Internet vs. network

Aren’t they the same thing?

Well… there’s a qualitative difference between

• “Network” — A network that is “here”, i.e. you can inspect the devices, listen in wherever you prefer, have control over who owns what, who’s responsible for it, can pierce virtual devices all the way down to the hardware, etc…
• “Internet” — A network that is “over there”, i.e. you can’t in general (at least not easily) investigate devices, have to infer topology, have to guess at what is virtual and what is physical, don’t know responsibilities (”bad guys” may pose as “good guys”) etc…

Here we’ll focus mostly on “internet” - note that that means crime committed on the internet as well as with the internet.

Internet

So is all lost?

No, we’ll typically have access to at least one of the endpoints either the victim or the adversary. And a bit of network close to both.

One important part of the crime scene left — the network between the two. You typically won’t have access to that, but you can perform tests to see how its configured. But beware that network change quickly and fundamentally.

A short whirlwind tour of the internet:

• IP addresses, ports, domain name system
• ISO OSI model
• Routing
• Topology
• Applications (web, email, peer-to-peer)

Basics

Shouldn’t be a surprise, but let’s go through it quickly

TCP/IP:

• IP addresses, one (or more) per endpoint

  Network sends data from source IP address to destination IP address (and back)

  Port numbers (0-65535) denote different kinds of services, but they are a convention, nothing stopping someone from using a port (such as 80-http) for something else

  Computers are connected to one (or more) networks, thgough which all traffic flows. Switches extend to a LAN, routers connects LANs (or MANs or WANs)