Reference no: EM132732520

ITECH1102 Networking and Security - Federation University

Learning Outcome 1: Describe and explain role and function of network connectivity in current computing

Learning Outcome 2: Describe and explain protocols and interactions that implement network communication

Learning Outcome 3: Describe and explain role of information security in securing communication systems

Learning Outcome 4: Describe fundamental aspects of cloud computing

Learning Outcome 5: Proficiently use a variety of network services and tools

Learning Outcome 6: Interpret security needs of information systems

Learning Outcome 7: Examine and configure network settings on various network devices and operating systems

A1. Apply network architecture knowledge to analyse networking needs for businesses

A2. Apply knowledge of security policies in reducing security threats

A3. Plan and implement operational assurance programs from security perspectives

A4. Analyse cryptographic techniques for data security

Assessment Details
• Students are required to complete computing, networking, and security tasks during laboratory sessions. The tasks are designed to help students understanding the material covered in lecture slides through interaction with various networking and computing software tools.
• When completed, students get marks allocated for those tasks. The tasks are designed to help students understanding the material covered in lectures through interaction with computing systems.

Lab Sheet 2

Objectives
• Learn to run Linux Lite under VirtualBox
• Investigate Linux Lite Graphical User Interface (GUI)

Introduction
• Linux Lite is a Linux distribution based on the Ubuntu Linux.
• The GUI on Linux Lite has some similarities to Windows operating systems.
• The distribution used in ITECH1102 labs has a few small changes to provide seamless operations in our lab sessions. These changes include some firewall settings, updates to a command line text editor, and automatic running of some processes during booting.
• Throughout the semester, we will use Linux Lite to investigate and administer network settings and capture and analyse network traffic.
• This week's lab is to familiarise students with the Linux Lite GUI and some applications.

Running VirtualBox
• Folder C:\VBoxImages\ (shown below) contains an image of Linux Lite.

• The disk image (.vdi) of Linux Lite is quite large. The Linux Lite lab image is setup as an Immutable (read only) image to enable students to refresh the operating system image prior to the start a lab session.
• The functions of three batch files in C:\VBoxImages\ folder are:
o RefreshImages.bat: This file will delete temporary VirtualBox files associated with the last VirtualBox session. This will reset the images to their installation state.
o vb.bat: This file will configure the VirtualBox interface with appropriate configuration and network settings for each virtual operating system.
o createvm.bat: This file is used by vb.bat during the setup process.
• To set the virtual operating system to its installation state, run (double click) the RefreshImages.bat file. Note-The VirtualBox interface and all associated VirtualBox processes must not be running when RefreashImages.bat is running otherwise the refresh will fail.

Task 1
• Open Windows explorer
• Navigate to C:\VBoxImages\
• Double click RefreshImages.bat
• Double click vb.bat
• You should see the VirtualBox interface on your computer screen as shown below.

• The left-hand pane shows the Linux Lite virtual operating system.
• The right-hand pane shows the virtual hardware settings of currently selected virtual machine.
• Click the start (green arrow) to run Linux Lite virtual machine.
• You should see the Linux Lite GUI display as shown below.
• The passwords for user1 and user2 are user1pw and user2pw, respectively.

• Enter the password for user1 to login to Linux Lite.

• The top left-hand corner has an icon to the Linux Lite help manual.

• Double click the help manual icon.
• This will run Firefox and display the Linux Lite manual.
• This web site will help you learning how to configure and use Linux Lite.
• In the bottom left-hand corner of the screen, there is a set of icons primarily used to run applications.

• The three icons on the right run the following programs:
o FireFox
o Thunar (which is a file manger much like windows explorer)
o Terminal
• The Menu icon invokes the screen shown below. As you can see, the office category of applications has office productivity tools for word, excel, and powerpoint. These are LibreOffice equivalents to Microsoft Office.

• Other categories of applications can be selected from left-hand pane.
• Try selecting system to observe applications associated with system category, then select multimedia and the Internet.
• You should now have a good feel for GUI applications that are a part of the basic Linux Lite distribution.

• In the bottom right-hand corner of the screen, there are a few more icons. These allow the following.
o To setup multiple desktop workspaces
o Observe network settings
o Change speaker volume and microphone levels
o Observe time and date
• To configure extra desktop workspaces, do the following.
o Right click on one of the two workspace boxes (in the bottom right-hand corner of the screen)
o Select workspace settings
o Change the number of workspaces to 6

Task 2-Gain Some Familiarity with Linux Applications
• Linux calculator allows conversions between the four number systems discussed in Topic 1.
• Run the calculator.
o Menu -> Accessories -> Calculator -> View -> Scientific mode.
o Enter the hexadecimal number 0x2A and convert it to the other three number systems.
o Determine control sequences from keyboard to do each conversion.
• Run the text editor.
o Menu -> Accessories -> Text editor (This program is like notepad on windows).
o Create a file with 4-5 lines of text.
• Run LibreOffice writer.
• Create a file with different types of formatting including different fonts with different sizes and representations like bold, Italic, etc.
• Copy the text to the text editor program to see the effects.
• Try the other two Office Products to create a 3 slides presentation and a small spreadsheet.

Configuring the Desktop
Changing the Desktop on Workspace #1
• Click on the first workspace icon (left most icon) in the Linux panel (equivalent to Windows taskbar) along the bottom of the Linux Lite interface.
• Right click the desktop -> select the Background tab under Desktop Settings... -> Choose a background that you like -> Uncheck "apply to all workspaces".

Changing the Desktop on Workspace #2
• Now click the second workspace and apply a different background to it.
• Run FireFox on this desktop.

Desktop URL Links
• While on this desktop, create a URL link to Google maps.
• To do this, open your browser for Google maps and copy the URL.

• Right click on the Linux desktop -> Create URL link -> Give it a name and paste the URL.
• Double click the URL link and determine the time it takes to fly from Beijing to Melbourne.
• This task is just a small example of working with Linux Lite GUI interface. If you want to fiddle more, read Linux Lite documentation in conjunction with a running session of Linux Lite.

