Windows 2000 Server TCP/IP安全指南

需积分: 5 90 浏览量更新于2024-07-17 收藏 840KB PDF 举报

"Syngress - How to Cheat at Securing Windows 2000 Server TCP-IP Connections.pdf" 这本书，"How to Cheat at Securing Windows 2000 Server TCP-IP Connections"，由Syngress Publishing出版，旨在帮助IT专业人员以高效且实用的方式加强Windows 2000 Server的TCP/IP连接安全性。尽管书名含有“作弊”一词，但其真正的含义是提供巧妙而快捷的方法来优化和保护网络环境。 TCP/IP是计算机网络通信的基础，此书首先介绍了TCP/IP的基础知识。在“TCP/IP Primer”部分，书中详细讲解了IP地址的分类与子网划分，这是理解网络架构和配置网络服务的关键。IP地址分为A、B、C三类，以及特殊用途的D类（多播）和E类（保留）。子网划分则允许更有效地管理网络资源和控制流量，同时路由概念在此处也有所涉及，它描述了数据包在网络中的传输路径。接着，书中提到了开放系统互连（OSI）模型，这是一个七层模型，用来标准化网络通信过程。这七层分别是物理层、数据链路层、网络层、传输层、会话层、表示层和应用层。理解这些层次的功能有助于识别和解决问题，特别是在跨不同设备和协议的通信中。在“TCP/IP Protocol Suite”章节，作者深入讨论了TCP/IP的核心协议。TCP（传输控制协议）是一种面向连接的协议，保证了数据的可靠传输，通过三次握手建立连接，并在数据传输后通过四次挥手断开连接。UDP（用户数据报协议）则相对简单，无连接且不保证数据包的顺序或完整性，常用于对实时性要求较高的应用如视频流或在线游戏。 IP（互联网协议）是网络层的核心，负责将数据包从源主机发送到目标主机。书中可能还涵盖了ARP（地址解析协议），它将IP地址转换为物理MAC地址，以便在局域网中进行通信。通过对这些基础概念的详细解析，本书旨在帮助读者掌握Windows 2000 Server环境下TCP/IP连接的安全实践，包括如何配置、优化和保护这些关键网络组件，以提升系统的整体安全性和稳定性。对于任何处理Windows服务器网络管理的人来说，这些都是不可或缺的知识点。

How to Cheat at Securing Windows 2000 TCP/IP

TCP/IP Core Protocols

There are a handful of protocols that are the mainstay of the TCP/IP suite, the real bread-and-

butter protocols. These protocols

handle all of the network connections and routing so that

applications are simply concerned with handing data to the protocols at the Transport layer.

TCP

Transmission Control Protocol (TCP) works on the Transport layer of the TCP/IP model,

providing connection-based communication with other IP hosts. When an application passes data

to the Transport layer, it is often too much data to transmit in one packet, so TCP segments the

data on the

sending side and reassembles it at the receiving end according to sequence information

that is packaged with the packet. TCP sends acknowledgments to confirm successful delivery, and

analyzes each packet according to checksum information to ensure data integrity. TCP uses a system

of ports to manage communication. Applications bind to a specific TCP port, and any inbound traffic

delivered to that port will be picked up by the application. This enables multiple applications on one

host to use TCP at the same time, and also standardizes the way a client can connect to a given service

on a server. For instance, Telnet’s standard TCP port is 23, so Telnet clients try to establish

connections on port 23 by default. Port assignments are flexible; that is, you can change the port a

client or server uses for a specific application if needed. Although Web servers typically use port 80

for HTTP communication, the Web server application can be bound to a different port, but clients will

need to know which port to use in order to establish a connection since it differs from the default (see

the following table).

TCP Ports Used by Common Applications

TCP Port Application

20 FTP (data)

21 FTP (control)

23 Telnet

53 DNS zone transfers

80 HTTP

139 NetBIOS session

UDP

UDP also provides Transport layer services, and is a connectionless protocol that does not guarantee

delivery or sequencing of data. UDP can be used when data transfer is not critical, or when the

application is designed to ensure correct delivery of data. Since it does not acknowledge successful

transfer, it is faster and uses less network bandwidth than TCP (see the following table).

UDP Ports Used by Common Applications

UDP Port Application

53 DNS name queries

69 Trivial File Transfer Protocol

137 NetBIOS name service

138 NetBIOS datagram service

161 SNMP

520 Routing Information Protocol

When TCP and UDP are ready to send data, they pass it to IP for delivery to the destination. IP is

connectionless and unreliable, which is why TCP is designed to establish connections and

How to Cheat at Securing Windows 2000 TCP/IP

guarantee delivery. IP does not try to detect or recover from lost, out-of-sequence, delayed, or

duplicated packets. IP is the foundation of the TCP/IP protocol suite.

The Three-Way Handshake

Computers using TCP to communicate have both a send window and a receive window. At

the beginning of a TCP communication, the protocol uses a three-way handshake to

establish the session between the two computers. Because TCP (unlike its Transport layer

sibling, UDP) is connection oriented, a session, or direct one-to-one communication link,

must be created prior to sending and receiving of data. The client computer initiates the

communication with the server (the computer whose resources it wants to access). The

handshake includes the following steps:

1. Sending of a SYN (synchronization request) segment by the client machine. An

initial sequence number, sometimes just referred to as the ISN, is generated by the

client and sent to the server, along with the port number the client is requesting to

connect to on the server

2. Sending of an ACK message and a SYN message back to the client from the

server. The ACK segment is the client’s original ISN plus 1, and the server’s SYN is

an unrelated number generated by the server itself. The ACK acknowledges the

client’s SYN request, and the server’s SYN indicates the intent to establish a session

with the client. The client and server machines must synchronize one another’s

sequence numbers.

