Domain 4: Communication and Network Security 14% Flashcards
1
Q
Baseband
A
networks have on channel, and can only send one signal at a time. Ethernet is baseband.
2
Q
Broadband
A
networks have multiple channels and can send and receive multiple signals at a time.
3
Q
Extranet
A
is a connection between private Intranets, often connecting business partners Intranets.
4
Q
Circuit switching
A
Expensive, but always available, used less often. A dedicated comm channel through the network, guarantees the full bandwidth.
5
Q
Packet switching
A
cheap, but no capacity guarantee, very widely used today.
6
Q
QOS (Quality of Service)
A
gives specific traffic priority over other traffic. Most commonly VOIP, or other UDP traffic needing close to real time comm.
7
Q
GAN (Global area network)
A
A global area network, is a network used for supporting mobiles users across a number of wireless LANs, satellite coverage areas, the transition from one to the next can be seamless
8
Q
OSI (Open Systems Interconnect)
A
7 layers. 1. Physical, 2. Data Link, 3. Network, 4 Transport, 5. Session, 6. Presentation, 7. Application
7-1 All people seem to need data processing
9
Q
PDU (Protocol Data Units)
A
Data-567, Segments-4, Packets-3, Frames-2, Bits-1
10
Q
Layer 2: Data Link Layer
A
Transports btw 2 nodes connected to same network. LLC - Logical Link Control-error detection.
11
Q
MAC address (BIA)
A
a unique identifier on the network card. Can be spoofed very easily. Threats - MAC Spoofing, MAC Flooding.
12
Q
ARP (Address Resolution Protocol)
A
Layer 2/3
13
Q
CSMA/CD (Collision Detection)
A
Ethernet - minimized with switches vs hubs.
14
Q
CSMA/CA (collison Avoidence)
A
Wireless
15
Q
Token passing
A
Similar to the talking stick, not really used anymore
16
Q
Layer 3: Network Layer
A
Expands to many different nodes (IP) - The Internet is IP based. Isolates traffic into broadcast domains. Threats = Ping of Death, Ping Floods, Smurf - spoof source and directed broadcast, IP modifications, DHCP attacks
Only IMAP is layer 7 all other I protocols are Layer 3.
17
Q
Layer 4: Transport Layer
A
SSL/TLS Layer 4 to 7
18
Q
UDP (User Datagram Protocol)
A
Connectionless protocol, unrealiable, VOIP, Live video, gaming, “real time” Timing is more important than delivery confirmation Attack: Fraggle attack
19
Q
TCP (Transmission Control Protocol)
A
Reliable, connection oriented, guaranteed delivery, 3 way handskake, slower/more overhead, data reassembled. Attacks: SYN floods - half open TCP sessions, client sends 1,000’s of SYN requests, but never the ACK
20
Q
3-Way handshake
A
SYN, SYN/ACK, ACK
21
Q
TCP Flags (9 bits 1-bit flags)(Control bits)
A
SYN= synch sequen numbers ACK= indicates that the Acknowledgment field is significant. RST= Rest the connection. FIN= Last package from sender
22
Q
Layer 5: Session Layer
A
Establishes connection between 2 applications: Setup > Maintenance>Tear down
23
Q
Layer 6: Presentation Layer
A
Only layer with no protocols. Formatting, compressing, encryption (file level)
24
Q
Layer 7: Application Layer
A
Presents data to user (applications/websites. HTTPS, FTP, SNMP, IMAP, POP, AD integration
25
The higher up the layers
the slower it is, speed traded for intelligence
26
Threats to level 5-7
virus, worms, trojans, buffer overflow, app or OS vulner
27
TCP/IP Model (Internet protocol suite)
A conceptual model that provides end-to-end data comm. It has four layers which are used to sort all related protocols according to the scope of networking involved.
