Skip to content
Solved Assignments

Mechanisms of IP Fragmentation, TCP Flow Control, and ARP Spoofing Detection in Network Security

This document discusses critical mechanisms related to IP fragmentation, TCP flow control, and ARP spoofing detection in network security.

Preview 6 of 17 pages

See the first 6 pages exactly as they appear in the document.

  1. Page 1
    Read page 1 as text

    Mechanisms of IP Fragmentation, TCP Flow Control, and ARP Spoofing Detection in Network Security 1. Explain the mechanisms of IP fragmentation and reassembly, and describe the role of intermediate routers and the receiver in this process. Additionally, explain the TCP flow control and retransmission process when a segment is lost during data transmission. Answer 1 Ip fragmentation and reassembly are total different mechanism and not identical to each other. The main difference between two of them is that the intermediate routers perform fragmentation and they do not perform reassembly of an IP datagram. The reassembly takes place at receiver site. When the data travels over the internet, intermediate routers divide the whole information into smaller segments known as packets (datagram’s). There are thousands reasons why reassembly of an IP datagram has to made on receiver side. The substantial reason is that the packets can take different routes so that they can reach their real destination. ('IP fragment reassembly vulnerability', 2000) This mean is that the whole information goes through multiple routers. Hence, multiple paths are available to transmit data. If the task of reassembly is handed over to intermediate routers then all fragments of a message are unavailable. The intermediate router is unable to see all the fragments. System becomes more complex if reassembly carries out by the middle routers. Apart from them, there are thousands of drawbacks associated if reassembly attempts while the data is being sent. If reassembly begins in intermediate routers then there are high

  2. Page 2
  3. Page 3
    Read page 3 as text

    chances of data loss or obscure information. The entire message becomes corrupted because of missing fragment. If intermediate has to take place at intermediate routers, buffers resources are needed. All parts of the datagram have to go through intermediate nodes for proper reassembly, which might halt the process of dynamic routing. The main task of an intermediate router is to perform fragmentation, not to do reassembling. The end device has full privilege t o reassemble the fragments. We got a reason for that. (a) T he fragments follow the concept of packet switching instead of circuit switching. This means datagram can may follow different paths instead of one. There are thousands chances that one router may receive only few fragments of a packet. It is not in proper situation to get all the needed fragments. Hence, this halts the continue flow of data and might pose some problems. If router has capability to receive all the fragments, it is futile to put an extra pressure on a router and this pressure slows down the working of an intermediate router. Part 2

  4. Page 4
    Read page 4 as text

    In the above scenario, we can see clearly that H ost B sends two tcp segments of 100 bytes each . One segment is lost during the data transmission and flow of data is unidirectional. The receiver receives the TCP segment NO 2 which is out of order. The receiver puts the data in its buffer after leaving a gap to show that data is still missing and yet to receive. Acknowledgement is sent back to the sender displaying the next byte it expects. It is important to note that the receiver stores bytes 201 – 300, but these bytes are not delivered to the application till the missing space is filled. There is one RTO timer lying on sender TCP for entire duration of connection. When TCP segment 1 times out, the n TCP resends the missing segment again. Host A successfully receives the missing segment and put in its buffer. When the whole data is in proper sequence, it sends to the process. This way is very useful and beneficial for proper flow of data. After retransmission of the missing segment, host A can successfully receive the whole information without any obstacle after reassembling is over. Host B (Sender) Seq:101 ~ 200 Lost Seq:201 ~ 300 Host A (Receiver) TCP segment

  5. Page 5
    Read page 5 as text

    2. Explain the ARP spoofing detection process, detailing the modules involved in detecting and mitigating ARP spoofing attacks, and how the system handles traffic verification and alerts network administrators. Answer 2 Arp stands for address resolution protocol that does not possess authentication procedure so that true identity of the initiator can be verified. This networking protocol holds a long history and lacks immunity against spoofing attacks. It is considered that ARP spoofing is the first stair that leads to various attacks such DoS, man in the middle attack etc. The world is still using passive mechanism for the detection of spoofing attack. This method does not hold good reputation because it got a lot of drawbacks. There is a time la g between detection and learning, which is the main of its less popularity. Sometimes, the system is unable to grab the neck of an attacker and come to know about this event long after. The active approach is an alternative to overcome from this situation. This approach is better, incredible faster as compared to passive approach in figuring out ARP spoofing attacks. This is just not enough because it has capability to detect the real mapping of MAC to ip address. The active approach has been chosen that divides our detection in different modules. ARP sniffer module: The main task of this module is to collect all the needed traffic from every inch of the network. MHAD module: - The main job of this module is to divide all the traffic into two different categories. These categories are inconsistent and consistent header ARP packets respectively.

  6. Page 6
    Read page 6 as text

    KTFM: - It stands for known traffic module whose main task is to perform filtering of all the traffic. The packet will be dropped by it if the internet protocol to MAC mapping is systematic. If contradiction exists then alarm will be raised. The main task of spoof detection engine is to done verification of new ARP packets and they do not have known address. SDE module: - It stands for spoof detection engine module which is the prominent engine to detect anything related with ARP spoofing. It receives input in the form of consistent header ARP packets. It has thousands of responsibilities on its shoulder and comes with deep complexity. Database module: - When the verification of legitimate ARP entries done, then these entries are sent to host database. Spoof alarm module: - An alarm will be raised by this module if it detects arp spoofing. It immediately sends a mail, text to the administrator who is eagerly waiting for such moment. Hence, a lot of pressure on network administrator shoulders has already been reduced.

11 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More Information Technology study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.