Linux Networking

Question 1

Using tcpdump, how can you isolate a specific interface port and source ip?

Answer 1

tcpdump -i eth0 port 8080 src 10.0.0.1

Question 2

Using tcpdump, how can you isolate a specific protocol?

Answer 2

tcpdump icmp

You can only isolate transport layer protocols like icmp, tcp, udp

Question 3

How are the OSI and TCP/IP models composed and how do they compare?

Answer 3

OSI Model TCP/IP Protocols
Application Application http,smtp,telnet,ftp
Presentation Application http,smtp,telnet,ftp
Session Application http,smtp,telnet,ftp
Transport Transport tcp, udp
Network Internet arp, ip, igmp, icmp
Data Link Network Interface / Network Access Layer
Physical Network Interface / Network Access Layer
https://www.iperiusbackup.net/wp-content/uploads/2019/09/image4.jpg

Question 4

What type of networks are there (not in terms of topology) and which devices can we find in each one?

Answer 4

LANs: switches, nic
WANs: routers, firewalls

Question 5

What is ARP used for?

Answer 5

ARP (Address Resolution Protocol) is used to discover the link layer address (mac address) given a network layer address (ip)

Question 6

What are some components of an IP header?

Answer 6

Version, header length, total length, identifier, flags, fragmentation offset, time to live, protocol, source address, destination address, header checksum

Question 7

What is TTL?

Answer 7

Time to live is a number that represents the maximum number of routers a packet is allowed to pass trough before dying. It is helpfull in preventing a packet from being stuck in an infinite loop

Question 8

Which command allows you to check the route a packet to a specific destination ip will follow?

Answer 8

traceroute (ip), -n flag removes wait time for dns resolutions

Question 9

What commands allows you to see the route table?

Answer 9

route -n or ip route

Question 10

What is the difference between static and dynamic routing?

Answer 10

Static routing is define manually for specific destinations, whilst dynamic ports are defined by algorithms that find the optimal path to specific destinations

Question 11

What commands allow you to define a default gateway?

Answer 11

sudo ip route add default via (ip)
or
sudo route add default gw (ip)

Question 12

How do you define default gateway in a permanent manner?

Answer 12

On ubuntu neplan yml file can be used (/etc/netplan/something.yaml) as follows:
network:
version: 2
renderer: networkd
ethernets:
enp2s0:
addresses: [192.168.1.10/24]
gateway4: 192.168.1.1
nameservers:
addresses: [1.1.1.1, 1.0.0.1]

And running sudo netplan apply followed by a reboot

Question 13

What does a tcp header contain?

Answer 13

Source and destination ports
Sequence number
Acknowledgement number
flags
window size
checksum
options

Question 14

What are the 3 states of a tcp connection that is being established, and how is each state reached?

Answer 14

SYN_SENT, SYN_RECEIVED, ESTABLISHED
syn_sent is reached when the first syn message is sent to the destination
syn_received is reached when the syn/ack is recieved from the target
established is reached when the final ack is sent to the target

Question 15

How does a tcp connection termination work?

Answer 15

Tcp connection is terminated by the source sending a FIN signal and the destination responding with ACK, after which the same processed is repeated for the destination, so the destination sends a FIN signal and awaits and ack before setting the connection as terminated

Question 16

Name 3 flags that can be set in a tcp connection?

Answer 16

SYN, ACK, FIN

Question 17

What command allows you to see active tcp connections?

Answer 17

netstat -t

Question 18

What is the purpose of the window size component of tcp header?

Answer 18

Window size determines the amount of segments that can be in flight without having been acknowledged

Question 19

How does mtls work?

Answer 19

Mutual tranaport layer security is a protocol that requires both client and server to have a certificate as oposed to tls where only the server has it. Comunicstions are then done with pub/private key pairs on both sides as well, meaning both client and server have their set of pub/private keys