Test Prep #3 Questions/Answers

Question 1

Control or data plane: IS-IS

Answer 1

Control - used to calculate routes that allow routers to later forward data packets, but does not carry data for any application

Question 2

Control or data plane: IP

Answer 2

Data - actual IP packets that are forwarded by routers are the packets that contain application data

Question 3

Control or data plane: UDP

Answer 3

Data - UDP packets contain application data

Question 4

Control or data plane: DHCP

Answer 4

Control - used to automatically assign IP addresses to end hosts. DHCP messages do not contain any application data themselves

Question 5

Control or data plane: 802.11 (Wi-Fi)

Answer 5

Data - link laker protocol that carries data for applications or higher level protocols (considered “data” by the link layer)

Question 6

flood()

Answer 6

Returns one packet per local port on the network spanning tree

Question 7

match(dstip=’10.0.0.8’)&raquo_space; fwd(12)

Answer 7

Any packet bound for IP 10.0.0.8 and forwards it along port 12. This effectively filters out all traffic not bound for IP 10.0.0.8.

Question 8

match(dstip=’10.0.0.1’)&raquo_space; ( match(srcip=’10.0.0.15’)&raquo_space; drop() + match(srcip=’10.0.0.25’)&raquo_space; modify(dstip=’10.0.0.30’) )

Answer 8

All traffic not bound for IP 10.0.0.1 is filtered. Any packets bound for 10.0.0.1 is then subject to parallel composition. If the packet is from IP 10.0.0.15, it is dropped. If the packet is from 10.0.0.25, it is returned, with the destination IP rewritten to 10.0.0.30.

Question 9

What are the advantages of using a Jellyfish topology over a traditional hierarchical data center topology?

Answer 9

• Network load balancing
• Higher capacity
• Shorter paths
• Incremental expansion

Question 10

Drawbacks of Jellyfish

Answer 10

• Does not handle heterogeneous switch devices well

- Long cable runs between random switch pairs may be necessary, but are inconvenient and difficult to install

Question 11

If you are trying to detect TCP SYN flooding attacks and want to raise an alarm when there are 1048576 (i.e., 1024^2) attack packets using a /12 subnet as the telescope, how many backscatter packets do you need to observe to detect the attack?

Answer 11

2^20 = 1048576. 1048576/2048576 = 1 packet to observe.

Question 12

3 categories of attackers against DNS

Answer 12

Off-path adversaries: can’t observe DNS queries and responses. Trigger DNS lookups, but must generate numerous packets in hopes of matching the request the resolver will accept as they must guess the transaction ID and other entropy.

On-path adversaries: passively observe the actual lookups and can directly forge DNS replies

In-path adversaries: can both block and modify packets and can block the legitimate packet. Hold-on can’t help here as the legitimate packets can be blocked.