Chapter 6 Flash Cards - TCP/IP, Applications, Security

Question 1

Describe the TCP/IP Transport Layer Function: Multiplexing using ports

Answer 1

Function that allows receiving hosts to choose the correct application for which the data is destined, based on the port number.

Question 2

Describe the TCP/IP Transport Layer Function: Error Recovery (Reliability)

Answer 2

Process of numbering and acknowledging data with Sequence and Acknowledgment header fields.

Question 3

Describe the TCP/IP Transport Layer Function: Flow Control using windowing

Answer 3

Process that uses window sizes to protect buffer space and routing devices.

Question 4

Describe the TCP/IP Transport Layer Function: Connection Establishment and temination

Answer 4

Process used to initialize port numbers and sequence and acknowledgement fields.

Question 5

Describe the TCP/IP Transport Layer Function: Ordered data transfer and data segmentation

Answer 5

Continuous stream of bytes from an upper-layer process that is “segmented” for transmission and delivered to upper-layer processes at the receiving device, with the bytes in the same order.

Question 6

What are dynamic port numbers?

Answer 6

Ports allocated by host starting at 1024 because the ports below are reserved for well-known applications.

Question 7

Give the Protocol and Application for the given Port: 20

Answer 7

TCP/ FTP Data

Question 8

Give the Protocol and Application for the given Port: 21

Answer 8

TCP/ FTP Control

Question 9

Give the Protocol and Application for the given Port: 22

Answer 9

TCP/ SSH

Question 10

Give the Protocol and Application for the given Port: 23

Answer 10

TCP/ Telnet

Question 11

Give the Protocol and Application for the given Port: 25

Answer 11

TCP/ SMTP

Question 12

Give the Protocol and Application for the given Port: 53

Answer 12

UDP,TCP/ DNS

Question 13

Give the Protocol and Application for the given Port: 67, 68

Answer 13

UDP/ DHCP

Question 14

Give the Protocol and Application for the given Port: 69

Answer 14

UDP/ TFTP

Question 15

Give the Protocol and Application for the given Port: 80

Answer 15

TCP/ HTTP (WWW)

Question 16

Give the Protocol and Application for the given Port: 110

Answer 16

TCP/ POP3

Question 17

Give the Protocol and Application for the given Port: 161

Answer 17

UDP/ SNMP

Question 18

Give the Protocol and Application for the given Port: 443

Answer 18

TCP/ SSL

Question 19

Give the Protocol and Application for the given Port: 16,384-32,767

Answer 19

UDP/ RTP-based Voice (VoIP) and Video

Question 20

Define Connection-Oriented Protocol

Answer 20

A protocol that requires an exchange of messages before data transfer begins or that has a required preestablished correlation between two endpoints.

Question 21

Define Connectionless Protocol

Answer 21

A protocol that does not require an exchange of messages and that does not require a preestablished correlation between two endpoints.

Question 22

What are the QoS requirements for VoIP?

Answer 22

1. Low delay: VoIP requires a very low delay between the sending phone and the receiving phone–typically less than 200 milliseconds (.2 seconds). This is a much lower delay than what is required by typical data applications.
2. Low jitter: Jitter is the variation in delay. VoIP requires very low jitter as well whereas data applications can tolerate much higher jitter. For example, the jitter for consecutive VoIP packets should not exceed 30 milliseconds (.03 seconds), or the quality degrades.
3. Loss: If a VoIP packet is lost in transit because of errors or because a router doesn’t have room to store the packet while waiting to send it, the VoIP packet is not delivered across the network. Because of the delay and jitter issues, there is no need to try to recover the lost packet. It would be useless by the time it was recovered. Lost packets can sound like a break in the sound of the VoIP call.

Question 23

Define Denial of Service (DoS) attacks.

Answer 23

An attack whose purpose is to break things.
DoS attacks called destroyers try to harm the hosts, erasing data and software.
DoS attacks called crashers cause harm by causing hosts to fail or causing the machine to no longer be able to connect to the network.
Also, DoS attacks called flooders flood the network with packets to make the network unusable, preventing any useful communications with the servers.

Question 24

Define Reconnaissance attacks.

Answer 24

This kind of attack may be disruptive as a side effect, but its goal is gathering information to perform an access attack. An example is learning IP addresses and then trying to discover servers that do not appear to require encryption to connect to the server.

Question 25

Define Access Attacks

Answer 25

An attempt to steal data for some financial advantage, for a competitive advantage with another company, or even for international espionage.

Question 26

Explain the following security issue: Access from the Wireless LAN

Answer 26

Wireless LANs allow users to access the rest of the devices in the Enterprise. The wireless radio signals might leave the building, so an unsecured wireless LAN allows the user across the street in a coffee shop to access the Enterprise network, letting the attacker begin the next phase of trying to gain access to the computers in the Enterprise.

Question 27

Explain the following security issue: Infected mobile laptops

Answer 27

When an employee brings his or her laptop home, with no firewalls or other security, the laptop may become infected with a virus. When the user returns to the office in the morning, the laptop connects to the Enterprise network, with the virus spreading to other PCs. The PC may be vulnerable in part because the users may have avoided running the daily ant-virus software scans that, although useful, can annoy the user.

