Section 2: Networking Flashcards

Question

What are ephemeral ports?

Answer 1

Ephemeral ports (temporary ports) are used for when you are communicating with a server. You need a port number on your device that you can associate with a particular traffic flow. These are usually temporary port numbers and once that traffic flow is over, will no longer use that port number. Commonly, an operating system will assign a port number between 1,024 and 65,535. But this is often configured in the operating system itself and it’s assigned in real time as you’re using these applications.

Answer 2

Some applications that use dynamic port numbers that can change dramatically from one device to the other. This is simply a number associated with that service. And if we know that, then we’re able to communicate with that service and have a conversation to send data

Answer 3

Port numbers are not designed to be a security mechanism. They’re simply designed to allow you to access those services on that particular device. It’s relatively easy to use a port scanner to find all of the open ports on a particular server and then begin to do more research to determine what service is really running on that port.

Answer 4

When you access all of the different sites that you visit on the internet, all of those sites are going to be using the same port numbers. This allows you to type in the name of the website and immediately connect to that site and be able to transfer data. If all of those different websites used completely different port numbers, we would have to have another mechanism in place to somehow determine what the appropriate port number might be for that individual site.

Answer 5

TCP has its own port numbers which are different to those of UDP This means that there could be a service running on TCP port 80 and a different service running on UDP port 80. However this can be confusing so we don't tend to do that in normal operation

Answer 6

FTP, or the File Transfer Protocol is a protocol that transfers files from one device to another. There are two port numbers used by FTP: TCP port 20 (for data transfers) TCP port 21, (used to control the data transfer)

Answer 7

FTP is a generic way to transfer data between devices, but it commonly requires some type of authentication to log in to the remote device. So you might use a username and password, although some systems will allow you to log in as anonymous and use any password to gain access. The FTP protocol also includes a number of file management functions. When you connect to an FTP server you can list all of the files on that server. You can add, delete, rename, and perform other file management functions all by using FTP.

Answer 8

Secure Shell - Used when you need to connect to a remote device through a terminal or command line front end. It’s common to use SSH to provide a terminal connection to a remote device. SSH commonly communicates over TCP using port 22 It has a text-based front end to be able to access that remote device. Although we see plain text on our screen, any communications sent over the network are sent as encrypted data

Answer 9

Using Telnet (Telecommunication network protocol) Telnet commonly uses TCP port 23 Telnet provides this text-based front end that allows us to connect to the remote console of another device. But unlike SSH, all of the communication between this Telnet front end and the Telnet server is sent unencrypted This is why we often say that you shouldn’t use Telnet on your production networks and instead you should always use SSH for terminal communication

Answer 10

SMTP - Simple Mail Transfer Protocol TCP port 25 Not only is SMTP used to communicate between mail servers, but it’s also used for our mail clients to send mail to a mail server. So if you’re using a mail client on your mobile device or your desktop computer and you’re sending an email message, you could be using SMTP.

Answer 11

SMTP is used to send mail and IMAP or POP3 is used to receive mail

Answer 12

They are two standard email protocols used to retrieve messages from a mail server, but work in different ways IMAP - Internet Message Access Protocol - keeps emails on the server - Ideal for multiple device accessing the same inbox - Messages not downloaded unless you open them Port 143 (unencrypted) Port 993 (encrypted/SSL) POP3 - Post Office Protocol 3 -downloads emails to your device and typically removed from the server - best for single device use - uses less server storage Port 110 (unencrypted) Port 995 (encrypted/SSL)

Answer 13

DNS (Domain Name System) DNS uses UDP Port 53 to make a connection between you and the DNS server DNS provides the resolution between the domain name you type in the browser, and the IP address that will be used for the communication

Answer 14

Dynamic Host Configuration Protocol Uses UDP port 67 and 68 It requires a DHCP server to assign IP addresses to devices on the network, and they are commonly built into routers and Wireless Access Points that we used

Answer 15

The DHCP server will have a large pool of IP addresses that can then be assigned to devices on your network. All of these IP addresses are assigned in real time. So when you start up your computer, it queries the DHCP server and the DHCP server assigns your device all of your IP configuration details. DHCP uses a leasing system to assign these IP addresses, so you are only using this IP address for a certain amount of time. And after that lease expires and you’re no longer on the network, that IP address goes back in the pool for someone else to use.

Answer 16

Network administrators can configure DHCP servers to always assign the same IP address to certain devices, e.g routers, firewalls, switches. They may configure DHCP reservations so those devices always receive the same IP address every time they’re booted up. This means that if you need to change any of the IP configurations on these devices, you don’t have to go to the devices to make those changes. You simply make them on the DHCP server. The next time that device requests a DHCP address, it will receive the new configuration.

