Module 3.3 Flashcards
Maximum size in bytes of a frame’s payload. If the payload cannot be encapsulated within a single frame at the Data Link layer, it must be fragmented.
maximum transmission unit (MTU).
A standard _____________ frame has a maximum length of 1518 bytes, excluding preamble
Ethernet
Each ethernet frame has an 18-byte header:
__ byte destination and source MAC address fields
__byte error checking field.
__ byte Ether Type field
6 / 4 / 2
To comply with CSMA/CD, the minimum length of an Ethernet frame is 64 bytes, so the payload must be at least ___ bytes.
46
Most Gigabit and 10 GbE Ethernet devices support jumbo frames with a larger MTU, such as _____________ bytes. Such products are not standardized, however, and there can be compatibility issues when using devices from different vendors.
9000
Recording data from frames as they pass over network media, using methods such as a mirror port or tap device.
packet sniffer
A basic software-based sniffer installed to a host will simply ____________the frames received by the network adapter by installing a special driver. This allows the frames to be read from the network stack and saved to a file on disk
interrogate
_____________________ this means that the sensor is attached to a specially configured port on the switch that receives copies of frames addressed to nominated access ports (or all the other ports).
SPAN (switched port analyzer)/mirror port-
Hardware device inserted into a cable to copy frames for analysis.
TAP
___________________this is a box with ports for incoming and outgoing network cabling and an inductor or optical splitter that physically copies the signal from the cabling to a monitor port
Passive test access point ( TAP )-
______________________this is a powered device that performs signal regeneration (again, there are copper and fiber variants), which may be necessary in some circumstances.
Active TAP-
Command-line packet sniffing utility.
TCP Dump
Widely-used protocol analyzer.
Wireshark
______________________________is an open source graphical packet capture and analysis utility, with installer packages for most operating systems.
Wireshark ( wireshark.org )
On a SOHO network, switches are more likely to be _________________, standalone units that can be added to the network and run without any configuration. The switch functionality might also be built into an Internet router/modem.
Unmanaged