To Gain 1 Mark, Demonstrate the Following to Your Tutor
• 6 desktop workspaces
• Different backgrounds on 3 workspaces
• A workspace with a URL link to Google maps
• A Google map showing Beijing and Toronto

File Management on Linux Lite
• The Thunar file manager can be run from Beige Icon in the panel (at the bottom of the screen).
• When you click on the icon, the file manager will display your home directory. Your home directory is at /home/user1/ as can be seen at the top of the file manager in the location selector.
• By using Thunar file manager, you will be able to navigate your way around the Linux Lite file system. Note-The file system on Linux Lite is standardized across Linux distributions and understanding this file system holds you in good stead when working on other Linux distributions.

The Root (Start) of the Linux File System
• Root (start) of Linux file system is designated using a forward slash (/)
• If you click on the "File System" icon in the left-hand pane, the root of the file system and all directories in it will be displayed.
• Directories in Linux have specific functionalities. Some important ones are mentioned below.

Linux Lite Directory Name Functionality
/bin/ Application programs
/etc/ Configuration files
/home/ Contains users' home directories
/home/user1/ Home directory of user named user1
/mnt/ Directory for removable devices
/mnt/vbox/ Directory we use to access USB sticks from a Linux Lite virtual machine

User Management
• Linux is a Multiuser system. Currently our system has two users named user1 and user2.
• You can change between users from the switch users icon in the menu. It is the Beige icon showing three heads (see below).

• Note-user1 has the administrative privileges whereas user2 is just a normal Linux Lite user. This means that user1 has the authority to undertake administrative tasks like creating new users.
• Under normal circumstances, user1's login operates at normal user privileges, however, when user1 tries to undertake privileged tasks (like create new users on the system), it is asked to enter user1's password prior to completing the privileged task.
• This helps in maintaining the security on Linux system by not allowing a user to work in a high privileged state all the time.

To gain 1 Mark, Complete the Following Task
The Linux manual describes how to create new users on a Linux Lite system.
• Using the documentation, determine how to create a new user.
• Login as the new user
• Navigate to its home directory
• Create a text file in the home directory
Once you have completed above steps, demonstrate them to your tutor.

Extra things some students may like to do:
• There are numerous videos on the Internet that discuss how to use Linux Lite. Have a look at some of them and try some of the configuration processes you observe.
• By referring to the Linux Lite manual, check other configuration options in Linux Lite.

Lab Sheet: Week 3 (The Application Layer)
Objectives
• Investigate different applications on application layer
• Explore how to use VirtualBox on a USB stick to save and exchange files
• Create two Linux Lite instances communicating on the same host machine

Introduction
User applications communicate through the facilities provided by computer networks. This week's lab focuses on some important application layer protocols and programs that use these protocols to facilitate data transfers between client/user and server applications.

Task 1: Categories of User Applications
Use the Internet and determine the names of at least two user applications that fit into the following categories of network applications.
• Email
• Social Media
• Audio Streaming
• Video Streaming
• File Transfer
• VoIP
• Video Conferencing
• Web Searching
• Your Choice
• Your Choice

Task 2: Common Web Server Programs
• In client server computing, web clients (user applications) include FireFox, Chrome, Safari, Internet Explorer, etc. Describe the names of most popular web server platforms used on the following platforms.
o Linux
o Windows
• What is the current market share of each platform?

Task 3: Common Email Server Programs
• What platforms does exchange server run on?
• Name three mail server programs that run on Linux and Windows but not on Mac.

Investigate Application Layer Protocols (1 mark)
Some application layer protocols that are discussed in week 3 lecture slides are
• HTTP (Hypertext Transfer Protocol)
• FTP (File Transfer Protocol)
• BitTorrent

• NTP (Network Time Protocol)

The Wikipedia application layer page lists many protocols. Choose two protocols and briefly describe their use. Your description must be written with Linux Lite LibreOffice writer and must contain enough details so you can describe its operation to your lab tutor (online students should include a screenshot of their 1-2 paragraph(s) description in their first lab tasks report).

Working with VirtualBox
VirtualBox allows a USB stick to be concurrently accessed from Linux Lite Virtual Machine (VM) and Windows host operating system. It gives us the ability to save files created on Linux Lite to a USB device. It also enables us to use a USB stick to transfer files between Linux and Windows. To transfer the files, the USB stick must be inserted on the Windows machine prior to running VirtualBox. The drive letter setting in line 15 of vb.bat file must be correct for successfully sharing the USB stick as described above. The USB stick can be accessed from directory /mnt/vbox/ on your Linux Lite VM.

Task 4: Accessing a USB Stick from a Virtual Machine
1. Run C:\VBoxImages\RefreshImages.bat to reset the VMs to their initialization state.
2. Insert a USB stick into Windows host machine.
3. Run C:\VBoxImages\vb.bat.
4. Start Linux Lite.
5. Run text editor application from the Menu
o Menu -> Accessories -> Text Editor (This is the Linux equivalent to Notepad).
o Write a few lines of text in the editor.
o select File -> Save As -> File System -> mnt -> vbox.
o Give file name and use the extension .txt for Windows compatibility.
o The file will save on the USB stick.
6. Minimize Linux Lite.
o Open Windows explorer on your Windows host machine.
o Copy the file created in step 5 and paste to your Windows desktop.
7. In this exercise, you have been able to save files created in Linux to a USB stick and share the files with the underlying Windows operating system.
8. You can also try copying files from Windows to Linux Lite.

Task 5: Taking Screenshots in Linux
The Linux Lite Accessories menu has a program for creating screenshots.

With this program, you can take a screenshot of the entire screen or just the active window. After the screenshot is taken, you will be prompted to save the screenshot. You can save the file to your Linux Lite home directory (as shown below), or to the USB stick at /mnt/vbox/

Task 6: Cloning of a Virtual Machine
Sometimes, you may want more than one instance of Linux Lite running at the same time, e.g., when networking between two Linux Lite machines that are running on the same host operating system. To successfully get two Linux Lite instances with separate identities (different IP addresses) on one host computer, it is important to select the option "Reinitialize the MAC address of all network cards" as show below.