28
TCP/IP link layer
equals OSI Layers 1/2
29
TCP/IP Internetwork layer
equals OSI Layer 3
30
TCP/IP Transport layer
equals OSI Layer 4, TCP/UDP. port number
31
TCP/IP Application layer
equals OSI Layers 5-7
32
48bit MAC's in IPv6
modified into 64-bit MAC's by adding FF:FE to the device identifier
33
IPv4
1st deployed for production in the ARPANet in 1984, ARPANet later became the Internet. IP was developed in 1970's for secure closed networks DARPA. Security was not built in, but was bolted on later. It is a connectionless protocol for use on packet-switched networks. It operates on a best effort delivery model, it does not guarantee delivery, it also does not assure proper sequencing or avoidance of duplicate delivery. We have added protocols (TCP) on top of IP to ensure those.
34
IPv6
moving here mainly because we are running out of IPv4 address
35
A Socket
1 set of IP and Port. UDP only uses 1 socket (connectionless), TCP uses 2 in a pair
36
Socket Pairs (TCP)
2 sets of IP and Port (Source and Destination)
37
IANA (Internet Assigned Numbers Authority)
governs the IP's address allocation. Is a department of ICANN (Internet Corporation for Assigned Names and Numbers)
38
Unicast
1-1 traffic (Client to Server) we can capture all unicast traffic on a network by using promiscuous mode on a NIC (Network IDS'/IPS')
39
Multicast
one to many (predefined)
40
Broadcast
one to all (on a LAN Network) The traffic is sent to everyone
41
Limited L3 Broadcast:
Use the 255.255.255.255 broadcast IP address, router do not pass
42
Limited L2 Broadcast:
Uses FF:FF:FF:FF:FF:FF broadcast MAC address, routers do not pass.
43
Directed broadcast:
Sent to anyone logically connected to the same network, regardless if it is physically behind the same router or not.
44
IPv4 Private Addresses
RFC 1918 - Not routable on the Internet
10. 0.0.0 10.255.255.255
172. 16.0.0 172.31.255.255
192. 168.0.0 192.168.255.255
127. 0.0.0/8 Loopback IP's
169. 254.0.0/16 Link-Local
255. 255.255.255 Broadcast
45
NAT (Network Address Translation)
Static NAT Translates 1-1, not practical.
| Pool NAT Also still 1-1, but a pool was available to all clients not assigned to specific clients
46
PAT (Port Address Translation)
It uses IP and Port number. Also called One-to-Many or NAT Overload since it translates One public IP to Many private IP's. This is what is used today.
47
Classful IP Networks
were used early on the Internet for public address networks were very large. It was very inefficient use of IP Addresses.
48
CIDR (Classless Inter-Domain Routing, also called slash notation)
it breaks our addresses into smaller logical segments, thus saving addresses.
49
IP Headers contain
```
Version: IP v4
IHL: Length of the IP header
QoS (Quality of Service)
Id, Flags, Offset: used for IP fragmentation
TTL (Time to live): to prevent routing loops.
Protocol: Protocol number for TCP/UDP
Source/Destination IP Addresses
Optional: Options and padding
```
50
MTU (Maximum Transmission Unit)
normally 1500 bytes in Ethernet usage. If packet exceeds that size a router along the path may fragment into smaller packets.
51
IPv6
is 128bit in hexadecimal numbers (uses 0-9 and a-f). IPSec is built in, not bolted on like with IPv4.
52
IPv6 MAC Address
It is a EUI-48 address we add "ffee" to convert for EUI-64. This is added to the middle of the EUI-48 address.
53
IPv6 Header contains
```
Version: IP v6 (4bits)
Traffic Class/Priority (8bits)
Flow label/QoS management (20bits)
Payload length in bytes (16bits)
Next Header (8bits)
Time to live (TTL)/Hop Limit
Source IP add
Destination IP address
```
54
ARP
translates IP address into MAC addresses. OSI 2/3 layer. Is simple and trusting protocol, anyone can respond to an ARP request.
