Networks Flashcards
Define Physical Layer
The physical part of a network (e.g. Cables, Radio Waves, etc.)
The path data takes is a channel (e.g. Frequency Range)
Define Link Layer
Responsible for sending frames (encapsulated packets) over one hop of the physical layer
Link Layer: Frame Header & Trailer
Header: Source & Destination MAC Address
Trailer: Error Checking (e.g. Checksum). Uses Cyclic Redundancy Check (CRC) to identify corruption
Link Layer: Flow Control
Regulation of data transmitted over a network to prevent congestion
Link Layer: ARQ
Automatic Repeat Request. Re-transmits frames if Link Layer Acknowledgement (ACK) isn’t received before timeout
Link Layer: Connection-oriented & Connectionless Communication
Connection-Oriented: Established dedicated connection e.g. TCP
Connectionless: Independently delivered frames e.g. UDP
Link Layer: MAC Layer
Media Access Control sub-layer. Manages access to Physical Layer. CSMA/CD protocol ensures only one sender transmits at a time
Link Layer: LANs: ARP
Address Resolution Protocol. Determines MAC addresses using IPv4. Stores in ARP Cache (Vulnerable to Spoofing)
Network Layer: Define
Responsible for routing packets
Network Layer: MTU
Maximum Transmission Unit. Determines fragment size
Network Layer: QoS Methods
Quality of Service Methods. Minimise loss of important data by giving critical data (voice, video, etc.) necessary bandwidth and low latency
Network Layer: IPv4: Subnetting
Uses Subnet Masks to split on network into multiple sub-networks
Network Layer: IPv4: NAT
Network Address Translation. Translates private IPv4 address to public IPv4 address.
Network Layer: IPv4: CGNAT
Carrier Grade NAT (CGNAT). One public IPv4, many ISP customers.
Network Layer: IPv6: Address Compression
Remove leadings 0s, compress longest consecutive 0s to ::
Network Layer: IPv6: Link-local Address
For routing local network packets. fe80::/10
Network Layer: IPv6: Path MTU Discovery
Determines MTU size on path to receiver, fragmentation occurs only once
Network Layer: IPv6: Deployment Issues
Time, Money, Hardware Support, Education
Network Layer: ICMP
Internet Control Message Protocol. Adds a header to provide diagnostics before IP encapsulation
Network Layer: ICMPv6: NDP
Neighbour Discovery Protocol.
Neighbour Solicitation (NS) and Neighbour Advertisement (NA) messages to retrieve MAC addresses using IPv6 addresses
Router Advertisement (RA) and Router Solicitation (RS) to discover routers and config info (Network Prefix, Default Router Address, Address Allocation Type (SLAAC or DHCP))
Redirections inform hosts of better first-hop routers by updating routing tables.
Network Layer: ICMPv6: SLAAC
Allows hosts to configure their own IPv6 address without relying on a DHCPv6 server
Network Layer: Routing Tables
Database of information about paths to destinations.
Gateway: Connection to another network (typically a router). ‘On-link’ means end point is on the same network
Interface: The point of connection
Metric: Priority, lower number is higher priority
Network Layer: Traceroute
Determines route between two hosts by sending packets with increasing time-to-live (TTL) packets. ICMP time exceeded message sent
to sender when TTL is 0.
Latency not equal to RTT/2 as routes change quickly and routes are likely to be asymmetric
Network Layer: Autonomous Systems (AS)
Interconnected networks managed by a single netwrok
Network Layer: Multi-Homed AS
AS with multiple connections to other AS
Network Layer: Transit AS
AS with no network of its own, just provides connections between AS
Network Layer: Single-Homed/Stub AS
AS with one connection to another AS, typically a service provider
Network Layer: AS: Interior Gateway Protocol
A routing protocol using within autonomous systems
Network Layer: AS: Interior Gateway Protocol: Distance Vector Routing: RIP
Routers interact with only neighbour routers
Routing Information Protocol (RIP). Has a router send its routing table periodically to connected routers.
Limitations:
- Slow Updates (30s periodically)
- Unacknowledged (uses UDP)
- Poor Quality Metric (Hop count doesn’t take into account physical medium speed)
- Maximum Hop Count (after 15 hops, the router is deemed unreachable
- Cracked Authentication Hash (MD5)
Network Layer: AS: Interior Gateway Protocol: Link-State Routing
Routers interact with all routers to establish complete network knowledge
Broadcast reaches all routers and assigns cost
Dijkstras algorithm populates routing table
Benefits:
- Fast Updates
- Known Topology
- Avoids loops
Network Layer: AS: Exterior Gateway Protocol: BGP
Route between autonomous systems
Border Gateway Protocol: Considers relationships with other AS. Neighbours choose whether to route by you
Drawbacks:
- Trust Based
- Slow
- Flapping
- Limited routing table
Transport Layer: Definition
Responsible for data transfer between applications
Transport Layer: UDP
Connectionless, Unacknowledged
Transport Layer: TCP
Connection-oriented, Acknowledged (Uses SYN, SYN-ACK, ACK to establish connection)
Transport Layer: TCP: Congestion Control
Manages flow of data to avoid overload.
