Communication & Network Security Flashcards
(130 cards)
1
Q
Decimal
A
10
2
Q
Binary
A
2
3
Q
Hex
A
16
4
Q
Protocol
A
Agreed upon set of rules
Defines the format and order of messages and actions taken upon receipt of the message
5
Q
Encapsulation
A
Layered model (OSI)
6
Q
OSI Layer
A
Please Do No Throw Sausage Pizza Away (Bottom to Top) Application Presentation Session Transport Network Data link Physical
7
Q
Application Layer
A
interacts with applications to determine which network service will be required.
Layer 5-7 - considered Data Layers
8
Q
Presentation Layer
A
data sent from one side of the connection is received Presenting data to application (Characters set/ graphics) in a way that makes sense
Layer 5-7 - considered Data Layers
9
Q
Session Layer
A
establish and maintains connection between systems
Layer 5-7 - considered Data Layers
10
Q
Transport Layer
A
ensure transmission end to end
handles sequencing of packets in transmission
Port/TCP & UDP headers
11
Q
Network Layer
A
interaction network address schemes
How different network segment interact with each
other
IP Address/Routing
12
Q
Data Link Layer
A
connects physical layer to network Ethernet address (MAC)/switches
13
Q
Physical Layer
A
transmission across physical media
Bits 0/1
14
Q
TCP/IP Model
A
Layer 5-7 (Application)
Layer 4 - Host to Host transport
Layer 3 - Internet
Layer 1-2 Network Access
15
Q
TCP/IP Protocol Stack
A
Developed 1970, Darpa, DOD
OSI still referenced when talking about layers
16
Q
IP4 Packets Diagram
A
32 bits across. Every 32 bit is 4 bytes. 5 rows so total of 20 bytes Starts at 0 Bits 0-31 Bytes 0-19
17
Q
IP4 Class Address
A
Classless Inter-Domain Router (CIDR) (/8 notation)
Class A: /8 - 1.0.0.0 to 127.255.255.255
Class B: /16 - 128.0.0.0 to 191.255.255.255
Class C: /24 - 192.0.0.0 to 223.255.255.255
Class D: Multicast
Class E: Reserved
18
Q
IP Broadcast
A
Limited broadcast (no router will block ) 255.255.255.255 Direct broadcast - 192.168.1.255 - Broadcast from 192.1.168.0 network
19
Q
RFC-1918 (think of NAT)
A
Private addresses
- 0.0.0/8
- 16.0.0/16 - 172.31.0.0/16
- 168.0.0/16
20
Q
Network Address Translation (NAT)
A
one to one -
Pool NAT - maps to a set of public addresses
Many to one - multiple mapped to one
NAT limitation 64k
21
Q
gethostbyname
A
have fully qualified domain name (eric.sans.org) and need the address
22
Q
gethostbyaddr
A
when you have address and the need the fully qualified domain name
23
Q
DNS request & response
A
UDP if under 512 bytes
24
Q
DNS Security issues
A
Not reliable
DNS Poisoning Attack
25
DNSSEC
does not provide confidentiality
| digital signature for packet
26
Authenticated Denial of Existence (DNS)
Proving DNS record does not exist
27
IPv6
IPv4 - 32 bit 4.2 billion unique addresses
IPv6 - 128bit 340 undecillion addresses
Faster, no checksum like IPv4
28
IPv6 Features
route aggregation - method used to minimize the number of routing tables required in an IP network.
Support IPv6 tunneling over IPv4
Fixed header bytes - next header
Auto-configuration - don't need to assign IP address
29
User Datagram Protocol (UDP)
```
Layer 4
connection less communication
don't care if the packet gets there
less overhead
Good if small amount of packet loss is acceptable
```
30
UDP Ports
DNS 53
NTP - 123
BootP - 67 & 68
SNMP - 161
31
Transmission Control Protocol
3 way handshake
SYN
SYN-ACK
ACK
32
TCP Header (Key fields)
```
Source Port
Destination Port
Sequence number
Acknowledgement number
SYN bit
ACK bit
```
33
TCP Ports
```
20 - FTP Data (receive)
21 - FTP - (send)
22 - SSH
23 - Telnet
25 - SNMP
53- DNS
79- Finger
80 - http
443 - https
source port >= 1024 (ephemeral)
```
34
TCP Code Bit (Flags)
```
Urg (Urgent)
Ack (Acknowledgement)
PSH (Push) - think of data stream
RST (Reset) - terminate connection
SYN(Synchronize)
FIN(Finish)
```
35
TCP Port Scanning (response types)
SYN/ACK - port is open and unfiltered
RST/ACT - port is closed and unfiltered
No response: Unknown
36
Socket Pair
Source IP Address
Source Port number
Destination IP Address
Destination Port Number
37
Internet Control Message Protocol (ICMP)
```
report error (troubleshoot) rather than transfer info
Ping & Traceroute are ICMP
```
38
TraceRoute
Set TTL to 1 and when router receives it, it will drop it.
