Final Study Guide Flashcards

Question

What are the four defining features of an SDN architecture?

Answer 1

Flow‑based forwarding Separation of data plane and control plane Network control functions A programmable network

Answer 2

Communication layer Network‑wide state‑management layer Interface to the network‑control application layer

Answer 3

communicating between the controller and the network elements

Answer 4

stores information of network‑state

Answer 5

communicating between controller and applications

Answer 6

Network‑control applications

Answer 7

Controlled devices

Answer 8

Southbound interface Northbound interface Model Driven Service Abstraction Layer (or MD‑SAL)

Answer 9

Data Plane

Answer 10

Handling the ever growing complexity and dynamic nature of networks Tightly coupled architecture

Answer 11

Software Defined Networking

Answer 12

Data plane Control plane Management plane

Answer 13

These are functions and processes that forward data in the form of packets or frames.

Answer 14

These refer to functions and processes that determine which path to use by using protocols to populate forwarding tables of data plane elements

Answer 15

These are services that are used to monitor and configure the control functionality, e.g. SNMP‑based tools.

Answer 16

Shared abstractions Consistency of same network information Locality of functionality placement Simpler integration

Answer 17

(a) a plane‑oriented view (b) the SDN layers (c) a system design perspective

Answer 18

Infrastructure Southbound Interfaces Network Visualization Network Operating Systems Northbound Interfaces Language-Based Virtualization Network Programming Languages Network Applications

Answer 19

routers, switches and other middlebox hardware

Answer 20

These are interfaces that act as connecting bridges between connecting and forwarding elements

Answer 21

Interfacing with the physical network components via software

Answer 22

Ease network management and solve networking problems by using a logically centralized controller by way of a network operating system

Answer 23

There is no normalized standard

Answer 24

a) a matching rule b) actions to be executed on matching packets c) counters that keep statistics of matching packets.

Answer 25

In an OpenFlow device, when a packet arrives, the lookup process starts in the first table and ends either with a match in one of the tables of the pipeline or with a miss (when no rule is found for that packet).

Answer 26

1. Forward the packet to outgoing port 2. Encapsulate the packet and forward it to controller 3. Drop the packet 4. Send the packet to normal processing pipeline 5. Send the packet to next flow table

Answer 27

The Southbound interfaces or APIs are the separating medium between the control plane and data plane functionality.

Answer 28

1. Event‑based messages that are sent by forwarding devices to controller when there is a link or port change 2. Flow statistics are generated by forwarding devices and collected by controller 3. Packet messages are sent by forwarding devices to controller when they do not know what to do with a new incoming flow

Answer 29

topology, statistics, notifications, device management, along with shortest path forwarding and security mechanisms

Answer 30

In this architecture, we typically see a single entity that manages all forwarding devices in the network, which is a single point of failure and may have scaling issues.

Answer 31

A distributed network operating system (controller) can be scaled to meet the requirements of potentially any environment ‑ small or large networks

Answer 32

It can be a centralized cluster of nodes or physically distributed set of elements

Answer 33

Scales more easily, no single point of failure

Answer 34

Open Networking Operating System

Answer 35

There are several ONOS instances running in a cluster. The management and sharing of the network state across these instances is achieved by maintaining a global network view. To make forwarding and policy decisions, the applications consume information from the view and then update these decisions back to the view.

Answer 36

To achieve fault tolerance, ONOS redistributes the work of a failed instance to other remaining instances.

Answer 37

P4 (Programming Protocol‑independent Packet Processors)

Answer 38

A high‑level programming language to configure switches which works in conjunction with SDN control protocols.

Answer 39

Reconfigurability Protocol independence Target independence

Answer 40

Configure Populate

Answer 41

These sets of operations are used to program the parser. They specify the header fields to be processed in each match+action stage and also define the order of these stages.