55
ARP (cache) Poisoning
an attacker sends fake responses to ARP requests, often done repeatedly for critical AP entries (default gateway)
56
RARP (Reverse ARP)
is used by diskless workstations to get IP's.
57
ICMP (Internet Control Message Protocol)
used to help IP, often used for troubleshooting. If we do not get a ping response it does not mean that it is down. Firewalls and routers can block ICMP replies.
58
Traceroute
Uses ICMP to trace a network route. Sends message with TTL until it reaches the destination. Max 30 hops.
59
Telnet
remote access over a network. Uses TCP port 23 everything is transmitted in plaintext so it is easy to sniff
60
SSH (Secure Shell)
Designed to replace or add security to unsecure protocols Telnet, FTP, HTTP. CIA and NSA can decrypt SSH and SSL traffic/data. No longer secure.
61
FTP (File Transfer Protocol)
Transfer files to and from servers. No confidentiality or Integrity checks. Should not be used. Uses TCP port 21 for sending command/ control collection. Uses TCP port 20 for sending the data
62
SFTP (SSH/Secure File Transfer Protocol)
Uses SSH to add security to FTP
63
FTPS (FTP Secure)
Uses TLS and SSL to add security to FTP
64
TFTP(Trivial FTP)
uses UDP port 69. No authentication or directory structure, files are written and read from one directory /tftpboot. Used for "Bootstrapping" - Downloading an OS over the network for diskless workstations. Used for saving router configuration.
65
DNS (Domain Name System)
Translates server names into IP Address, uses TCP/UDP port 53. Uses UDP for most requests and natively has no authentication
66
Authoritative name servers
The authority for a given name space
67
Recursive name server
Tries to resolve names it does not already know
68
Cache name server
Keeps previously resolved names in a temporary cache
69
DNS Poisoning
is similar to ARP poisoning, an attacker sends a fake address/name combo to another DNS server when asked and the server keeps it in its DNS record until it expires
70
DNSSEC (DNS Security Extensions)
Provides Authentication and Integrity using PKI Encryption
71
SNMP (Simple Network Management Protocol)
Mostly used to monitor devices on our network (routers, switches, servers, HVAC, UPS) An SNMP client agent is enabled or installed on the client. SNMPv1/v2 send data in cleartext and should be avoided.
72
SNMPv3
uses encryption to provide CIA. This should be the standard across any organization.
73
HTTP (Hypertext Transfer Protocol)
Uses TCP port 80 (8008, 8080) unencrypted website data sent across the Internet
74
HTTPS (HTTP Secure)
Uses TCP Port 443 (8443), encrypted data sent over the Internet
75
HTML (Hypertext Markup Language)
The actual language webpages are written in.
76
BOOTP (Bootstrap Protocol)
Used for diskless workstations, used to determine OS (downloaded with tftp) and IP address
77
DHCP (Dynamic Host Config Protocol)
The common protocol we use to assign IP's. DHCP process: Discovery, Offer, Request, Acknowledge
78
Both BOOTP and DHCP
use UDP Port 67 for the BOOTP/DHCP Server and UDP 68 for the Client.
79
EMI
Magnetism that can disrupt data availability and integrity.
80
Crosstalk
is the signal crossing from one cable to another, this can be an confidentiality issue
81
Attenuation
is the signal getting weaker the farther it travels.
82
Cable UTP (Unshielded Twisted Pair)
Pairs of twisted pairs of cable.
83
Cable STP (Shielded Twisted Pair)
Has extra metal mesh shielding around each pair of cables, making them less susceptible to EMI, but also making the cables thicket and more expensive.
84
Coax (Coaxial) Cables
for cable TV and ISP
85
Fiber Optic Cables
uses light to carry data. Distance has no attenuation like copper. Not susceptible to EMI.
