i take one breath / mint at a time

Week 9.1-2 Class Notes & Activities: DNS

#networking #OSI #wireshark #dns #nslookup #tcp #ip #80211 #email #UofTBootcamp #arp

Follow-Up Questions from Class Activities

DNS

DNS Record Types: CONTAINED IN DNS ZONE FILE

MX Record: mail exchange: directs emails to specific mail server; if multiple, can be set with preferences

TXT Record: created to include human-readable notes

SPF record: Sender Policy Framework: determines if email is from a trusted server

nslookup

nslookup -type=[NS record type] [domain] look up name server records

To look up the MX record: nslookup -type=MX gadget.com

To look up the A record: nslookup -type=A gadget.com

To look up the SOA record: nslookup -type=SOA gadget.com

nslookup Option Description
-domain=[domain-name] Change the default DNS name.
-debug Show debugging information.
-port=[port-number] Specify the port for queries. The default port number is 53.
-timeout=[seconds] Specify the time allowed for the server to respond.
-type=a View information about the DNS A address records.
-type=any View all available records.
-type=hinfo View hardware-related information about the host.
-type=mx View Mail Exchange server information.
-type=ns View Name Server records.
-type=ptr View Pointer records. Used in reverse DNS lookups.
-type=soa View Start of Authority records.

Email Headers

Some of the most important fields in this raw email are:
– Return-Path: Specifies the sender's return email.
– Delivered-To: Specifies the recipients email.
– Received: Shows a list of mail servers, illustrating the path taken by the email from its source to destination.
– Message-ID: A unique string created by the sending mail server as an identifier of the email.
– Received SPF: The SPF verification field, which we will cover in more detail in the next activity.

Security Concerns for Emails

__ SPAM__: mitigate with using SPF records, matching list of known spam senders, and keyword identification
Sending Confidential Emails across encrypted channels:
– emails are typically routed across multiple mail servers
– encryption tools: PGP: Pretty Good Privacy or S/MIME: Secure/Multipurpose Internet Mail Extensions
– Email Spoofing

Detecting Email Spoofing:

(1) Check the From email header
(2) Check the Received-SPF email header
– Received-SPF uses the IP address from the Received field and determines if it's an IP of an authorized sender with pass/fail
(3) Check the Received Email Header
– look up the source IP of the mail server that sent the email
– For example, the ARIN Whois/RDAP tool.

Class Activities

Analyzing DNS Records:

MX Record:
splunk.com mail exchanger = 20 mx1.splunk.iphmx.com.
splunk.com mail exchanger = 20 mx2.splunk.iphmx.com.
Type A Record:
Non-authoritative answer:
Name: splunk.com
Address: 52.5.196.118
Name Server
Non-authoritative answer:
splunk.com nameserver = ha2.markmonitor.zone.
splunk.com nameserver = ha1.markmonitor.zone.
splunk.com nameserver = ha4.markmonitor.zone.
splunk.com nameserver = ha3.markmonitor.zone.

Bonus:
dig nmap.org txt | grep "spf" gives us 3 servers authorized to send mail from:

nmap.org. 3600 IN TXT "v=spf1 a mx ptr ip4:45.33.49.119 ip6:2600:3c01::f03c:91ff:fe98:ff4e ip6:2600:3c01:e000:3e6::6d4e:7061 `include:_spf.google.com ~all"

Analyzing Email Headers Activity:

determine the following data points:
Email 1:
– Delivered-To: juliejones@acme.com
– Return-Path: jonathanthomas@microsoft.com
– IP address of source domain: 40.76.4.15 from:
Received-SPF: pass (google.com: domain of jonathanthomas@microsoft.com designates 40.76.4.15 as permitted sender) client-ip=40.76.4.15;
– Message-ID: 1689837351.2998569.1568044304435@mail.microsoft.com

Email 2: permitted by SPF but clearly spam
– Delivered-To: juliejones@acme.com
– Return-Path: xzvvvret34344@yahoo.com
– IP address of source domain: 74.6.130.41 from:
Received-SPF: pass (google.com: domain of xzvvvret34344@yahoo.com designates 74.6.130.41 as permitted sender) client-ip=74.6.130.41;
– Message-ID: 1689837351.2998569.1568044304435@mail.yahoo.com