Answer 42

The entries in the match+action tables specified during configuration may be altered using the populate operations. It allows addition and deletion of the entries in the tables

Answer 43

Traffic Engineering - ElasticTree Mobility and Wireless - OpenRadio, The Odin Network Measurement and Monitoring - OpenSketch, OpenSample and PayLess Security and Dependability - CloudWatcher Data Center Networking - LIME, FlowDiff

Answer 44

SDN can perform multiple actions on the traffic by matching over various header fields, not only by matching on the destination prefix.

Answer 45

To implement the following: Application specific peering Traffic engineering Traffic load balancing Traffic redirection through middleboxes

Answer 46

In the SDX architecture, each AS the illusion of its own virtual SDN switch that connects its border router to every other participant AS. For example, AS A has a virtual switch connecting to the virtual switches of ASes B and C. Each AS can have its own SDN applications for dropping, modifying, or forwarding their traffic

Answer 47

Application specific peering Inbound traffic engineering Wide‑area server load balancing Redirection through middle boxes

Answer 48

Data Plane

Answer 49

Both Conventional and SDN

Answer 50

Routing Security Enforcement Quality of Service Enforcement

Answer 51

Confidentiality, Integrity, Authentication, Availability

Answer 52

Responds to a DNS request with a list of DNS A Records, which it cycles through in a RR manner. DNS client can then pick one from this list using its own metric If request again, a different order

Answer 53

To distributed large loads of incoming traffic to several different servers; used by big companies

Answer 54

CDN computes the ‘nearest edge server’ and returns its IP address to the DNS client. Basically chooses nearest one in order to deliver content quickly

Answer 55

Short TTL, and after it expires, it returns a different set of records rather than the same list of records cycled through

Answer 56

Botnet command and control providers Drive‑by‑download hosting providers Phish housing providers

Answer 57

Training phase - The system learns control‑plane behavior typical of both types of ASes Operational phase ‑ Given an unknown AS, it then calculates the features for this AS. It uses the model to then assign a reputation score to the AS.

Answer 58

Rewiring activity IP Space Fragmentation and Churn BGP Routing Dynamics

Answer 59

Mismanagement symptoms Malicious Activities Security Incident Reports

Answer 60

Open Recursive Resolvers – misconfigured open DNS resolvers DNS Source Port Randomization – many servers still do not implement this BGP Misconfiguration – short‑lived routes can cause unnecessary updates to the global routing table Untrusted HTTPS Certificates – can detect the validity of a certificate by TLS handshake Open SMTP Mail Relays – servers should filter messages so that only those in the same domain can send mails/messages.

Answer 61

Capturing spam activity Capturing phishing and malware activities Capturing scanning activity

Answer 62

VERIS Community Database Hackmageddon The Web Hacking Incidents Database

Answer 63

In this class of hijacking attacks, we are primarily concerned with the IP prefixes that are advertised by BGP. Exact prefix hijacking, sub-prefix, squatting

Answer 64

When two different ASes (one is genuine and the other one is counterfeit) announce a path for the same prefix. This disrupts routing in such a way that traffic is routed towards the hijacker wherever the AS‑path route is shortest, thereby disrupting traffic.

Answer 65

This is an extension of exact prefix hijacking, except that in this case, the hijacking AS works with a sub‑prefix of the genuine prefix of the real AS. This exploits the characteristic of BGP to favor more specific prefixes, and as a result route large/entire amount of traffic to the hijacking AS

Answer 66

In this type of attack, the hijacking AS announces a prefix that has not yet been announced by the owner AS.

Answer 67

In this class of attacks, an illegitimate AS announces the AS‑path for a prefix for which it doesn’t have ownership rights. Type-0, Type-N, Type-U

Answer 68

This is simply an AS announcing a prefix not owned by itself

Answer 69

This is an attack where the counterfeit AS announces an illegitimate path for a prefix that it does not own to create a fake link (path) between different ASes.

Answer 70

In this attack the hijacking AS does not modify the AS‑PATH but may change the prefix.

Answer 71

In this class of attacks, the intention of the attacker is to hijack the network traffic and manipulate the redirected network traffic on its way to the receiving AS.

