Emily Lin

Live Drawing Show!

Goal:

•  User will draw on the website’s draw page. The Axi Draw will update based on user’s drawing. There will be a camera that is recording. The recording will be sent to the website’s live stream page so others can see the live stream of the drawing. 
  
  

—

Functionality:

• Co-Draw allows people to contribute to a drawing using a web interface
• Control the Axidraw’s position based on the user’s mouse x and y position on the website.
• Include a camera that video records the Live Drawing show. The live stream will be posted on a separate page on the website.
• Ideally: use socket.io to allow 2 people to draw at the same time.

—

REST API:

1.) Identify Axi Draw Machine

• Address: /identify_axi
• Method: ?

2. ) Find current position of the user’s mouse x and mouse y on the website

Address: /pen_position

Method: post

Body:

{
   “mouse_x”: 2344,
   “mouse_y”: 281,
   “state” : 1  //pen state is from 0 to 1 (down/on)
}

Response:

“coordinates”: [
        {
        “success”: 
            {
             “type”: “200”, //ok
             “mouse_x”: “2344”,
             “mouse_y”: “281”,
             “state”: “1”
            },
         “error”: 
             {
               “type”: “400”, //error
               “details”: “invalid inputs”
             }
         }
     ]
}

3. ) Set to original position when user presses Reset Button

Address: /original
Method: POST
Body: 

{
   “mouse_x”: 0,
   “mouse_y”: 0,
   “state” : 0 // off
}

Response: 

{
    “original_position”:[
        “success”: 
        {
            “mouse_x”: 0,
            “mouse_y”: 0,
            “state” : 0 // off
         },

   “error”: 
        {
             “type”: “400”,
             “details”: “invalid inputs”
         }
      ] 
}

—

Video for live stream

4.) Get channel 

Address: /channel
Method: GET
Body: 

Response: 

{
    “channel”:[
        “success”: 
        {
            “recording”: on, //turn channel on or off
            “channel_id”: {channel_id}, //integer
            “width": 1920px,
            "height": 1080px
         },

   “error”: 
        {
             “type”: “400”,
             “details”: “invalid inputs”
         }
      ] 
}

5.) Post channel data to client

Address: /channel
Method: POST

{
 “channel”:
      “recording”: on, //turn channel on or off
      “channel_id”: {channel_id}, //integer
      “width": 1920px,
      "height": 1080px
}

—

Reference:

• https://www.dacast.com/video-api-documentation/
• https://developers.meethue.com/
• https://github.com/techninja/cncserver

Assignment:
“Run Linux host for several days, with a firewall in place and a public IP address. Make a table of all the IP addresses that attempt to connect to your host. Found out where they are located? What organizations are the associated with? What service providers are providing their IP address?”

a.) Step 1: Using my Digital Ocean Linux Host, I installed and configured the ufw firewall. I enabled the TCP connections on  the ports below. I did this by following this super helpful tutorial from the ITP Network Site.

—

b.) Step 2: I collected a table of all the IP addresses that tried to connect to my host for Nov. 2, Nov.3, and Nov. 4. I was planning to combine all 3 day’s worth of data into 1 set, but that was just too large and made it hard to manage in Excel.

I decided to just focus on the Nov. 4 data, which was more than enough data points to work with (5,640 unique hits).  The below image shows a section of the full dataset.

—

c.) Step 3: Using Excel I was able to find: total hits from all the sources, number of unique sources, top 10 most frequent src (including their ip addresses). The image below shows the results for this.

Other Data (Nov 4): 

• Total Hits from All the Sources: 5,640
• Number of Unique Sources: 1,111

—

d.) Step 4: Using ipinfo.io, I tried to find where each of these 10 ip addresses are coming from and the organizations they are associated with.

