André Perez is a consultant and teacher in networks and telecommunications. He works with industrialists and operators regarding architecture studies and leads training on the 4G and IMS networks for NEXCOM SYSTEMS.

• PREFACE xi ABBREVIATIONS xxxiiiCHAPTER 1. INTRODUCTION TO CRYPTOGRAPHY 11.1. The encryption function 11.1.1. 3DES algorithm 31.1.2. AES algorithm 61.1.3. RSA algorithm 101.1.4. ECC algorithm 121.2. Hash function 131.2.1. MD5 algorithm 131.2.2. SHA algorithm 161.2.3. HMAC mechanism 201.3. Key exchange 221.3.1. Secret-key generation 221.3.2. Public key distribution 24CHAPTER 2. 802.1X MECHANISM 272.1. General introduction 272.2. EAPOL protocol 282.2.1. EAPOL-Start message 302.2.2. EAPOL-Logoff message 302.2.3. EAPOL-Key message 302.2.4. EAPOL-Encapsulated-ASF-Alert message 312.2.5. EAPOL-MKA message 312.2.6. EAPOL-Announcement message 312.2.7. EAPOL-Announcement-Req message 322.3. EAP protocol 322.3.1. EAP-Method Identity 352.3.2. EAP-Method Notification 352.3.3. EAP-Method NAK 362.4. RADIUS protocol 362.4.1. RADIUS messages 382.4.2. RADIUS attributes 392.5. Authentication procedures 422.5.1. EAP-MD5 procedure 442.5.2. EAP-TLS procedure 452.5.3. EAP-TTLS procedure 48CHAPTER 3. WPA MECHANISMS 513.1. Introduction to Wi-Fi technology 513.2. Security mechanisms 543.3. Security policies 553.4. Key management 593.4.1. Key hierarchy 593.4.2. EAPOL-key messages 613.4.3. Four-way handshake procedure 633.4.4. Group key handshake procedure 673.5. WEP protocol 683.6. TKIP protocol 703.7. CCMP protocol 73CHAPTER 4. IPSEC MECHANISM 774.1. Review of IP protocols 774.1.1. IPv4 protocol 774.1.2. IPv6 protocol 804.2. IPSec architecture 834.2.1. Security headers 854.2.2. Security association 894.2.3. PMTU processing 924.3. IKEv2 protocol 934.3.1. Message header 934.3.2. Blocks 964.3.3. Procedure 102CHAPTER 5. SSL, TLS AND DTLS PROTOCOLS 1095.1. Introduction 1095.2. SSL/TLS protocols 1115.2.1. Record header 1115.2.2. Change_cipher_spec message 1125.2.3. Alert message 1125.2.4. Handshake messages 1145.2.5. Cryptographic information 1245.3. DTLS protocol 1265.3.1. Adaptation to UDP transport 1265.3.2. Adaptation to DCCP transport 1295.3.3. Adaption to SCTP transport 1305.3.4. Adaption to SRTP transport 131CHAPTER 6. NETWORK MANAGEMENT 1336.1. SNMPv3 management 1336.1.1. Introduction 1336.1.2. SNMPv3 architecture 1356.1.3. SNMPv3 message structure 1436.2. SSH protocol 1466.2.1. SSH-TRANS protocol 1466.2.2. SSH-USERAUTH protocol 1516.2.3. SSH-CONNECT protocol 152CHAPTER 7. MPLS TECHNOLOGY 1557.1. MPLS overview 1557.1.1. Network architecture 1557.1.2. LSR router tables 1577.1.3. PHP function 1587.1.4. MPLS header format 1597.1.5. DiffServ support 1607.2. LDP protocol 1627.2.1. Principles of functioning 