleconferencing
imap		143/tcp	Server IMAP - POP-server development
snmp-trap		162/udp	SNMP - Simple Network Management Protocol
snmp		161/udp	used to remotely configure and manage routers and other network equipment
bgp		179/tcp	Routing daemon protocol bgp
uucp		540/tcp	The daemon uucp - Service to copy files (including mail delivery) Dial
syslog		514/udp	Daemon log system events
talk		517/udp	Tools of communication between two users in real time
nfsd		2049/udp	The server NFS - Network File System
nfsd	2049/tcp

2.7 Example of the ports, the organization of IP - firewall. To configure a firewall built-in OS Windows 2000/XP - must enter the directory Local Security Policy (Control Panel -> Administrative Tools).

2.7.1 Creating a new security policy. In the directory of the local security settings to select the line "Privacy Policy IP"

By right-clicking on the "Security Policy IP", select "Create a security policy IP", as a result, run the installation wizard IP Policy.

In the resulting dialog box, enter the policy name and description

I n the next window, mark the "Use the default rule."

In this window, leave all the default settings.

In the next window remove the check mark - property policy will be edited later.

Now politics has appeared in the list created by the policy.

2.7.2. Create a new filter action. By right-clicking on the "Security Policy IP", select "Manage Lists IP-filter and filter actions."

In the window that appears, go to the tab "Manage filter actions."

Click "Add" button - to add the action "filter ban" wizard will start.

In the window that give the name of the action of the filter and its description.

In the window that appears, select the action - "Block."

Thus was created the first rule - banned all types of services, and will continue to allow those services (open ports) are required. The last window press the "Done", select "Edit Properties" to be installed.

In the window there was a new line of action.

2.7.3 Editing the established security policy Clicking twice left click on the name of security policy. In the window "Properties" to change the properties of established policies push the button "Add"

A wizard to create new rules of security policy.

In the next window, leave everything unchanged.

In the next window, specify, for which the connection will operate this rule. In the case of an excited this rule will apply to all network connections

In this window, leave everything unchanged

In this window it is necessary to choose the filter which forbids all types of services for all. As the necessary filter in the list isn't present, he is necessary for adding. For this purpose we press the Add button.

In the opened window we entitle the filter and it is described its actions. Further we press the Add button

The master of creation of the filter is started

In a window we specify a source of packages (the address of senders) since the filter should not pass packages from all, we specify any IP address

In the following window the address of the recipient of a package as the filter should forbid packages from all sources to ours of a host, we specify «my IP address».

In the following window the address of the recipient of a package as the filter should forbid packages from all sources to ours of a host, we specify «my IP address».

In the following window without establishing a tag «To change properties» we press "ready".

The new filter is created.

I n a window of existing filters we choose the created filter and we press "Next"

In the opened window we choose action for the filter, in this case we choose created by us in point 2.7.2 action – «The ban filter» and we press "Next".

In this window without establishing a tag «To change properties» we press "ready"

A new rule appeared in the created policy.