86
Single-Mode fiber
a single strand of fiber carries a single mode of light, used for long distance cables (Often used in IP-bakbones)
87
Multi-mode fiber
uses multiple modes (light colors) to carry multiple data streams simultaneously, this is done with WDM (Wavelength Division Multiplexing)
88
Cable/speed
```
1Kbps (10^3)
1Mbps (10^6
1Gbps (10^9)
1Tbps (10^12)
1Pbps (10^15)
```
89
CSMA (Carrier Sense Multiple Access)
Clients on a network check to see if the shared line is in use, if not they will not send their data.
90
CSMA/CD (CSMA/Collision Detection)
Used for systems that can send and receive at the same time like Ethernet. If the line is clear the client sends and then waits a random amount of time while monitoring the network. They send a Jam signal to tell the other nodes to stop sending. Each switch port is its own collision domain.
91
CSMA CA (CSMA/Collision Avoidance)
Used for systems that can either send or receive like wireless. On wireless clients are not aware that there is other wireless clients, only the Access Points is aware of other clients. If a lot of congestion the client can send a RTS (Request to Send), and if the AP replies with a CTS (Clear to Send), similar to a token, the client will transmit. The AP only issues a CTS to one node at a time.
92
Star Topology
All nodes are connected to a central device. This is what we normally use for the ethernet, or nodes are connected to a switch.
93
Partial Mesh
nodes are directly connected to all other nodes.
94
Full Mesh
All nodes are directly connected to all other nodes. Often used in High Availability enviroments, with cluster servers for keepalives.
95
WAN copper connections where attentuation is high for DSL
T1 (US): Dedicated 1,544 Mbps circuit. Often also called DS1
T3 (US): 28 bundled T1 lines, dedicated 44,736 circuit
E1 (EU): Dedicated 2,048 circuit
E3 (EU): 16 bundled E1 lines, dedicated 34,368 Mbps circuit.
96
MPLS (Multiprotocol label switching
Often used to connect geographical distant locations of an org. w/MPLS VPN connections. Seems like one continuous seamless network. Directs data from one node to the next based on short path labels and not IP address. The labels id. virtual links/paths between distant nodes and not the endpoint. Encapsulates packets for other protocols/tech (T1/E1, ATM, Frame Relay, DSL). Can create end-to-end circuits across any type of transport medium, using any protocol. Operates in OSI "2.5"
97
SDLC (Synchronus Data Link Control)
A synchronous L2 WAN protocol that uses polling (token passing) to transmit data. Uses NRM transmission only.
98
HDLS (High-Level Data Link Control)
The successor to SDLC. Adds error correction and flow control, and two additional modes (ARM/ABM)
99
SDLC NRM (Normal Response Mode)
Secondary nodes transmit when given permission by the primary only.
100
HDLC ARM (Asynchronous Response Mode)
Secondary nodes my initiate communication with the primary node.
101
HDLC ABM (Asynchronous Balanced Mode)
Most commonly used mode. When nodes act as primary or secondary, initiating transmission without receiving permission.
102
DNP3 (Distributed Network Protocol)
A set of light weight comm protocols used btw components in process automation systems. Mainly used in utilitiessuch as elec/wtr companies. Used by SCADA for comm btw a Master Station (Cntrl Cntr) and Remote Terminal Units and Intelligent Electronic Devices.
103
SAN (Storage Area Network)
protocols provide a cost-effective way to use existing network infra tech and protoc to connect servers to storage. A SAN allows block-level file access across a network, it acts liek an attached hard drive.
104
FCoE (Fiber Channel over Ethernet)
Uses Ethernet, not TCP/IP, and because of that it is not routable.
105
FCIP (Fiber Channel over IP)
Encapsulates fiber channel frames via TCP/IP
106
VSAN (Virtual storage area network)
A collection of ports from a set of connected fiber channel switches, that form a virtual fabric.
107
iSCSI (Internet Small Comp Sys Interface)
Leverages existing networking infrastructure and protocols to interface with storage. Uses higher layers TCP/IP for comm and can be routed. Can be used for storage across a WAN. Uses LUNS to provide addressing storage across the network.
