Data Travels: The Structure of a Data Packet

First, a data packet refers to a piece or unit of data sent across the Internet. Every data packet has the following: Header, Payload, and Trailer. This ensures the data sent is correctly delivered.

• Header refers to the source and destination IP address, port numbers, and the sequence order of packets.
• Payload contains the actual data.
• Trailer marks the end of the packet, including the information for error checking.

Data Travels: Breakdown Process

Following our understanding of what data packets and their structure are, when they travel the internet, they follow these steps:

• Segmenting data into packets: TCP takes and breaks the data into smaller chunks as packets.
• Addressing the packets: For each packet, the destination and source are given IP addresses, and the sequence in their headers.
• Routing: Once the address of the packet is resolved, they are sent across the internet. Here, the routers direct each packet through the efficient paths.
• Packets travel independently: Through the packet switching method, each packet (along with its addresses) follows an independent path, different from others.
• Reassembly:At the destination, the TCP protocol uses the sequence order of the packets to reassemble the image.
• Data Verification: And finally, the data is verified with the packet's trailer. It checks for errors. If the packet is corrupt, a new one is requested.

Why are Data Packets Important?

The above steps attest to the essence of data packets. Without them, network communication is less reliable and efficient. The internet becomes clogged with congestion. The data sent will take longer to deliver. However, the imports of data packets are highlighted below:

• It handles errors. That is, corrupted parts of a file can be resent or checked for reliability.
• It is scalable. With packet switching, high volumes of data can be properly handled.
• It is flexible and reliable.

Packet Switching vs Circuit Switching

Fundamentally, the difference between packet-switching and circuit-switching lies in the way data is transmitted over a network. By circuit-switching, data is only transmitted after a dedicated, physical communication channel is established between two points in a network. The table below captures these key differences:

Understanding ISPs, Routers, Hops & Latency

• Internet Service Providers (ISPs) are companies that provide access to the internet. In this case, they define the segments of how the data travels from the initial to the last phase. So when you send data, your ISP uses its router to handle the connection and send the packets to other networks for efficiency and proper routing.
• Routers, as the name implies, control the network traffic of the internet. From how data travels, routers receive packets, analyse their destination IP address, and decide the most efficient path for them, through as many routers, and repeat the process till the packet reaches its destination.
• Meanwhile, Hops refer to the steps taken by the data packets as they travel from the source to the destination. Much deeper, it is like a brief, calculated stop before routers during a data packet's journey through the internet. For every hop, considering that each router must process the data packet, a delay (latency) is introduced. So ideally, the lower the hops, the lower the latency, which also amounts to a faster network path. Tools like Traceroute are used to show the number of hops or routers a data packet took before reaching its final destination.
• Latency, as we know, is the time delay in sending data from one point to another. Measured in milliseconds, it is highly influenced by the number of hops, the distance between routers, and network congestion. As established, if there is high latency, connecting to the internet can be frustratingly slow.

Diagnosing a Network: Walkthrough Lab Cases

In the following walkthroughs, we will attempt to show how tools like Traceroute, and Wireshark are essential in testing a network or understanding how data travels the internet.

Lab Case 1: Showing Hops (Traceroute)

This lab test helps us understand the hops or specific paths your data takes to reach a website, showing that packets don't move in a straight line.

Steps:

• Open Command Prompt (Windows) or Terminal (Mac)
• Type either of the commands based on your operating system and press Enter:
  • Windows: tracert reinventsecurity.org
  • Mac: traceroute reinventsecurity.org
• After running the command, you will see a list of IP addresses and the number of hops your data packet passed through, including the size of the packets.

Takeaway: By taking this test, you have learned how data travels, taking repeated turns or routes for efficiency.

Lab Case 2: Using Wireshark

Note: Ensure that Wireshark has been installed on your virtual machine before taking this test.

Step 1: Start a capture

• Open Wireshark and double-click your network interface (Wi-Fi or Ethernet) to capture all data packets from your computer.

Step 2: Generate TCP Traffic

• To trigger a new network connection, first close all tabs on your web browser.
• In Wireshark, click the red square button to stop capture. Click Green to start another
• In your browser, visit a simple website.
• Once the page loads, go back to Wireshark.

Step 3: Stop and Filter the Packets

• To stop capture, use the red square button again.
• To filter the packets, find the filter bar at the top of the Wireshark window
• Type “tcp” and press Enter.

Step 4: Locate TCP Handshake

• In the info column in the packet list, look for three packets with the following:
  • SYN (synchronize)
  • SYN, ACK
  • ACK

This sequence defines the TCP handshake, establishing a connection between a client and the website's server.

Step 5: View Packet Details

• Click the [SYN, ACK] column on the packet list
• The pane will display the detailed info of the packet
• Click the small arrow next to the TCP to expand the section to show the source and destination ports and sequence numbers of the packet

Key Takeaway: By doing this, you learn about the inner workings of the internet. It will demonstrate how systematic and organised the internet works.

Real-World Insight: What Causes Slow Page Loads?

Slow-loading pages can be quite frustrating. In the business world, for instance, that could amount to a significant loss in revenue if consistent. That is, a slow page means poor user experience.

In 2010, for instance, Google announced that page speed would act as a driver for its search engine ranking. While there are no straight lines to what causes slow page loads, the following are some of the real-world insights that can be drawn:

• High Latency: As we discussed, latency comes from the number of hops a data packet passes through. If the network path is inefficient or improperly routed, the time it takes for requests to reach and return from a server affects how fast the page may load.
• Network Congestion: A page might load more slowly if there are too many people using a network at once. This tends to slow down the transfer of data and even result in packet loss, which overall impacts the speed of rendering the page.
• Server Performance: This could mean that the server is overloaded or typically slow in response, even if the network conditions are favourable.
• Extensively, the lack of a Content Distribution Network (CDN) could also play a role in why pages load slowly. CDN allocates local servers to handle clients' requests. Without this, the round-trip time is maximised and the pages may load slowly.
• Large File Size: Webpages with large images and less optimised coding would require more packets and time to download. This, too, may make a page slow.

Why does this matter for cybersecurity?

Understanding how data traverses the internet is fundamental for all cybersecurity professionals. This is based on the fact that when data travels, it relies on both public and private networks, different routers, servers, and a host of other network infrastructures, before it reaches the final destination.

In cases where the data is barely encrypted or secured, attackers have the leisure of intercepting, stealing, and compromising it. Attacks like eavesdropping or Man-in-the-Middle are reference points. In fact, two recorded cases come to mind:

• The Equifax Data Breach (2017) was a result of an MITM attack that allowed threat actors to intercept and steal data from the Equifax web application, exposing over 100 million people's personal information.
• Lapsus$ Office 365 Attack (2022) targeted more than 10,000 Office 365 users by simply spoofing.

From this, it is clear that cybersecurity matters. With the escalating cyber threats, understanding the foundations of how data navigates the internet can help cybersecurity professionals, as well as organisations, solidify their security postures.