The reason for this step is that when a Linux Lite VM boots, it requests for IP settings from a local DHCP server. Most home routers provide DHCP as a part of their basic functionality. If MAC addresses of two Linux Lite machines are the same, then both machines will receive the same IP address settings and will not be able to exchange data over the network. By Reinitializing all MAC addresses, the Linux Lite instances acquire different IP addresses from the DHCP server.
• To create a clone of a Linux Lite instance, close all running VMs.
• Click on the Linux Lite instance in the left-hand pane of VirtualBox interface.
• Click Machine -> Clone (as shown in the image).

• Click "Expert Mode" -> select "Linked Clone" -> Reinitialize the MAC address of all network cards (as shown in the image).

You are now ready to run two instances of Linux Lite concurrently on the same host machine. From a networking perspective, this is identical to having two different sets of hardware (computers) each running a Linux Lite. Now you can do various networking tasks between Linux Lite instances and

Windows host operating system. If required, you can also run up Windows 8.1 virtual machine and have all four operating systems networking.

Task 7: Observing Network Settings on Linux Lite
• Run original Linux Lite VM.
• Open a Terminal session and type command ifconfig. It will display network settings of current Linux Lite instance. The output should resemble the screenshot below. in the third line, you can see the IP address (in this case, it is 192.168.0.23)

Task 8: Running Linked Clone
• Start Linux Lite linked clone image.
• Open the terminal window and determine the IP address of the clone. It should be different from the one seen in the previous screenshot. (note the last 2 digits)

Task 9: Confirming Connectivity Between Machines Using ping Command
ping command is used to check the network connectivity between two machines on a network. For example, in the below screenshot, we are working on a linked clone with an IP address 192.168.0.24. To see if we have the connectivity with the other machine, we must ping 192.168.0.23. (See the output of ping command at the bottom of the terminal screenshot). The output of ping command shows that we have the connectivity with a machine with an IP address 192.168.0.23 and that it takes a little for destination machine to reply.

ping Command (1 mark)
Demonstrate a cloned Linux Lite instance pinging the base Linux Lite image. (Online students should include a clear screenshot in their first lab report)

lab sheet 4 : Introduction to Wireshark.

Major goals of this lab sheet:
• Gain familiarity with Wireshark
• Capture and interpret network data
• Locate additional Wireshark resources

Discussion:
Wireshark is an industry standard protocol analyser. The function of a protocol analyser is to capture and display network traffic in a readable format. Wireshark can also filter traffic to limit the capture of traffic to that of interest, (eg. Include all broadcast traffic from other machines). Hence by appropriate choice of filters a user can perform detailed analysis of the traffic on a network. In the coming weeks, we will use Wireshark to capture and examine network traffic to help us better understand the basics of networking and how particular network protocols function.

Wireshark is and open source product and as such can be downloaded from the Internet and installed free of charge. It runs on Windows, Mac OS X, Linux and Unix platforms. It is arguably the most widely used networking and security tool available. Version 2.0.2 is installed on our Linux Lite virtual image and the main campuses have Wireshark installed on the Windows host machines.
Students (particularly online students) should consider downloading and installing Wireshark on their host machine. This will allow traffic captures on multiple machines as required.

Launching Wireshark:
Wireshark can be launched from the Windows Start menu or Menu > Internet on Linux. (See the opening screen below).

From the opening menu we can see all interfaces on the machine and to the right we get an indication as to whether traffic is being seen on each interface.

We can also enter a capture filter from this screen to specific traffic types for capture.

The opening screen also shows the Main Menu at the top of the screen. These are the menu selections we will use frequently for capturing and analysing network traffic.

For us the main Menu items are:
• File (For saving and opening traffic capture files)
• Capture (Used to start and stop network captures and choose network interfaces)
• Statistics (Used to summarise information about captured traffic)

The icons below the menu bar provide shortcuts for starting capture sessions, stopping a capture session, saving and opening capture files, searching for particular packets and other functions.

The Filter area allows display filters to be chosen from the standard filters provided by Wireshark or the entry of new filters. Display filters allow us to limit the amount of traffic displayed by Wireshark.

Capturing network traffic:
Open Wireshark on Linux Lite and from the Wireshark menu select Capture > Options.

The left hand side of the screen shows available network interfaces. Select the one labelled enp0s3. From here we can enter a capture filter (optional) then select Start to start capturing network traffic.

To stop the traffic capture click on the red Stop button in the Wireshark menu.

Captured traffic should resemble the screen capture below. Notice the three distinct panes: Packet list pane at the top, the Decode pane in the middle and the Packet dump at the bottom. Each is explained below.

Packet List - Shows brief details about all the packets that have been captured. Notice the Time column which records the time when the packet was captured. Currently, with no filter this list will grow rapidly!

Packet Decode - For the currently selected packet in the packet list this pane shows the decoded contents of that packet. Wireshark understands what is taking place within many common network protocols and, provided this packet contains a protocol that Wireshark understands, this pane will contain a "human readable" interpretation of the data in the packet. You can click on different sections of the decode and the corresponding region in the Packet Dump pane will be highlighted in blue.

Packet Dump - In this pane the raw data bytes in the current packet can be viewed. Maximise the window and note that there are two, parallel, views of the data on offer. On the left hand side are the numeric value of the binary data displayed in hexadecimal (Each hexadecimal digit represents 4 binary bits). On the right hand side is the same binary information displayed with each byte (2 hexadecimal digits) represented as a character. As you can see, certain bytes do not represent a printable character and are therefore shown instead by a full-stop. Sixteen bytes are normally displayed per row).

Wireshark exercises

(i) Capture some network traffic

If you have not already done so run Wireshark.

1. From the main menu select Capture then Interfaces
2. Choose the interface that is connected to the Network.
3. Click Start to begin the capture.

• If you are not capturing traffic you may have selected an interface that is not connected to the network.
• If you are on a low traffic network you can generate network traffic by running any network enabled program, Firefox for instance. The number of packets generated from basic web sites will be significant.

Wait for about 20 seconds then click the Stop button to stop the capture.

Confirmation that we are dealing with a packet switched network.

