2 cissp ® Official Study Guide Eighth Edition

Tunneling
Before you can truly understand VPNs, you must first understand tunneling. 
Tunneling
is the network communications process that protects the contents of protocol packets by 
encapsulating them in packets of another protocol. The encapsulation is what creates the 
logical illusion of a communications tunnel over the untrusted intermediary network. This 
virtual path exists between the encapsulation and the de-encapsulation entities located at 
the ends of the communication.
In fact, sending a snail mail letter to your grandmother involves the use of a tunneling 
system. You create the personal letter (the primary content protocol packet) and place it in 
an envelope (the tunneling protocol). The envelope is delivered through the postal service 
(the untrusted intermediary network) to its intended recipient. You can use tunneling in 
many situations, such as when you’re bypassing firewalls, gateways, proxies, or other traffic 
control devices. The bypass is achieved by encapsulating the restricted content inside pack-
ets that are authorized for transmission. The tunneling process prevents the traffic control 
devices from blocking or dropping the communication because such devices don’t know 
what the packets actually contain.
Tunneling is often used to enable communications between otherwise disconnected 
systems. If two systems are separated by a lack of network connectivity, a communica-
tion link can be established by a modem dial-up link or other remote access or wide area 
network (WAN) networking service. The actual LAN traffic is encapsulated in whatever 
communication protocol is used by the temporary connection, such as Point-to-Point 
Protocol in the case of modem dial-up. If two networks are connected by a network 
employing a different protocol, the protocol of the separated networks can often be 
encapsulated within the intermediary network’s protocol to provide a communication 
pathway.
Regardless of the actual situation, tunneling protects the contents of the inner pro-
tocol and traffic packets by encasing, or wrapping, it in an authorized protocol used by 
the intermediary network or connection. Tunneling can be used if the primary protocol 
is not routable and to keep the total number of protocols supported on the network to a 
minimum.

---

542
Chapter 12 
■
Secure Communications and Network Attacks
The Proliferation of Tunneling
Tunneling is such a common activity within communication systems that many of us use 
tunneling on a regular basis without even recognizing it. For example, every time you 
access a website using a secured SSL or TLS connection, you are using tunneling. Your 
plaintext web communications are being tunneled within an SSL or TLS session. Also, if 
you use internet telephone or VoIP systems, your voice communication is being tunneled 
inside a VoIP protocol.
How many other instances of tunneling can you pinpoint that you encounter on a
weekly basis?
If the act of encapsulating a protocol involves encryption, tunneling can provide a means 
to transport sensitive data across untrusted intermediary networks without fear of losing 
confidentiality and integrity.
Tunneling is not without its problems. It is generally an inefficient means of 
communicating because most protocols include their own error detection, error handling, 
acknowledgment, and session management features, so using more than one protocol at 
a time compounds the overhead required to communicate a single message. Furthermore, 
tunneling creates either larger packets or additional packets that in turn consume additional 
network bandwidth. Tunneling can quickly saturate a network if sufficient bandwidth
is not available. In addition, tunneling is a point-to-point communication mechanism and is 
not designed to handle broadcast traffic. Tunneling also makes it difficult, if not impossible, 
to monitor the content of the traffic in some circumstances, creating issues for security 
practitioners.