Various

Question 1

001 What is virtualization, what are its 3 key points and 5 benefits?

Answer 1

Virtualization = using a single physical machine’s hardware to run multiple virtual machines within it

Key points:
- it uses a system’s hardware
- it allocates the CPU / RAM / storage to Virtual Machines
- it cannot exceed the total CPU / RAM / storage that is available on the physical hardware

Benefits:
- better use of hardware resources
- power saving / reduced footprint
- easier recovery (VMs can be saved as files and be in multiple locations for backup and recovery purposes)
- more flexibility (VMs can be moved unlike hardware based machines)
- research and testing without the need for a physical machine

Question 2

002 What is VSI?

Answer 2

Virtual Server Instance

Question 3

003 What is a hypervisor?

Answer 3

It’s a piece of software that runs above the physical host and enables virtualization by pulling the resources from the host and allocating them to the virtual environments.

Question 4

004 What are the two types of hypervisor?

Answer 4

1) Type 1 - Bare Metal (BM) Hypervisors

• installed directly on a bare metal hardware (server), so the virtual machines are added from within the virtualization layer (the hypervisor)
• once it is installed we connect to it via a web-browser or a client and set up our VMs

examples: VMWare vSphere / ESXi, Microsoft Hyper-V, Citrix XenServer

2) Type 2 - Hosted Hypervisors

• installed on a host OS
• VMs are run directly from that computer
• usually running a virtual desktop inside an existing computer (Linux on Windows or the opposite way)

examples: VMWare Workstation / Fusion, Oracle / VirtualBox, Parallels (Mac)

Question 5

010 What is a three-way handshake?

Answer 5

A three-way handshake is a method used in a TCP/IP network to create a connection between a local host/client and a server.

It is a three-step method designed to allow both communicating ends to initiate and negotiate the parameters of the network TCP socket connection at the same time before data such as HTTP and SSH is transmitted.

Multiple TCP socket connections can be transmitted in both directions simultaneously. A three-way handshake is also known as a TCP handshake or SYN-SYN-ACK, and requires both the client and server to exchange SYN (synchronization) and ACK (acknowledgment) packets before actual data communication begins.

In fact, its name originates from the three messages transmitted by TCP before a session between the two ends is initiated.

Question 6

011 What are the steps of three-way handshake?

Answer 6

Step 1: A connection between server and client is initiated:

First, the target server must have open ports that can accept and initiate new connections. The client node sends a SYN (Synchronize Sequence Number) data packet over an IP network to a server on the same or an external network.

This SYN packet is a random sequence number that the client wants to use for the communication (for example, X). The objective of this packet is to ask/infer if the server is open for new connections.

Step 2: The server receives the SYN packet from the client node:

When the server receives the SYN packet from the client node, it responds and returns a confirmation receipt – the ACK (Acknowledgement Sequence Number) packet or SYN/ACK packet. This packet includes two sequence numbers.

The first one is ACK one, which is set by the server to one more than the sequence number it received from the client (e.g. X+1).

The second one is the SYN sent by the server, which is another random sequence number (for example, Y).

This sequence indicates that the server correctly acknowledged the client’s packet, and that is sending its own to be acknowledged as well.

Step 3: The client node receives the SYN/ACK from the server and responds with an ACK packet.
Once again, each side must acknowledge the sequence number received by incrementing it by one.

So now it’s the turn of the client to acknowledge the server’s packet by adding one to the sequence number (in this case, Y+1), and resend it to the server.

Upon completion of this process, the connection is created and the host and server can communicate.

All these steps are necessary to verify the serial numbers originated by both sides, guaranteeing the stability of the connection.

Since both hosts must acknowledge the connection parameters of the other side, a missing or out-of-order segment can be quickly detected before the actual data transfer process is initiated.

Question 7

015 How to find MAC address?

Answer 7

Command for UNIX/Linux:

ifconfig -a
ip link list
ip address show

Command for Windows OS:

ipconfig /all

MacOS:

TCP/IP Control Panel

Question 8

016 What is DNS?

Answer 8

The Domain Name System (DNS) is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources.

Each device connected to the Internet has a unique IP address which other machines use to find the device. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).

Question 9

017 What are the 8 steps of DNS lookup?

Answer 9

The 8 steps in a DNS lookup:

1) A user types ‘example.com’ into a web browser and the query travels into the Internet and is received by a DNS recursive resolver (or a recursive DNS server)

2) The resolver then queries a DNS root nameserver (.).

