Question

Diagnostic programs are commonly available that record the first 100 bytes, say, of every TCP connection to a certain (host, port). Outline what must be done with each received TCP packet, P, in order to determine if it contains data that belongs to the first 100 bytes of a connection to host HOST, port PORT. Assume the IP header is P.IPHEAD, the TCP header is P.TCPHEAD, and header fields are as named in Figures \(4.3\) and 5.4. Hint: To get initial sequence numbers (ISNs) you will have to examine every packet with the SYN bit set. Ignore the fact that sequence numbers will eventually be reused.

Short answer

Check target HOST and PORT, examine SYN bit, store ISN, calculate and compare sequence ranges, extract and record data within the first 100 bytes.

Step-by-step solution

- Identify the Target Host and Port

Check if the TCP packet, P, is directed to the specific HOST and PORT. This can be done by examining P.IPHEAD.DestIP and P.TCPHEAD.DestPort fields. If these values match the target HOST and PORT, proceed to the next step.

- Check for SYN Bit

Examine if the SYN bit is set in the TCP header, P.TCPHEAD.Flags. If this bit is set, store the initial sequence number (ISN), which is given by P.TCPHEAD.SeqNum. This ISN is essential in determining the sequence range for the first 100 bytes.

- Calculate Sequence Number Range

Using the stored ISN, calculate the sequence number range for the first 100 bytes of data in the connection. The range will be ISN to ISN + 99.

- Extract Sequence Number from Packet

For each received TCP packet, extract its sequence number from P.TCPHEAD.SeqNum. This will help to determine if the packet contains the desired byte range.

- Determine Data Offset

Calculate the offset of the data within the TCP packet. This is typically done by considering the length of the TCP header (given by P.TCPHEAD.HeaderLength), which will specify where the actual data starts in the packet.

- Check Data Range

Compare the extracted sequence number with the desired byte range (ISN to ISN + 99). If the sequence number, plus the length of data in the packet, falls within this range, then the data in this packet is part of the first 100 bytes.

- Extract and Record Data

If Step 6 is satisfied, extract the data from the TCP packet starting at the determined offset and up to the length of data within the packet. This extracted data should then be recorded/stored until the total reaches 100 bytes.

Key concepts

TCP Header Analysis

When dealing with TCP connections, analyzing the TCP header is crucial. The header contains important information about the packet, such as the destination port, sequence numbers, and flags. Here are some key fields you'll encounter in the TCP header:

• Source Port: The sending port of the packet.
• Destination Port: The receiving port, which helps identify where the packet should go.
• Sequence Number: Indicates the position of the first byte of data in the segment.
• Acknowledgment Number: Used for acknowledging the receipt of data.
• Flags: Control bits like SYN, ACK, FIN, which are used to establish, maintain, and terminate connections.
• Header Length: Length of the TCP header, which helps determine where the data starts.

By analyzing these fields, you can determine if a packet belongs to a specific TCP connection and what its role is, such as starting a new connection (SYN flag) or acknowledging received data.

Sequence Numbers

Sequence numbers are essential for keeping track of data packets in TCP connections. When establishing a connection, the initiating host sends a packet with the SYN flag set and an Initial Sequence Number (ISN). The ISN is randomly generated to prevent security issues like replay attacks.

To monitor the first 100 bytes of a TCP connection, you need to focus on sequence numbers as follows:

• Identify the ISN from the SYN packet.
• Calculate the range for the first 100 bytes of data. This is done by adding 99 to the ISN (ISN + 99).
• Check each incoming packet's sequence number to see if it falls within this range.

By following these steps, you can ascertain whether a packet contains data within the first 100 bytes of the TCP stream.

Data Extraction

Once you identify packets that fall within the first 100 bytes of a TCP connection, extracting and recording the data is the next step. Here's how to do it:

• Calculate the data offset using the header length. The data offset is essentially the point where the header ends, and the data begins.
• Compare the packet's sequence number and the data length to the identified 100-byte range.
• If the packet's data overlaps with the desired byte range, extract the relevant portion of the data.

For example, if your ISN is 1000, you should extract data from packets whose sequence numbers are within the range 1000 to 1099. Calculate where the data starts and ends using both the sequence number and the data offset from the header. Store this data until you have a complete 100-byte segment.

By understanding these key concepts, you can effectively parse and record the relevant data from TCP streams for further analysis or diagnostics.