Answer 17

Hypertext Transfer Protocol - common protocol used by our browsers to communicate to web servers - unencrypted using TCP port 80 Hypertext Transfer Protocol Secure - used to communicate over an encrypted channel using TCP port 443

Answer 18

POP3 was designed to retrieve email messages to an email client, but it wasn’t built for multiple email clients. We often use many different mobile devices, all accessing the same email inbox.

Answer 19

To be able to synchronise emails across many different mailboxes IMAP commonly uses TCP port 143 to be able to download and manage the mailbox.

Answer 20

SMB - Server Message Block Operating Systems use SMB to transfer information between devices Sometimes referenced as CIFS (Common Internet File System) SMB uses several protocols to communicate Older Windows machines use NetBISO over TCP/IP TCP port 445

Answer 21

NetBIOS is the Network Basic Input Output System This uses UDP port 137 as a name service function so that it can find devices on your network by name and: uses TCP port 139 to set up a session and transfer data between devices. On most modern versions of Windows, NetBIOS isn’t used. Devices can communicate directly between each other using TCP/IP. In those cases, it would use a direct SMB connection using TCP port 445. This allows us to have a direct SMB communication between two devices by using only TCP/IP.

Answer 22

Simple Network Management Protocol Allows a network management device to query these infrastructure devices for performance details and receive those metrics in return Uses UDP port 161 Can configure the infrastructure device to monitor for certain metrics. And if it exceeds any of those metrics, it can send an alert to the management station. We refer to these alerts as traps, and the traps use UDP port 162. If you’re configuring SNMP on a device, it will ask you if you’re using version 1, version 2, or version 3. V3 includes encryption

Answer 23

LDAP - Lightweight Directory Access Protocol Uses TCP port 389 Most popular implementation of LDAP is Microsoft Active Directory, which allows you to query the Active Directory server using the LDAP protocol

Answer 24

RDP - Remote Desktop Protocol Uses TCP port 3389 Standard protocol used by Windows for remote access to someone's device

Answer 25

Remote Desktop Protocol used to remotely connect to someone's device. RDP can be used to take over and control an entire system, or just to run a single application from that server. Although you’ll find servers running RDP almost exclusively on Windows, there are clients that you can run on almost any operating system. So if you’re running Linux, Mac OS, Android, or any other operating system, there’s probably an application you can load that would allow you to connect to a Windows device using the remote desktop protocol.

Answer 26

Layer 2 switch Layer 3 switch Network Interface Card (NIC) Optical Network Terminal (ONT) DSL Modem Cable Modem Firewall Hub Router PoE switch Patch panels Access Point

Answer 27

A router is a device that forwards traffic between different IP subnets. The router uses the IP address that’s within the packet to determine what the next hop might be on its way to the final destination. Because this routing takes place at layer 3 of the OSI model, we often refer to these as layer 3 devices if we have a router that can be configured inside of a switch, you’ll see those devices referred to as layer 3 switches Routers also connect different types of networks together (LAN, WAN, Fibre)

Answer 28

A switch determines where traffic should be forwarded based on the destination MAC address inside of that time frame, as opposed to a router which forwards traffic based on destination IP It is able to forward traffic at very high rates of speed because a lot of those forwarding decisions are based in the hardware of the device Many switches have an Application Specific Integrated Circuit or an ASIC which allows for very fast throughput. They will also add additional power to the switch connection using POE or Power Over Ethernet A switch that has the ability to turn on additional routing functionality, we often refer to that as a layer 3 switch or a multilayer switch

Answer 29

Unmanaged switches have very limited functionality with no configuration options (often purchased from a local or online retailer). Very little integration with other protocols You cannot configure any VLANs on an unmanaged switch No SNMP capabilities

Answer 30

Managed switches are usually found in offices and provide additional capabilities Allow you to configure different interfaces to be on completely different IP subnets (VLANS) and gives you the option to prioritise traffic e.g. VoIP traffic higher priority than file transfer traffic Allows capabilities such as SNMP

Answer 31

Virtual Local Area Network - a way to logically segment a physical network into multiple, isolated networks at the data link layer (Layer 2 of the OSI model), even if the devices are physically connected to the same switches. Each port on a managed switch can be assigned to a VLAN. When a device sends data, it gets tagged (usually with a VLAN ID using IEEE 802.1Q tagging), so switches and routers know which VLAN it belongs to A company has one switch and wants to separate the IT and HR departments. VLAN 10 is assigned to IT, VLAN 20 to HR. Even though both departments’ computers connect to the same switch, they can't directly communicate unless a router or Layer 3 switch is used.

