CND (312-38) Network Defense Simulation

Welcome to this scenario-based practice module. You will learn to map network activity to the correct OSI model layer, a critical skill for pinpointing where to apply defensive controls such as firewalls, proxies, and IDS signatures.

Network Scenario

You are investigating intermittent application connectivity issues between an internal accounting client and an RPC-based financial database server (`10.0.5.50`). The network firewall is permitting traffic on port TCP 135 (RPC Endpoint Mapper), but subsequent dynamic ports negotiated for the actual data exchange are failing to establish properly.

To implement a fix using an Application Layer Gateway (ALG) or deep packet inspection, you must first verify your understanding of how protocol stacks handle connection management. You need to identify the exact OSI layer responsible for the creation, maintenance, and teardown of the dialogue between the remote client and the local server application.

Traffic & Logs

Packet Capture (PCAP) snippet of the communication attempt:

Time Source Destination Proto Info 10:01:45 10.0.2.15 10.0.5.50 TCP 53012 > 135 [SYN] Seq=0 Win=64240 Len=0 10:01:45 10.0.5.50 10.0.2.15 TCP 135 > 53012 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 10:01:45 10.0.2.15 10.0.5.50 TCP 53012 > 135 [ACK] Seq=1 Ack=1 Win=64240 Len=0 10:01:45 10.0.2.15 10.0.5.50 DCERPC Bind: call_id: 1, EPMv4 V3.0 10:01:45 10.0.5.50 10.0.2.15 DCERPC Bind_ack: call_id: 1 accept max_xmit: 5840 max_recv: 5840 10:01:46 10.0.2.15 10.0.5.50 DCERPC Request: call_id: 2 ctx_id: 0 opnum: 3 (Map) ... [!] ALERT: Stateful inspection dropped subsequent dynamic port connection. [!] ALERT: RPC Session termination triggered unexpectedly.

Note: The DCERPC bind and unbind process directly correlates to the management of the application's dialogue/session.

Question

Which of the following OSI layers establishes, manages, and terminates the connections between the local and remote applications?

Hint: Think about the layer explicitly named for its role in maintaining a "dialogue" or "session" between two endpoints, distinct from routing (Network), MAC framing (Data Link), or the user interface itself (Application).

Expert Analysis

1. What is happening in the network

The client is successfully establishing a TCP handshake (Layer 4) with the server on port 135. Following this, the application initiates an RPC Bind request to negotiate communication parameters. However, the firewall's stateful inspection engine is dropping the subsequent dynamic ports because it lacks the application-level awareness to track the session being negotiated within the payload.

2. Identify Attack or Behavior

This is not necessarily an attack, but rather a configuration failure resulting from a lack of protocol-aware inspection. Many application protocols (like RPC, SIP, FTP, SQL) require dynamic ports. A standard Layer 4 firewall only tracks TCP/UDP states. To secure and permit this traffic, the defender must utilize inspection that understands the Session and Application layer negotiation to dynamically open firewall pinholes.

3. Why correct answer is correct

D. Session layer (Layer 5) is specifically responsible for establishing, maintaining, and terminating sessions (or dialogues) between applications. It dictates whether communication is simplex, half-duplex, or full-duplex, and handles synchronization and checkpointing. In network defense, protocols operating here (like NetBIOS, RPC, SOCKS) often require specialized proxy or deep-packet inspection (DPI) controls.

4. Why others are wrong

A. Data Link layer (Layer 2): Incorrect. Responsible for node-to-node frame delivery using MAC addresses (e.g., Ethernet, switches). It does not understand application connections.
B. Network layer (Layer 3): Incorrect. Handles routing and logical addressing (IP addresses). It ensures packets move across networks but has no concept of application state.
C. Application layer (Layer 7): Incorrect. Provides network services directly to end-user applications (HTTP, SMTP). While related to applications, the specific management and teardown of the underlying dialogue is delegated to Layer 5 in the OSI model.

5. Defensive Action

To resolve the scenario issue securely, the defender should enable DCERPC (Distributed Computing Environment / Remote Procedure Call) application inspection on the firewall. This allows the firewall to read the Layer 5/7 payload, understand the session negotiation, and dynamically open the required high ports only for the duration of that specific authorized session, maintaining a strict default-deny posture.

6. MINI LESSON: Layer-Specific Defensive Controls

Layer 2 (Data Link): Defend against ARP spoofing, MAC flooding. Controls: Port Security, Dynamic ARP Inspection (DAI).
Layer 3/4 (Network/Transport): Defend against SYN floods, unauthorized routing. Controls: Stateful Firewalls, ACLs, IPsec.
Layer 5 (Session): Defend against session hijacking, unauthenticated RPC/NetBIOS enumeration. Controls: DPI Firewalls, ALGs, strict protocol validation.
Layer 7 (Application): Defend against SQLi, XSS, malware payloads. Controls: WAF (Web Application Firewall), Email Gateways, Antivirus.

Ready for more network analysis?

Improve your defensive mindset with full-length CND practice exams.

Explore more CND simulations