Congestion window is number of bytes that can be sent over a network. The ‘Slow Start’ algorithm gradually increases the window until timeout and then resets
Transport Layer: TCP: Flow Control
e.g. Sliding Window Protocol
Uses buffers and messages to allow sender to send data when buffer has enough space
Application Layer: Definition
Responsible for providing services to applications and users
Application Layer: DHCP
Dynamic Host Configuration Protocol.
Assigns IP addresses to reduce IP conflicts and simplify network administration
Uses DISCOVER, OFFER, REQUEST, ACK to assign IP addresses
Application Layer: DHCP Helper
Forwards DISCOVER messages from subnets to DHCP servers. Stops needed a server per subnet which is inefficient
Application Layer: DHCPv6
Uses IPv6 and uses DHCP Unique Identifiers (DUIDs) instead of MAC Addresses.
Terminology Changes
- DISCOVER -> Solicit
- OFFER -> Advertise
- ACK -> Reply
Application Layer: Telnet
Remote access of CLI.
Unencrypted, replaced by SSH
Application Layer: SMTP
Simple Mail Transfer Protocol.
Sends email, no authentication, vulnerable to email spoofing (extensions resolve this)
Application Layer: IMAP
Internet Message Access Protocol.
Used to manage and retrieve emails from a server. Uses TCP
Application Layer: HTTP
Client to Web Server.
GET
HEAD (Retrieve resource headers without retrieving all data)
POST (Process Data)
PUT (Modify or create data)
DELETE
1XX: Information
2XX: Success
3XX: Redirection
- 301: Moved Permanently
4XX: Client Error
- 403: Forbidden
- 404: Not Found
5XX: Server Error
- 500: Internal Error
Application Layer: HTTP/2
Adopted Multiplexing, one TCP connection, many requests
Application Layer: HTTP/3
Adopts Quick UDP Internet Connection (QUIC) protocol.
Built on UDP - adds reliability and encryption
Application Layer: RTSP
Real-time Streaming Protocol
Application Layer: SMB
Server Message Block.
Windows file-sharing
Application Layer: NFS
Network File System.
Unix file sharing. used between servers
Application Layer: MQTT
Message Queuing Telemetry Transport
Communication between IoT devices. TCP or UDP
Pub/Sub Model with Hierarchical Topics
+ wildcard selects all at a level
# wildcard selects all after a specific level
Application Layer: CoAP
Constrained Application Protocol
Communication between constrained devices (low power systems)
Uses small messages
UDP with retransmission and ACK
RESTful architecture like HTTP
Features
- Observation: Clients get updates on resource change
- Proxy Servers: Cache values
- Multicast Support
- Data Chunking
- Resource Discovery using CoRE
Application Layer: DNS
Domain Name System
Converts URL to IP
Uses UDP
ICANN Delegates domain names
Target for cyber attacks
DNS Resolvers query root DNS server if it cannot find the URL
Network Security: Firewalls
A barrier to malicious traffic between internal and external network
Network Security: Stateless Firewalls
Examine packets against a set of rules in an attempt to identify malicious intent
Network Security: Stateful Firewalls
Track connections to identify malicious pakcets
Network Security: Application-Layer Firewalls
Analyse packet contents to ensure the purpose is legitimate e.g. port 80 only receives HTTP
Network Security: NID
Network Intrusion Detection.
Monitoring of network traffic
Network Security: NIDS
Network Intrusion Detection Systems (NIDS)
Use signature-based detection and anomaly detection to identify potential threats (and in some cases take action)
Network Security: NAC
Network Access Control (NAC)
Determines what devices are granted network access (e.g. use MAC Address filtering (poor choice)
Network Security: NAC: 802.1x
NAC Solution using Extensible Authentication Protocol (EAP) requiring login credentials to access a network
Network Security: IPSec
Protocol and standards used by IP to provide authentication, integrity, confidentiality of IP packets. e.g. via encryption
Network Security: VPN: Site-to-Site
Securely connects two netwroks
Network Security: VPN: Remote-Access
Allows client to connect to a server and act resources as if they were physically there
Network Security: WEP
Wired Equivalent Privacy.
Outdated, insecure protocol designed to provide confidentiality over wireless connections similar to that of wired networks
Network Security: WPA
Wi-Fi protected access.
Upgrade to WEP
WPA Personal for small networks uses a constant Pre-shared key (PSK) that is vulnerable to dictionary attacks. Compromised devices are also an issue and there is no user-level authentication
WPA Enterprise for larger orgs, uses 802.1x
Network Security: Key Reinstallation Attack (KRACK)
Vulnerability in WPA and WPA2 that allows an attacker to work out the key used for secure connections
Network Security: WPS
Wifi Protected Setup
Makes it easier to connect to a WPA protected network using an easily trackable 8 digit pin or by pushing a physical button on the access point
Network Security: DNS
Vulernable as not encyrpted.
Where you are going can be seen, not what you are doing
Network Security: DNS Amplification
DDoS Attack using a spoofed IP and a misconfigured DNS server that response to a large request. overloading the victim
Mitigate by ignoring large requests