Question 28

Explain the following security issue: Disgruntled employees

Answer 28

When a user is planning to move to a new company. He steals information from the network and loads it onto an MP3 player or USB flash drive. This allows him to carry the entire customer database in a device that can be easily concealed and removed from the building.

Question 29

Describe the following attacking tool: Scanner

Answer 29

A tool that sends connection requests to different TCP and UDP ports, for different applications, in an attempt to discover which hosts run which IP services, and possibly the operating system used on each host.

Question 30

Describe the following attacking tool: Spyware

Answer 30

A virus that looks for private or sensitive information, tracking what the user does with the computer, and passing the information back to the attacker in the Internet.

Question 31

Describe the following attacking tool: Worm

Answer 31

A self-propagating program that can quickly replicate itself around Enterprise networks and the Internet, often performing DoS attacks, particularly on servers.

Question 32

Describe the following attacking tool: Keystroke logger

Answer 32

A virus that logs all keystrokes, or possibly just keystrokes from when secure sites are accessed, reporting the information to the attacker. Loggers can actually capture your username and password to secure sites before the information leaves the computer, which could give the attacker access to your favorite financial websites.

Question 33

Define Anti-x

Answer 33

The term used by Cisco to refer to a variety of security tools that help prevent various attacks, including antivirus, anti-phishing, and anti-spam.

Question 34

Define Connection Establishment

Answer 34

The process by which a connection-oriented protocol creates a connection. With TCP, a connection is established by a three-way transmission of TCP segments.

Question 35

Define DoS

Answer 35

A type of attack whose goal is to cause problems by preventing legitimate users from being able to access services, thereby preventing the normal operation of computers and networks.

Question 36

Define Error detection

Answer 36

The process of discovering whether or not a data-link level frame was changed during transmission. This process typically uses a Frame Check Sequence (FCS) field in the data-link trailer.

Question 37

Define Error Recovery

Answer 37

The process of noticing when some transmitted data was not successfully received and re-sending the data until it is successfully received.

Question 38

Define Firewall

Answer 38

A device that forwards packets between the less secure and more secure parts of the network, applying rules that determine which packets are allowed to pass, and which are not.

Question 39

Define Flow Control

Answer 39

The process of regulating the amount of data sent by a sending computer toward a receiving computer. Several flow control mechanisms exist, including TCP flow control, which uses windowing.

Question 40

Define Forward Acknowledgement

Answer 40

A process used by protocols that do error recovery in which the number that acknowledges data lists the next data that should be sent, not the last data that was successfully received.

Question 41

Define HTTP

Answer 41

Hypertext Transfer Protocol. The protocol used by web browsers and web servers to transfer files, such as text and graphic files.

Question 42

Define Intrusion Detection System (IDS)

Answer 42

A security function that examines more complex traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out, rating each perceived threat and reporting the threats

Question 43

Define Intrusion Prevention System (IPS)

Answer 43

A security function that examines more complex traffic patterns against a list of both know attack signatures and general characteristics of how attacks may be carried out, rating each perceived threat and reacting to prevent the more significant threats.

Question 44

Define Ordered data transfer

Answer 44

A networking function, included in TCP, in which the protocol defines how the sending host should number the data transmitted, defines how the receiving device should attempt to reorder that data if it arrives out of order, and specifies to discard the data if it cannot be delivered in order.

Question 45

Define Port

Answer 45

In TCP and UDP, a number that is used to uniquely identify the application process that either sent (source port) or should receive (destination port) the data inside the data segment.

Question 46

Define Positive Acknowledgement and Re-transmission (PAR)

Answer 46

A generic reference to how the error recovery feature works in many protocols, including TCP, in which the receiver must send an acknowledgement that either implies that the data was (positively) received, or send an acknowledgement that implies that some data was lost, so the sender can resend the lost data.

Question 47

Define Segment

Answer 47

In TCP, a term used to describe a TCP header and its encapsulated data (also called L4PDU). Also in TCP, the process of accepting a large chunk of data from the application layer and breaking it into smaller pieces that fit into TCP segments.

Question 48

Define Sliding Windows

Answer 48

For protocols such as TCP that allow the receiving device to dictate the amount of data the sender can send before receiving an acknowledgement--a concept called a window---a reference to the fact that the mechanism to grant future windows is typically just a number that grows upwards slowly after each acknowledgement, sliding upward.

Question 49

Define URL

Answer 49

Universal Resource Locator. A standard for how to refer to any piece of information retrievable via a TCP/IP network, most notably used to identify web pages. For example, http://www.cisco.com/univercd is a URL that identifies the protocol (HTTP), hostname (www.cisco.com) and web page (/univercd).

Question 50

Define Virtual Private Network (VPN)

Answer 50

The process of securing communication between two devices whose packets pass over some public and unsecured network typically the Internet. VPNs encrypt packets so that the communication is private and authenticate the identity of the endpoints.

Question 51

Define VoIP

Answer 51

Voice over IP. The transport of voice traffic inside IP packets over an IP network.

Question 52

Define Web Server

Answer 52

Software, running on some computer, that stores web pages and send those web pages to web clients (web browsers) that request the web pages.