3) The root server then responds to the resolver with the address of a Top Level Domain (TLD) DNS server (such as .com or .net), which stores the information for its domains. When searching for example.com, our request is pointed toward the .com TLD.

4) The resolver then makes a request to the .com TLD.

5) The TLD server then responds with the IP address of the domain’s nameserver, example.com.

6) Lastly, the recursive resolver sends a query to the domain’s nameserver.

7) The IP address for example.com is then returned to the resolver from the nameserver.

8) The DNS resolver then responds to the web browser with the IP address of the domain requested initially.

Once these 8 steps of the DNS lookup have returned the IP address for example.com, the browser is able to make the request for the web page:

9) The browser makes a HTTP request to the IP address.

10) The server at that IP returns the webpage to be rendered in the browser (step 10).

Question 10

018 What is a WKP?

Answer 10

Well Known Port

A number from 0 through 1023 used to identify a network service on a private IP network or the public Internet.

Residing in a field in the TCP or UDP header, the port number directs packets to the appropriate application in the server. The most common well-known port is 80, which identifies HTTP traffic for a Web server.

Question 11

019 What are the most common well known ports?

Answer 11

HTTP 80 Web
HTTPS 443 Web (secure)

FTP 20,21 File transfer
SFTP 22 File transfer (secure)
FTPS 989, 990 File transfer (secure)

SIP 5060 VoIP (Internet phone)

DNS 53 Find IP address

SMTP 25 Internet mail
POP3 110 POP mailbox
IMAP 143 IMAP mailbox

Telnet 23 Remote login
SSH 22 Remote login (secure)

NNTP 119 Usenet newsgroups
NNTPS 563 Usenet (secure)

IRC 194 Chat

NTP 123 Network time of day

SNMP 161,162 Network management
CMIP 163,164 Network management

Syslog 514 Event logging

Kerberos 88 Authentication

NetBIOS 137-139 DOS/Windows naming

Question 12

020 What is HTTP?

Answer 12

The Hypertext Transfer Protocol (HTTP) is the foundation of the World Wide Web, and is used to load web pages using hypertext links. HTTP is an application layer protocol designed to transfer information between networked devices and runs on top of other layers of the network protocol stack. A typical flow over HTTP involves a client machine making a request to a server, which then sends a response message.

Question 13

021 What is HTTP request?

Answer 13

An HTTP request is the way internet communications platforms such as web browsers ask for the information they need to load a website.

Each HTTP request made across the Internet carries with it a series of encoded data that carries different types of information. A typical HTTP request contains:

HTTP version type
a URL
an HTTP method
HTTP request headers
optional HTTP body

Question 14

022 What’s an HTTP method?

Answer 14

An HTTP method, sometimes referred to as an HTTP verb, indicates the action that the HTTP request expects from the queried server.

For example, two of the most common HTTP methods are ‘GET’ and ‘POST’

‘GET’ request expects information back in return (usually in the form of a website), while a ‘POST’ request typically indicates that the client is submitting information to the web server (such as form information, e.g. a submitted username and password).

Question 15

023 What is HTTP request header?

Answer 15

HTTP headers contain text information stored in key-value pairs, and they are included in every HTTP request and response.

These headers communicate core information, such as what browser the client is using and what data is being requested.

Example of HTTP request header (the first row is a request row containing basic information, the rest is the header) :

GET /tutorials/other/top-20-mysql-best-practices/ HTTP/1.1
Host: net.tutsplus.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120
Pragma: no-cache
Cache-Control: no-cache

Question 16

024 What is HTTP response?

Answer 16

An HTTP response is what web clients (often browsers) receive from an Internet server in answer to an HTTP request.

These responses communicate valuable information based on what was asked for in the HTTP request.

A typical HTTP response contains:

an HTTP status code
HTTP response headers
optional HTTP body

Question 17

025 Whats an HTTP status code?

Answer 17

HTTP status codes are 3-digit codes most often used to indicate whether an HTTP request has been successfully completed. Status codes are broken into the following 5 blocks:

1xx Informational
2xx Success
3xx Redirection
4xx Client Error
5xx Server Error
The “xx” refers to different numbers between 00 and 99.

Status codes starting with the number ‘2’ indicate a success. For example, after a client requests a web page, the most commonly seen responses have a status code of ‘200 OK’, indicating that the request was properly completed.

