

Corresponding author: Ogweno Jeremiah okeyo

Copyright © 2024 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution Liscense 4.0.

Performance, privacy and security issues at the TCP internet layer

Ogweno Jeremiah okeyo

*

Jaramogi Oginga Odinga University of Science and Technology, Bondo, Kenya.

World Journal of Advanced Research and Reviews, 2024, 21(03), 1386–1410

Publication history: Received on 01 February 2024; revised on 13 March 2024; accepted on 15 March 2024

address performance concerns; the research paper investigates the factors affecting internet Layer. Through extensive

research studies, the paper examines the impact of network congestion, routing inefficiencies, and protocol limitations

on the overall performance of internet-based services. This research delves into the vulnerabilities and risks associated

with the internet layer. It investigates the potential threats posed by malicious actors, including hackers, data breaches,

and unauthorized access to sensitive information. The findings of this research contribute to a comprehensive

understanding of the interplay between performances and privacy security issues at the internet layer. By identifying

the key challenges and potential solutions, this study provides valuable insights for network administrators, service

providers, policymakers, and end-users to optimize performance while ensuring robust privacy and security measures.

Ultimately, this research aims to foster a safer and more efficient internet ecosystem for all stakeholders.

Keywords: TCP/I; Networks; Attacks; Protocols; Security; Privacy

conceived, the Internet as we know it today did not exist. The concept behind this layer was to define a framework for

two computers to connect to one another to share data. This laid the foundation for widespread internetworking, which

led to what we now know as the Internet. Before data can be sent out over the Network Interface, it must have a standard

format, size, and addressing scheme. The Network Interface layer is responsible only for taking the data it is given and

translating that to signals on a physical medium. The Internet layer defines packet structure (what each bit of a data

segment means), addressing, and routing [3]. As shown in Figure 1, the Internet layer is the third layer in TCP/IP model,

and it is equivalent to the network layer in the OSI model. The main function for the Internet layer is to handle

communication from one PC to another. This layer is responsible to request and send a packet from the transport layer

by knowing to which PC it will be delivered [4] [5].

At the TCP/IP internet layer, performance, privacy, and security issues [6] intersect in complex ways, influencing the

susceptible to attacks like route hijacking and spoofing, which not only impact performance by causing data to be routed

inefficiently but also raise security concerns by potentially exposing sensitive information to unauthorized parties [8]-

[12]. Furthermore, as the internet continues to grow in scale and complexity, scalability becomes a performance

challenge at the TCP/IP internet layer, requiring constant optimization efforts to maintain network efficiency and

responsiveness.

Figure 1 TCP/IP Protocol

Privacy issues at the TCP/IP internet layer stem from the inherent lack of encryption and authentication mechanisms,

leaving data vulnerable to interception and manipulation by malicious actors [13]. Without encryption, data transmitted

across the internet can be intercepted at various points along its journey, compromising user privacy and

Denial of Service (DDoS) attacks, packet sniffing, and IP spoofing. DDoS attacks exploit vulnerabilities in TCP/IP

protocols to flood targeted servers or networks with an overwhelming volume of traffic, disrupting services and causing

downtime. Packet sniffing techniques allow attackers to intercept and analyze data packets traversing the network,

potentially exposing sensitive information such as passwords, financial transactions, or personal communications [20]-

[24]. IP spoofing involves forging the source IP address of data packets to disguise the attacker's identity or launch

attacks on unsuspecting targets, undermining the integrity and trustworthiness of TCP/IP communications. Mitigating

these security risks requires a multi-faceted approach, including the implementation of robust network security

measures, regular vulnerability assessments, and user education initiatives to raise awareness about safe internet

practices and privacy-enhancing technologies.

and data exchange between different devices and systems. Given the critical role of the internet layer, it is essential to

crucial for researchers, network administrators, policymakers, and other stakeholders to develop effective solutions

and strategies to address these challenges.