Answer 72

When traffic is dropped by a hijacker.

Answer 73

When traffic is eavesdropped or manipulated before it reaches the receiving AS

Answer 74

When traffic is impersonated, e.g. In this case the network traffic of the victim AS is impersonated and the response to this network traffic is sent back to the sender.

Answer 75

Human error - mistake Targeted Attack - stealthy High Impact Attack - obvious

Answer 76

1. The attacker uses a router to announce the prefix 10.10.0.0/16 that belongs to AS1, with a new origin AS4, pretending that the prefix belongs to AS4. 2. This new announcement causes a conflict of origin for the ASes that receive it (Multiple Origin AS or MOAS). 3. As a result of the new announcement, AS2, AS3 and AS5 receive the false advertisement and they compare it with the previous entries in their RIB. 4. AS2 will not select the route as the best route as it has the same path length with an existing entry. 5. AS3 and AS5 will believe the new advertisement, and they will update their entries (10.10.0.0/16 with path 4,2,1) to (10.10.0.0/16 with path 4). Therefore AS5 and AS3 will send all traffic for prefix 10.10.0.0/16 to AS4 instead of AS1.

Answer 77

1. AS1 advertises the prefix 10.10.0.0/16. 2. AS2 and AS3 receive and propagate legitimately the path for the prefix. 3. At AS4, the attacker compromises the update for the path by changing it to 4,1 and propagates it to the neighbors AS3, AS2, and AS5. Therefore it claims that it has direct link to AS1 so that others believe the new false path. 4. AS5 receives the false path (4,1) “believes” the new false path and it adopts it. But the rest of the ASes don’t adopt the new path because they either have an shorter path already or an equally long path to AS1 for the same prefix. The key observation here is that the attacker does not need not to announce a new prefix, but rather it manipulates an advertisement before propagating it.

Answer 78

A configuration file: where all the prefixes owned by the network are listed here for reference A mechanism for receiving BGP updates: this allows receiving updates from local routers and monitoring services

Answer 79

Prefix deaggregation and Mitigation with Multiple Origin AS (MOAS)

Answer 80

Outsource the task of BGP announcement to third parties Filtering is less optimal than outsourcing

Answer 81

A Distributed Denial of Service (DDoS) attack is an attempt to compromise a server or network resources with a flood of traffic. To achieve this, the attacker first compromises and deploys flooding servers (slaves). Later, when initiating an attack, the attacker instructs these flooding servers to send a high volume of traffic to the victim. This results in the victim host either becoming unreachable or in exhaustion of its bandwidth.

Answer 82

IP spoofing is the act of setting a false IP address in the source field of a packet with the purpose of impersonating a legitimate server

Answer 83

A reflection/amplification attack is a combination of the two attacks that allows the attacker to generate an enormous amount of traffic and at the same time keep its identity hidden by spoofing the victim's IP address.

Answer 84

Traffic Scrubbing Services ACL Filters BGP Flowspec

Answer 85

With this mechanism, all the attack traffic to a targeted DoS destination is dropped to a null location. The premise of this approach is that the traffic is stopped closer to the source of the attack and before it reaches the targeted victim

Answer 86

The victim AS uses BGP to communicate the attacked destination prefix to its upstream AS, which then drops the attack traffic towards this prefix. Then either the provider (or the IXP) will advertise a more specific prefix and modifying the next‑hop address that will divert the attack traffic to a null interface. The blackhole messages are tagged with a specific BGP blackhole community attribute, usually publicly available, to differentiate it from the regular routing updates.

Answer 87

They provide the blackholing community to be used

Answer 88

It sends the blackholing messages to the IXP route server when a member connects to the route server. The route server then announces the message to all the connected IXP member ASes, which then drops the traffic towards the blackholed prefix

Answer 89

DNS censorship is a large scale network traffic filtering strategy opted by a network to enforce control and censorship over Internet infrastructure to suppress material which they deem as objectionable.