1627.2.2. LDP PDU format 1657.2.3. LDP messages 1677.3. VPN construction 1707.3.1. Network architecture 1707.3.2. Differentiation of routes 1747.3.3. Route target 1757.3.4. Principles of operation 1777.4. Network interconnection 1807.4.1. Hierarchical mode 1817.4.2. Recursive mode 182CHAPTER 8. ETHERNET VPN 1858.1. Ethernet technology 1858.1.1. Physical layer 1868.1.2. MAC layer 1888.1.3. VLAN isolation 1918.2. PBT technology 1948.3. VPLS technology 1968.3.1. Network architecture 1968.3.2. EoMPLS header 1998.3.3. LDP 2018.4. L2TPv3 technology 2038.4.1. Data message 2038.4.2. Control messages 2058.4.3. Procedures 208CHAPTER 9. FIREWALLS 2159.1. Technologies 2159.1.1. Packet filter 2169.1.2. Applicative gateway 2189.1.3. NAT/NAPT device 2199.2. NAT/NAPT device crossing 2229.2.1. ICMP protocol 2239.2.2. IPSec mechanism 2249.2.3. SIP, SDP and RTP protocols 2279.2.4. FTP protocol 2339.2.5. Fragmentation 235CHAPTER 10. INTRUSION DETECTION 23710.1. Typology of attacks 23710.2. Methods of detection 23910.2.1. Signature-based detection 24010.2.2. Anomaly-based detection 24010.2.3. Protocol analysis 24110.3. Technologies 24210.3.1. N-IDPS device 24310.3.2. WIDPS device 24610.3.3. H-IDPS device 24810.3.4. NBA device 249BIBLIOGRAPHY 253INDEX 259

André Perez is a consultant and teacher in networks and telecommunications. He works with industrialists and operators regarding architecture studies and leads training on the 4G and IMS networks for NEXCOM SYSTEMS.

• PREFACE xi ABBREVIATIONS xxxiiiCHAPTER 1. INTRODUCTION TO CRYPTOGRAPHY 11.1. The encryption function 11.1.1. 3DES algorithm 31.1.2. AES algorithm 61.1.3. RSA algorithm 101.1.4. ECC algorithm 121.2. Hash function 131.2.1. MD5 algorithm 131.2.2. SHA algorithm 161.2.3. HMAC mechanism 201.3. Key exchange 221.3.1. Secret-key generation 221.3.2. Public key distribution 24CHAPTER 2. 802.1X MECHANISM 272.1. General introduction 272.2. EAPOL protocol 282.2.1. EAPOL-Start message 302.2.2. EAPOL-Logoff message 302.2.3. EAPOL-Key message 302.2.4. EAPOL-Encapsulated-ASF-Alert message 312.2.5. EAPOL-MKA message 312.2.6. EAPOL-Announcement message 312.2.7. EAPOL-Announcement-Req message 322.3. EAP protocol 322.3.1. EAP-Method Identity 352.3.2. EAP-Method Notification 352.3.3. EAP-Method NAK 362.4. RADIUS protocol 362.4.1. RADIUS messages 382.4.2. RADIUS attributes 392.5. Authentication procedures 422.5.1. EAP-MD5 procedure 442.5.2. EAP-TLS procedure 452.5.3. EAP-TTLS procedure 48CHAPTER 3. WPA MECHANISMS 513.1. Introduction to Wi-Fi technology 513.2. Security mechanisms 543.3. Security policies 553.4. Key management 593.4.1. Key hierarchy 593.4.2. EAPOL-key messages 613.4.3. Four-way handshake procedure 633.4.4. Group key handshake procedure 673.5. WEP