The TCP/IP Protocol Suite is a group of different communication protocols working through the Internet and other

private communication networks, and it carries most of the essential services running over the network. It provides

end-to-end connectivity by establishing, maintaining, and releasing connections between the sender and receiver. It

provides for flow control, error control, IP addressing and the routing of network traffic and an interface between the

node and the physical network [25]. Figure 2 shows the communication model in TCP/IP networks.

access to various services [28]. However, as the Internet grows in scale and complexity, it also gives rise to several

challenges related to performance, privacy, and security. This literature review aims to explore the existing research on

these issues at the Internet layer;

Xaminer [29] the first Internet cross-layer resilience analysis tool, to evaluate the interplay between physical and

network-layer failures, Using a cross-layer Internet map [30] and a failure event model, Xaminer generates a risk profile

encompassing a cross-layer impact report, critical infrastructure identification at each layer, and the discovery of trends

and patterns under different failure event settings. Xaminer's key strengths lie in its adaptability to diverse disaster

scenarios, the ability to assess risks at various granularities, and the capability to generate joint risk profiles for multiple

events. We demonstrate Xaminer's capabilities in cross-layer analysis across a spectrum of disaster event models and

regions, showcasing its potential role in facilitating well-informed decision-making for resilience planning and

traffic demands. Researchers have proposed various solutions such as network address translation (NAT), quality of

service (QoS) mechanisms, and IPv6 adoption to address scalability issues.

and load balancing mechanisms to enhance network performance and minimize congestion [35].

Latency and Delay: The delay experienced during data transmission can significantly impact user experience. Studies

have focused on reducing latency through techniques like caching, content delivery networks (CDNs), and protocol

optimizations such as Multipath TCP (MPTCP) to improve response times and enhance overall performance [36]-[38].

IP Address Tracking: The use of IP addresses as unique identifiers raises concerns about user privacy [39]. IP address

tracking refers to the technique of monitoring and logging the Internet Protocol (IP) addresses that access a network or

website. This process is essential for various purposes, including network management, security, and analytics. By

tracking IP addresses, administrators can identify where traffic is coming from, detect and respond to unauthorized

access or malicious activities such as hacking attempts and denial of service (DoS) attacks, and enforce access controls

user privacy and prevent unauthorized tracking or surveillance [45], [46].

Traffic Analysis: Adversaries can perform traffic analysis to infer sensitive information about users' online activities

[47]. According to [48], TCP traffic analysis involves the examination and interpretation of the flow of packets over TCP

(Transmission Control Protocol) connections to understand network behavior, identify potential security threats, and

optimize performance. By analyzing the characteristics of TCP traffic, such as volume, packet sizes, timing, and the

sequence of TCP flags (e.g., SYN, ACK), network administrators and security analysts can detect anomalies that may

indicate malicious activities like port scans, denial-of-service attacks, or data exfiltration attempts [49], [50].

Furthermore, TCP traffic analysis helps in assessing network efficiency [51], identifying bottlenecks, and understanding

user behavior, thereby enabling better network management and planning. However, sophisticated encryption

techniques and the use of secure protocols like TLS/SSL can challenge traffic analysis efforts by obscuring packet

wide range of applications, from location-specific advertising and personalized content delivery to local weather

forecasts and navigation aids. By analyzing the IP address of a user's device, which can give a rough estimate of its

geographical location, service providers can customize the information and services offered to enhance user experience

and relevance. However, the accuracy of TCP/IP-based location determination can vary significantly, influenced by

factors such as the method used for assigning IP addresses and the use of VPNs or proxy servers, which can obscure the

device's actual location [54]-[57]. Despite these challenges, TCP location-based services represent a crucial intersection

of network technology and geographic information systems, offering significant benefits for both users and providers

by delivering more personalized and location-aware online experiences. Studies have examined approaches like k-

anonymity spatial cloaking, and privacy-preserving location-based services to safeguard users' location privacy while

still enabling the benefits of location-based applications [58], [59].