• #1 hits: 185.156.73.52
  • Moscow, RU
  • OOO Patent-Media

• #2 hits: 185.176.27.254
  • Moscow, RU
  • Balkan Internet Exchange Ltd

• #3 hits: 185.156.73.52
  • Moscow, RU
  • Balkan Internet Exchange Ltd

• #4 hits: 80.82.64.73
  • Amsterdam, NL
  • Incrediserve.net

* Side note: Incrediserve.net is an IP Trading company! This is a dumb question, but do they mean ip addresses or ip as in intellectual property? 

• #5 hits: 96.250.119.232
  • New York City, NY
  • MCI Communications Services, Inc. Verizon Business

—

e.) Step 5: Reflection.

UM, why is someone from Russia constantly hitting my IP address?! And so many time in 1 day! Is this maybe tied with the hacking of our elections? Tried to look into this a little and found this forum. Seems like some people on the forum say it is “normal” to get probes from many countries like Russia, China, Vietnam, etc. Basically, I shouldn’t let my biases get in the way, even though my top 3 places that hit me are from Russia.

—

Thank You: 

• So much gratitude to Rashida for answering my many questions about this!
• Thank you for the straightforward guide to setting up the firewall and ip tables, Professor Tom! By initially trying to do this assignment without the guide, I have realized how confusing the process of setting up a firewall and configuring the ip tables could have been. The internet has so many resources, but not all structured so well!

—

Helpful Resources for Understanding UFW ( initially, I forgot about the itp tutorial above, so found some forums/helpful links online for trying to understand what to do) :

• https://www.digitalocean.com/docs/networking/firewalls/resources/troubleshooting/
• https://help.ubuntu.com/community/UFW
• https://ubuntuforums.org/showthread.php?t=801351

—

Lines to remember:

sudo dmesg | grep '\[UFW'
grep UFW /var/log/syslog
/var/log
sudo tail ufw.log

remember:
csp root@.....:/var/log/ufw.log .

 STEP 1: Packet Sniffing With Wireshark (~5 Hours)

I used Wireshark to capture and analyze the traffic on my home network. I left it running while I worked on other projects that required me to look up a bunch of sites for help (youtube, stack overflow, random blogs, unity’s documentation site). This step was done so I could get an overview of what a typical working session looks like on my home network. After this, I exported the data (which was way too large – a total of around 1 million data points, 300 MB) as a CSV. Then I used excel to do a little data analysis.

snippet of excel sheet with summary

a.) With Excel, I grouped all the protocols then got all the unique values.
There are 22 unique protocols.

• ARP: address resolution protocol;  “is a procedure for mapping a dynamic Internet Protocol address (IP address) to a permanent physical machine address in a local area network (LAN)”
• Browser
• DB-LSP: Dropbox LanSync Protocol,
• DB-lSP-DISC: Dropbox LAN Sync Discovery
• DNS: Domain Name System; “the phonebook of the Internet; DNS translates domain names to IP addresses so browsers can load Internet resources.”
• EAPOL: “Extensible Authentication Protocol (EAP) over LAN (EAPoL) is a network port authentication protocol “
• H1: “is a bi-directional communications protocol used for communications among field devices and to the control system”
• HTTP: HyperText Transfer Protocol
• HTTP/XML
• ICMP: “(Internet Control Message Protocol) is an error-reporting protocol network devices like routers use to generate error messages to the source IP address when network problems prevent delivery of IP packets.”
• ICMPv6: v6 of ICMP
• IGMPv3: “Internet Group Management Protocol (IGMP) is the protocol used by IPv4 devices to report their IP multicast group memberships to neighboring multicast devices. “
• MDNS: “multicast DNS protocol resolves hostnames to IP addresses within small networks that do not include a local name server.”
• NBNS: “stands for NetBIO Name Service, which is a protocol for name resolution.”
• NTP: ” is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. “
• OCSP: “Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate”
• SSDP: “(SSDP) is a network protocol based on the Internet protocol suite for advertisement and discovery of network services and presence information.”
• SSLv2: “is an obsolete version of SSL that has been deprecated since 2011 due to having security flaws.”
• TCP: Transmission Control Protocol (explained elsewhere in blog)
• TLSv1.2: TLSv1.2 is the newest SSL protocol version
• TLSv1.3: rewrite of TLSv1.2.
• UDP: User Datagram Protocol (explained elsewhere in blog)

—

b.) Then I filtered and organized the destinations (outbound).
There are 981 unique destinations.