Answer 90

Locality of GFW nodes (likely on the edge) Centralized management Load balancing

Answer 91

1. DNS probe is sent to the open DNS resolvers 2. The probe is checked against the blocklist of domains and keywords 3. For domain level blocking, a fake DNS A record response is sent back. There are two levels of blocking domains: the first one is by directly blocking the domain, and the second one is by blocking it based on keywords present in the domain

Answer 92

Certain DNS requests are captured, and a fake DNS response is sent instead of what was actually requested

Answer 93

Packet Dropping, DNS Poisoning, Content Inspection, Blocking with Resets, Immediate Reset of Connections

Answer 94

All network traffic going to a set of specific IP addresses is discarded

Answer 95

When a DNS receives a query for resolving hostname to IP address‑ if there is no answer returned or an incorrect answer is sent to redirect or mislead the user request, this scenario is called DNS Poisoning. Like packet dropping, but for host names instead of IP addresses

Answer 96

It allows for all network traffic to pass through a proxy where the traffic is examined for content, and the proxy rejects requests that serve objectionable content.

Answer 97

It sends a TCP reset (RST) to block individual connections that contain requests with objectionable content

Answer 98

Censorship systems like GFW have blocking rules in addition to inspecting content, to suspend traffic coming from a source immediately, for a short period of time.

Answer 99

Packet Dropping

Answer 100

Strengths: Easy to implement Low cost Weaknesses: Maintenance of blocklist Overblocking

Answer 101

When two sites share an IP address, blocking one risks blocking both, etc

Answer 102

Stengths: No overblocking Weaknesses: Still hard to maintain probably

Answer 103

Strengths: Precise censorship Flexible Weaknesses: Not scalable

Answer 104

Doesn't say???

Answer 105

Also doesn't say???

Answer 106

Difficult to determine where an ISP's rules are affecting, and which countries are affected by which ISPs Huge amount of internet usage, need more volunteers Hard to differentiate natural fluctuations in DNS behavior from malicious behavior Ethical issues in obtaining this data

Answer 107

Typically rely on volunteer data, makes getting continuous and diverse data difficult

Answer 108

IP‑based disruptions as opposed to DNS‑based manipulations

Answer 109

Iris uses open DNS resolvers located all over the globe

Answer 110

1. Performing global DNS queries – Iris queries thousands of domains across thousands of open DNS resolvers. To establish a baseline for comparison, the creators included 3 DNS domains which were under their control to help calculate metrics used for evaluation DNS manipulation. 2. Annotating DNS responses with auxiliary information – To enable the classification, Iris annotates the IP addresses with additional information such as their geo‑location, AS, port 80 HTTP responses, etc. This information is available from the Censys dataset. 3. Additional PTR and TLS scanning – One IP address could host several websites via virtual hosting. So, when Censes retrieves certificates from port 443, it could differ from one retrieved via TLS’s Server Name Indication (SNI) extension. This results in discrepancies that could cause IRIS to label virtual hosting as DNS inconsistencies. To avoid this, Iris adds PTR and SNI certificates

Answer 111

1. Scanning the Internet’s IPv4 space for open DNS resolvers 2. Identifying Infrastructure DNS Resolvers

Answer 112

Consistency Metrics - Network properties and infrastructure/content are similar when accessed from differing locations Independent Verifiability Metrics - Externally verified metrics, such as HTTPS Certificate

Answer 113

If neither the Consistency Metric or Independent Verifiability Metric is found to valid

Answer 114

Perform Global DNS Queries Annotate the responses with auxiliary information Additional PTR and TLS scanning Clean the Data Set Evaluate with Consistency Metrics and Independent Verifiability Metrics

Answer 115

Disrupts the critical routers which send information on which parts of the network are reachable, causing the pathways to no longer be valid

Answer 116

Blocks packets matching a certain criteria, preventing that information from disseminating through the network

Answer 117

Packet Filtering

Answer 118

1. The measurement machine probes the IP ID of the reflector by sending a TCP SYN‑ACK packet. It receives a RST response packet with IP ID set to 6 (IPID (t1)). 2. Now, the measurement machine performs perturbation by sending a spoofed TCP SYN to the site. 3. The site sends a TCP SYN‑ACK packet to the reflector and receives a RST packet as a response. The IP ID of the reflector is now incremented to 7. 4. The measurement machine again probes the IP ID of the reflector and receives a response with the IP ID value set to 8 (IPID (t4)).

