HP 635n Practical IPsec Deployment for Printing and Imaging Devices - Page 19

To further explain, we'll bring up an analogy. You are a paleontologist in charge of a recent discovery of a new Tyrannosaurus Rex fossil. The skeleton was separated into fossils and these fossils have been distributed to various other paleontologists. The goal is to move these fossils to a museum across the country where the separate fossils will be assembled into a complete skeleton. Because money is an issue and the fossils can't be mailed, you devise a plan to deliver them across the country. Essentially, each paleontologist that has the fossils will put them in a package and hire a truck driver to deliver them to a city along the way. In the intermediate city, the cargo will be transferred to another hired driver's vehicle which will continue on with the delivery of the package. This process will be continued until all the cargo is delivered to the museum. Figure 17 - Cargo In our analogy, the truck/driver represents the Ethernet frame. The cargo represents the IP packet. The IP packet contains the original source (warehouse) address and final destination (museum) address and the data (fossils). The Ethernet frame is addressed from source to intermediate destination - not from original source to final destination - and encapsulates the data (IP packet). The IP packet is transferred from Ethernet frame to Ethernet frame. This concept is very important to understand for Man-In-The-Middle (MITM) attacks. Let's continue our analogy: An upset paleontologist, who didn't get a chance to examine any fossils, finds out about the shipment. He secretly changes the sign at the Intermediate Stop Point B to point to a new location. Essentially, he intercepts the cargo. He is able to examine the fossils and then hires another driver to drive the rest of the way to the museum. By making sure the museum receives the fossils, no one will suspect any mischief was done. He has executed a successful Man-In-The-Middle attack. 19