In Topic 2 we described the differences between circuit switched and packet switched networks.
Starting with Packet # 1 in the Packet List pane determine the size of the packet.
• The Frame summary at the top of the packet decode lists the size.
• You could also confirm the size by counting the raw bytes in the packet dump pane at the bottom of the screen.

Now look at the sizes of more packets in the capture. The sizes are likely to vary considerably.

Although quite obvious you have just confirmed that the information we are looking at with Wireshark is in fact 10's 100's or 1000's of packets of data. Confirming we are working with Packet Switched network traffic.

(ii) Saving captured traffic

From the file menu select Save As and save the captured traffic to your desktop. What is the size of the saved file? .............................
What extension does Wireshark use to save such traffic? .............................

Saved files can be loaded into Wireshark from the File Menu for subsequent analysis.

(iii) Analysis of captured traffic

At the top of the packet list pane are 7 headings that give us a brief description of each packet in the packet list.

On busy networks the number of packets in the packet list can grow very quickly.

The Time column indicates the time between subsequent packets. Take a look at this column and determine the number of millionths of a second between any two packets. Try to find a few packets that were sent within a very short time period of one another.

(iv) Sorting traffic

The protocol column is extremely important as it allow us to focus in on specific traffic for close observation.

Click on the Protocol column to sort traffic according to its type.

You will probably see TCP traffic, UDP traffic and hopefully numerous other types of traffic.

(v) Ethernet (MAC addresses)

Arrange the three panes so that the packet list pane (top pane) only shows 3 or 4 packets. This will give you room to display most of (or all of) the packet dump (raw data) pane at the bottom of the screen.

In the Packet Decode pane (middle pane) click on the word Frame. You should see the entire packet dump pane display in blue to indicate the entire transmission constitutes a frame.

Now try clicking on word Ethernet II. You should see the first 14 bytes highlighted in the packet dump pane. This indicates the Ethernet II data constitutes the first 14 bytes of the frame.

Now try clicking the solid triangle next to the Ethernet II. From here you should be able to determine where in the frame the Ethernet Destination address (MAC address) is located. Where the Ethernet source address in located and where the Ethernet type is located in the packet.

How many bytes are used to store the Ethernet Source or destination address? ..............

How many binary bits are required to store the Ethernet destination address? ...............

(vi) Observing captured traffic

1. There is a Wireshark traffic capture (named RandomTraffic-1.pcapng) included in the topic 4 files stored on Moodle.

2. Download it to Linux Lite so we can inspect it in the context of the material we have covered so far in lectures.

This file was captured from the Mt Helen networking lab using no capture filter.
The traffic captured is simply background traffic typical of moderately sized networks.

Protocol column

The protocol column tells us the network protocol in this packet.

1. How many different types of protocol have been captured?
2. What are the size range of the packets captured?

Encapsulation

In this exercise we want to find the Protocols used at each layer of the Internet Model and the size of the associated layer header.

This information can be found by selecting a packet in the packet list pane then inspecting the packet in the decode pane.

For example packet 1 (TCP packet) is 66 bytes in length. The first 14 byte are the Ethernet Header
The next 20 bytes are the IP header and the last 32 bytes are the TCP header.

The second byte is an OSPF packet. It is 94 bytes in length.
It has an IP header associated with it (again 20 bytes) followed by the OSPF information.

OSPF is a Network layer protocol and as such does not require any layers of encapsulation further up the Internet Model so we do not see a TCP header.

Have a look on the Internet to determine a little more information about the role of OSPF in computer networking.
Have a look at the encapsulation of the STP protocol.

Try to determine the encapsulation from the network traffic. (Hint - If you can't see a Network layer protocol header or a Transport Layer protocol then interactions are taking place at a the Data Link layer.

Confirm this by looking on the Internet for information about the particular protocol in question.

Also have a look at the Ethernet Type field of the Ethernet header for STP, note that it is different to all TCP packets.

(vii) Confirmation that Ethernet only requires source and destination MAC addresses to communicate.

Ethernet is only concerned with local communications that is communications between two network interface cards on a common network.
An important point concerning local Ethernet communication is that communications between the two machines only requires the source and destination MAC addresses for communications to take place.

To demonstrate this fact we have developed a program that can run on Linux Lite that creates an Ethernet packet containing the MAC address of your machine (the source) and a destination machine. (You enter the destination machine's MAC address by hand).

The Type field of this particular Ethernet frame is one of the reserved Ethernet types. This was chosen so that Wireshark does not have issues decoding the frame content. It will simply interpret any information beyond the 14 bytes of the Ethernet header as Data.

Machine 1: Any machine that can run Wireshark

You will need to determine the MAC address of this machine so the packet can be formatted correctly on machine 2.

Machine 2: Linux Lite

This machine will be used to format the Ethernet frame and send it.

1. Open Firefox.
2. Enter the URL phoebe.ballarat.edu.au/ITECH1102/
3. Click on the file SendEthernet.tar.gz
4. Save the file to the Home directory of user1 ( /home/user1/ )
5. Double click the file SendEthernet.tar.gz file then extract it to user1's home directory.
6. Open a terminal screen
7. Type ls (ls is the list command and should show the contents of your home directory You should see the file run.sh)
8. Then type sudo ./run.sh and enter the user1 password when prompted.
9. You should see an interface similar to the one on the next page.
10. Make sure you have Wireshark running on the receiving machine and if you like on the Linux Lite machine.
11. Send the packet
12. Stop each instance of Wireshark from capturing more packets.

Note - The program Interface creates a Wireshark Display filter that can filter out all other traffic from a large capture.

If you like you could cut and paste the display filter on your Linux Lite machine to only display the packet that was sent or you could use it on the other machine to display the packet that was received. By inspecting the packet we should be able to see the two MAC addresses of the destination and source, we can also see the type field (0xffff) and the data that you entered into the GUI interface.

The understanding you need to take away from this is that Ethernet only requires the source and destination MAC addresses to communicate with another machine.

(viii) Wireshark online resources

Laura Chappell is extremely active in the area of Network Analysis using Wireshark and has a strong web presence. She even runs a web site called Chappell University.