protocol 683.6. TKIP protocol 703.7. CCMP protocol 73CHAPTER 4. IPSEC MECHANISM 774.1. Review of IP protocols 774.1.1. IPv4 protocol 774.1.2. IPv6 protocol 804.2. IPSec architecture 834.2.1. Security headers 854.2.2. Security association 894.2.3. PMTU processing 924.3. IKEv2 protocol 934.3.1. Message header 934.3.2. Blocks 964.3.3. Procedure 102CHAPTER 5. SSL, TLS AND DTLS PROTOCOLS 1095.1. Introduction 1095.2. SSL/TLS protocols 1115.2.1. Record header 1115.2.2. Change_cipher_spec message 1125.2.3. Alert message 1125.2.4. Handshake messages 1145.2.5. Cryptographic information 1245.3. DTLS protocol 1265.3.1. Adaptation to UDP transport 1265.3.2. Adaptation to DCCP transport 1295.3.3. Adaption to SCTP transport 1305.3.4. Adaption to SRTP transport 131CHAPTER 6. NETWORK MANAGEMENT 1336.1. SNMPv3 management 1336.1.1. Introduction 1336.1.2. SNMPv3 architecture 1356.1.3. SNMPv3 message structure 1436.2. SSH protocol 1466.2.1. SSH-TRANS protocol 1466.2.2. SSH-USERAUTH protocol 1516.2.3. SSH-CONNECT protocol 152CHAPTER 7. MPLS TECHNOLOGY 1557.1. MPLS overview 1557.1.1. Network architecture 1557.1.2. LSR router tables 1577.1.3. PHP function 1587.1.4. MPLS header format 1597.1.5. DiffServ support 1607.2. LDP protocol 1627.2.1. Principles of functioning 1627.2.2. LDP PDU format 1657.2.3. LDP messages 1677.3. VPN construction 1707.3.1. Network architecture 1707.3.2. Differentiation of routes 1747.3.3. Route target 1757.3.4. Principles of operation 1777.4. Network interconnection 1807.4.1. Hierarchical mode 1817.4.2. Recursive mode 182CHAPTER 8. ETHERNET VPN 1858.1. Ethernet technology 1858.1.1. Physical layer 1868.1.2. MAC layer 1888.1.3. VLAN isolation 1918.2. PBT technology 1948.3. VPLS technology 1968.3.1. Network architecture 1968.3.2. EoMPLS header 1998.3.3. LDP 2018.4. L2TPv3 technology 2038.4.1. Data message 2038.4.2. Control messages 2058.4.3. Procedures 208CHAPTER 9. FIREWALLS 2159.1. Technologies 2159.1.1. Packet filter 2169.1.2. Applicative gateway 2189.1.3. NAT/NAPT device 2199.2. NAT/NAPT device crossing 2229.2.1. ICMP protocol 2239.2.2. IPSec mechanism 2249.2.3. SIP, SDP and RTP protocols 2279.2.4. FTP protocol 2339.2.5. Fragmentation 235CHAPTER 10. INTRUSION DETECTION 23710.1. Typology of attacks 23710.2. Methods of detection 23910.2.1. Signature-based detection 24010.2.2. Anomaly-based detection 24010.2.3. Protocol analysis 24110.3. Technologies 24210.3.1. N-IDPS device 24310.3.2. WIDPS device 24610.3.3. H-IDPS device 24810.3.4. NBA device 249BIBLIOGRAPHY 253INDEX 259

André Perez is a consultant and teacher in networks and telecommunications. He works with industrialists and operators regarding architecture studies and leads training on the 4G and IMS networks for NEXCOM SYSTEMS.

