Last week we talked about switches and routers, where we covered Layers 1, 2, and 3 of the internet, link below.
<a href="https://devsafehouse.medium.com/switches-and-routers-whats-the-difference-df2dedc24d86">https://devsafehouse.medium.com/switches-and-routers-whats-the-difference-df2dedc24d86</a>
Today, we will zoom out and discuss what the other layers are up to layer 7. We will analyze a message sent across the internet and witness its journey through all these layers.
OSI model
Let’s go over the OSI model first. The OSI (Open Systems Interconnection) model consists of seven layers of the internet: 1) Physical, 2) Datalink, 3) Network, 4) Transport, 5) Session, 6) Presentation, 7) Application. The Physical, Datalink, and Network layers we’ve already talked about, consisting of ethernet cables, MAC addresses, and IP addresses.
The Transport layer most commonly uses the TCP and UDP protocols to manage the ports that computers connect with each other through. The Session layer is responsible for maintaining the connection between computers. The Presentation layer is where you’ll see formatting of the information being communicated, such as file types and encryption. Finally the Application layer is for end-user software such as a browser, and it uses protocols including HTTP and FTP.
TCP/IP model
The TCP/IP model has the exact same layers for the first four layers; Physical, Datalink, Network, and Transport. But it combines the layer 5, 6, and 7 into the Application layer. This is because many things in Layer 5 and 6 were dealt with in layer 4 and 7, as technology progressed.
In recent years, the TCP/IP model has become more popular, while the OSI model leaves its legacy as the application layer is still referred to as layer 7.
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*ODVh96O1PtUdUbTw"></figure>Example
Let’s say we have a network setup exactly like in the picture above. Your computer is connected to a switch, then a router, another switch, then to a server. You want to access a website that is hosted on the server. In your browser, you type in the URL of the website and hit enter.
Your message will be sent first to the DNS server within your network, in order to figure out what IP the URL is representing. Now that you know what IP the website server has you can send your GET request to display the website.
Your message is encapsulated in an HTTPS header. Then it is encapsulated in a Layer 4 header(TCP), which contains the source and destination ports. Messages at layer 4 are called segments. It will then be encapsulated in a layer 3 header, containing the source and destination IP addresses, and becoming a packet. After, it will be encapsulated at layer 2, which actually has a header and a tail, becoming a frame. Finally it is sent over ethernet cables at layer 1 to the router.
Upon arrival at the router, the router de-encapsulates the message to figure out what IP to send it to. Arp frame goes out to learn the MAC address of that IP. Router encapsulates the message with a layer 2 head and tail, and the second switch receives and sends this message to the server.
Arriving at the server, the server de-encapsulates every layer to open the HTTPS message. It now knows that you sent a GET request to be able to display the website. Finally, the server sends a message back to you, repeating the process all over again.
Transport layer
To cover the transport layer in more detail, we’re going to talk about the two main protocols, TCP and UDP. TCP(Transmission Control Protocol) is the more reliable one incorporating confirmation of data being received. UDP(User Datagram Protocol) sends information without verification and hence is the faster one.
In TCP, there is a three way handshake that a client makes with a server. A SYN packet sent by the client, followed by a SYN ACK packet sent by the server, then finally an ACK packet sent by the client. SYN means synchronization and ACK means acknowledgement.
This handshake occurs so that the client and server can confirm whether messages are received and can make sure everything is reliably handled.
In UDP, messages from the client are just thrown at the server without verification. This does make the process a lot faster, but some downsides are that packets can be lost in the transaction, or duplicates of messages can be received.
Safehouse
Safehouse is trying to enhance the security of communications across networks such as in the example above. We want to do this through dynamic honeypots to fool hackers. Read more at <a href="http://www.safehouse.dev/">www.safehouse.dev</a>.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=88d99d2ce516" width="1" height="1" alt="">