Laura makes available a large number of free online videos both on YouTube and other sites. The site www.lcuportal2.com/ makes available many free Wireshark Videos from Wireshark Basics to quite advanced Wireshark features.

Open your Browser to www.lcuportal2.com/

On the left hand side of the screen you should see links to:
• Free Wireshark Basics
• Public Course Handouts

Starting with the Free Wireshark Basics link, observe the first few videos. Note: Laura Chappell's Wireshark videos can also be found on YouTube.

It will be advantageous to look at numerous other Videos made available on this site so that you become more familiar with Wireshark. Some video topics may help you to better understand some later Lab exercises.

Week 5 lab sheet: The Network (Internet) layer.

Major goals of this lab sheet:
• Investigate the Linux file system and basic Linux commands
• Observe IP settings on Windows and Linux
• Use Wireshark to capture and analyse ARP (Data Link Protocol)
• Use Wireshark to capture and analyse network layer protocols Part 1 - Investigate the Linux file system and basic Linux commands. Discussion:
Most students will be familiar with the structure of the Windows File System and the way it identifies file system devices using drive letters.
For instance:
C: represents typically the main hard drive that contains the operating system. D: is often used for the DVD drive (if one exists)
E: for removable media like USB sticks or hard drives

In Linux, a totally different file system structure is used. The Linux file system all falls below the root of the file system which is represented by a forward slash. ( / )

Devices like extra hard drives, USB devices and network drives must be mounted into a file system directory somewhere beneath the root of the file system. This is usually all done for you during installation.

When representing parts of the Linux file system, we usually represent the entire path starting from /. For instance, the Documents directory of user1 is located at /home/user1/Documents/

The directory representing the first USB device on our Linux Lite system is at /mnt/vbox/

Task 1.

Draw a diagram of the Linux file system identifying the directories mentioned below:
• /bin/
• /home/
• /home/user2/Downloads/
• /etc/
• /etc/samba/
• /sbin/
• /mnt/
• /mnt/vbox/

Task 2

Determine from the Internet the primary function of each of the above Linux directories.

Task 3

Draw a hierarchical diagram of the above Linux directory structure. (not the entire Linux file system)

Task 4 - Navigating the Linux file system from the command line

Thunar allows us to navigate the Linux file system using a GUI. However, power Linux users spend much of their time working in Linux terminals with command-line commands and associated arguments.

There are a few commands that allow us to move around the Linux file system and to determine our current location in the file system.

Command line commands

cd Change directory command

This command allows us to navigate to specific Linux directories. Example:
cd /home/user1/ takes us to user1's home directory

Example:
cd /home/user1/Pictures/ takes us to the Pictures directory of user1. The cd command can navigate to any directory in the Linux file system.
pwd Print Working Directory

This command shows us our current location in the file Linux system.

Exercise

Open a Linux terminal and using the cd and pwd commands navigate to all Linux directories mentioned in Task 1 above.

From the Pictures directory enter the command:
cd ..

Use the pwd command to determine what the cd .. command does in Linux.

Shortcut notations in Linux commands.

Linux file system paths are often quite long and so entering an entire path from the root of the file system can be tedious.

Shortcuts include:
. This represents the current directory as determined with the pwd command.
.. This represents the directory one level up in the Linux file system.
~ This represents the current users home directory.

These shortcuts can be particularly useful in all sorts of commands. The Linux copy ( cp )
and move ( mv ) are good examples.

Example:
cp /home/user1/Pictures/MyPhoto.jpg ~

Would copy the file MyPhoto.jpg to the current users home directory.

Likewise:
cp ../file3 /home/user1/

Would copy the file named file3 from one directory back in the file system to the directory /home/user1/

Other Linux terminal commands:

whoami This command tells you who you are currently logged in as.

ls ls is the Linux List command. It is probably the most frequently used Linux command. It lists the contents of the current working directory, or if a file system path is added it lists the contents of that path.

Example:

cd /home/ ls

This will change directory to /home/ and then list its contents.

The ls command has two main command line arguments that tell us more about the contained file system.

ls -l is a long listing. (This displays extra information about each file/directory) ls -a is a listing that includes hidden files (files that start with a period)
ls -la does both.

Exercise

From the command line Navigate to the directory /etc/gufw/

Use the command ls -la to get a long listing of the files within /etc/gufw/

Use the Internet to try to determine what each column of an ls -la listing tells us about the associated files.
Note - we are not concerned with what the files of /etc/gufw/ do, we just want some idea of what the ls -la listing tells us about the associated files.

Part 2 - Observing IP settings on Windows and Linux

Windows ipconfig command

The Windows ipconfig command allows us to determine the current IP configuration of the Windows machine.
The basic form of the command only shows the following basic settings:
• IPv4 address
• Subnet Mask
• Default Gateway
• IPv6 address

By using the ipconfig /all option, we can obtain a wealth of other related IP information, including:
• Physical Address (MAC address)
• DHCP status (Enabled or disabled)
• DHCP Lease information (How long DHCP has allocated the IP setting to you)
• DHCP server's IP address
• DNS servers IP address

These setting are all we require for most solving most IP issues. Linux ifconfig command
Like the ipconfig command in Windows, the Linux ifconfig command displays basic IP settings including:
• IPv4 address
• Subnet Mask
• HWaddr (MAC address)
• IPv6 address

To observe the gateway address, we use the route command. Gateway address
The route command displays the Linux machines routing table. The entry labelled default is the gateway address.
You may have to determine the default entry first by running the route command then entering the command route -n to fist the actual IP address of the gateway.

Part 3 - Examining Protocols with Wireshark Discussion
Wireshark is an industry-standard protocol analyser that allows us to capture and analyse network traffic. It is a fantastic learning tool because it will enable us to closely examine the particular protocols discussed in lectures.

Wireshark is also used as a software diagnostic tool. It allows us to determine the interactions that occur between client and server applications and can enable difficult interactions to be traced and diagnosed.

Wireshark is also an important tool used in forensic analysis in security circles. Traffic generated by viruses and bots on client computers can be examined to help determine the source and
lead to mitigation of the security threats.