• PREFACE xi ABBREVIATIONS xxxiiiCHAPTER 1. INTRODUCTION TO CRYPTOGRAPHY 11.1. The encryption function 11.1.1. 3DES algorithm 31.1.2. AES algorithm 61.1.3. RSA algorithm 101.1.4. ECC algorithm 121.2. Hash function 131.2.1. MD5 algorithm 131.2.2. SHA algorithm 161.2.3. HMAC mechanism 201.3. Key exchange 221.3.1. Secret-key generation 221.3.2. Public key distribution 24CHAPTER 2. 802.1X MECHANISM 272.1. General introduction 272.2. EAPOL protocol 282.2.1. EAPOL-Start message 302.2.2. EAPOL-Logoff message 302.2.3. EAPOL-Key message 302.2.4. EAPOL-Encapsulated-ASF-Alert message 312.2.5. EAPOL-MKA message 312.2.6. EAPOL-Announcement message 312.2.7. EAPOL-Announcement-Req message 322.3. EAP protocol 322.3.1. EAP-Method Identity 352.3.2. EAP-Method Notification 352.3.3. EAP-Method NAK 362.4. RADIUS protocol 362.4.1. RADIUS messages 382.4.2. RADIUS attributes 392.5. Authentication procedures 422.5.1. EAP-MD5 procedure 442.5.2. EAP-TLS procedure 452.5.3. EAP-TTLS procedure 48CHAPTER 3. WPA MECHANISMS 513.1. Introduction to Wi-Fi technology 513.2. Security mechanisms 543.3. Security policies 553.4. Key management 593.4.1. Key hierarchy 593.4.2. EAPOL-key messages 613.4.3. Four-way handshake procedure 633.4.4. Group key handshake procedure 673.5. WEP protocol 683.6. TKIP protocol 703.7. CCMP protocol 73CHAPTER 4. IPSEC MECHANISM 774.1. Review of IP protocols 774.1.1. IPv4 protocol 774.1.2. IPv6 protocol 804.2. IPSec architecture 834.2.1. Security headers 854.2.2. Security association 894.2.3. PMTU processing 924.3. IKEv2 protocol 934.3.1. Message header 934.3.2. Blocks 964.3.3. Procedure 102CHAPTER 5. SSL, TLS AND DTLS PROTOCOLS 1095.1. Introduction 1095.2. SSL/TLS protocols 1115.2.1. Record header 1115.2.2. Change_cipher_spec message 1125.2.3. Alert message 1125.2.4. Handshake messages 1145.2.5. Cryptographic information 1245.3. DTLS protocol 1265.3.1. Adaptation to UDP transport 1265.3.2. Adaptation to DCCP transport 1295.3.3. Adaption to SCTP transport 1305.3.4. Adaption to SRTP transport 131CHAPTER 6. NETWORK MANAGEMENT 1336.1. SNMPv3 management 1336.1.1. Introduction 1336.1.2. SNMPv3 architecture 1356.1.3. SNMPv3 message structure 1436.2. SSH protocol 1466.2.1. SSH-TRANS protocol 1466.2.2. SSH-USERAUTH protocol 1516.2.3. SSH-CONNECT protocol 152CHAPTER 7. MPLS TECHNOLOGY 1557.1. MPLS overview 1557.1.1. Network architecture 1557.1.2. LSR router tables 1577.1.3. PHP function 1587.1.4. MPLS header format 1597.1.5. DiffServ support 1607.2. LDP protocol 1627.2.1. Principles of functioning 1627.2.2. LDP PDU format 1657.2.3. LDP messages 1677.3. VPN construction 1707.3.1. Network architecture 1707.3.2. Differentiation of routes 1747.3.3. Route target 1757.3.4. Principles of operation 1777.4. Network interconnection 1807.4.1. Hierarchical mode 1817.4.2. Recursive mode 182CHAPTER 8. ETHERNET VPN 1858.1. Ethernet technology 1858.1.1. Physical layer 1868.1.2. MAC layer 1888.1.3. VLAN isolation 1918.2. PBT technology 1948.3. VPLS technology 1968.3.1. Network architecture 1968.3.2. EoMPLS header 1998.3.3. LDP 2018.4. L2TPv3 technology 2038.4.1. Data message 2038.4.2. Control messages 2058.4.3. Procedures 208CHAPTER 9. FIREWALLS 2159.1. Technologies 2159.1.1. Packet filter 2169.1.2. Applicative gateway 2189.1.3. NAT/NAPT device 2199.2. NAT/NAPT device crossing 2229.2.1. ICMP protocol 2239.2.2. IPSec mechanism 2249.2.3. SIP, SDP and RTP protocols 2279.2.4. FTP protocol 2339.2.5. Fragmentation 235CHAPTER 10. INTRUSION DETECTION 23710.1. Typology of attacks 23710.2. Methods of detection 23910.2.1. Signature-based detection 24010.2.2. Anomaly-based detection 24010.2.3. Protocol analysis 24110.3. Technologies 24210.3.1. N-IDPS device 24310.3.2. WIDPS device 24610.3.3. H-IDPS device 24810.3.4. NBA device 249BIBLIOGRAPHY 253INDEX 259