If the response starts with a ‘4’ or a ‘5’ that means there was an error and the webpage will not be displayed. A status code that begins with a ‘4’ indicates a client-side error (It’s very common to encounter a ‘404 NOT FOUND’ status code when making a typo in a URL). A status code beginning in ‘5’ means something went wrong on the server side. Status codes can also begin with a ‘1’ or a ‘3’, which indicate an informational response and a redirect, respectively.

Question 18

026 What is HTTP response headers and body?

Answer 18

Much like an HTTP request, an HTTP response comes with headers that convey important information such as the language and format of the data being sent in the response body.

Successful HTTP responses to ‘GET’ requests generally have a body which contains the requested information. In most web requests, this is HTML data which a web browser will translate into a web page.

Question 19

027 What is CLI?

Answer 19

Command Line Interface
Command Line Interpreter
Command Line Input

CLI is a command line program that accepts text input to execute operating system functions.

In the 1960s, using only computer terminals, this was the only way to interact with computers.

In the 1970s an 1980s, command line input was commonly used by Unix systems and PC systems like MS-DOS and Apple DOS.

Today, with graphical user interfaces (GUI), most users never use command-line interfaces (CLI).

However, CLI is still used by software developers and system administrators to configure computers, install software, and access features that are not available in the graphical interface.

Question 20

028 What is ping?

Answer 20

Ping (Packet Internet Groper) is a method for determining communication latency between two networks. Simply put, ping is a method of determining latency or the amount of time it takes for data to travel between two devices or across a network. As communication latency decreases, communication effectiveness improves.

Question 21

029 How to get a ping of a certain website?

Answer 21

By typing “pingwebsite name” into the command prompt or terminal to have your system send some data packets to that specific website and then acknowledge you with value of ping that is occurring within your system and that specific website.

Question 22

030 What is a protocol analyzer?

Answer 22

Protocol analyzers are tools that allow IT administrators and security teams to capture network traffic and perform analysis of the captured data to identify problems with network traffic or potential malicious activity.

This traffic data can be observed in real time by a technician for troubleshooting purposes, monitored by an alerting tool to identify active network threats, or retained to perform forensic analysis in the case a network breach is discovered.

Question 23

032 What is a layer 2 switch?

Answer 23

A layer 2 switch is a type of network switch or device that works on the data link layer (OSI Layer 2) and utilizes MAC Address to determine the path through where the frames are to be forwarded. It uses hardware based switching techniques to connect and transmit data in a local area network (LAN).

Question 24

033 What is a MAC address table?

Answer 24

The MAC address table is where the switch stores information about the other Ethernet interfaces to which it is connected on a network.

The table enables the switch to send outgoing data (Ethernet frames) on the specific port required to reach its destination, instead of broadcasting the data on all ports (flooding).

Question 25

034 What is layer 2 broadcast?

Answer 25

A Layer 2 Broadcast is any frame with a Destination MAC address of FFFF. FFFF. FFFF (or ff:ff:ff:ff:ff:ff or ff-ff-ff-ff-ff-ff)

This is a MAC address specifically reserved for Broadcast Frames. It is also sometimes displayed as — these are all identical ways of displaying the “all F’s” MAC address.

Question 26

035 What is a subnet mask?

Answer 26

Every device has an IP address with two pieces: the client or host address and the server or network address. IP addresses are either configured by a DHCP server or manually configured (static IP addresses).

The subnet mask splits the IP address into the host and network addresses, thereby defining which part of the IP address belongs to the device and which part belongs to the network.

Question 27

036 What is default gateway?

Answer 27

A default gateway is a node that enables a connection between networks in order to allow machines on other networks to communicate. The ‘default’ part of the terminology relates to the fact it is often the first and default route taken.

One of the most common uses for a default gateway is to access web pages; a request is sent through the gateway before it actually gets on to the internet. Other use cases of default gateways include connecting multiple devices to a single subnet. In that scenario, the default gateway acts as an intermediary.

Put simply, default gateways are routing systems that allow requests to find the path of least resistance to their intended destination, even if the network protocols of the sender and the receiver are different.

Question 28

037 What is DHCP?

Answer 28

Dynamic Host Configuration Protocol (DHCP) is a network management protocol used to automate the process of configuring devices on IP networks, thus allowing them to use network services such as DNS, NTP, and any communication protocol based on UDP or TCP.

A DHCP server dynamically assigns an IP address and other network configuration parameters to each device on a network so they can communicate with other IP networks.