In this lab, we will examine some protocols discussed in lectures.

Exercise: Examine the format of an IP header.

Prior to examining an IP header, we must first of all capture one.

From the Linux Lite Menu select > Internet > Wireshark (This should run Wireshark)

If you double click on the name of an interface that is indicating it is capturing traffic, you will start capturing background network traffic.
After capturing for 10 or 20 seconds, you should have captured significant traffic.

Try clicking on a packet in the Packet List pane (the one at the top). Look in the Packet decode pane, and you will see all the headers associated with the packet selected in the packet list pane.

Find a packet that has an IP header and click the expand/contract triangle in the Packet Decode pane. This should show the details of this particular IP header. We will investigate various fields of this header by answering the following questions about it:

What is the IP version? ........................
How many bits are used to store the IP header length? ........................
What is the length of the IP header in this case?. ........................
What is the first flag suggest about the packet? ........................
What is the value of the Time to Live field ........................
What does this mean?

What is the value of the header checksum? .........................
What is the function of the header checksum field?

 What is the IP address of the host that sent this packet?
Where can you find the hexadecimal value of the IP address in Wireshark?

What is the IP address of the destination host? ............................

Exercise - Examine an ARP request and associated response Discussion
ARP is a Data Link layer protocol, and as such you will not see an IP header in ARP Wireshark captures.
The role of ARP is to determine the MAC address of a machine with a specific IP address.
ARP does this by sending a broadcast to the network asking which machine has the IP address. It then waits for a response from the machine with the IP address in question.

Looking closely at the request packet is instructive, it has a blank MAC address (00:00:00:00:00:00) in the field associated with the target machine's MAC address.

Exercise: Capture an ARP request with Wireshark on Linux Lite

The first thing we must do is to find a machine to contact. In the university labs, all you need do is determine the IP address of another lab machine (one that does not already have an entry in your machine's ARP cache)

To look at your arp cache, enter the command:
arp

Run Wireshark > Capture > options
- Select the correct interface
- Enter the word arp in the capture filter box
- Click the Start button

To generate an arp request and reply:
- open a terminal
- ping the IP address of the machine identified above You should see an arp request and an arp reply captured in Wireshark. Click the RED stop button to stop the Wireshark capture.
Note - ARP is a Data Link protocol and so only works on your local network.
If you ping a remote IP address (e.g. That of google.com), you will not get arp packets generated because communications would go via the gateway, for which there is already an entry in the arp cache.

Note - If you need to remove an entry from the arp cache, use the command:
sudo arp -d <ip_address>

If you are having problems generating arp traffic, there is an arp capture on Moodle.

Once you have an arp request and reply, carefully examine them in Wireshark.

You should be able to see the request that is missing the MAC address of the target machine (see below).
The reply has the MAC address included.

Exercise - Examine DNS traffic Discussion
DNS is the service on IP networks that translates names like www.apple.com to its associated IP address.

When you enter a URL into a browser, for instance, that URL has to be converted to its associated IP address for the web site to be contacted.

If you try to ping a remote web site, DNS will also do an associated lookup and return the IP address in question.

In the next exercise, we will ping a remote web site to force DNS traffic. We will capture it with Wireshark and then investigate it.

Exercise: Capture DNS Traffic

Run Wireshark > Capture > options
- Select the correct interface
- Enter the word port 53 in the capture filter box
- Click the Start button

To generate a DNS request and reply:
- open a terminal
- ping the web site www.apple.com Now press the Red stop button to stop the capture. Investigate the resulting traffic.
Things to examine in the traffic:
• The sequence of headers in each packet.
From this, you should be able to identify the layer at which DNS works.
• What is the query asking?
• What is the response sending back?
• Associated fields in the Domain Name System ( response ) header.

Week 6 lab sheet: The Transport layer.

Major goals of this lab sheet:
• Capture and investigate Transport layer protocols
• Investigate the Linux file system and basic Linux commands

Part 1 - Investigate simple HTTP. Discussion:
Simple network interactions can be analysed using Wireshark.

Two simple Wireshark HTTP interactions are available on Moodle (Topic 6 section).
• Capture 1 - Browser request for a simple HTML page
• Capture 2 - Similar request, but it includes two images in the HTML page

Although we can capture the traffic ourselves, in the first instance use the captures on Moodle so that all discussion of the traffic aligns exactly with the discussion in this lab sheet.

Upon completion of part 1 of the lab sheet, you may like to capture each HTTP interaction live. (This is optional)

Task 1: Download the first capture file from Moodle and open it in Wireshark.
Then observe the Wireshark display while reading the following description.

The filename is Phoebe-HelloITECH1102.pcapng
This capture contains the 10 packets of a simple HTTP GET from a server named phoebe.

• The first 3 packets are the 3-way handshake setting up the connection between the browser client (Firefox) and the webserver (phoebe). [note the SYN, SYN/ACK, ACK flags.]

• Packet 4 is an HTTP request from the Web Browser, asking for a specific HTML page.

• Packet 5 is an acknowledgement from the Server to the Client. This packet acknowledges that the Server successfully received 389 bytes from the Web Client.

• Packet 6 is the Server sending the requested HTML page back to the Web Client.

• Packets 7 & 8 are the Server closing its connection with the Client.

• Packets 9 & 10 are the Client closing its connection with the Server.

Task 2: understand the difference between Relative and Actual Seq/Ack numbers.

If you look at the first packet, you will see in the packet list pane that the sequence number is zero (seq = 0).

Further down in the Wireshark display, you will see larger sequence and acknowledgement numbers (390, 374 etc.). These are Relative sequence and acknowledgement numbers. They are relative to the initial sequence numbers setup during the TCP connection (3-way handshake).
To view the actual values, we are going to change the associated preference in Wireshark. From the Edit Menu
Edit > Preferences > Protocols > TCP Uncheck Relative Sequence Numbers

You are now seeing actual sequence and acknowledgement numbers as opposed to relative ones.

You should now be able to see that the initial sequence number (ISN) from the Client to the Server is 1043872907 and that the initial sequence number (ISN) from the Server to the Client is 3447850100.