Answer 119

The scenario where filtering occurs on the path from the site to the reflector is termed as inbound blocking. In this case, the SYN‑ACK packet sent from the site in step 3 does not reach the reflector. Hence, there is no response generated and the IP ID of the reflector does not increase. The returned IP ID in step 4 will be 7 (IPID(t4)) as shown in the figure. Since the measurement machine observes the increment in IP ID value as 1, it detects filtering on the path from the site to the reflector.

Answer 120

The return IPID from the reflector to the Measurement Machine will increase by 1.

Answer 121

Least: Music Mid: FaceBook Most: Video

Answer 122

Streamed - Can start without waiting for download to finish Interactive - Pause, play, etc Typically stored on a CDN

Answer 123

Delay sensitive, but not as much as conversational Typically many simultaneous users Delay is okay

Answer 124

Realtime, highly delay sensitive Loss-tolerant

Answer 125

Voice over IP

Answer 126

Audio is encoded by taking many (as in, thousands) of samples per second, and then rounding each sample’s value to a discrete number within a particular range

Answer 127

Rounding to a discrete value

Answer 128

Narrowband, broadband, and multimode (which can operate on either)

Answer 129

1) User location ‑ the caller locating where the callee is. 2) Session establishment ‑ handling the callee accepting, rejecting, or redirecting a call. 3) Session negotiation ‑ the endpoints synchronizing with each other on a set of properties for the session. 4) Call participation management ‑ handling endpoints joining or leaving an existing session.

Answer 130

end‑to‑end delay jitter packet loss

Answer 131

the time it takes to encode the audio the time it takes to put it in packets, all the normal sources of network delay that network traffic encounters such as queueing delays, "playback delay," which comes from the receiver’s playback buffer, decoding delay, which is the time it takes to reconstruct the signal.

Answer 132

When one packet is delayed 300ms, another 100ms, another 250ms, another 50ms, etc

Answer 133

the “jitter buffer” or the “play‑out buffer” Basically buffer packets and play them at a steady rate Increases end to end delay or dropped packets, depending on how you optimized

Answer 134

FEC (Forward Error Correction), interleaving, and error concealment

Answer 135

FEC works by transmitting redundant data alongside the main transmission, which allows the receiver to replace lost data with the redundant data. May be more of the same, may be lower quality.

Answer 136

The more redundant data transmitted, the more bandwidth is consumed. Also, some of these FEC techniques require the receiving end to receive more chunks before playing out the audio, and that increases playout delay

Answer 137

Interleaving works by mixing chunks of audio together so that if one set of chunks is lost, the lost chunks aren’t consecutive. The idea is that many smaller audio gaps are preferable to one large audio gap.

Answer 138

The tradeoff for interleaving is that the receiving side has to wait longer to receive consecutive chunks of audio, and that increases latency. Unfortunately, that means this technique is limited in usefulness for VoIP, although it can have good performance for streaming stored audio

Answer 139

Basically “guessing” what the lost audio packet might be. Similar to audio compression.

Answer 140

One, the bandwidth for both the core network and last‑mile access links have increased tremendously over the years. Two, the video compression technologies have become more efficient. This enables to stream high‑quality video without using a lot of bandwidth. Finally, the development of Digital Rights Management culture has encouraged content providers to put their content on the Internet.