TCP sequence number prediction is a type of security exploit that targets the TCP/IP protocol's mechanism for ordering

data packets [77]. As shown in Figure 5, TCP connections rely on sequence numbers to ensure data is reassembled in

of service attacks, emphasizing the need for robust security measures, including the use of unpredictable initial

sequence numbers and encryption protocols to protect data integrity and confidentiality [80], [81]. Figure 2 shows a

typical TCP sequence numbers prediction attack.

The normal TCP connection establishment sequence involves a 3-way handshake. The client selects and transmits an

initial sequence number ISN C, the server acknowledges it and sends its own sequence number ISN S, and the client

acknowledges that. Following those three messages, data transmission may take place. The exchange may be shown

schematically as follows:

C→S: SYN (ISN C)

C→S: data

S→T: SYN (ISN S), ACK (ISN X)

X→S: ACK (ISN S), SRC = T

X→S: ACK (ISN S), SRC = T, nasty − data

Even though the message S→T does not go to X, X was able to know its contents, and hence could send Data. If X were

to perform this attack on a connection that allows command execution (i.e., the Berkeley rsh server), malicious

commands could be executed. How, then, to predict the random ISN? In Berkeley systems, the initial sequence number

variable is incremented by a constant amount once per second and by half that amount each time a connection is

initiated. Thus, if one initiates a legitimate connection and observes the ISN S used, one can calculate, with a high degree

of confidence, ISN S′ used on the next connection attempt.

Morris points out that the reply message

is not a serious obstacle. Morris found that by impersonating a server port on T, and by flooding that port with apparent

connection requests, he could generate queue overflows that would make it likely that the S→T message would be lost.

Alternatively, one could wait until T was down for routine maintenance or a reboot. A variant on this TCP sequence

number attack, not described by Morris, exploits the netstat service. In this attack, the intruder impersonates a host that

is down. If netstat is available on the target host, it may supply the necessary sequence number information on another

Routing is the process of path selection in any network. A computer network is made of many machines, called nodes,

are a variety of ways to do this, depending on the exact routing protocols used. Some of these attacks succeed only if the

remote host does source address-based authentication; others can be used for more powerful attacks [83], [84]. A

number of the attacks described below can also be used to accomplish denial of service by confusing the routing tables

on a host or gateway. The details are straight-forward corollaries of the penetration mechanisms, and will not be

described further.

The Routing Information Protocol (RIP) is used to propagate routing information on local networks, especially

broadcast media. Typically, the information received is unchecked [85]. This allows an intruder to send bogus routing

information to a target host, and to each of the gateways along the way, to impersonate a particular host. The most likely

attack of this sort would be to claim a route to a particular unused host, rather than to a network; this would cause all

sensitive data [88]. This mode of attack is unique in that it affects outbound calls as well; thus, a user calling out from

the targeted host can be tricked into divulging a password. Most of the earlier attacks discussed are used to forge a

source address; this one is focused on the destination address.

One solution is for RIP to be more skeptical about the routes it accepts. In most environments, there is no good reason

to accept new routes to your own local networks [89], [90]. A router that makes this check can easily detect intrusion

attempts. Unfortunately, some implementations rely on hearing their own broadcasts to retain their knowledge of

directly-attached networks. The idea, presumably, is that they can use other networks to route around local outages.

While fault-tolerance is in general a good idea, the actual utility of this technique is low in many environments compared

with the risks. It would be useful to be able to authenticate RIP packets; in the absence of inexpensive public-key

[93], [94].

The Exterior Gateway Protocol (EGP) is intended for communications between the core gateways and so-called exterior

gateways [95], [96]. An exterior gateway, after going through a neighbor acquisition protocol, is periodically polled by

the core; it responds with information about the networks it serves. These networks must all be part of its autonomous

system. Similarly, the gateway periodically requests routing information from the core gateway. Data is not normally

send exactly one spontaneous update between any two polls; this, too, must carry the sequence number of the last poll