108
VoIP (Voice over IP)
A group of technologies for the delivery of voice comm and multimedia sessions over IP networks. The digital info is packetized, and transmitted using UDP IP packets over a packet-switched network. Audio/Video encoded with codecs. VoIP is used for VoIP phones, smartphoes, PC's calls/texts can be sent over 3/4G or Wi-Fi. Needs real time error free connections.
109
VoIP protocols
SIP (Session Initiation Protocol), H.323. If you see a transport protocol or control protocol its a safe bet its VoIP protocol.
110
SDN (Software-defined networking)
Allows network administrators via software to initialize, cntrl, chg, mng network behavior dynamically.
111
WLAN (Wireless LAN)
Are based on IEEE 802.11 standards. Usually referred to WiFi
112
Rogue access points
An unauthorized access point that has been added to our network without our knowledge.
113
Wi-Fi Jamming/Interference
Jamming is DOS attack. Interference can be addressed by changing channels or frequencies.
114
Evil twin
rogue access point used to gain access to the network information that is being put through a network. Can compromise confidentiality and integrity.
115
802.11 versions, frequency, range
802. 11-1997: 2.4 GHz, 1,2 Mbits/s, 20m
802. 11a: 3.7 GHz, 6,9,12,18,24,36,48,54 Mbits/s, 35m
802. 11b: 2.4 GHz, 1,2,5.5,11 Mbits/s, 35m
802. 11g: 2.4 GHz, 6,9,12,18,24,36,48,54 Mbits/s, 35m
802. 11n: 2.4/5 GHz, Up to 150 Mbits/s, 70m
802. 11ac: 5 GHz, Up to 866.7 Mbits/s, 35m
116
802.11 Managed/Client mode:
Commonly used. Clients connect to an access point in managed mode, once connected, clients communicate with the access point only.
117
802.11 Master/infrastructure mode:
The mode used by wireless access points.
118
802.11 Ad-hoc mode
WNIC can interface with all other wireless nodes directly as long as they are on the same channel and SSID. A comp connected to the Internetvia a wired NIC my advertise an ad-hoc WLAN to allow Internet sharing.
119
802.11 Monitor mode/ RFMON
WNIC can capture all traffic without having to be associated with the AP or Ad-hoc network first.
120
SSID (Service Set ID)
name of the wireless AP you see when you connect.
121
WEP (Wired Equivalent Privacy)
No longer secure, should not be used.
122
WPA (WiFi Protected Access)
Vulnerable so should not be used unless WPA2 is not feasible. Uses RC4 and TKIP neither of which are secure.
123
WPA2 also called RSN (Robust Security Network)
Current standard, the most secure form of WPA2 is WPA2-PSK using AES. Was found to have a vulnerability, but with a patch it is good to go.
124
Bluetooth
wireless data exchanging over short distances using 2.4 GHz from fixed and mobiles devices, and building personal area networks (PANs). Class 1: 100m, 2: 10 m, 3: under 10m. Bluetooh implements confidentiality, authentication and key derivation with custom algorithms based on teh SAFER+block cipher. Bluetooth key generation is generally based on a Bluettoh PIN, which must be entered on one or both devices.
125
Bluetooth attacks:
Bluejacking: Sending unsolicited messages over Bluetooh, most often harmless but annoying.
Bluesnarking: Unauthorized access of info from a Bluetooth device phones, desktop, laptops
Bluebugging: The attacker gain total access and cntrl of your device, it can happen when your device is left in discoverable mode. Only happens on old devices with old OS.
126
Layer 1 devices
Repeaters, Hubs
127
Layer 2 devices
Bridges are 2 port switches used to separate collision domains.
Switches are bridges with more than 2 ports. Each port is it's own collision domain.
128
MAC Sticky #
command to only allow that # of MAC to use the port.
129
VLAN pruning for trunk ports
enable this command on ports between switches.
130
VLAN is a broadcast domain that is partitioned and isolated at layer 2.