Notice that the initial sequence number for the connection between the Client and Server is totally different to that from the opposite connection (Server to Client). This is less obvious when using Relative sequence numbers.

Note - You can view both

If you open a capture twice, you can set the associated preferences so that one shows actual sequence numbers and the other relative numbers.
This could be useful on occasions.

Task 3: How the HTTP protocol works.

The HTTP protocol is a very simple text-based protocol developed by Tim Berners-Lee when he was creating what is now called the World Wide Web.

Do an Internet search to understand more about the HTTP protocol.

You should spend 5 to 10 minutes researching HTTP so that you are a little more familiar with how the protocol works.

Task 4: Investigate Port Numbers

The port numbers used by the Client and Server can be seen in the packet list pane or the packet decode pane of Wireshark.

What is the port number used by the Client? ........................................

What is the port number used by the Server? ........................................

Are these port numbers consistent with those described in the Topic 6 lecture? What are the associated sockets of the Client and Server?
Server socket .........................................................

Client socket .........................................................

Task 5: Investigate TCP Flags

The Packet Decode pane shows all aspects of the TCP header.

The Flags indicate the main function of each TCP Segment (as shown below)

Notice that the Flags are either On or Off (0 or 1) and hence only take up one bit each.

Choose a few packets of the capture. Note the state of the flags and how it relates to the display in the packet list pane.

Task 6: Following sequence and acknowledgement numbers of the Client, then the Server.

The screen capture below shows the 5 client packets first then it shows the 5 server packets.

From this capture, we should be able to see the following:
• The initial Relative Sequence Number is zero.
• After it is acknowledged, it becomes 1.
• After sending 389 bytes, it increases to 390

Try doing a similar analysis of the traffic coming from the last 5 packets that is the traffic from the Server to the Client.

Note - You may like to also try this using actual sequence numbers instead of Relative ones.

Task 7: Download the second capture from Moodle (Phoebe-Hello_Images.pcapng ) and analyse it.

You should spend at least 15 minutes trying to discover what is happening in this Wireshark capture. You may need to refer to the Internet if you are unsure about particular traffic.

This capture is similar to that of above-downloaded one. However, in this case, two images are also being downloaded as part of the web page. Hence far more traffic is generated.

Write down any findings so you can describe what is happening to your tutor.

Part 2 - Using wildcards in Linux copy (cp) move (mv) and remove (rm) commands.

The Linux shell and shell commands.

When we run a terminal from the taskbar, we are running a program called the Linux shell (equivalent to the command line in Windows).
The default shell in Linux Lite is the bash shell (or Bourne again shell). The shell allows Linux users to administer the Linux system by entering Linux commands and creating and running scripts.

The bash shell interprets commands we enter and displays the results to the screen. Most commands require arguments that often include paths to files or directories.
To specify a directory, it is good practice to use a forward slash at the end of the directory reference to indicate it is a directory.
Example: /home/user2/MyGames/

To specify a file, you use a directory reference followed by the filename.
Example: /home/user2/MyGames/game1.exe

Last week we saw how we could use a dot ( . ) and dot dot ( .. ) to represent the current directory and the directory one level up. We also saw that the tilde character (~) could be used to represent the current user's home directory.

This week we want to extend the treatment of commands that are run in a Linux shell (shell commands) to include the wildcards? and *. Wildcards are often used in shell commands to

Wildcards are used in a file reference to specify multiple files. A question mark in a file reference indicates any single character in place of the question mark.

Hence file? Would specify any of the following filenames: file1, file2, file4, fileC etc. An asterisk in a file reference can represent any number of characters (zero or more).
Hence file* Would specify any of the following filenames: file, file123, fileAbc etc.

Wildcards are particularly useful when looking for multiple files in an ls (list) command, or for copying multiple files from one place in the Linux file system to another.

Absolute and Relative file references

There are two categories of file system reference in Linux. Absolute file references fully specify every directory from the root of the file system to the file (or files) in question.

Hence Absolute file references always start with a forward slash /

Examples:
/home/user1/file1
/home/user1/
/home/user1/*
/home/user1/file2??.conf

Relative file references are file references that are relative to the Current Working Directory
as displayed in the pwd command.

Relative file references never start with a forward slash.
Examples:
file1
../dir2/file
.
..
~/vault/

Exercises using the copy and move commands

To start with, we need to create a directory that contains numerous files. To create directories in linux, do the following set of commands one after the other.
cd /
sudo mkdir fileStore cd fileStore
sudo mkdir oldSongs cd oldSongs
sudo touch song11 sudo touch song12 sudo touch song13 sudo touch song45 sudo touch song55 sudo touch song65

You should have a directory /fileStore/oldSongs/ that contains 6 files.

Now create a directory under /home/user1 named songBackup using the mkdir command.

Copy command

The format of the copy (and move) command is:

cp source destination

Where source and destination are file references Use bash shell commands to complete the following exercises.
1. Using absolute addresses for both source and destination copy song11 to songBackup/
2. Using absolute addresses copy song11, song12 and song13 to songBackup
3. Using absolute addresses copy any song that ends in 5 to songBackup
4. Delete all files in the songBackup directory with the rm commands and the wildcard *
5. Now repeat the first 3 exercises using relative addressing for both the source and destination.

Testing yourself

Being able to use shell commands to list, copy, delete and move files is an important skill. Using either absolute or relative file references is also an important skill.
To test your skills, try the following:

1. Use the ls command to list multiple files from within Linux directories.

Example change directory to /bin
List all files that start with the letter c List all three letter files that start with c
Determine how many files start with ch (the answer is 5)

2. You could also test yourself by copying single or multiple files from any location in the Linux file system to your home directory.

Try to make sure you understand all of the following:
• Absolute addressing
• Relative addressing
• Using . .. ~ ? *
• Understand how to use cp mv rm mkdir ls touch

Week 9 lab sheet: Cloud & Mobile networks

Major goals of this lab sheet:
• Investigate simple cloud file storage
• Investigate the CDMA protocol

Part 1 - Investigate simple cloud file storage. Discussion:
Cloud services come in many shapes and sizes. For large corporates, outsourcing many services to cloud providers can be an effective but sometimes costly option. Fed University, for example, currently uses cloud providers for our corporate web site and also for Workstation management (controlling and updating staff and lab machine software). The university also has plans to use cloud providers for other IT systems.

