Chapter 3 — Physics for computing | Engineering Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Latency has a floor"]
  N2["3.2 Bandwidth and serialisation"]
  N3["3.3 Heat, power and physical media"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Latency has a floor"]
  N2["3.2 Bandwidth and serialisation"]
  N3["3.3 Heat, power and physical media"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Latency has a floor]
    |
    v
[3.2 Bandwidth and serialisation]
    |
    v
[3.3 Heat, power and physical media]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) relate signal propagation, bandwidth and latency to what a test can observe; (2) estimate the physical side effects of test traffic; (3) explain why radio and physical-access tests need separate authorization.

3.1 Latency has a floor

Signals in fibre travel at about two-thirds of the speed of light, roughly 200,000 km/s, so 1,000 km of fibre adds about 5 ms each way. When TrackScope reports a 40 ms round trip to a depot server 300 km away, about 3 ms is propagation and the rest is queuing, switching and processing. Engineers use this floor to sanity-check timing evidence: a round trip below the propagation floor means the measurement or the location assumption is wrong.

If a measured round trip is shorter than light could travel the claimed distance, either the server is closer than believed or the clock is wrong. Sam uses the floor as a check on evidence, not as a location finder: many paths take longer routes, so a high latency proves nothing about distance. For depot links over a few hundred kilometres, a few milliseconds of propagation is normal; tens of milliseconds of processing on a busy fare system is also normal and must not be read as proof of a distant host.

3.2 Bandwidth and serialisation

Serialisation time is size divided by link rate. A 1,500-byte frame on a 10 Mb/s depot uplink takes 1,500 × 8 / 10⁷ = 1.2 ms to put on the wire. If an authorized scan sends 2,000 small probes per second at 100 bytes each, it consumes 1.6 Mb/s, 16% of that uplink, which is why low-bandwidth OT and branch links get tighter ROE limits than data-centre networks.

Serialisation time adds to every packet before any processing delay. On a slow uplink, many small probes add up faster than engineers expect, because each probe still carries headers. Sixteen percent of a depot link is already enough to annoy operations and to trigger capacity alarms. Sam therefore sizes scans against the smallest link in scope, not against the data-centre core, and writes the assumed link rate into the ROE so the client can correct it.

3.3 Heat, power and physical media

Computation dissipates power as heat. A stress test that keeps an embedded fare validator's CPU at 100% may push it past its thermal envelope in a sealed kiosk; that is a safety issue, not a security finding. Radio is a physical medium shared with people who never signed the ROE: Wi-Fi and Bluetooth assessments transmit into public space and are regulated, so they need explicit written authorization naming frequencies, locations and times.

Synthetic case — Riverstone Transit. A proposed throughput test on the depot uplink would have used 70% of a 10 Mb/s link during the morning dispatch window. Sam moved it to 02:00–04:00 and capped it at 1 Mb/s after computing the serialisation load.

3.4 Errors and limits

Back-of-envelope physics gives orders of magnitude; real links have overheads (headers, retransmissions) that add 5–20%. Do not infer geographic location from latency alone; routing paths are rarely straight lines.

Header and retransmission overhead means a calculation that ignores them underestimates load. Using latency to guess location fails when traffic is routed through a distant hub or a VPN. Sam states assumptions next to every estimate and treats a mismatch with measured values as a signal to revise the model, not as a finding about the target.

Exercises

EX007 — Propagation floor. A report claims a 2 ms round trip between sites 800 km apart over fibre. Is it plausible? Rubric: 3 = floor ≈ 8 ms round trip, so implausible, with a likely cause (cache, wrong site, local proxy); 2 = calculation only; 1 = guess; 0 = none.
EX008 — Link share. What fraction of a 2 Mb/s link do 500 probes per second of 120 bytes use? Rubric: 3 = 0.48 Mb/s = 24%; 2 = one unit slip; 1 = method only; 0 = none.
EX009 — Radio authorization. List four fields a written authorization for a Wi-Fi assessment must contain beyond a normal network ROE. Rubric: 3 = frequencies/bands, physical locations, times, and a rule for third-party devices/data; 2 = three; 1 = one or two; 0 = none.

Synthesis

Physics sets floors and budgets. Using them catches impossible evidence and keeps test traffic within what fragile links and devices can take.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →