Networking Flashcards
Name the five different classes of IP addresses.
The five different classes of IP addresses are as follows:
Class A: Class A addresses have the first octet (the first 8 bits) reserved for the network portion of the address, and the remaining three octets for the host portion. The range of Class A addresses is from 1.0.0.0 to 126.0.0.0, with a subnet mask of 255.0.0.0.
Class B: Class B addresses allocate the first two octets for the network portion and the remaining two octets for the host portion. The range of Class B addresses is from 128.0.0.0 to 191.255.0.0, with a subnet mask of 255.255.0.0.
Class C: Class C addresses reserve the first three octets for the network portion and only the last octet for the host portion. The range of Class C addresses is from 192.0.0.0 to 223.255.255.0, with a subnet mask of 255.255.255.0.
Class D: Class D addresses are used for multicast groups, where data is sent to multiple hosts simultaneously. The range of Class D addresses is from 224.0.0.0 to 239.255.255.255.
Class E: Class E addresses are reserved for experimental or research purposes and are not commonly used in regular networks. The range of Class E addresses is from 240.0.0.0 to 255.255.255.255.
Please note that the concept of IP address classes is somewhat outdated, and IP addressing has transitioned to classless addressing or CIDR (Classless Inter-Domain Routing), which allows for more flexible allocation of IP addresses.
What is a mac address? What kind of information can you extract from a mac address?
A MAC address (Media Access Control address) is a unique identifier assigned to a network interface controller (NIC) of a network device. It is a hardware address that is assigned by the manufacturer and is used at the data link layer of the OSI model to uniquely identify devices on a network.
A MAC address is a 48-bit address, usually represented as six sets of two hexadecimal digits separated by colons or hyphens. For example, “00:1A:2B:3C:4D:5E”.
Here’s the information you can extract from a MAC address:
- Manufacturer or Vendor: The first three octets (24 bits) of a MAC address are known as the OUI (Organizationally Unique Identifier) and can be used to identify the manufacturer or vendor of the network device. Organizations are assigned specific ranges of MAC addresses, and by looking up the OUI in a MAC address database, you can determine the manufacturer.
- Device Type: Some MAC address databases provide information about the type of device associated with a particular MAC address range. This can give you an idea of whether the device is a computer, router, smartphone, or other network device.
- Uniqueness: MAC addresses are intended to be globally unique. While there is a finite number of possible MAC addresses, the intention is for each device to have a unique MAC address to prevent conflicts on a network.
It’s important to note that MAC addresses are typically used within a local network and are not routable over the internet. They serve the purpose of identifying devices on the same network segment, while IP addresses are used for routing traffic between different networks.
What is an IP address?
An IP address (Internet Protocol address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. It serves as a unique identifier for devices, allowing them to send and receive data over the internet or a local network.
IP addresses are binary numbers, but they are commonly expressed in human-readable form using the IPv4 or IPv6 addressing formats.
IPv4 addresses are 32-bit numbers represented as four sets of decimal numbers separated by periods. For example, “192.168.0.1”. IPv4 addresses are gradually being phased out due to the limited number of available addresses.
IPv6 addresses are 128-bit numbers represented in hexadecimal format and separated by colons. For example, “2001:0db8:85a3:0000:0000:8a2e:0370:7334”. IPv6 addresses were introduced to address the exhaustion of IPv4 addresses and provide a significantly larger address space.
IP addresses serve two main purposes:
Network Identification: An IP address is used to identify a specific device or node on a network. It consists of a network portion and a host portion. The network portion identifies the network to which the device belongs, while the host portion identifies the specific device within that network.
Routing: IP addresses are crucial for routing data across networks. Routers use IP addresses to determine the best path for forwarding data packets from the source device to the destination device across different networks.
IP addresses can be assigned dynamically through DHCP (Dynamic Host Configuration Protocol) or assigned statically (manually) by network administrators. They are essential for establishing communication between devices on the internet and local networks, enabling the transmission of data packets between sender and receiver.
State 2 main differences between TCP and UDP?
TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are two different transport layer protocols used in computer networks. Here are two main differences between TCP and UDP:
Connection-Oriented vs. Connectionless: TCP is a connection-oriented protocol, which means it establishes a reliable and ordered connection between the sender and receiver before transferring data. It guarantees that data packets arrive in the correct order and without errors. UDP, on the other hand, is connectionless. It does not establish a dedicated connection before transmitting data. Each UDP packet is treated independently, and there is no guarantee of delivery, ordering, or error-checking. UDP is often used for real-time applications where speed and minimal latency are more important than reliability, such as streaming media or online gaming.
Reliability vs. Speed: TCP provides reliable data delivery by implementing mechanisms such as acknowledgment, retransmission, and flow control. It ensures that data is transmitted accurately and guarantees delivery. In case of lost or corrupted packets, TCP will retransmit them until they are received successfully. UDP, on the other hand, prioritizes speed and low overhead over reliability. It does not perform error-checking or retransmissions, which makes it faster and more lightweight than TCP. However, this speed comes at the cost of potentially losing data packets, as UDP does not guarantee delivery or error recovery.
In summary, TCP is a reliable, connection-oriented protocol suitable for applications that require guaranteed data delivery and ordered transmission. UDP is a faster, connectionless protocol used in scenarios where real-time data transfer, minimal latency, and reduced overhead are more important than reliability. The choice between TCP and UDP depends on the specific requirements of the application or service being used.
Describe the OSI model flow that takes place when a user access URL in a browser.
Certainly! Let’s dive into more specific details and describe the OSI model flow when a user accesses a URL in a browser, along with the protocols involved at each layer:
- Application Layer:
- The user enters a URL in the browser, which triggers an HTTP request (Hypertext Transfer Protocol).
- Other application layer protocols that may come into play include HTTPS (HTTP Secure) for encrypted communication or FTP (File Transfer Protocol) for file downloads.
- Presentation Layer:
- The presentation layer handles data formatting and encryption.
- It can compress the HTTP request using protocols like gzip or deflate.
- Encryption protocols like SSL/TLS (Secure Sockets Layer/Transport Layer Security) are utilized for HTTPS communication.
- Session Layer:
- The session layer establishes and manages the session between the browser and the web server.
- It sets up parameters for communication, such as session tokens or cookies that maintain the user’s state.
- Common protocols include session management mechanisms provided by HTTP, such as cookies or session tokens.
- Transport Layer:
- The transport layer segments the HTTP request into smaller units called segments.
- TCP (Transmission Control Protocol) is the commonly used transport protocol, ensuring reliable data delivery.
- TCP establishes a connection between the browser and the web server using a three-way handshake mechanism.
- Network Layer:
- The network layer adds IP (Internet Protocol) addresses to the segments, creating packets.
- IP is responsible for addressing and routing packets across networks.
- Routing protocols like OSPF (Open Shortest Path First) or BGP (Border Gateway Protocol) determine the best path for the packets to reach the destination.
- Data Link Layer:
- The data link layer encapsulates the packets into frames and adds MAC (Media Access Control) addresses.
- Ethernet is a widely used data link layer protocol for wired networks.
- Ethernet frames include source and destination MAC addresses, as well as error detection using protocols like CRC (Cyclic Redundancy Check).
- Physical Layer:
- The physical layer converts the frames into electrical or optical signals and transmits them over the physical medium.
- This layer encompasses the physical cables, connectors, and network interfaces used for data transmission.
On the receiving end, the process occurs in reverse:
- The physical layer receives the signals and converts them into frames.
- The data link layer checks for errors, performs necessary corrections, and extracts the packets.
- The network layer receives the packets, reads the IP addresses, and determines the next hop for forwarding.
- The transport layer reassembles the segments, performs error checks, and ensures data integrity.
- The session layer manages the session and synchronization between the browser and the web server.
- The presentation layer handles any necessary decryption or data formatting.
- Finally, the application layer processes the received HTTP response and presents the web content to the user.
These specific protocols and processes within each OSI layer facilitate the communication flow when a user accesses a URL in a browser, ensuring successful retrieval of web content.
Is the following IP internal or external - 77.14.50.20? What can you do to extract more information about it?
To determine whether the IP address 77.14.50.20 is internal or external, we need to consider the context in which it is being referenced. However, based solely on the IP address itself, we cannot definitively determine if it is internal or external.
Typically, internal IP addresses are reserved for private networks and are not routable over the public internet. Commonly used private IP address ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If the IP address 77.14.50.20 falls within these ranges, it is more likely to be an external IP address.
To extract more information about the IP address, you can perform the following steps:
Perform a Reverse DNS Lookup: Use a tool or service that allows you to perform a reverse DNS lookup by entering the IP address. This will provide information about the domain name associated with the IP address.
Use IP Geolocation Services: There are various IP geolocation services available online. By inputting the IP address, you can retrieve information such as the country, city, ISP (Internet Service Provider), and approximate location of the IP address.
Check Public IP Databases: Some databases collect and maintain information about IP addresses, including historical data and potential abuse reports. You can search these databases to gather more details about the IP address.
By combining the results from these steps, you can gather additional information about the IP address 77.14.50.20, such as the associated domain, geographical location, and potential reputation.
Determine which part, or octet, of an IP address is the network ID and which part is the host ID.
In an IP address, the division between the network ID and host ID depends on the specific IP addressing scheme being used. There are two main IP addressing schemes: IPv4 and IPv6.
IPv4:
In IPv4, the division between the network ID and host ID is based on the subnet mask associated with the IP address. The subnet mask determines the length of the network ID and host ID portions. The subnet mask is represented in the form of four octets, just like the IP address itself.
For example, consider the IP address “192.168.1.100” with a subnet mask of “255.255.255.0”. In this case, the first three octets (192.168.1) represent the network ID, and the last octet (100) represents the host ID. The subnet mask of “255.255.255.0” indicates that the first three octets are used to identify the network, while the last octet is available for host addressing within that network.
IPv6:
In IPv6, the division between the network ID and host ID is based on the hierarchical structure of the IP address. IPv6 addresses are 128 bits in length, represented in eight groups of four hexadecimal digits separated by colons.
For example, consider the IPv6 address “2001:0db8:85a3:0000:0000:8a2e:0370:7334”. In IPv6, the first 64 bits (the first four groups of digits) represent the network ID, and the remaining 64 bits (the last four groups of digits) represent the host ID.
It’s important to note that the network ID and host ID portions may vary depending on the specific IP address and subnet configuration being used. The subnet mask or hierarchical structure determines how the IP address is divided into these components.
Specify three ways to identify valid and invalid IP addresses based on the rules of IP addressing.
To identify valid and invalid IP addresses based on the rules of IP addressing, here are three ways:
- Syntax and Format:
- Valid IP addresses must consist of four sets of numbers (octets) separated by periods (IPv4) or eight sets of four hexadecimal digits separated by colons (IPv6).
- Each octet in IPv4 must range from 0 to 255, while each hexadecimal digit in IPv6 must range from 0 to FFFF.
- Leading zeros are not allowed in IPv4 octets, except for the number zero itself.
- IPv4 addresses should not have more or fewer than four octets, and IPv6 addresses should not have more or fewer than eight sets of hexadecimal digits.
Example:
Valid IPv4 address: 192.168.0.1
Invalid IPv4 address: 256.168.0.1 (exceeds the valid range)
- Reserved Address Spaces:
- Certain IP address ranges are reserved and cannot be used as valid IP addresses. These reserved address spaces include private IP address ranges (such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) and special addresses like loopback (127.0.0.0/8) and broadcast addresses.
Example:
Valid IPv4 address: 192.168.0.100 (private address)
Invalid IPv4 address: 169.254.0.1 (link-local address range)
- Subnet Validity:
- When working with subnetting, it’s important to ensure that an IP address and its associated subnet mask are valid and consistent. The subnet mask should have a consecutive sequence of binary ones followed by binary zeros.
- The network portion of the IP address obtained by applying the subnet mask should be the same across all devices in the same subnet.
Example:
Valid IP/subnet combination: 192.168.0.0/24 (subnet mask 255.255.255.0)
Invalid IP/subnet combination: 192.168.0.0/33 (invalid subnet mask)
These are three ways to identify the validity of IP addresses based on IP addressing rules. Paying attention to the syntax, reserved address spaces, and subnet validity helps ensure proper IP addressing in network configurations.
Which octet(s) represent the network portion of Class C IP addresses?
In Class C IP addresses, the first three octets represent the network portion of the address. The fourth and final octet is reserved for the host portion.
Class C IP addresses have a fixed range of 192.0.0.0 to 223.255.255.0, with a subnet mask of 255.255.255.0. The first three octets (192.x.x) are used to identify the network, while the last octet (x) is available for addressing individual hosts within that network.
For example:
- IP address: 192.168.1.10
- Network portion: 192.168.1
- Host portion: 10
In Class C addressing, the network portion allows for a large number of individual networks, each capable of accommodating up to 256 hosts (excluding network and broadcast addresses).
How many hosts can each Class B network have?
In Class B IP addressing, each network can have up to 65,534 hosts.
Class B IP addresses have a range of 128.0.0.0 to 191.255.255.255, with a subnet mask of 255.255.0.0. The first two octets (128.x) represent the network portion of the address, while the last two octets (x.x) are available for addressing individual hosts within that network.
The number of hosts in a Class B network can be calculated using the formula:
Number of hosts = (2^16) - 2
The “2^16” represents the total number of possible combinations for the last two octets (16 bits), and the “- 2” accounts for the network address and the broadcast address, which are reserved and not usable for individual hosts.
Therefore, the maximum number of hosts that each Class B network can have is 65,534 (2^16 - 2).
Explain the DHCP process once a new device joins the network.
When a new device joins a network and needs to obtain an IP address, it typically follows the DHCP (Dynamic Host Configuration Protocol) process. Here is a simplified explanation of the DHCP process:
- Discovery: The new device broadcasts a DHCP discovery message, known as a DHCPDISCOVER, to the local network. This message is sent as a broadcast request, seeking a DHCP server.
- Offer: DHCP servers on the network receive the DHCPDISCOVER message and respond with a DHCP offer message, known as a DHCPOFFER. The DHCPOFFER contains an available IP address lease, subnet mask, lease duration, and other network configuration parameters.
- Request: The new device selects one of the DHCPOFFERs it received and sends a DHCP request message, known as a DHCPREQUEST. The request message confirms the device’s intent to accept the offered IP address and configuration parameters.
- Acknowledgment: The DHCP server receives the DHCPREQUEST and responds with a DHCP acknowledgment message, known as a DHCPACK. The DHCPACK confirms the lease of the IP address to the new device and provides any additional configuration information.
- Configuration: The new device receives the DHCPACK message and configures its network interface with the provided IP address, subnet mask, gateway, DNS servers, and other relevant settings. From this point onwards, the device can communicate on the network using the assigned IP address.
- Lease Renewal: The assigned IP address has a lease duration associated with it. As the lease approaches expiration, the device may initiate a DHCP lease renewal process to extend the lease period and maintain its network connectivity. This process typically involves the device sending a DHCPREQUEST to the DHCP server, and the server responding with a DHCPACK to renew the lease.
The DHCP process allows for dynamic and automated IP address allocation, simplifying network management and enabling efficient use of IP addresses. By providing automatic configuration, DHCP eliminates the need for manual IP address assignment, making it easier to connect new devices to a network and manage IP address assignments centrally.
List ten known port numbers and their services.
Here are ten well-known port numbers and their associated services:
Port 80: HTTP (Hypertext Transfer Protocol) - Used for serving web pages over the internet.
Port 443: HTTPS (HTTP Secure) - Used for secure communication over the internet, often used for secure websites.
Port 22: SSH (Secure Shell) - Used for secure remote access and administration of systems.
Port 25: SMTP (Simple Mail Transfer Protocol) - Used for sending email messages between mail servers.
Port 53: DNS (Domain Name System) - Used for resolving domain names to IP addresses and vice versa.
Port 110: POP3 (Post Office Protocol version 3) - Used for retrieving email messages from a mail server.
Port 143: IMAP (Internet Message Access Protocol) - Used for retrieving email messages from a mail server, with more advanced features than POP3.
Port 21: FTP (File Transfer Protocol) - Used for file transfer between a client and a server.
Port 3389: RDP (Remote Desktop Protocol) - Used for remote desktop access and administration of Windows systems.
Port 161/162: SNMP (Simple Network Management Protocol) - Used for managing and monitoring network devices.
These are just a few examples of well-known port numbers and their associated services. Port numbers help identify the specific network service or application running on a device and facilitate communication between devices on a network.
Explain the difference between encoding, hash, and encryption.
Encoding, hashing, and encryption are distinct concepts used in information security and data manipulation. Here’s an explanation of the differences between them:
- Encoding:
Encoding is a process of converting data from one format to another for various purposes such as data representation or transmission. It is primarily used to ensure that data can be properly interpreted or displayed in a specific system or application. Encoding does not provide any security or protection and is generally reversible.
- Examples of encoding schemes: Base64, ASCII, Unicode.
- Hashing:
Hashing is a one-way process that converts input data of any size into a fixed-length string of characters, called a hash value or hash code. The primary purpose of hashing is data integrity verification. A hash function takes the input data and produces a unique hash value. Any small change in the input will result in a significantly different hash value. Hashing is not meant for data retrieval or reversibility.
- Characteristics of hashing:
- Deterministic: Same input always produces the same hash value.
- Irreversible: It is computationally infeasible to derive the original input from the hash value.
- Fixed length: The hash value has a fixed size, regardless of the input size.
- Common uses of hashing: Password storage (storing hashed passwords instead of plaintext), data integrity verification (ensuring data integrity during transmission or storage), digital signatures.
- Encryption:
Encryption is a process of converting data into an unreadable form, known as ciphertext, using an encryption algorithm and a secret key. The primary purpose of encryption is to protect the confidentiality and privacy of data. Encryption ensures that only authorized parties with the appropriate decryption key can access and decipher the original data.
- Characteristics of encryption:
- Reversible: The ciphertext can be decrypted back to the original plaintext using the correct decryption key.
- Confidentiality: Encryption ensures that unauthorized individuals cannot understand the encrypted data.
- Common encryption algorithms: AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adleman), DES (Data Encryption Standard).
It’s important to note that encryption and hashing serve different purposes. Encryption is used to protect data confidentiality, while hashing is used for data integrity verification. Encoding, on the other hand, is primarily used for data representation or transmission and does not offer security features.
Explain what hash collision is.
A hash collision occurs when two different inputs produce the same hash value or hash code when processed by a hash function. In other words, it is a situation where two different pieces of data result in the same hash output.
Hash functions are designed to distribute hash values uniformly across the output space, making collisions extremely unlikely. However, due to the finite nature of hash functions and the infinite possible input data, collisions can still occur.
The occurrence of a hash collision can have various implications depending on the specific context:
- Data Integrity: In certain applications, such as data integrity checks or digital signatures, collisions are undesirable. The presence of a collision could allow an attacker to modify data while retaining the same hash value, potentially compromising the integrity or authenticity of the data.
- Hash Tables: In hash table data structures, collisions can impact the performance and efficiency of operations. When two different inputs produce the same hash value, a collision resolution technique is employed to handle the situation and ensure proper data retrieval.
- Cryptographic Hash Functions: In cryptographic applications, hash collisions are a significant concern. A secure cryptographic hash function should have a negligible probability of collisions. The discovery of hash collisions in widely-used cryptographic hash functions can have serious security implications, potentially enabling attackers to forge digital signatures, create counterfeit certificates, or bypass security mechanisms.
It’s important to note that the likelihood of hash collisions depends on the specific hash function and the size of the hash space. Cryptographic hash functions are designed with collision resistance as a fundamental requirement, aiming to minimize the probability of collisions even for an attacker with significant computational resources.
Give two reasons why TCP is more reliable than UDP.
TCP (Transmission Control Protocol) is considered more reliable than UDP (User Datagram Protocol) due to the following reasons:
- Guaranteed Delivery: TCP provides guaranteed delivery of data packets. It uses a combination of acknowledgment mechanisms, retransmission of lost packets, and sequencing to ensure that all packets are received by the intended recipient in the correct order. If any packet is lost or corrupted during transmission, TCP detects it and initiates retransmission until the data is successfully delivered. This reliability mechanism ensures that data is received accurately and completely, making TCP suitable for applications where data integrity is crucial, such as file transfers or web page loading.
- Error Checking and Correction: TCP performs error checking and correction through checksums. Each TCP segment includes a checksum field that allows the receiver to verify the integrity of the data. If the receiver detects any errors or corruption in the received data, TCP discards the corrupted packets and requests retransmission from the sender. This error detection and correction mechanism enhance the reliability of TCP by ensuring that data integrity is maintained during transmission.
On the other hand, UDP does not provide these reliability mechanisms, making it less reliable in comparison. UDP is a connectionless protocol that does not guarantee delivery or ensure data integrity. It is a “best-effort” protocol that focuses on low-latency and minimal overhead. UDP is commonly used in applications where real-time communication or speed is prioritized over reliability, such as live streaming, online gaming, or DNS (Domain Name System) queries.