3. Sending of an ACK from the client back to the server, acknowledging the

server’s request for synchronization. This ACK from the client is, as you might

have guessed, the server’s ISN plus 1. When both machines have acknowledged

each other’s requests by returning ACK messages, the handshake has been

successfully completed and a connection is established between the two.

NOTE

Packets are often referred to as datagrams at this level. These datagrams contain the

source and destination IP addresses, which will be translated to MAC (physical)

addresses at a lower layer.

IP receives TCP segments (or UDP for connectionless communications such as

broadcasts) and then passes it down to the Network layer. Before handing it down, however, IP

performs an important function: It looks at the destination IP address on the packet and then

consults its local routing table to determine what to do with the packet. It can pass the data to the

network card (or if it is a multihomed system, determine which of the attached network cards to

pass it to), or it can discard it. When a Windows 2000 computer starts, the routing table is

constructed. Certain entries, such as the addresses for the loopback, the local network, and the

default gateway (if configured in TCP/IP properties) are added automatically. Other routes can be

added by ICMP messages from the gateway, by dynamic routing protocols (RIP or OSPF), or you

can manually add routes using the route command at the command prompt.

ARP

The Address Resolution Protocol resolves IP addresses to Media Access Control (MAC)

addresses. MAC addresses are unique IDs that are assigned to network interface devices. ARP

uses a broadcast, after checking the ARP cache, to send out a query that contains the IP address of

the destination host, which replies with its MAC address. When the request is answered, both the

How to Cheat at Securing Windows 2000 TCP/IP

sender and the receiver record the IP and MAC addresses of the other host in their ARP table

cache to eliminate the need for an ARP broadcast for every communication.

ICMP

Internet Control Message Protocol is used by network devices to report control, error, and status

information. ICMP messages are delivered by IP, which means that they are not guaranteed to

reach their destinations. ICMP is used by routers to indicate that they cannot process datagrams at

the current rate of transmission, or to redirect the sending host to use a more appropriate route.

Most of you are probably familiar with the ping utility, which sends ICMP echo requests and

displays the replies it receives.

IGMP

Internet Group Management Protocol is used to exchange and update information regarding

multicast group membership. Multicasting is a system of sending data to one address that is

received and processed by multiple hosts. Multicast addresses are in the Class D IP address range,

and addresses are assigned to specific applications. For instance, the 224.0.0.9 address is used by

RIP (Routing Information Protocol) version 2 to send routing information to all RIP routers on a

network (see the following table).

TCP/IP Core Protocols and Their Related RFCs

Protocol RFCs

ARP 826

IP 791

ICMP 792

IGMP 1112, 2236

UDP 768

TCP 793

TCP/IP Applications

TCP/IP would be rather useless without applications to run on top of it. In addition to the

applications that are considered part of the TCP/IP protocol suite, there are numerous proprietary

applications that work on IP networks as well. For instance, NetBIOS over TCP/IP (NetBT) is

Microsoft’s implementation of NetBIOS for IP. Since NetBT is typically only found on Windows

computers, it is not considered part of the TCP/IP protocol suite.

• SMTP Simple Mail Transport Protocol is a protocol designed for applications to deliver mail

messages. SMTP defines the specific commands and language that mail servers use to

communicate, and the format of the messages to be delivered. For instance, if an SMTP

server receives a mail message that is addressed to a user that is not defined, according to

SMTP standards it will reply to the sender and include information regarding the failed

delivery.

• HTTP The child prodigy of Internet protocols, Hypertext Transport Protocol is used by Web

browsers and Web servers to conduct their business with each other. HTTP defines how

browsers request files and how servers respond. HTTP works in conjunction with Hypertext

Markup Language (HTML), graphics, audio, video, and other files to deliver the killer

application of the 1990s, the World Wide Web.

• FTP File Transfer Protocol is a client/server application designed to enable files to be copied

between hosts regardless of the operating systems. FTP can also be used to perform other file

operations, such as deletion, and it can be used from a command-line interface or a GUI

剩余52页未读，继续阅读

drjiachen

粉丝: 172
资源: 2138

Windows 2000 Server TCP/IP安全指南

Syngress - How to Cheat at Administering Office Communicator.pdf

Syngress - How To Cheat At Installing, Configuring Windows 2000 File Systems

Syngress - How to Cheat at Installing Troubleshooting Active Directory and DNS

How to Cheat at Securing SQL Server 2005

How to Cheat at Securing a Wireless Network

Syngress - Securing Exchange Server and Outlook Web Access.pdf

Syngress - Stealing the Network - How to Own the Box (2003).pdf

How to Cheat at Managing Windows Server Update Services

How to Cheat at Managing Windows Small Business Server 2003

Syngress - MCSA_MCSE Exam 70-290.Windows Server 2003 Environment.pdf

最新资源