Network Management Services Flashcards
1
Q
SSH
A
Secure Shell
- Principal means of secure remote access to UNIX and Linux servers and most types of network appliances
- Can be used to secure SFTP
- Port 22 by default
- Server must be configured with key pair, but client can use key pair or other authentication method, like a password
2
Q
SSH Host Key
A
- Public/private key pair that identifies SSH server
- Map of host names to public keys can be kept manually by each SSH client
- Must be changed if any compromise of host is suspected, as the attacked could masquerade as the server
3
Q
SSH Client Authentication Kerberos
A
- Client submits Kerberos credentials obtained when user logged into workstation to the server using the generic Security Services Application Program Interface (GSSAPI)
- Server contacts ticket Granting Service(often DC) to validate credential
4
Q
SSHD
A
- Starts SSH Daemon
- Parameters like host’s certificate file, port to listen on and logging options can be set
5
Q
ssh-keygen
A
- Create a key pair to access servers
- Private key must be stored securely on local computer
- Public key must be copied to server
6
Q
ssh-agent
A
- Configure service to use to store the keys used to access multiple hosts.
- Reduces the number of times key must be confirmed with passphrase
- Provides SSO mechanism for multiple SSH servers
- SSH-ADD used to add key to agent
7
Q
ssh host
A
Use SSH Client to connect to the server running host.
- host can be FQDN or IP address
8
Q
ssh Username@host
A
- Use SSH client to connect to server running at host with a different username
9
Q
SNMP
A
Simple Network Management Protocol
- Widely used framework for remote management and monitoring of servers and network appliances
- Uses agents and a monitoring system
10
Q
SNMP Agents
A
- Process running on network device or server
- Maintains database of statistics relating to activity of device called MIB (Management Information Base)
- Each parameter in MIB is call OID(Object Identifier)
- Passes information top management system, with same community name
11
Q
SNMP Monitor
A
- Management system where you can oversee network activity
- Polls agents at intervals for MIBs
- Gets information by “Get” regular polling
or Trap, based on certain threshold meeting events
12
Q
Syslog
A
- protocol and supporting software that facilitates log collection
- De facto standard for logging events from distributed systems
- Usually listens on port 514
13
Q
Logging level
A
- Determines maximum level at which events are recorded or forwarded
- 0 is highest priority
- If it is set to 4, levels 5-7 are not forwarded
14
Q
Jitter
A
- Variation in transmission delay
- Mainly a problem for real-time applications
15
Q
Diffserv
A
Differentiated Services
- Classifies each packet passing through a device
- Policies can be applied to router to prioritize delivery
- Works at layer-3
16
Q
Traffic Shapers
A
- delay certain packet types based on content to ensure other packets have priority
- Helps reduce latency for critical services
- Stores packet until there is bandwidth available
17
Q
Top Talker/Listener
A
- Interfaces generating most outgoing traffic(in terms of bandwidth)
- Listeners receive most traffic
- Identifying these and routes can be useful to eliminate bottlenecks
18
Q
Netflow
A
- Gathers traffic metadata only and reports to structured database
- Use sapling to reduce processing demands
- Utilizes exporters, collectors and analyzers
19
Q
Link State
A
- Whether or not an interface is up or down
- Alerts can be configured for when an interface goes down
- You can also track downtime percentage
20
Q
Reset
A
- Number of times an interface has restarted in sample time.
- If interface is continually resetting it is described as flapping
21
Q
Speed
A
- rated speed of interface in Mbps or Gbps
- Should be the same for host and switch ports
22
Q
Duplex
A
- Most ethernet interfaces operate in full duplex
- If operating in half, indicates a problem
23
Q
Utilization
A
- Data transferred over a period of time
- calculated as amount transferred or as % of available bandwidth
24
Q
Per-Protocol Untilization
A
- Packet or byte count for a specific protocol
25
Q
Error Rate
A
- Number of packets per second that cause errors
- May be caused from interference or bad link quality
26
Q
Discard and drops
A
- Interface may discard frames for reasons like checksum errors, mismatched MTUs, too small packets (runts) to big (giants).
27
Q
Retransmissions
A
- Caused by packet loss necessitating retransmission
28
Q
CRC
A
Cyclic Redundancy Check
- Calculated by an interface when it sends a frame
- Derives a 32 bit value from contents of fram
- Added to header
- Receiving interface runs same calculation and rejects different value
- Errors caused by interference on Layer 1
29
Q
Public Key Management
A
- Critical security task
- If a users private key is compromised, public key must be deleted and regenerated
- Always delete public keys if user access had been revoked
30
Q
System Log
A
- Records Startup events and subsequent changes to configuration at OS level
- Includes Kernel Processes and drivers but also core services
31
Q
Application Log
A
- Records data for single, specific service like DNS, HTTP or RDBMS
- Complex application could write multiple log files
32
Q
Audit Logs
A
- Records use of authentication and authorization privileges
- Generally records success/fail type events
- Also called access or security log
- Done at OS level or per application level
33
Q
Performance/Traffic Logs
A
- Record statistics for compute, storage and network resources over defines period
34
Q
Latency
A
- Time it takes for transmission to reach recipient
- Measures in ms
- Problem for real time applications
- Can test with ping, pathping and mtr
- Need to consider RTT(Round Trip Time)
- VoIP RTT is required to have less than 300 ms.
35
Q
802.1p
A
- Used at layer 2 to classify and prioritize traffic passing through switch or WAP
- Defines tagging mechanism in VLAN field (802.1Q/p)
- Value is set to 0-7, with 0 being highest priority
36
Q
Class of Service Mechanisms
A
- Categorize protocols into groups that require different service levels and provide tagging mechanism to identify them
- DiffServ and 802.1p
37
Q
Control Plane
A
- Division of network function for QoS
- Makes decisions about how traffic should be prioritized and where it should be switched
38
Q
Data Plane
A
- Division of network function for QoS
- Handles actual switching of traffic
39
Q
Management Plane
A
- Division of network function for QoS
- Monitors traffic conditions
40
Q
Traffic Shapers
A
- Delay certain packet types based on their content
- Will store packets until bandwidth is available
41
Q
Throughput testers
A
- Divides file size by time it took to transfer file
- Should be used at a time representative of real-world network usage
- iperf, ttcp, bwping can be used as throughput testers
42
Q
Encapsulation Errors
A
- Error in the frame format expected by the interface
- Prevents transmission and reception
- Physical link will appear as up, but line protocol will be listed as down
Issue could be: - Wrong frame type
- Ethernet trunk error
- Router framing