OSI model and TCP/IP Explained with Example

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*4c8nrDQYod7IgEjEPHlA8A.png"></figure>Switches and Routers are essential hardware pieces for the foundation of a network. In the beginning stages of the development of the computer, the need arose for computers to be able to talk to each other. Two computers were connected by a wire, and gradually, multiple computers were connected by switches and routers.
In this article, we will talk about Switches and Routers, how they work, and their differences.
First, to understand the development of Switches, we will take a look at hubs.
Hubs, the outdated switches
Hubs are the old switches that became outdated for good reason. Let’s say we have a network of 4 computers that want to talk to each other. All 4 computers are connected to a hub via ethernet cables, forming a plus sign with the hub in the middle.
When computer 1 wants to talk to computer 2, it sends out a message to the hub, who then sends this message out to the other 3 computers on the network. Then when computer 2 responds, it sends its message to the hub, who broadcasts it to the other 3 computers again.
The obvious problem here is that computers 3 and 4 get to see the whole conversation that computers 1 and 2 are having. Not only will it be annoying for people that don’t want to hear conversations not directed towards them, but also it makes it easier for hackers to listen in on any conversation as long as they are on the network.
Enter Switches
Switches allow two computers on a network to talk to each other privately. With the same example of four computers connected by a switch in the middle, computer 1 sends a message through an ethernet cable to the switch, who then sends it only to computer 2. Computer 2 responds back to the switch, who redirects the message back to computer 1. This way, no one else on the network will receive the messages.
Switches do this through the use of MAC addresses(Media Access Control). Each computer on the network has a layer 2 identifier called a MAC address that might look something like this 00:1B:54:21:3A:A7. The switch recognizes each computer by their MAC address, and is thus able to send messages to the correct computer. Messages sent at this layer, layer 2, are called frames.
The switch is a device with a bunch of ethernet ports that computers connect to, which is layer 1, the physical. Inside the switch, it will create a CAM table that matches all of the connected devices to their corresponding physical ports. As long as a machine sends a message across the network through the switch, the switch will add its MAC address and physical port to the CAM table.
A computer trying to talk to another computer does so through IP addresses. So how does the switch match the IP address to the MAC address? The answer is through ARP (Address resolution protocol). Computer 1 sends out a request to talk to computer 2 by sending an IP address to the switch. The switch broadcasts this ARP frame to everyone, asking for “Who has this IP?”. Computer 2, who has that IP, will respond “Me, and this is my MAC address.” Now the switch will know computer 2’s MAC and IP address. This process only needs to happen once.
Routers
A router’s job is to connect different networks to each other. Let’s say we have computers 1–4 connected by a switch on network 1, and computers 5–8 connected via a switch in the same way on network 2. The router would be sitting in the middle of these two networks, connecting to both switches via ethernet.
When let’s say computer 1 wants to talk to computer 5, it will send a request to the switch, asking to send a message to the router’s IP address. Computer 1 automatically knows that computer 5’s IP does not belong on the same network, and sends this request to the gateway, or router.
It is able to do this through the configuration of the IP addresses. Let’s say computers 1–4 have IP’s in the range 10.1.1.0 to 10.1.1.225. This means that every computer on the network will have an IP that starts with 10.1.1. On network 2, computers 5–8 have IP’s in the range 192.168.1.0–225, meaning that their IP’s all start with 192.168.1. When computer 1 sends a request to talk to computer 5, whose IP starts with 192.168.1, it knows that this computer does not belong on the same network, and will send the request directly to the router, who might have an IP of 10.1.1.1.
The router is a layer 3 device, meaning that it deals with IP addresses. Messages sent on layer 3 are called packets. Lets see how a message might travel across our 2 networks.
Example of message sent across a network
Computer 1 wants to talk to computer 5. Computer 1 first sends an ARP frame to the switch asking for the IP of the router, 10.1.1.1. The switch broadcasts this message to all devices, and the router returns the message with its MAC address. Now computer 1 knows the router’s MAC address.
Computer 1 now sends a packet to the router with the IP address of computer 5. The router sends an ARP frame to the switch on network 2, who broadcasts it to find out what MAC address belongs to that IP. Computer 5 responds with its MAC address.
Computer 1 now knows Computer 5’s IP and MAC address. It sends a packet to computer 5 and computer 5 responds back with a message.
Bonus: WAP, DNS, Layer 3 switches
Wireless Access Point: You can think of a wireless access point as a wireless hub. Messages sent from the access point is broadcasted to all devices connected to it. This is what Wi-fi is.
DNS: DNS stands for domain name server. This can be a server on a network that contains information to match IP addresses to URLs. Computer 1 figures out who the DNS server is by sending an ARP frame to the switch who broadcasts it, then the DNS server tells computer 1 the IP address of the URL it’s trying to connect to.
Layer 3 switches: There are switches that can operate on layer 3 which will be covered in a later article.
Summary
Layer 1: Physical, ethernet cables, wires.
Layer 2: Switches(connect computers), MAC addresses, messages sent are called frames.
Layer 3: Routers(connect networks), IP addresses, messages sent are called packets.
At Safehouse, we are trying to make networks more secure, read more at <a href="http://www.safehouse.dev/">www.safehouse.dev</a>.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=df2dedc24d86" width="1" height="1" alt="">

Switches and Routers, what’s the difference?