The top 3 destinations are:

1. emilys-MacBook-Pro-1798.local
2. iMac.fios-router.home
3. cs10.wpc.v0cdn.net (Verizon Business/ ISP: Edgecast Networks)

—

c.) I did the same for the source (incoming).
There are 970 unique sources.

The top 3 sources are:

1. emilys-MacBook-Pro-1798.local
2. cs10.wpc.v0cdn.net (Verizon Business/ ISP: Edgecast Networks)
3. e5042.dsci.akamaiedge.net (akamai is a content-provider/CDN)

—

d.) HTTP traffic: 

• Observations from HTTP Packets:
  • Total HTTP Packets: 18457
  • Of the 18457, Response Packets: 779 (4.22%); Request Packets: 17512 (94.88%)
  • Of the 779 Response Packets: 3 Client Errors, 115 Redirection, 661 Success
    
  • I’m noticing the info HTTP/1.1 200 comes up a lot. Found out that “200 OK” means that everything went well and I was able to connect to the server.

• Definitions (for personal understanding)
  • HTTP found at Layer 7 of OSI model (Application)
  • When I upload data to a web server, I am creating a POST packet. This requires 3 way handshake: from client to server then back again. 
  • Burst: the maximum number of packets sent per interval of time. 
  • Burst start: the time when the maximum number of packets sent occurred.
  • GET: Used when the client is requesting a resource on the Web server.
  • HEAD: Used when the client is requesting some information about a resource but not requesting the resource.
  • POST: Used when the client is sending information or data to the server—for example, filling out an online form (i.e. Sends a large amount of complex data to the Web Server).
  • PUT: Used when the client is sending a replacement document or uploading a new document to the Web server under the request URL.

STEP 2: Specific Activities Captured on Wireshark

After capturing hours of data (Step I), I then ran a couple of experiments to see what would show up if I performed specific internet activities such as going to streaming services, uploading files, downloading files.

a.) What would I find if I uploaded a video onto vimeo?

• I noticed that when uploading to Vimeo (I know this because the source says: “emilys-MBP….”) the protocol is usually UDP. This makes sense because the video is a large data file so would benefit from the faster speed of UDP. However, how is it possible to ensure that my video data gets transferred reliably, since that is one of the main drawbacks of UDP? I’ve usually had good success with uploading to Vimeo and don’t have any issues with not getting my data sent. Is there a way they ensure it is transferred properly? Read on the below site that: “Although it (UDP) still has certain drawbacks that prevent it from being used in all applications, there have been great advancements in improving its stability and reliability.” Perhaps UDP file transfers are improving and that is why I rarely experience Vimeo issues?(*Reference for UDP/TCP: https://www.keycdn.com/support/udp-file-transfer)

Screenshot of source: my network | destination: vimeo

• When vimeo is sending to my network, the transfer is using TCP or TLSv1.2. This does make sense since vimeo isn’t sending me a large file back.
  • TLSv1.2: TLS stands for Transport Layer Security. It is a way to transfer information securely. (*Reference: https://www.appointmentplus.com/blog/top-8-things-know-about-tls-1-2/)
  • The TLSv1.2 version was required for any site by PCI (payment card industry) on  June 30, 2018. Apparently, PCI requires sites to upgrade to newer version our sites risk putting user’s data at risk. Wow, who knew?!

Screenshot of source: vimeo | destination: my network

—

b.) What would I find it I downloaded something from the browser?