VLAN Trunks ports connecting two switches to span VLAN's across them.
131
Layer 3 Routers
Forward traffic based on source and destination IP's and ports.
132
Static route
a preconfigured route, always, send traffic there for a certain subnet.
133
Default gateway
sends all non-local traffic to an ISP for instance
134
Dynamic route
is learned from another routing via a routing protocol (OSPF, EIGRP, BGP, IS-IS)
135
Metric
is used to determine the best route to a destination. Hop count
136
Router Control Plane
the routing table that lists which route should be used to forwared a data packet, and through which physical interface connection
137
Forwarding plane
The router forwards data packets between incoming and outgoing interface connections. It routes them to the correct network type using information that the packet header contains.
138
All IGP (Interior Gateway Protocols)
rely on covergence to function right.
139
Exterior Gateway Routing Protocol, BGP
typcially never converges because the Internet is too big for the changes to be communicated fast enough.
140
Distance vector routing protocols
only focus on how far the dest is in Hops
141
RIP (Routing Inf Protocol)
Uses UDP 520 for its transport protocol. HOP is the only metric it uses. No longer really used.
142
Link-stating routing protocol
Each node independetnly runs an algorithm over the map to determine the shortest path from itself to every other node in the network.
143
OSPF (Open Shortest Path First)
Used within a single routing domain, which is logically divided into areas. Converges on a new loop-free routing tables within seconds. Does not use UDP/TCP, but encapsulates the data directly in IP packets with protocol # 89.
144
BGP (Border Gateway Protocol)
What the Internet uses. BGP routes between AS (Autonomous Systems) which are networks with multiple Internet connections. Considered a path vector routing protocol. Makes rouring decisions based on paths, network, policies, or rule-sets.
145
1st gen: Packet filtering firewalls, OSI Layer 1-3
Packet filters act by inspecting the "packets" which are transferred between clients. Any packet that matches one of the Permits, is allowed to pass. If a packet does not match the packet filter set of filtering rules, the packet filter will drop the packet or reject it and send error responses to the source.
146
2nd gen: Stateful filtering firewalls, OSI 1-4
Records all cxn passing through and determines whether a packet is the start of a new connection, a part of an existing cxn, or not a part of any cxn. Static rules are still used, these rules can now contain cxn state as one of their criteria. DOS attacks try to fill the cxn state memory by bombarding it with thousands of fake cxns.
147
3rd gen: Application layer firewall, OSI Layer 7
These firewalls can understand certain applications and protocols. They see the entire packer, the packet isn't decrypted until layer 6, any other firewall can only inspect the packet, but not the payload.
148
Network firewall
filter traffic btw 2 or more networks, either software appliances running on general purpose hardware, or hardware-based firewall
149
Proxy server
can act as a firewall by responding to input packets in the manner of an app, while blocking other packets. A proxy server is a gateway from one network to another for a specific application.
150
Host-based firewalls
provide a layer of software security on one host that controls network traffic in and out of that single machine.
151
Bastion host
is a special purpose hardened host desinged and configured to withstand attacks. Normally hosts a single app, all other services are removed or limited to reduce the threat to the host. It is placed either on the outside of the firewall or in the DMZ.
152
Dual-homed host
host w/ two NICs, one connected to a trusted network, and the other connected to an untrusted network (Internet). It doesn't route. No longer used, mostly used pre modern firewalls.
153
Modem (Modulator/Demodulator)
still used today
154
ADSL modem (asymmetric digital subscriber line)
TP telephone cable can carry signals with higher frequencies than the cable's normal frequency rating. The signal drops the longer the cable (attenuation)
155
Cable modems
use infrastructure originally inteded to carry television signals and therefore designed from teh outset to carry higher frequencies.
156
DTE (Data terminal equipment)
An end devicde often a desktop or server. Not really used any longer.
157
DCE
is often a modem, it sits between the data terminal equipment (DTE) and a data transmission circuit. Not really used any longer.
