Chapter 3

Question 1

Netflow

Answer 1

Is a Cisco network protocol that collects IP traffic information, allowing network traffic monitoring. Flow data is used to provide a view of traffic flow and volume. A typical flow capture includes the IP and port source and destination for the traffic and the class of service. Netflows and a netflow analyzer can help identify service problems and baseline typical network behavior and can also be useful in identifying unexpected behaviors.

Question 2

Windows netstat - o output

Answer 2

Provides ethernet statistics on how many bytes and packets have been sent and received. Also shows Discards, errors and unknown protocols.

Question 3

Windows netstat -e

Answer 3

Shows various information depending on the OS, Windows shows the destination network, netmask, gateway, interface the route is associated with and a metric for the route that captures link speed

Question 4

Windows netstat -nr

Answer 4

This means that running netstat from a system can provide information about both the machine’s network behavior and what the local network looks like. Knowing what machines a system has or is communicating with can help you understand local topology and services.

Question 5

DHCP

Answer 5

Is a client/server protocol that provides an IP address as well as information such as the default gateway and subnet mask for the network segment that the host will reside on.

Question 6

DHCP being used in passive reconnaissance

Answer 6

When you are conducting passive reconnaissance, DHCP logs from the DHCP server for a network can provide a quick way to identify many of the hosts on the network. If you combine DHCP logs with other logs, such as firewall logs, you can determine which hosts are provided with dynamic IP addresses and which hosts are using static IP addresses.

Question 7

nslookup

Answer 7

Uses DNS to translate URL’s to IP addresses and vice versa

Question 8

traceroute

Answer 8

Traces the route by each hop. Will typically find that the last few responses stay the same. These are often the local routers and other network devices in an organization’s network, and knowing how traffic gets to a system can give you insight into the company’s internal network topology.

Question 9

Border Gateway Protocol

Answer 9

Is responsible for looking at all of the available paths that data could travel and picking the best route, which usually means hopping between autonomous systems.

Question 10

Domain Registrars

Answer 10

This means that registrars work with the domain name registries to provide registration services: the ability to acquire and use domain names. Registrars provide the interface between customers and the domain registries and handle purchase, billing, and day-to-day domain maintenance, including renewals for domain registrations.

Question 11

Zone Transfers

Answer 11

Are intended to be used to replicate DNS databases between DNS servers, which makes them a powerful information-gathering tool if a target’s DNS servers allow a zone transfer.

Question 12

Exif

Answer 12

Data often includes location and camera data, allowing the images to be mapped and identified to a specific device or type of camera.

Question 13

Cisco Log Criticality 0-7. What level for emergencies and what is for debugging?

Answer 13

Log level 0 is used for emergencies in Cisco’s logging level scheme. Log level 7 is for debugging information and is at the bottom of the scale

Question 14

axfr flag

Answer 14

It is one of the many mechanisms available for administrators to replicate DNS databases across a set of DNS servers. This is used for DNS Zone Transfers.