Then I wanted to see what packets would appear if I downloaded a file from the internet. So, I went to a course github page and downloaded that repo. I chose not to use SSH. I wonder if this would’ve made a difference?

results from downloading a file from github

• Most of the Protocol is with TCP. And in the info section it is often says [TCP Keep Alive]. The sources that come up consistently on github’s side are “github.map.fastly.net” and “api.github.com”
  • Fastly is a CDN (Content Delivery Network) so there is no need to worry.
  • When looking into Api.github.com, I found this helpful page: https://developer.github.com/v3/. According to their site, all API access is over HTTPS. All data is sent and received as JSON. The page also mentions: “By default, all requests to https://api.github.com receive the v3 version of the REST API.” This leads me to my next question…
• What is REST API?
  • REST is acronym for REpresentational State Transfer.
  • “It means when a RESTful API is called, the server will transfer to the client a representation of the state of the requested resource.”
  • The representation is often in JSON, but is sometimes in XML or HTTP
  • A REST API is a set of functions which developers can perform requests and receive responses via HTTP protocol such as GET and POST.
  • * Reference: https://medium.com/extend/what-is-rest-a-simple-explanation-for-beginners-part-1-introduction-b4a072f8740f

—

c.) What would happen if I visited sites of other countries?

I was also curious what would happen if I tried to visit a website from another country like Taiwan or Iran. I first checked this taiwanese design site: https://www.oniondesign.com.tw.

• “http://k6kv-bfrm.accessdomain.com” comes up alot. This checks out to be the ip address of the onion site.

For Iran, I checked this site: http://footballitarin.com. This is what immediately came up in Wireshark.

what came up immediately when I went to this Iranian site

• “eu-u.openx.net” came up a lot when I clicked. Discovered that us-U.Openx.Net is a high-risk domain. It acts as a browser hijacker infection. It can invade your system when you visit a risky web site, install unsafe freeware or open spam email attachments. That’s not good.
• “ds.dotomi.com” came up many times as well and wanted to check it out. According to this site: https://malwaretips.com/blogs/remove-cj-dotomi-com/, if your browser is constantly redirected to this Cj.dotomi.com site, then it is possible that you have an adware program installed on your computer. It’s a malicious program that once installed in your program, your browser may get many unwanted ads or pop ups. Beware!

—

d.) What’s with all these different types of TCPs? Observation from these step: what is TCP Dup ACK? What does TCP Out-of-Order, TCP Keep Alive, and TCP Retransmission mean? It seems to always be colored in black when it is related to TCP, but not just a normal TCP, there is always a message in the “info” section. She helps break it down: https://www.youtube.com/watch?v=tjZ2IgiG2PU

• TCP will judge the need for retransmission based on the RTO or the retransmission timeout. If the packet never receives a packet in a given time frame, it is retransmitted. If it is constantly showing TCP retransmission that means that there was no acknowledgement received.
• TCP Duplicate Acknowledgements means that they received order packets out of order. All TCP connections start with a initial sequence number (ISN) and each packet after that will go up by the size of its data payload. Ex: If my computer has an ISN of 1000, I send a data with 200 bytes, then my acknowledgment should be 1200. Next ISN should be 1200.
• TCP Keep Alive: two main purposes for keepalive is to check for dead peers and to prevent disconnection due to network inactivity.
  • Reference: http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html

Example of the TCP Dup ACK

Super basic questions just to help me understand Wireshark, packet sniffing, and this assignment:

• What is Wireshark? What exactly is it doing?
  • Series of data are considered frames, which are considered packets
  • Wireshark can detect and decode the packets for analysis.
  • Data is converted into packets when it passes through your network interfaces. Wireshark hunts for those packets in the TCP/IP layer during transmission and keep what it finds.

Other resources stumbled upon as I researching: 

• https://lifehacker.com/how-to-tap-your-network-and-see-everything-that-happens-1649292940
• for reading wireshark: https://www.youtube.com/watch?v=akhB55S86kE
• https://www.c-sharpcorner.com/forums/what-is-difference-between-get-post-put-and-delete
• she explains things nicely for someone who doesn’t know much about networks (I fall in this category): https://www.youtube.com/watch?v=RYCH7-PfJpY
• https://www.keycdn.com/support/udp-file-transfer