Chapter 17 - Supplement - Sheet1 Flashcards
Protocol Analyzers
AKA sniffers / network monitors. Uysed to capture packets in their raw format as they cross the network.
Examples of protocol analyzers
Wireshare, OmniPeek
Promiscuous Mode
NIC processes all packets that it sees
Throughput Testers
Usually software based, work much like a protocol analyzer in that they measure traffic, but these measure throughput of that traffic (network speeds)
Connectivity Software
Designed to allow you to make a connection to a machine, its desktop, and perform any action you could perform while sitting in front of it.
Traceroute
(AKA trace) displays the path a packet takes to get to a remote device by using IP Packet TTL, time-outs, and ICMP error messages.
ipconfig / ifconfig
Display the current configuration of TCP/IP on a given workstation. Includes IP, DNS, WINS config and default gateway
OSes that use ipconfig
New Macs, Windows
ipconfig /all
ipconfig option that gives you hardware addresses, DHCP lease times, and DNS addresses
ipconfig /release & ipconfig /renew
Renews the IP address lease, or gets a new one if applicable.
OSes that use ifconfig
Linxus, Unix, Mac
ifconfig
ipconfig equivalent. Short for interface configuration
2 purposes to using the ping utility
To find out if a host is responding OR to find out if you can reach a host
ping -t
Pings the specified host until stopped
ping -a
Resolves addresses to hostnames
ping - n count
Specified the number of echo requests to send. Default is 4. (4 “Reply from…”)
ping -w timeout
Set the timeout time in milliseconds. Default is 1000, which is 1 second
ARP
Address Resolutin Protocol. Used to translate TCP/IP addresses to MAC addresses using broadcasts.
ARP Table
Windows table that includes a list of TCP/IP addresses and their associated physical (MAC) addresses. Cached in memory to reduce the need to perform lookups
2 Types of Entries in the ARP Table
Dynamic and Static
Dynamic ARP table entries
Created whenever the Windows TCP/IP stack performs an ARP lookup but the MAC address isn’t found in the ARP table. When MAC address is finally resolved (via Broadcast) that info is added to the table.
Static ARP table entries
Manually added MAC addresses.
arp -a
Dispays current ARP entries.
arp -g
Dispays current ARP entries. Same as arp -a
arp -a -v
Verbose ARP entries - shows all invalid entires and regular arp -a entries