Answer 141

1: Video content is created at a high quality 2: It is compressed with an algorithm 3: It is secured with DRM and hosted on a server 4: Content providers duplicate it using CDNs 5: The end users download, decode, and render

Answer 142

Spatial redundancy or temporal redundancy - the former compression in the context of a single image, the latter compression in the context of different frames

Answer 143

Step 1: Transform it into color components (Cb, Cr) and brightness component (y) matrices Step 2: For each matrix, subdivide and apply the Discrete Cosine Transformation Step 3: Compress the matrix of the coefficients using a pre‑defined Quantization table Step 4: Perform a lossless encoding based on the subdivision results

Answer 144

Encode the first image (i-frame), then encode the difference between that and the next frame (p-frame), or the next *and* previous frame (b-frame)

Answer 145

Because there may be a cut to a new scene, and therefore the transposition between the two frames would not make sense

Answer 146

CBR - output size of video is fixed over time VBR - It varies based on scene quality. Image quality is better, more expensive

Answer 147

TCP, as it has an implicit reliability promise

Answer 148

Original vision was have everything be server-side with a unique protocol, ie you hit pause, the server stops transmission Http was chosen because this would have required specialized hardware, cheaper to use Http

Answer 149

As the client watches video, it has a playout buffer, which depletes. When it reaches a threshold, ie 10 seconds left, it requests more video, further filling the buffer. This prevents unnecessary downloads while keeping things seemless

Answer 150

Videos are usually stored in short segments at different bitrates, and an appropriate bit rate is sent depending on network capacity, and can switch if that capacity changes

Answer 151

A video in DASH is divided into chunks and each chunk is encoded into multiple bitrates. Each time the video player needs to download a video chunk, it calls the bitrate adaptation function, say f. The function f that takes in some input and outputs the bitrate of the chunk to be downloaded

Answer 152

Low or zero re‑buffering High video quality Low video quality variations Low startup latency

Answer 153

Network Throughput Video Buffer

Answer 154

In order to have a stall‑free streaming, clearly the buffer‑filling rate should be greater than the buffer‑depletion rate C(t)/R(t)> 1 or C(t)> R(t).

Answer 155

Estimation Quantization

Answer 156

While the buffer is full, if the quality drops, that is not necessarily reflected immediately and a higher quality (and higher delay) bitrate is requested until it catches up and buffers

Answer 157

File Transfer

Answer 158

File Transfer

Answer 159

Low or zero re-buffering High video quality Low video quality variations Low start up latency

Answer 160

1: Users are worldwide; what if somebody far away wants it? 2: What if the same thing is requested again and again? Can be wasteful 3: What if the single server has an outage?

Answer 161

Content Distribution Network - Network of geographically distributed servers with copies of content

Answer 162

Peering point congestion Inefficient routing protocols Unreliable networks Inefficient communication protocols Scalability Application limitations and slow rate of change adoption

Answer 163

Shift to a focus on large scale content delivery Topological Flattening of providers thanks to IXPs and ASes in addition to ISPs

Answer 164

Enter Deep - Create many, many CDNs in order to minimize geographic distances from recipients to content Bring Home - Fewer but larger clusters in IXPs, easier to manage but larger delays

Answer 165

When a user makes a request, the users' local DNS queries the CDN, which returns an appropriate IP address for a content server with the content to the LCDN.

Answer 166

The first step consists of mapping the client to a cluster. In the next step, a server is selected from the cluster.

Answer 167

Pick the geographically closest one. If you're using a remote LDNS, it can pick the wrong one. There can also be routing inefficiencies.

Answer 168

Network-level, ie delay or available bandwidth Application-level, ie re-buffering ratio and avg bitrate

Answer 169

Actively: ie the LDNS will ping the clusters and see how quickly they respond Passively: Keep track of how operations from the same IP address have performed prior

Answer 170

A coarse‑grained global layer operates at larger time scales (timescale of a few tens of seconds (orminutes)). This layer has a global view of client qualitymeasurements. It builds a data‑driven prediction model of video quality. A fine‑grained per‑client decision layer that operates at the millisecond timescale. It makes actual decisions upon a client request. This is based on the latest (but possibly stale) pre‑computed global model and up‑to‑date per‑client state.

Answer 171

It needs to have data for different subnet‑cluster pairs. Thus, some of the clients deliberately need to be routed to sub‑optimal clusters.

Answer 172

Assign one randomly - could end up picking one with a higher workload Use least-loaded server - not all servers have all the content at all time, so you could get one which currently doesn't have it, leading to a longer wait while it is copied over

Answer 173

The main idea behind consistent hashing is that servers and the content objects are mapped to the same ID space. For instance, imagine we map the servers to the edge of a circle (say uniformly). Server 1, Item 4, Item 8, Server 12, Item 13. Server 12 is responsible for Items 4 and 8, but not 13. If a Server leaves, the next Server takes over its responsibilities.

Answer 174

They are consisting of variable characters and thus it’s difficult for routers to process them.

Answer 175

1. The user host runs the client side of the DNS application 2. The browser extracts the hostname www.someschool.edu (Links to an external site.) and passes it to client side of the DNS application. 3. DNS Client sends a query containing the hostname of DNS 4. DNS Client eventually receives a reply which included IP address for the hostname 5. As soon as the host receives the IP addresses, it can initiate a TCP connection to the HTTP server located at that port at that IP

Answer 176

Mail server/Host aliasing Load distribution

Answer 177

Distributed Hierarchical Database: Each node can have multiple children

Answer 178

Would be too much traffic otherwise, would have a single point of failure otherwise, allows for many transactions with many clients to happen concurrently

Answer 179

Root DNS servers Top level domain (TLD) Servers Authoritative servers Local DNS servers

Answer 180

In the iterative query process, the querying host is referred to a different DNS server in the chain, until it can fully resolve the request. Whereas in the recursive query process, the querying host and each DNS server in the chain queries the next server and delegates the query to it.

Answer 181

The idea of DNS Caching is that, in both iterative and recursive queries, after a server receives the DNS reply of mapping from any host to IP address, it stores this information in the Cache memory before sending it to the client

Answer 182

The DNS servers store the mappings between hostnames and IP addresses as resource records (RRs). These resource records are contained inside the DNS reply messages. A DNS resource record has four fields: (name, value, Type, TTL). The TTL specifies the time (in sec) a record should remain in the cache. The name and the value depend on the type of the resource record.

Answer 183

A, NS, CNAME, MX TYPE=A: the name is a domain name and value is the IP address of the hostname. (abc.com, 190.191.192.193, A) TYPE=NS: the name is the domain name, and the value is the appropriate authoritative DNS server that can obtain the IP addresses for hosts in that domain. (abc.com, dns.abc.com, NS) TYPE=CNAME: the name is the alias hostname, and the value is the canonical name, (abc.com, relay1.dnsserver.abc.com, CNAME) TYPE=MX: the name is the alias hostname of a mail server, and the Value is the canonical name of the email server. (abc.com, mail.dnsserver.abc.com, MX)

Answer 184

ID, Flags, Question, Answer, Authority, Additional The first field is an ID that is an identifier for the query and it allows the client to match queries with responses. The flags section have multiple fields. For example, a field allows to specify if the DNS message is a query or response. Another field specifies if a query is recursive or not. The question section contains information about the query that is being made for example the host-name that is being queried, the type of the query (A, MX, etc). In the answer section, and if the message is a reply, we will have the resource records for the hostname that was originally queried. In the authority section, we have resource records for more authoritative servers. The additional section contains other helpful records. For example, if the original query was for an MX record, then the answer section will contain the resource record for the canonical hostname of the mail server, and the additional section will contain the IP address for the canonical hostname

Answer 185

The main goal of IP anycast is to route a client to the “closest” server, as determined by BGP (Border Gateway Protocol), a routing protocol used for inter‑AS-routing.

Answer 186

Essentially, when a client sends a GET request to a server, say A, it can redirect the client to another server, say B, by sending an HTTP response with a code 3xx and the name of the new server.