Question 29

038 What is DORA?

Answer 29

DORA is the Process that is used by DHCP (Dynamic Host Configuration Protocol). It is used for providing the IP Address to the clients/host machine. It has four main stages and it obtains the IP Address from the centralized server.

D - Discover
O - Offer
R - Request
A - Acknowledge

Question 30

039 What is NAT?

Answer 30

When devices communicate on the Internet, they are sending data from their IP address to the IP address of their intended destination.

Sometimes, while data is en route to a destination, the IP addresses used in the communication need to be translated to different IP addresses.

This IP translation is similar to when multiple employees of the same company use their individual phones (with individual phone numbers) to make outbound phone calls, yet still appear as if they were all using the same company phone number.

The process of translating one IP address to another is known as Network Address Translation, or NAT.

There are many different reasons one would need NAT, and many different ways of translating IP addresses. Understanding NAT is paramount to any Network Engineer, as every wifi, home, or company network employs Network Address Translation at some point.

Traditionally, NAT exists to translate Private IPv4 addresses into Public IPv4 addresses. For the sake of simplicity, this article series will describe NAT from this perspective. However, in reality, it does not matter whether the IP addresses being translated are public or private. NAT could easily occur from private addresses to other private addresses or from public addresses to other public addresses.

Question 31

040 What is a Firewall?

Answer 31

A firewall is a network security device that monitors incoming and outgoing network traffic and permits or blocks data packets based on a set of security rules.

Its purpose is to establish a barrier between our internal network and incoming traffic from external sources (such as the internet) in order to block malicious traffic like viruses and hackers.

Question 32

041 What is DMZ?

Answer 32

In computer networks, a DMZ, or demilitarized zone, is a physical or logical subnet that separates a local area network (LAN) from other untrusted networks – usually, the public internet. DMZs are also known as perimeter networks or screened subnetworks.

Any service provided to users on the public internet should be placed in the DMZ network. External-facing servers, resources and services are usually located there. Some of the most common of these services include web, email, domain name system, File Transfer Protocol and proxy servers.

Servers and resources in the DMZ are accessible from the internet, but the rest of the internal LAN remains unreachable. This approach provides an additional layer of security to the LAN as it restricts a hacker’s ability to directly access internal servers and data from the internet.

Hackers and cybercriminals can reach the systems running services on DMZ servers. Those servers must be hardened to withstand constant attack. The term DMZ comes from the geographic buffer zone that was set up between North Korea and South Korea at the end of the Korean War.

Question 33

042 What is Port Forwarding?

Answer 33

Port forwarding is a technique that is used to allow external devices access to computers services on private networks.

It does this by mapping an external port to an internal IP address and port.

Question 34

043 What is OSPF?

Answer 34

The OSPF (Open Shortest Path First) protocol is one of a family of IP Routing protocols, and is an Interior Gateway Protocol (IGP) for the Internet, used to distribute IP routing information throughout a single Autonomous System (AS) in an IP network.

The OSPF protocol is a link-state routing protocol, which means that the routers exchange topology information with their nearest neighbors. The topology information is flooded throughout the AS, so that every router within the AS has a complete picture of the topology of the AS. This picture is then used to calculate end-to-end paths through the AS, normally using a variant of the Dijkstra algorithm. Therefore, in a link-state routing protocol, the next hop address to which data is forwarded is determined by choosing the best end-to-end path to the eventual destination.

Question 35

044 What is ICMP?

Answer 35

The Internet Control Message Protocol (ICMP) is a network layer protocol used by network devices to diagnose network communication issues. ICMP is mainly used to determine whether or not data is reaching its intended destination in a timely manner. Commonly, the ICMP protocol is used on network devices, such as routers. ICMP is crucial for error reporting and testing, but it can also be used in distributed denial-of-service (DDoS) attacks.

The primary purpose of ICMP is for error reporting. When two devices connect over the Internet, the ICMP generates errors to share with the sending device in the event that any of the data did not get to its intended destination. For example, if a packet of data is too large for a router, the router will drop the packet and send an ICMP message back to the original source for the data.

A secondary use of ICMP protocol is to perform network diagnostics; the commonly used terminal utilities traceroute and ping both operate using ICMP. The traceroute utility is used to display the routing path between two Internet devices. The routing path is the actual physical path of connected routers that a request must pass through before it reaches its destination. The journey between one router and another is known as a ‘hop,’ and a traceroute also reports the time required for each hop along the way. This can be useful for determining sources of network delay.