Next iteration - TTL decreases for the one below it
Incrementing TTL for each hop
39
Secure Shell (SSH)
Port 22
Supports Authentication, compression, confidentiality, and integrity
Supports wide range of ciphers, 3DES, AES, Blowfish
SSH1 - Man In the middle attack
40
Secure Multipurpose Internet Mail Extension (S/MIME)
Secure MIME
| Email
41
Simple Network Management Protocol (SNMP)
```
Monitoring of network devices
SNMPv1 and SNMPv2 - clear text community string (NO CONFIDENTIALITY)
Public - read
Private - read & write
Should use SNMPv3 - port 161
```
42
Multilayer Protocols
TCP/IP - span multiple layers (OSI)
| DNP3 (Distributed Network Protocol)
43
DNP3 (Distributed Network Protocol)
```
Open protocol smarts Smart Grid
SCADA
IEEE 1815- 2010
allowed pre-share key only
IEEE 1815 - 2012 current standard
Supports PK
```
44
Network Attached Storage (NAS)
Read/Write entire files
45
Storage Area Network (SAN)
block/clusters to files (not entire files like NAS)
46
Internet Small Computer System Interface (ISCSI)
network cables/routed via IP (NAS)
think of SCSI drives that are connected to network
Lun - logical grouping of drives
47
Fibre Channel
Sans Protocol
| Does not use Ethernet/does not easily scale across WAN
48
Fibre Channel (FCoE)
Local subnet only
| TCP/IP is not used - layer 2
49
Fibre Channel over IP (FCIP)
can route (layer 3)
50
Voice of IP (VOIP)
```
Digitized before sending across wire
Combining data
Cost-effective
Redundancy
Security issue (PBX)
Expsoures
```
51
PSTN PBX/VOIP
Common and phased approach
| PBX and VOIP network
52
UP PBX/PSTN
must use VOIP phones
| IP PBX - soft switch route calls
53
VOIP Components
```
Media Gateways
Registration & Location servers
Proxy Servers
Messaging Servers
End-User devices (VOIP Phones)
```
54
VOIP Protocols
Signaling (H.323 SIP) - setup and tear down call, locate users, negotiate protocols
Media (RTP) - transport of package
Supporting (IP, TCP, UDP, etc..)
55
SIP (H.323)
Setup and tear down of calls
56
SIP
Plaintext
TCP/UPD
Looks like HTTP
57
RTP
Transmit voice content between VOIP devices
Over plaintext
Commonly over UDP, can use TCP
58
Virtual Network Computing (VNC)
TCP Port 5900
59
Remote Desktop Sharing (RDP)
TCP Port 3389
60
802.11 Standard
****Fundamental risk - no physical control of network
Supports two physical layers
Infrared
Radio Frequency
61
802.11 Types
802. 11b - 11 Mbps at 2.4 ghz
802. 11a - 54 Mbps at 5 ghz
802. 11g - 54 Mbps at 5 ghz
802. 11n - 300 Mbps using both 2.4 & 5 ghz
802. 11ac - 1.3 Gbps at 5 ghz
62
802.11 Network modes
Managed - client connect to WAP
Master - Wireless Access point
Ad-hoc - peer to peer
Monitor Mode - ready only/sniffing
63
Wire Equivalent Privacy (WEP)
Inability to rotate WEP keys
| Permit recovery of WEP keys in minutes
64
Types of Network
```
PAN - Personal area network (bluetooth)
LAN - Local Area Netwrk
CAN - Campus Area Network
MAN - Metropolitan Area nework
WAN- Wide Area Network
GAN - Global Area Network
```
65
LAN transmission method
unicast - from source to single network destination
multicast - from source to multiple network destination
Broadcast - source to all network address
66
Physical Topology
How systems are connected - bus, ring, star
67
Logical Topology
rules of communication
| Ethernet/ATM
68
Persistent Carrier Sense
No ack from destination, assumes collision and re-sends immediately
69
Non-Persistent Carrier Sense
no ack from destination, assume collision, waits a random amount of time before resending
70
Carrier Sense Multiple Access with Collision Dectection (CSMA/CD)
Ethernet
| Send/transmit simultaneously
71
Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)
Wireless
72
Polling
Only allowed to send when given permission
73
T1
DS1 - 1.544 mbps
74
T3
DS3 - 44.376 mbps
75
E1
Wide Area Digital Transmission- 2.048 mbps (Europe)
76
E3
Wire Are Digital Transmission - 34.368 mbps
77
SDLC
Normal Response Mode - polling speak when given to speak
Asynchronous Response mode (ARM) - cannot transmit without permission from primary *Error recovery
Asynchronous Balance Mode (ABM)- equally responsibility
78
ISDN
reuse analog line infrastructure for data
High cost/Low speed
2 64K channel - 128k
79
Digital Subscriber Line (DSL)
Point to point use existing phone lines
| Symmetrical & Asymmetrical (download faster than upload)
80
Symmetric Digital Subscriber Line (SDSL)
Symmetrical up/download
| 1.544 (T1 equal)
81
High bit rate Digital Subscriber Line (HDSL)
Symmetrical up/download
| 1.544 (T1 equal)
82
Single Pair High Speed Digital Subscriber Line (SHDSL)
standardized version of symmetric DSL
replace SDSL & HDSL
Up to 5.696 Mbit/s
83
Asymmetric Digital Digital Subscriber Line (ADSL)
ADSL 2 - 12 mbps/3.5
| ADSL 2+ - 24 mbps/3.5
84
Very High Speed Digital Subscriber Line (VDSL)
VSDL 3 - 52 mbps/16 mbps
VDSL 4+ - interoperable with ADSL 2+
1600ft max
85
Cable Modem
date rate - number of concurrent uesrs
| 1,000-4,500 ft
86
X.25
built in error correction
| Precursor to frame relay
87
Asynchronous Transfer Mode (ATM)
Fixed cell size 48 bytes
Fixed header size 5 bytes
Total 53 bytes regardless of the size of the information each time.
