2. Network security: ARP, TCP/IP and its vulnerabilities

Question 1

What does ARP stand for?

Answer 1

Address Resolution Protocol

Question 2

What does ARP do?

Answer 2

Maps IP addresses to MAC addresses

Question 3

How does ARP work?

Answer 3

ARP broadcasts ‘who has IP C’. Machine C responds ‘IP C is at MAC C’. Machine A caches response.

Question 4

What layer does ARP operate at?

Answer 4

Link layer

Question 5

How does an ARP cache poisoning work?

Answer 5

Eve sends ARP response to Alice and Bob (gateway) with Eve’s MAC, thus all traffic between Alice and Bob routes through Eve

Question 6

What are static ARP tables?

Answer 6

Network admin sets up ARP cache manually, inconvenient when new device joins but mitigates ARP cache poisoning

Question 7

How many bits are ports?

Answer 7

16

Question 8

Which ports are reserved?

Answer 8

0-1023

Question 9

Which ports are user ports?

Answer 9

1024-49151

Question 10

Which port does HTTPS use?

Answer 10

443

Question 11

Which port does SSH use?

Answer 11

22

Question 12

Which port does SMTP use?

Answer 12

25

Question 13

Which port does FTP use?

Answer 13

21

Question 14

Which port does HTTP use?

Answer 14

80

Question 15

How is a TCP connection established?

Answer 15

Three-way handshake

• Client sends SYN packet
• Server responds with SYN/ACK packet
• Client responds with ACK packet

Question 16

How is a TCP connection terminated

Answer 16

4-way handshake

• Client sends FIN
• Other client responds ACK
• Other client sends FIN
• Client sends ACK

Question 17

How is the order of packets in TCP insured?

Answer 17

Each packet has a sequence number

Question 18

How is deliver of packets in TCP insured?

Answer 18

Client sends an ACK for each each packet (absent -> resend)

Question 19

How is the contents of a TCP packet insured?

Answer 19

Data is compared to checksum encoded in packet

Question 20

What is SYN flooding?

Answer 20

Eve sends SYN packet to Alice without acknowledging response, Alice can’t handle all the SYN packets

Question 21

What are the problems with SYN flooding?

Answer 21

Attribution - Attackers IP can be traced

Bandwidth - Limited by attackers bandwidth

Question 22

How does a smurfing attack work?

Answer 22

Send a ping with a forged source to a smurf amplifier who swamps the target with replies