The ping utility is a simplified version of traceroute. A ping will test the speed of the connection between two devices and report exactly how long it takes a packet of data to reach its destination and come back to the sender’s device. Although ping does not provide data about routing or hops, it is still a very useful metric for gauging the latency between two devices. The ICMP echo-request and echo-reply messages are commonly used for the purpose of performing a ping.

Question 36

045 What is TTL?

Answer 36

When a packet of information is created and sent out across the Internet, there is a risk that it will continue to pass from router to router indefinitely. To mitigate this possibility, packets are designed with an expiration called a time-to-live or hop limit. Packet TTL can also be useful in determining how long a packet has been in circulation, and allow the sender to receive information about a packet’s path through the Internet.

Each packet has a place where it stores a numerical value determining how much longer it should continue to move through the network. Every time a router receives a packet, it subtracts one from the TTL count and then passes it onto the next location in the network. If at any point the TTL count is equal to zero after the subtraction, the router will discard the packet and send an ICMP message back to the originating host.

Question 37

046 What is traceroute?

Answer 37

When we connect with a website, the data we get must travel across multiple devices and networks along the way, particularly routers. A traceroute provides a map of how data on the internet travels from its source to its destination.

A traceroute plays a different role than other diagnostic tools, such as packet capture, which analyzes data. Traceroute differs in that it examines how the data moves through the internet. Similarly, you can use Domain Name System time to live (DNS TTL) for tracerouting, but DNS TTL addresses the time needed to cache a query and does not follow the data path between routers.

A traceroute works by sending Internet Control Message Protocol (ICMP) packets, and every router involved in transferring the data gets these packets. The ICMP packets provide information about whether the routers used in the transmission are able to effectively transfer the data.

Question 38

047 What is a floating IP address?

Answer 38

A floating IP is usually a public, routable IP address that is not automatically assigned to an entity. Instead, a project owner assigns them to one or more entities temporarily. The respective entity has an automatically assigned, static IP for communication between instances in a private, non-routable network area, as well as via a manually assigned floating IP. This makes the entity’s services outside a cloud or network recognizable and therefore achievable.

In appropriately configured failover scenarios, an IP ‘floats’ to another active unit in the network so that it can take on the function of a dormant entity without a time delay, and can then answer incoming requests.

Question 39

048 What is BIG-IP?

Answer 39

BIG-IP is a collection of hardware platforms and software solutions providing services focused on security, reliability, and performance.

F5’s BIG-IP is a family of products covering software and hardware designed around application availability, access control, and security solutions. That’s right, the BIG-IP name is interchangeable between F5’s software and hardware application delivery controller and security products. This is different from BIG-IQ, a suite of management and orchestration tools, and F5 Silverline, F5’s SaaS platform. When people refer to BIG-IP this can mean a single software module in BIG-IP’s software family or it could mean a hardware chassis sitting in your datacenter. This can sometimes cause a lot of confusion when people say they have question about “BIG-IP” but we’ll break it down here to reduce the confusion.

BIG-IP software products are licensed modules that run on top of F5’s Traffic Management Operation System® (TMOS). This custom operating system is an event driven operating system designed specifically to inspect network and application traffic and make real-time decisions based on the configurations you provide. The BIG-IP software can run on hardware or can run in virtualized environments. Virtualized systems provide BIG-IP software functionality where hardware implementations are unavailable, including public clouds and various managed infrastructures where rack space is a critical commodity.

Question 40

049 What are the primary software modules for BIG-IP?

Answer 40

BIG-IP Local Traffic Manager (LTM) - Central to F5’s full traffic proxy functionality, LTM provides the platform for creating virtual servers, performance, service, protocol, authentication, and security profiles to define and shape your application traffic. Most other modules in the BIG-IP family use LTM as a foundation for enhanced services.

BIG-IP DNS - Formerly Global Traffic Manager, BIG-IP DNS provides similar security and load balancing features that LTM offers but at a global/multi-site scale. BIG-IP DNS offers services to distribute and secure DNS traffic advertising your application namespaces.

BIG-IP Access Policy Manager (APM) - Provides federation, SSO, application access policies, and secure web tunneling. Allow granular access to your various applications, virtualized desktop environments, or just go full VPN tunnel.

Secure Web Gateway Services (SWG) - Paired with APM, SWG enables access policy control for internet usage. You can allow, block, verify and
log traffic with APM’s access policies allowing flexibility around your acceptable internet and public web application use. You know…. contractors and interns shouldn’t use Facebook but you’re not going to be responsible why the CFO can’t access their cat pics.

