WSM Reference Guide - WatchGuard Technologies

Transfer Protocols
Source Routing
The loose source route option and the strict source route option enable the source of an
Internet packet to give routing information. Source routing options can be very dangerous,
because an attacker could use them to masquerade as a different user. But, loose source route
option and the traceroute tool can also help debug some unusual routing problems.
Record Route
The record route option was first used to do tests on the Internet. But, record route can record
only ten IP addresses. On the current Internet, a typical connection can include 20 or 30
different routers, making the record route option out of date.
Time Stamp
The time stamp option measures the time for a packet to make one full cycle (source -->
destination --> source). Higher level time protocols or time stamp messages do this task better
than the time stamp option.
Transfer Protocols
The Internet Protocol (IP) includes information kept in the transport layer. The transport layer has different
protocols that tell how to transmit data between software applications: for example, UDP, TCP, ICMP,
and others.
UDP
User Datagram Protocol (UDP) is a datagram protocol that does not use connections. It is a very fast protocol,
and it does not use much bandwidth or CPU. But, you cannot trust that datagrams will get to their
destination. A software application that uses UDP must make sure that the full message gets to its destination
in the correct sequence.
Characteristics of UDP include:
• Frequently used for services that include the exchange of small quantities of data where sending
a datagram more than one time is not a problem.
• Used for services such as time synchronization in which a missing packet does not have an effect
on continued operation. Many systems using UDP send packets again at a constant rate to tell
other systems about unusual events.
• Frequently used on LANs. Because of its low system and bandwidth requirements, it gives a large
performance advantage to Network File System (NFS) services users. Network File System is a
popular TCP/IP service for supplying shared file systems over a network.
• Gives supports to broadcasts.
• Gives abstraction of ports. A connection is made of its source and destination ports and its source
and destination IP addresses. In typical use, port numbers less than 1024 are saved for wellknown
services (destinations). The client side can use ports higher than1023 for the source of the
connection. But, this rule has many exceptions: NFS (port 2049) and Archie (port 1525) use server
ports at numbers higher than1024. Some services use the same source and destination port for
server to server connections. Examples include DNS (53), NTP (123), syslog (514), and RIP (520).
Reference Guide 5