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*z8mpXHTEimdsVKGB"></figure>A honeypot is a decoy target that attracts cyber attacks, distracting hackers from other important targets, and learns about how hackers do what they do.
In this article, we will discuss different types of honeypots and how they can help your business.
How honeypots work
A honeypot is supposed to imitate a real system that a hacker might want to attack. It is a fake system that doesn’t have any real data worth anything that the hacker can steal. If a honeypot is hacked, no real damage is done. In fact, the goal of a honeypot is to attract hackers to attack it.
A honeypot can be installed in various places within the infrastructure of a network. It could be in front of or behind a firewall, within a service, or inside a private network. This way, intrusion can be detected at various layers in the infrastructure.
There shouldn’t be any traffic to and from the honeypot, which makes it clear that any connection or attempt to connect to the honeypot is malicious. When the honeypot logs this information, it can send the info to administrators who then analyze any attacks the hacker carried out, or any files the hacker may have uploaded or downloaded.
In order to make the honeypot more convincing to a hacker, it cannot be completely vulnerable to any attack, or else it is easy to see that it’s a honeypot. It will still have some security features to simulate real systems. Fake data might even be put into the system, and even fake interactions with the honeypot can be implemented.
Types of Honeypots
There are many types of honeypots, as there are many types of systems and services that can be simulated.
SSH honeypots can simulate systems where hackers can connect to via SSH, logging every detail about the connection.
Email honeypots can simulate email services, logging mail that a hacker might send to it, and maybe even sending custom response messages back. These are also useful for catching spam, because they can be set up so that only robots can find the email address.
Database honeypots are fake databases that an attacker might download or pull fake data from. Traffic to and from the database will be logged.
You can also set up a webpage for example that humans cannot reach. This will ensure that any connection to it, or attempt to view it is done by a robot, or something that shouldn’t be there.
Benefits of Honeypots
As cyber attacks rapidly increase in this digital age, more advanced cybersecurity measures need to be taken. A honeypot can give you info on how secure your system is, distract hackers from real targets, and provide knowledge on how malware, exploits and other attacks are evolving.
Honeypots are low maintenance. Once it is set up, you just have to let it sit there and wait for an attacker to engage with it.
They don’t have to take up much of the system’s resources. Since there shouldn’t be any traffic from authorized people, the honeypot doesn’t consume any of the system’s resources, until a hacker connects to it.
How can Honeypots help my Business?
Many small businesses aren’t aware of the many cyber threats arising in our world today. One severe cyber attack on their business could take down the entire business. For example, with a ransomware attack where the hacker encrypts all of the data, and asks for a ransom to give the data back, many small businesses can’t afford the ransom, or the loss in sales when the website is down.
Honeypots can help businesses stay a step ahead of the hacker, and protect their data. They add a layer of security to the infrastructure to fool hackers and guide them away from real systems.
At Safehouse, we are working on dynamic honeypots to protect your online data. Read more at <a href="http://www.safehouse.dev/">www.safehouse.dev</a>.
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=7f0acb31d44d" width="1" height="1" alt="">

Fool, learn, and conquer

Smart honeypots for
small enterprises

Get SafeHouse

Learn More

Configurable

Designed to suit multiple use cases

Sophisticated

Constantly changes to fool hackers

Safe

Isolated, convinving and manageable

Disclaimer

This is a placeholder site for a product in development.
There is nothing to purchase nor demo.
In the meantime, check out our blog!

Recent blog posts

OSI model and TCP/IP Explained with Example

Switches and Routers, what’s the difference?

What is a Honeypot and How does it help my Business?

Disclaimer

There is nothing yet to purchase on this website.
The prices listed below are subject to change.

Basic

$XX.XX

Purchase Now!

Enterprise

$XX.XX

Purchase Now!

Get the world's most advanced commercial honeypot

Learn More

Read Our Blog

SafeHouse

Fool, learn, and conquer

Smart honeypots for small enterprises

Get SafeHouse

Learn More

Configurable

Designed to suit multiple use cases

Sophisticated

Constantly changes to fool hackers

Safe

Isolated, convinving and manageable

Disclaimer

This is a placeholder site for a product in development.There is nothing to purchase nor demo.In the meantime, check out our blog!

Recent blog posts

OSI model and TCP/IP Explained with Example

Switches and Routers, what’s the difference?

What is a Honeypot and How does it help my Business?

Disclaimer

There is nothing yet to purchase on this website.The prices listed below are subject to change.

Basic

$XX.XX

Purchase Now!

Enterprise

$XX.XX

Purchase Now!

Get the world's most advanced commercial honeypot

Learn More

Read Our Blog

SafeHouse

Smart honeypots for
small enterprises

This is a placeholder site for a product in development.
There is nothing to purchase nor demo.
In the meantime, check out our blog!

There is nothing yet to purchase on this website.
The prices listed below are subject to change.