Email 3:
– Delivered-To: juliejones@acme.com
– Return-Path: timmytom@widgets.com
– IP address of source domain: 34.86.130.4 from:
Received-SPF: fail (google.com: domain of timmytom@widgets.com does not designate 34.86.130.49 as permitted sender) client-ip=34.86.130.49 ;
– Message-ID: 1gytrdd9837351.987987abs9.1568044304435@mail.widgets.com

Networking Review Activity

A. Answer the following questions on HTTP:
7. What is the the port number range that this port is part of?
58424 or 62412
There are 49,152 – 65,535 dynamic and/or private ports.

Part Two: ARP

  1. What type of networking request does ARP first make? Broadcast

B. Use a filter to find the count of ARP responses, and answer the following questions:

arp.opcode
0 Reserved [RFC5494]
1 REQUEST [RFC826][RFC5227]
2 REPLY [RFC826][RFC5227]

arp.opcode == 1 for requests
arp.opcode == 2 for responses

  1. What is the IP of the device that is responding?
    Sender MAC address: IntelCor_10:ac:c0 (a0:a4:c5:10:ac:c0)
    Sender IP address: 10.0.0.32 (10.0.0.32)

  2. To what IP is the device responding to?
    Target IP address: c66251b0-093d
    Target MAC address: c66251b0-093d-7d9c-4f7c-c2fc9df7c3ca.local (e4:f0:42:3b:7a:de)
    -7d9c-4f7c-c2fc9df7c3ca.local (10.0.0.10)

  3. Write out in simple terms what has taken place, describing the request and response.
    Host makes a broadcast to find the MAC address of the IP = request. Response = information locating the MAC address.

DHCP
B. Use a filter to view the DHCP Discover, and answer the following questions on that packet:

###1. What is the original source IP? 0.0.0.0????###

  1. Why does it have that value?
    Unknown IP – usually to indicate that the local IP address is not assigned.

  2. What is the original destination IP?
    Internet Protocol Version 4, Src: 0.0.0.0 (0.0.0.0), Dst: 255.255.255.255 (255.255.255.255)

  3. What does that value signify? broadcast

C. Use a filter to view the DHCP ACK, and answer the following questions on that packet. dhcp.option.dhcp == 5

### 1. Explain in simple terms what is happening in this packet.

Topologies

  1. What are the Topologies for A, B, C? Tree, Hybrid of Bus and Tree, Disconnected ring?

  2. What are the advantages and disadvantages for each?

    • Network Devices

  3. In the network devices illustration, what are numbers one through four? Internet, Firewall, router, Switch

  4. What does the dashed line represent in number five? firewall security?

  5. What is a load balancer? distributes traffic across multiple servers to improve application availability and responsiveness and prevent server overload

4. Where would you place a load balancer? Between access and servers? Internet || servers or switch || servers?

  1. Which routing protocols use speed as criteria? Link-State Routing Protocols
  2. OSPF: Open Shortest Path First

Part Six: Network Addressing:

  1. Define binary.
    base-2 number system (0 and 1s) used to write machine code

  2. What are IP addresses used for? network interface identification and location addressing

  3. What are the two primary versions of IP addresses? IPv4 and IPv6

  4. How many octets are in a IPV4 address?
    IPv4 – 32 bits – 4 octects
    IPv6 – 128 bits – 16 octets

  5. What is the difference between primary and public IP addresses? private is within a network or subnet, public is on the internet and unique.

8. What is CIDR? “Classless Inter-Domain routing”

9. What is the range of IP addresses in: 192.18.65.0/24?

Network Attacks Review Activity

  1. What is 802.11? Wifi Standard (protocol)

  2. What is an SSID? a more recognizable format of how a networking hardware device identifies itself as broadcasting a wireless signal beacon

  3. What is the name of the the signal a WAP sends out identifying its SSID? beacon

  4. If a user has WEP encrypted wireless, what is a potential negative outcome? it's old and hackable easily with aircrack-ng