Answer 32

Spanning Tree Protocol (STP)

Answer 33

Some managed switches will allow you to perform port mirroring, where you can take traffic from one port that’s on the switch and copy all of that traffic to a different port on the switch, ideally to plug in a protocol analyser to be able to view all of those packets traversing the network. This is commonly used for troubleshooting or packet analysis and not something you would usually find on an unmanaged switch.

Answer 34

Often found on the ceiling of offices It provides wireless connectivity for the local network. This is not a router that you might find in a SOHO device that your small office or home office. This is a device that only provides a link between the wireless network and the wired network. You’ll sometimes hear these devices referred to as a bridge because they are simply bridging or extending that wired connection into a wireless connection. This is not a device that is routing between subnets, and it’s not performing any type of network address translation. It’s simply bridging people on the wireless network to the folks that are on the wired network. An access point makes forwarding decisions based on the destination MAC address, which is identical to the way that a switch forwards information. The access point examines the destination MAC address and determines if that MAC address is on the wireless network or if it should send that information to the wired network.

Answer 35

RJ45 Connectors

Answer 36

Connects cables that run from all of the desks using RJ45 connectors which ultimately connect to a switch Combination of punch-down blocks There are smaller cables on the front that connect from the patch panel and extend that connection into an interface on a switch

Answer 37

A traditional firewall is able to allow or disallow traffic through your network based on IP addresses and port numbers. Since those TCP and UDP ports operate at layer 4 of the OSI model, it’s common to refer to firewalls like this as an OSI Layer 4 device. It’s increasingly common to see firewalls that understand application layer traffic. And in those cases, the firewall would be a layer 7 device. Some firewalls can also act as an endpoint for an encrypted tunnel, which means that you can connect two sites together across a public network like the internet, but all of the traffic between those sites is encrypted Can also act as a proxy - firewall will perform browsing for the user Can also act as a router (in homes)

Answer 38

Power over Ethernet Some devices allow you to power a system through the Ethernet cable that’s already connecting to a device, referred to as Power over Ethernet Allows you to run a single wire to the device that will not only be able to transfer data but also be used as the power source for that device

Answer 39

You often see POE used with access points, cameras, and anything else where power may be difficult to run to that device

Answer 40

PoE Injectors, often referenced as a Midspan

Answer 41

PoE, PoE+, PoE++ Each has a different standard and provide different wattage and amps

Answer 42

Before there were switches, we used hubs to connect all of the devices on our network. Sometimes you’ll hear a hub referred to as a multi-port repeater. That’s because hubs are not very intelligent devices. Any data that’s going into one interface on this hub will automatically be copied and sent to all of the other interfaces on this hub. Not able to run any full duplex communication to a hub. So all of the devices plugged into this hub will operate at half duplex. Since everything is being re-transmitted to every other interface on this device, you put more of a load and add more devices to the network, so the performance of this device tends to get slower and slower

Answer 43

Cable modems are a prevalent type of hardware that connects computer devices with your ISP. Differing from other types of modems, a cable modem uses coax cable, the same infrastructure that brings television programming to our business or homes, to proxy that connection, rather than a telephone or DSL line.

Answer 44

Asymmetric Digital Subscriber Line - uses the same telephone line as what is used for analogue telephones

Answer 45

Optical Network Terminal Used in fibre networks This is connecting an ISP fiber network and converting it into signals like copper ethernet that can be used inside of your home. This ONT is usually connected to the outside of your building and it usually delineates the ISPs network from your own internal network.

Answer 46

It's so you know what the responsibilities are for each different party. Any of the wiring on the inside of your house is your responsibility up to the point of that demarcation, and then anything outside of that demarc is the responsibility of the service provider. Sometimes this demarc is located in your data centre itself. Or if you’re at home, it’s located on the outside of your home.

Answer 47

Network Interface Card Used for copper Ethernet connections to provide connectivity There are also network interface cards for other types of topologies. E.g. If you’re plugging into a wide area network serial connection, or have a wireless interface

Answer 48

Allow us to take devices like switches, routers, firewalls and other networking infrastructure devices and change them to be a software based platform that we could use in the cloud This means that we might take something like a switch and separate all of the functions of the switch into individual pieces. We can then take these pieces and then create software versions that we can then run in the cloud

Answer 49

1. Infrastructure layer (data plane) - forwarding, trunking, encrypting, NAT or anything else occurring at the packet level 2.Control layer (control plane) - references held in the control plane to know where the traffic is going 3. Application layer (management plane) - manage device through API, SSH into a router, graphical front end of firewall etc

Section 2: Networking Flashcards

(78 cards)