00:04
we talked about the hardware at Layer three and now we'll look at some of the software. Ah, specifically the layer three protocols. So of course I p works at layer three. We talked about that is being necessary with routers, but also something to remember for the exam.
00:21
Every protocol that starts with the letter I
00:25
for this exam functions that layer three with one exception, which is I'm app and I map is Internet mail application protocol. It's later seven. And listen, for those of you that are deep into Cisco Land, I understand
00:39
that when you really get underneath the hood, it's very difficult to say this is exactly layer three and
00:46
you could make all these different arguments. We're gonna keep it very light and very kind of superficial in nature. So the layer three protocols start with I accept. I meant so I p sec i g and P I g r key. I see MP ice a camp
01:03
I any of those guys that start with the letter I wanna put it, lay your three,
01:10
and by the way, let me just address that again for second. Um, the deeper you go, I don't want to make it sound like we're just going to say these air layer three even though they're not later three. What I want to stress here is the deeper you go into O s, I model in the further you pull things apart, the more you realize that the S I model wasn't really designed
01:30
to be a box that you stick protocols and devices in that there's a lot more flexibility and there is a lot more.
01:38
there's a lot more to it than that. Okay. But I'm gonna keep things on par for the exam. And, um, like I said, the layer three protocols start with I With the exception of I'm out. Okay, So
01:53
because of that layer three is a layer which there are many attacks directed at ah, Specifically, if you look at I c m p Internet control messaging protocol beaten up a lot, lots of exploits of icmp.
02:10
Um, so I would really pay attention here to this layer
02:15
when we talk about ah icmp as I mentioned, it's the protocol behind pink and trace route path Piggott lease and windows. So attacks that exploit that anything that has ping in its name Ping of Death. King floods Those exploit ICMP
02:32
so they would be considered later. Three. Tax
02:36
The low key attack The Loki attack is directed at at carrying out a covert channel. So information is stored in the I, C and P header, which is not where information supposed to be stored. So it's a way of sneaking information through hacking inspection.
02:54
It's a covert channel in a covert channels. Simply any path for communications that wasn't intended to be used for communication.
03:02
Ah, Smurf attack And these attacks. Most of these attacks are quite old, but they're still on the exam. And they're still important because we want to know why we do the things that we do by default and the things that we do by default. Well,
03:17
we don't allow huge pings through. We don't allow numerous things through. We don't allow directed broadcasts. We block icmp at the firewall. So you know, if you're if you've been around for a while and you're looking at some of these attacks, you're going touch. These are dated. Yeah, they are, but they're still testing
03:35
aren't so smart. Attack. What the smurf attack does
03:38
is, um, it's ah, distributed denial of service so I might find a system that I want to take off line. Let's see, I say I was gonna target Google, for instance. Um so what I would do is I would find an unsuspecting network. Okay, these guys are not intentionally part of the attack.
03:59
What I'll do is I will ping the broadcast address of that unsuspecting network,
04:03
but I smoothed the source of that pink packet to look like it comes from Target. But from Google. Remember, When you get a ping, he reply. So if I send a ping to the broadcast address that hits every sect, that every system on the network and they all reply to the source
04:21
which has been spoofed to look like it's Google, so they all respond back to Google. That's the way the Smurf attack would work. Now, there many elements in place that we do today to keep a Smurf attack on being successful. First of all, we block icmp.
04:34
Second of all, we blocked directed broadcasts, and the directly broadcast is when someone from outside your network
04:44
tries to broadcast inside your network. There is no good reason for that to be happening. So we walked, directed, broadcast on the fire while we don't allow icmp packets and and those are just a couple of the ways that we mitigate Smurf attacks, but definitely some exploits here. All of these air layer three attacks.
