Transport Qatlami (Transport Layer)

Transport qatlami (Transport Layer) — OSI modelining 4-qatlami. End-to-end ma'lumot uzatilishini ta'minlaydi. Asosiy protokollar: TCP (ishonchli) va UDP (tez). Port raqamlari orqali turli xizmatlarni ajratib beradi.

TCP Ulanish: 3-tomonlama qo'l siqish (3-Way Handshake) MIJOZ (Client) SERVER (Server) 1. SYN Ulanish so'rovi SYN_RCVD 2. SYN + ACK Tasdiqlash + javob SYN_SENT 3. ACK Tasdiqlash ESTABLISHED ESTABLISHED ✓ Ulanish o'rnatildi — Ma'lumot almashish boshlandi

TCP 3-tomonlama qo'l siqish (SYN → SYN-ACK → ACK)

TCP — Transmission Control Protocol

TCP ishonchli, tartibli va xatolarni tuzatadigan transport protokoli. Har bir paket yetkazilishini ta'minlaydi.

TCP Xususiyatlari

  • Connection-oriented: Ulanish o'rnatiladi (3-way handshake)
  • Reliability: Yo'qolgan paketlar qayta yuboriladi
  • Ordering: Paketlar tartibida yetkaziladi
  • Flow control: Qabul qiluvchi sig'imini nazorat qiladi
  • Congestion control: Tarmoq sig'imini saqlab turadi
  • Sekin: Overhead ko'proq (sarlavha = 20-60 bayt)

TCP Flaglari (Control Bits)

SYN Sinxronizatsiya — ulanish boshlash
ACK Tasdiqnoma — paket qabul qilindi
FIN Finish — ulanishni yopish
RST Reset — ulanishni zudlik bilan uzish
PSH Push — ma'lumotni darhol yuborish
URG Urgent — muhim ma'lumot

UDP — User Datagram Protocol

UDP Xususiyatlari

  • Connectionless: Ulanish o'rnatilmaydi
  • Tez: Minimal overhead (sarlavha = 8 bayt)
  • Broadcast: Ko'pchilikka yuborish imkoni
  • Ishonchsiz: Paket yo'qolishi mumkin
  • Tartibsiz: Paket tartibida yetmasishi mumkin

UDP Sarlavhasi (8 bayt)

Manba Port (16 bit)
Maqsad Port (16 bit)
Uzunlik (16 bit)
Checksum (16 bit)
Ma'lumot (Data)

UDP sarlavhasi faqat 8 bayt — TCP ning 20 baytiga nisbatan juda oddiy

TCP vs UDP Solishtirma

Xususiyat TCP UDP
Ulanish turiConnection-orientedConnectionless
Ishonchlilik✓ Kafolatlangan✗ Kafolatlanmagan
Tartib✓ Kafolatlangan✗ Kafolatlanmagan
TezlikO'rtacha (overhead)Yuqori (minimal overhead)
Sarlavha hajmi20-60 bayt8 bayt
Flow Control✓ Bor✗ Yo'q
FoydalanishHTTP/S, SSH, Email, FTPVideo, Gaming, DNS, VoIP

Port Raqamlari

Transport qatlamida portlar xizmatlarni ajratib turadi. Jami 0-65535 port mavjud.

Well-known (0-1023)

Tizim xizmatlari, root kerak

  • 20/21 — FTP
  • 22 — SSH
  • 25 — SMTP
  • 53 — DNS
  • 80 — HTTP
  • 443 — HTTPS

Registered (1024-49151)

Ilovalar tomonidan ro'yxatdan o'tgan

  • 1433 — MS SQL Server
  • 3306 — MySQL
  • 3389 — RDP
  • 5432 — PostgreSQL
  • 8080 — HTTP alt
  • 8443 — HTTPS alt

Dynamic (49152-65535)

Ephemeral — vaqtinchalik portlar

Mijoz tomonidan vaqtinchalik bog'lanish portlari sifatida tanlanadilar.

Client → :49152 - :80

Server ← :80 → :49152

Transport qatlami hujumlari

SYN Flood Hujumi

Hujumchi server ga ko'p miqdorda SYN paketlar yuboradi lekin 3-way handshakeni hech qachon tugatmaydi. Server SYN_RCVD holatida "half-open" ulanishlar ochadi va xotirasi tugaydi.

# SYN Flood sxemasi

Hujumchi → SYN (soxta IP) → Server

Server → SYN-ACK → (javob yo'q)

Server waits... waits... timeout (resources wasted!)

Himoya: SYN cookies, rate limiting, firewall

Port Scanning

Nmap kabi vositalar bilan ochiq portlarni aniqlash. Penetration testing va razvedkada ishlatiladi.

# Nmap port scan misollari

$ nmap -sS 192.168.1.1 # SYN scan (stealth)

$ nmap -sV -p 1-1000 target # Versiya aniqlash

$ nmap -sU target # UDP scan

Session Hijacking

TCP sessiya raqamlarini (sequence number) taxmin qilish yoki ushlab olish orqali sessiyani egallash.

Himoya: TLS/SSL shifrlash, xavfsiz sessiya boshqaruvi, seq number randomizatsiyasi

Transport qatlami xavfsizligi

TLS/SSL — Transport Layer Security

Transport qatlamida shifrlash. HTTPS = HTTP + TLS.

TLS 1.0, 1.1Eskirgan, xavfli
TLS 1.2Qabul qilinadi
TLS 1.3Tavsiya etiladi

Himoya texnikalari

  • ✓ SYN cookies — SYN flood'dan himoya
  • ✓ Rate limiting — port scanningdan himoya
  • ✓ TLS/SSL — ma'lumotlar shifrlash
  • ✓ Stateful firewall — TCP state tracking
  • ✓ Port filtering — keraksiz portlarni yopish

Bilimingizni tekshiring

1. TCP 3-way handshake'dagi to'g'ri tartib?

Javob: SYN → SYN-ACK → ACK. Mijoz SYN yuboradi, server SYN-ACK bilan javob beradi, mijoz ACK tasdiqlaydi.

2. SYN Flood hujumi qanday ishlaydi?

Javob: Ko'p SYN yuborib, handshake ni hech qachon tugatmaslik. Server "half-open" ulanishlarni kutib, xotirasi tugaydi → DoS.

3. HTTPS qaysi protokoldan foydalanadi?

Javob: HTTPS = HTTP + TLS/SSL. Transport Layer Security transport qatlamida ma'lumotlarni shifrlaydi.

Asosiy xulosalar

  • TCP — ishonchli, connection-oriented, 3-way handshake; UDP — tez, connectionless
  • TCP flaglari: SYN, ACK, FIN, RST, PSH, URG — ulanish nazorati uchun
  • Well-known portlar (0-1023): 22=SSH, 80=HTTP, 443=HTTPS, 53=DNS
  • SYN Flood, Port Scanning, Session Hijacking — asosiy transport hujumlari
  • TLS 1.3 — hozirgi kunda eng xavfsiz transport qatlami shifrlash protokoli
Tarmoq qatlami Xavfsizlik devori