Answer 187

Single point of failure. Bandwidth waste in high demand for the same content. Scalability issues. Potentially big geographic distance between Internet hosts/users and the server.

Answer 188

The local DNS server will immediately answer the host with the IP address.

Answer 189

Forwarding based on more than just longest prefix matching

Answer 190

Switch receives a packet Switch determines highest priority matching rule Perform action associated with highest rule Increment internal counter

Answer 191

A remote controller computes and distributes forwarding tables that are used by each router

Answer 192

Network Applications Programming Languages Language-Based Virtualization

Answer 193

Northbound Interface Network Operating System Network Hypervisor

Answer 194

Southbound Interface Network Infrastructure

Answer 195

Act as connectors between control and data plane

Answer 196

Provides abstractions, acts as a centralized controller for the SDN

Answer 197

This is still being determined/custom software

Answer 198

Pyretic, Frenetic, Merlin, Nettle, Procera, FML, etc

Answer 199

Control plane logic

Answer 200

Each instance has a "master". If an instance fails, an "election" is held for each child to find a new master.

Answer 201

Optimizing the traffic flow so as to minimize power consumption

Answer 202

ElasticTree

Answer 203

Connecting to mobile networks, ie WLans

Answer 204

OpenRadio, Odin Network

Answer 205

Keep better metrics to respond to change in network conditions

Answer 206

OpenSketch, OpenSample and PayLess

Answer 207

Make the network more secure

Answer 208

CloudWatcher

Answer 209

Identifying issues and troubleshooting, real‑time monitoring of networks, etc

Answer 210

LIME, FlowDiff

Answer 211

To maintain an illusion of sorts of an independent SDN, while still benefitting from an IXP

Answer 212

Message/content has not been modified

Answer 213

To keep malicious actions undetectable for longer

Answer 214

Finding Rogue Networks

Answer 215

Control Plane, Identify Malicious Networks

Answer 216

Frequent changes in provider, using lesser known providers, etc

Answer 217

Malicious ASes use very small BGP prefixes

Answer 218

Monitoring whether the announcements (updates/withdrawals) follow normal patterns

Answer 219

When something is manipulated before it reaches its destination AS

Answer 220

High Impact Attacks are meant to be noticed, Targeted Attacks are meant to be discrete

Answer 221

To safeguard a network's own prefixes against malicious BGP hijacking attempts

Answer 222

When you announce a more specific prefix than a targeted prefix, redirecting traffic to the new one you just announced.

Answer 223

Have third party networks/providers do BGP announcements for a targeted network

Answer 224

Distributed Denial-of-Service (DDoS) attack

Answer 225

Incoming traffic is diverted to a "scrubber", where "clean" and "unclean" traffic are separated. Clean traffic is sent to the destination.

Answer 226

Blocklists provided by ISPs/IXPs to prevent unwanted traffic

Answer 227

Sets up rules for how ASes/BGP lets traffic in, which can mitigate DDoS attacks.

Answer 228

It drops the traffic nearer to the sender, saving "energy" for the targeted site

Answer 229

All traffic, including valid traffic, is dropped

Answer 230

Setting up calls, managing them, tearing them down

Answer 231

It receives a manifest file over HTTP with all of the metadata

Answer 232

Little business/financial incentive to prioritize the "middle" between end users and hosts where peers connect

Answer 233

BGP was not designed for modern infrastructures

Answer 234

Outages, DDoS attacks, anything that prevents access

Answer 235

TCP was not designed for modern internet, distance is a bottleneck, it's hard to update TCP protocols

Answer 236

Accounting for situations where usage shoots up, ie viral video

Answer 237

It's hard to update protocols and processes since so many services/applications can only use the old one

Answer 238

More local traffic

Answer 239

DNS, HTTP Redirection, IP Anycast

Answer 240

Distribute traffic across different servers

Answer 241

One recursive, then however many iterative it takes

Answer 242

Dropped (blackholing) Man-in-the-middle Impersonation