At the other end of the spectrum is Cloud Storage Services which is primarily directed to the consumer market. These services provide free or subscription-based access to the internet (cloud) based storage and associated services. Products in this category include:
• Microsoft's OneDrive
• Dropbox
• Google Drive
• Apple's iCloud

Federation University students have access to Microsoft's OneDrive Cloud Storage Service.

This Microsoft (Azure) service gives students and staff access to 1TByte of mirrored cloud-based storage. The data is currently stored in Melbourne and Sydney.

OneDrive also allows access to online Microsoft Office applications, or more particular Microsoft Word, Excel and others.

To encourage consumers to use their products, Cloud Storage Service add other services such as file synchronisation to PC's, Macs, Android devices etc.

Today we will use OneDrive to store files from a Windows platform. We will then access those files from our Linux Virtual Machine then edit those files.
Finally, those students with mobile devices can access the cloud-based files from their mobile handsets (smartphones).

Task 1 : Create some file for storing in the cloud.

Students who are working from lab machines can access their OneDrive storage from the OneDrive icon in Windows Explorer.

If you are working from a machine without the OneDrive app you can:
• Install and configure OneDrive on your Windows machine OR
• Access OneDrive from a browser

To access OneDrive from a Browser enter the URL https://onedrive.live.com/about/en-nz/business/ or do a Google search for OneDrive for Business login.

Then enter your Fed Uni email address, follow the prompts to authenticate. The OneDrive interface will open, giving you 1 TByte of cloud storage.
Create the following three document and save them in the cloud:
• A Microsoft Word document
• A Microsoft Excel document
• A text file created with Notepad

Each document should be named week9-lab-xxxxxxx (where xxx is Excel, Word or Notepad). Each file should also include a line of text within the document (Eg. Week 9 lab)

Task 2: Access the file from your Linux Virtual Machine

1. Run Linux Lite.

2. Open a browser and login to OneDrive from the browser.

Note - Our Linux Lite Virtual Machines do not have Excel, Word or Notepad installed. Any editing of these documents will be done using the Cloud provider's online applications.

3. Open the word document and make a few text and formatting changes.

4. Open the Excel document and do the same.

5. Open the Text document and make some changes.

Part 2 - Investigate the CDMA (Code division multiple access) protocols.

CDMA is used widely in mobile phone communications systems.

This digital protocol aims to send the data from multiple devices as a single transmission, therefore, making better use of the radio channel bandwidth.

Each mobile device extracts its own data from the combined transmission, to extract the data from the combined transmission - each user device is allocated a code that is combined with each bit of data to be sent.

The process involves combining many users' data into one transmission and then the extraction of the data at the mobile phone, to extract the data; each mobile device uses its unique chipping code that was used to combine the data at the sender.

This process is demonstrated in the following YouTube video. Please examine it carefully.

Then use the associated spreadsheet to replicate the YouTube video in paper format. This should give you a reasonable understanding of how CDMA works.

Week 10 lab sheet: Security 1.

Major goals of this lab sheet:
• Rate the impact of Malware from 1949 - 2013.
• Rate your current vigilance with regard to cyber safety.
• Investigate Botnets
• Investigate the WannaCry worm.

Part 1 - Investigate the history of Malware.

The Sophos Threatsaurus (pages 92 - 98) contains a section titled Malware timeline.

• Your task is to rate the malware contained in these 7 pages by their impact on the users.
• You are required to produce a top 5 list according to impact and a bottom 5 list according to impact.
• Each entry must include the year and name of the Malware and a short summary of the effects of the Malware.

Part 2 - Cyber safety.

• The Sophos Threatsaurus (pages 74 - 90) contains a section titled Safety Tips.

• Create a half page document that summarises ways to stay safe on the Internet.

• At the end of the document rate your own performance (out of 10) as regards to your personal vigilance in Cyber Safety.

Part 3 - Botnets.

• Botnets can be particularly disruptive technologies.

• Using the Internet as a resource write a half page description (in point form if you like) describing key points relating to Botnets. Your discussion can be of a technical nature, points of general interest or both

Part 4 - WannaCry. (Optional task)

• On 12th May 2017 the WannaCry Ransomware worm infected over 200,000 computers worldwide. It seems to have hit the UK health service with particular vigour. It has also impacted Windows operating systems in 150 countries worldwide.

• A Cyber security researcher who was statically analysing the Malware code was able to find a URL within the code.

• The researcher registered the URL as a real domain and this had the effect of telling the Malcode to disable itself.

• Determine what you can about the WannaCry worm and include your discussion with that of parts 1-3 of this lab.

Week 11 lab sheet: Visualization tools

Major goals of this lab sheet:
• Use an online drawing tool to create network and security diagrams.

Discussion
When designing networks or networking related reports you are likely to require professional looking diagrams.
Two commonly used products used in the production of such drawings are:
• Draw.io
• Visio

Draw.io
Draw.io is a web based diagramming application.
Draw.io integrates with Google Drive, OneDrive and Dropbox as required. It is free to use
It can be used to create multiple diagram types including:
• Flowcharts
• Organisational structures
• Engineering diagrams
• Software diagrams
• UML diagrams
• Venn diagrams

Visio
Visio is a Microsoft product.
It is available as an add-on to Microsoft Office 365.

We will not use Visio in this lab class however the application is available on University lab machines for anyone wishing to experiment with it.

Task 1 - Invoke Draw.io.
Draw.io supports many current browser platforms. To start draw.io:
• Open a browser
• Enter Draw.io OR www.draw.io in the browser's address field
• Choose "Create New Diagram"
• Choose the type of Diagram (For this lab Network)

Task 2 - Create a network diagram that resembles the one shown below.

Optional Exercises

Task 3 - Create a flowchart, Electric circuit diagram, organisational chart or any other chart you like with Draw.io

Task 4 - Create content with Visio.

Attachment:- Lab Tasks Assignment.rar