88
Multiprotocol Label Switching (MPLS)
First router - apply label
| later router - only inspect label
89
Modem
modulate binary data to be sent over analog network
| demodulate analog data to digital binary
90
CSU/DSU
```
converts LAN protocol to transfer over WAN
Circuit Closet (DMARC)
```
91
DTE/DCE
Data Terminal Equipment (DTE) customer end of WAN - your router before ISP
Data Communications Equipment (DCE) ISP Network - ISP Router
92
Repeaters
Layer 1
Signal deteriorate with distance
recreate signal before retransmitting
93
Hubs
Layer 1
Operate as multiport repeater
No Security
94
Bridges
Layer 2
Multiple devices to connect to one bridge port
Learn MAC of each systems
Does not forward traffic unless necessary
95
Switch
Layer 2
Learns MAC address
Provides physical and logical separation
96
VLANS
different VLAN will not see each other broadcast
97
Routers
Routing Tables - routing information that points to all reachable network
98
Firewall Types
Packet Filtering
Stateful - remember state information - matching request allowed in
Proxy -
Next Generation Firewalls (NGFW) - payload
99
Coaxial
50 ohm - digital signaling
75 ohm cable for high speed data & analog signal
Baseband - Single channel
Broadband - multiple channel
100
Fiber Optic Cable
resistance to electromagnetic interference
101
Crossover Cable
+Tx to + Rx
| -Tx to -Rx
102
Category for twisted Pair
```
Cat 1 - telephone
Cat 2 - < 4 mbps
Cat 3 - 10 mbps
Cat 4 - 16 mbps
Cat 5 - 100 mbps
Cat 6 - 1000 mbps
```
103
Analog Signal
continuous signal
104
Digital Signal
pulses signal
105
Asynchronous Communications
Not tied to a clock
Send start bit
Send stop bit
106
Synchronous Communications
Tied to clock
| Don't need to send start & stop bit
107
MAC address
48 bit, 12 hexadecimal
| First 24 bit are organizationally unique identifier
108
Routing Information Protocol (RIP)
Legacy
Based on hop count - shortest
Maximum 15 hops
Routing updates every 30 seconds
109
Distance Vector
identify neighbors and figures out distances metrics to each.
110
Open Shortest Path First
routers knows all the paths
| factoring in # of hops and bandwidth
111
Border Gateway Protocol (BGP)
Used by the Internet
112
Interautonomous system routing
two or more BGP in different systems
113
Intra-autonomous system routing
two or more BGP in same systems
114
Pass-Through autonomous system routing
two or more BGP across autonomous systems without question
| Extranet routing
115
Autonomous System
route to the organization, not network.
| Multiple routes - send to the closest/fastest one
116
Software Defined Network (SDN)
Takes routing decision and gives it to server
| Router just route, no decision to be made
117
VPN Security Issue
Bypass firewall, IDES's, virus scanner, web filter
| Trusting the "other end "
118
IPSEC
IETF - RFC 2401
119
IPSEC Modes
Tunnel - sender to receiver (1 set of system) - don't know the sender or receiver
Transport - sender encrypt, received decrypts
120
TACAS Authentication
Start - continue - reply
| Single Factor Authentication
121
Extensible Authentication Protocol (EAP)
RFC-2284
| AuthN Mechanism
122
EAP-MD5
Client to Server
Weakest
Only one way authentication
123
EAP-TLS
PKI (Client cert) on both server and client
| Secure TSL tunnel for authN
124
EAP-TTLS
Can pre-shared key or password
125
PEAP
Cisco, Microsoft, RSA
Similar to EAP-TTLS
Not requiring 3rd party cert
126
802.1X
No IP until you authenticate
127
Supplicant
Software to authenticate 802.1x via Layer 2
128
Authenticator
WAP - open/close port based on authentication
129
Authentication Server
Diameter or Radius to user DB
130
NAC
Health Check
Patches/AntiVirus up to date
Client pass - access is granted
Client failed - place in isolated vlan
