Hacker Fundamentals: The Everyman's Guide to How Network Packets Are Routed Across the Web « Null Byte :: WonderHowTo

In general, hacking and information security is not just one discipline, but a number of them, and today we will look into some of the networking concepts.In the lastHacker Fundamentals, we talked about theOSI modelas well as a little on TCP/IP and the protocols that make up the suite. Now, we're going to expand on that now and take a look at the various parts of a network that you might have heard about, but might not understand.We already covered how your data travels the OSI model, layer by layer, and talks with other machines on your local network. But how does that data leave your network? How does it know where to go? What's going on here?Much of the 'talking' on a local network are broadcasts. This computer is asking for the MAC address of another one, or asking for a local IP address, or any number of things. But doesn't that mean the Internet should be flooded with various broadcast noise all over the place? As it turns out, no. You see, the job of a router is not only to route traffic, but to stop broadcasts. To explain this concept fully, let's look into some examples.No routers were hurt in the writing of this article.A Tale of Two Packets: InternalIf you remember correctly, an IP address has two components, the network section and the host section. A subnet mask separates the IP address into those two segments (<network><host>). A subnet is expressed just like an IP address in a four octet form, the most common one being 255.255.255.0 where the '255' means those octets are describing the network and the '0' is describing the host.Let's say you wanted to send data to another computer on your local network at home. Your internal IP address in this example is172.10.1.20and your destination IP address is172.10.1.30. Also, let's assume your subnet mask is a standard255.255.255.0.The first thing that gets done is the computer looks at the address on the packet being sent. It then compares its address with the destination address. Notice the172.10.1.xis the same on both, and the subnet mask has filled octets in the same locations as well (255.255.255.0). This tells the computer that the destination is on the same network it is on. Your computer knows it is host '20' and it needs to reach host '30' and it doesn't need to go through a router to get there.Now your computer only needs to know the MAC address of host '30' to send this data on its way. If you recall the Media Access Control address is a physical layer function that addresses actual physical hardware on your computer. In a nutshell, it works like an IP address, only on your local network.ARP!To perform this feat, your computer sends out a broadcast message to everyone on the network called anARP, or Address Resolution Protocol. It's like your PC yelling "HELLO! I am looking for the computer172.10.1.30".Now each device on the network receives that message and looks at its own IP address in turn. The router (172.10.1.1) sees it is not the one being looked for and drops the message. Other computers on the network do the same thing until the computer that has the IP of172.10.1.30gets it, checks its address, and sees they match. It then replies back to the sending computer of172.10.1.20saying "HEY! That's me and my MAC address isAA00:BC33:3211".In the picture below, the MAC address is called an "Ethernet address", reflecting the fact that it's addressing for the physical layer. However, common lingo is "MAC address".Now the sending computer has the internal IP and MAC address of the receiving computer and can send its data over. But what happens if the two addresses are not on the same network?A Tale of Two Packets: ExternalWell, it's not as simple when we have to cross other networks, as there is a bit more going on behind the scenes, as you will see. Let's assume we are sending the same data as before and our source IP address is172.10.1.20and our destination IP address is192.168.0.100. You should immediately notice by the subnet mask of255.255.255.0that these two addresses are on separate networks. See, we are getting there.Just like in the first example, the sending computer looks at the destination address and compares it to its own. However, this time there is a problem—they don't match at all.Now it knows that it can't just send out an ARP message like before, because remember what happened in the last example, when the routers address didn't match the address being asked? It simply dropped the packet. This is how routers stop broadcasts from traveling the entire Internet. In fact, without this design, the Internet would be flooded with so many broadcast messages from the millions of connected devices that it would crash and fail.At this point, your computer knows an ARP just isn't going to cut it for the destination of192.168.0.100, so it broadcasts another ARP. But this time is looks for what's called thedefault gateway. This is a node, or a router, that acts as an entry or exit point to another network.Normally, when a computer cannot find a route for an IP address, it will send it along to the default gateway as a route of last resort. This is your modem/router at home. Your router will reply saying, "YO! I am the default gateway and my MAC address is xxxx:xxxx:xxxx!"Your computer then adds the routers MAC address as the destination MAC address to the packet, and sends it over to the router for safe travels.Route Me Baby!The router takes a look at the packet and knows the source IP came from its own network. But the destination is separate altogether. Because the destination is not the same as the router's own internal IP address, it knows the packet isnot for it, but needs to travelthroughit.The router then looks at its routing tables to find a way to get to the192.168.0.xnetwork. It leaves the source and destination IP address information inside the packet, and changes the new source MAC address to its own address and the destination MAC address to the next node deducted from the routing table.This process continues over and over with each router that picks up the packets looking at the addresses, seeing it's not for their network and passing it along until it reaches the final destination of192.168.0.100.That router will strip of the source and destination MAC addresses that allowed the packets to travel, and replace the source with its own. It then ARPs to find the MAC address of the server being looked for and uses the reply to add the final MAC address of that machine, then sends it along.In ClosingIsn't that amazing? When you check your email or browse the web, this is happening all of the time, hundreds and thousands of packets traveling 10-20+ routers to span the world... all in just a few seconds.When you are packet sniffing, you can grab this information midstream. Simply turn on Wireshark and watch and see how many packets zip around in a small amount of time.Questions about all this? Comments? If you've got some knowledge, you can pass it onto the community—we are always welcome to it! Start athread in our forum!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage byHowcdn,Leavcom,Ehow,NewScienceRelatedHow To:A Hitchhiker's Guide to the Internet: Today and Now, How It All ConnectsHow To:Create Packets from Scratch with Scapy for Scanning & DoSingHow To:The Essential Skills to Becoming a Master HackerMac for Hackers:How to Set Up a MacOS System for Wi-Fi Packet CapturingHow To:Break into the Lucrative World of Ethical Hacking with This Reasonably Priced Course BundleNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Conduct Active Reconnaissance on Your Target with hping3Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)How To:Packet sniff networks with the fundamentalsHack Like a Pro:Networking Basics for the Aspiring Hacker, Part 2 (TCP/IP)How To:Securely Sniff Wi-Fi Packets with SniffglueHow To:Become a HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hacker Fundamentals:A Tale of Two StandardsHow To:Crack Wi-Fi Passwords—For Beginners!How To:Identify Antivirus Software Installed on a Target's Windows 10 PCWhere Do I Start:Learn the FundamentalsHow To:Detect Script-Kiddie Wi-Fi Jamming with WiresharkHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionHow To:Use & Abuse the Address Resolution Protocol (ARP) to Locate Hosts on a NetworkNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersTor vs. I2P:The Great Onion DebateHow To:A Hitchhiker's Guide to the Internet: A Brief History of How the Net Came to BeHow To:Spy on Your "Buddy's" Network Traffic: An Intro to Wireshark and the OSI ModelHow To:Networking Basics for the Aspiring HackerHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningHow To:How Hackers Steal Your Internet & How to Defend Against ItNews:Anonymity Networks. Don't use one, use all of them!News:8 Wireshark Filters Every Wiretapper Uses to Spy on Web Conversations and Surfing HabitsHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Use Wireshark to Steal Your Own Local PasswordsUDP Flooding:How to Kick a Local User Off the NetworkHow To:Get Free Wi-Fi from Hotels & MoreNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible InternetHow To:How The Internet Works