158
PAP (Password Authentication Protocol)
Sends credentials in clear text. No longer used.
159
802.1x defines the encapsulation of the EAP (Extensible Authentication Protocol)
802.1x auth involves 3 parites: a supplicant (client), an authenticator (network device, eg switch/AP), Authentication server (AS, RADIUS)
160
EAP is widely used, in 802.11 (WiFi) the WPA and WPA2 stndrs
it was adopted with 100+ EAP Types as the official authentication mechanisms
161
PEAP (Protected EAP)
A protocol that encaps EAP within a encrypted and authenticated TLS (Transport Layer Security) tunnel
162
EAP-MD5
Very weak form of EAP. It offers server authn only not mutual authn. Vulnerable to man in the middle/pwd attck
163
LEAP (Lightweight Extensible Authentication Protocol)
Cisco distr the protocol through the CCX as part of getting 802.1x and dynamic WEP adoption into the industry in the absence of a standard. No native support for LEAP in Win OS
164
EAP-TLS (EAP-Transport Layer Security)
Uses PKI, requiring both server/client certs. Establishes secure TLS tunnel for authn. Secure,e expensive and complex
165
EAP-TTLS (EAP Tunneled Transport Layer Security)
Simpler than EAP-TLS by dropping the client-side cert req, allowing other authn methods for client-side authentication.
166
PANA (Protocol for Carrying Authentication for Network Access)
Allows a device to authenticate itself with a network to be granted access. EAP will be used for authn protocol, key dist, key agreement, key derivation protocols.
167
SLIP (Serial Line Internet Protocol)
An encap of IP designed to work over serial ports and modem cxns. On PCs it has been replaced by PPP. On microcontrollers, SLIP is still the preferred way of encapsulating IP packets because of the very small overhead.
168
PPP (Point to Point Protocol)
Used over many types of Physical networks including serial cable, phone line, turnk line, cell. PPP is also used over Internet access connections. ISPs have used PPP for customer dial-up access to the Internet.
169
VPN (Virtual Private Network)
Extends a private network across a public network, and users can send and recieve data across shared or public networks as if they were on the private network. Created by est a virt point to point cxn through the use of dedicated cxns, virtual tunneling proto, traffic encryption. Get around geo-restrictions and censorship
170
PPTP (Point to Point Tunneling Protocol)
Obsolete method for implementing VPN. Not used no built in encryp or authn
171
L2TP (Layer 2 Tunneling Protocol)
Tunneling protocol used to support VPNs or as part of the delivery of services by ISPs. No built in encryp or confid, it relies on an encryp proto that it passes within the tunnel to provide priv.
172
IPSec SA (Security Association)
Simplex one-way comm, can be used to negotiate ESP or AH parameters. If 2 sys use ESP to comm they need 2 total SA and ESP 4 total.
173
IPSec ISAKMP (Internet Security and Key Management Proto)
manages the SA creation process.
174
IPSec Tunnel mode
encrypts and authn the entire package (inc hdrs)
175
IPSec Transport mode
only encryp and authn the payload, used for systems that speak ITSEC.
176
IPSec IKE (Internet Key Exchange)
negotiates the algorithm selection proc to pick the highest and fastest level of security.
177
VNC (Virtua Network Computing)
Non proprietary and can run on most OS' for RDP, Helpdesk access.
178
RDP (Remote Desktop Protocol)
MS proprietary proto server listens on TCP/UDP 3389.
179
VDI Thin Clients
Diskless workstation Thin Client Apps use web browser.
180
VDI Zero Clients
slimmer and more cost-effective than thin clients. Require no config and nothing is stored on them.
181
WAP (Wireless App Proto)
used in early 2000's when mobile devices could not handle full broswer w/HTML. WAP uses microbrowser instead and WML instead of XML.
182
CDN (Content Dist Network)
Are geographically dispered network of proxy srvrs and data centers.
