Cab303 Networks: Identify The Protocol Assessment Answer

Problem Details

Identify the protocol disrupted and explain the normal behaviour:

The transmission control protocol is disrupted for operation. FTP uses TCP exclusively for its transportation needs and data transfer (Myers ., 2016). This is protocol is used other than the UDP since the protocol does not drop the packets sent between the hosts. All the packets between the client and the server are received in the way they are sent as compared to UDP. This starts with the initialization of the FTP client connection on port 21 to the server. The server listens for  incoming clients and responds. Once the handshake between client and server is complete the server initiates a connection to FTP client and an active session is established for the data transfer (Jorgensen, Intellectual Ventures 2017).

Affected header fields:

Checksum flag – This field is used to ensure that data in the TCP section reaches the target destination. Checksum validation is disabled and therefore calculations based on the pseudo-header to ensure the segment reaches the target is not validated.

Window flag – Used to indicate the amount of data to be accepted by the sender. The size of the window which is a measure of the number of bytes used is not determined during data transfer.

Explain the abnormal behaviour:

ICMP Packets with a large fragment offset are dropped off, this means that no session is established between the client and the server.  Traffic is therefore blocked, no incoming packets can reach the server.

Solution:

Adoption of the MTU discovery technique to prevent fragmentation. This method usually works by sending ICMP packets to the server with a DF bit. MTU message is then sent back to the client. This message contains MTU values that are used to stop the fragmentation of the protocol (Craft et al ., 2016).

When a large number of packets are sent to the server, the huge number of smaller packets are spawned. A large number of packets cause congestion since MTU is not able to handle all the packets and therefore results in some of the packets being dropped.

Limitations of Solution:

ICMP messages do not support any form of authentication, this means that the packets sent between the hosts can not be checked if valid or not. Spoofing attacks can, therefore, be performed for all the packets sent between the hosts (Sadot et al ., 2015).

Pseudo-header Field is used in the calculation of the checksum. Since checksum calculation is disabled, TCP header checksum is not calculated which affects the segments.