BIG-IP Application Security Manager (ASM) - This is F5’s web application firewall (WAF) solution. Traditional firewalls and layer 3 protection don’t understand the complexities of many web applications. ASM allows you to tailor acceptable and expected application behavior on a per application basis . Zero day, DoS, and click fraud all rely on traditional security device’s inability to protect unique application needs; ASM fills the gap between traditional firewall and tailored granular application protection.

BIG-IP Advanced Firewall Manager (AFM) - AFM is designed to reduce the hardware and extra hops required when ADC’s are paired with traditional firewalls. Operating at L3/L4, AFM helps protect traffic destined for your data center. Paired with ASM, you can implement protection services at L3 - L7 for a full ADC and Security solution in one box or virtual environment.

Question 41

050 What is TMOS?

Answer 41

Traffic Management operating system or TMOS is, first of all, it is not an operating system which operates F5 chassis but TMOS encompasses a collection of operating systems and firmware, all of which run on BIG-IP hardware appliances or within the BIG-IP Virtual Edition.

TMOS is the software ecosystem which forms the management, control, and dataplane of Big IP solutions. It gives you complete control of the connections, packets, and payload for applications.

TMOS helps greatly reduce the overhead of CPU scheduling where each component within the system performs operations and then lets the next component run. It’s the Brain behind BIG-IP which is developed as the foundation for all F5 products.

Using F5’s event-driven iRules we can customize how we intercept, inspect, transform, and direct inbound and outbound application traffic.

Question 42

051 What is TMM?

Answer 42

TMM is an abbreviation for Traffic Management Microkernel. TMMs are real-time software microkernels which form the overall L4-L7 intelligence for the data plane. We create clusters of these TMMs to linearly scale the traffic management data plane.

TMM have direct driver level integration to much of our hardware. Think speed. It’s software which thinks like a switch. Traffic processing hardware components are as follows;

An L2 switch module (possibly using network processing NICs).
Packet Velocity ASIC(s) (PVAs) or Embedded PVA (ePVA) using FPGAs
FPGAs providing ePVA, SYN check and other functions in hardware
SSL hardware acceleration—Offload costly SSL processing and accelerate key exchange and bulk
encryption with best-in-market SSL performance
Dedicated compression hardware (in some models).
The software in the form of the connection between TMM and the firmware that operates the dedicated SSL card and others
TMM uses all CPUs (although one is shared with the HMS) and almost all system RAM, a small amount being provisioned for the HMS.

Question 43

052 What is HMS?

Answer 43

HMS is a short form of Host Management Subsystem. HMS is responsible for system management and administration functions and runs a version of CentOS (Community Enterprise Operating System) Linux (which includes the SELinux feature).

The HMS uses a single CPU (shared with TMM) and is assigned a dedicated provider of the overall system RAM, the rest being assigned to TMM
HMS runs a modified version of the CentOS Linux operating system and provides various interfaces and tools used to manage the system such as the GUI Configuration Utility, tmsh CLI, DNS client, SNMP and NTP.
The HMS also contains an SSL stack (known as the COMPAT stack): OpenSSL, which can also be used by TMM where necessary

Question 44

053 What is LTM, AOM, IPMI, MOS, EUD?

Answer 44

LTM and other ‘feature’ modules such as GTM and APM expose specific parts of TMM functionality when licensed. They are typically focused on a particular type of service (load balancing, authentication and so on).

AOM or Always on Management provides additional ‘lights out’ management of the HMS via a Management processor as well as layer 2 switch management and other supporting functions for TMM.

AOM also lights out system management accessible through the management network interface and serial console.

IPMI or Intelligent Platform Management Interface is a hardware-level interface specification and protocol supported on BIG-IP iSeries hardware.

It allows for out of band monitoring and management of a system independently of (or without) an operating system and when the system is ‘off’.

Like AOM, IPMI functions are accessible through the management network interface and serial console.

MOS or Maintenance Operating System is used for disk management, file system mounting and related maintenance tasks. MOS runs in RAM and used for disk and file system maintenance purposes such as drive reformatting, volume mounting, system re-imaging and file retrieval. MOS also supports network access and file transfer.

EUD or End User Diagnostics is a software program used to perform a series of BIG-IP hardware tests – accessible via the serial console only on system boot. EUD is run from the boot menu or via supported USB media.

Question 45

054 What is SSL, TSL and HTTPS?

Answer 45

SSL stands for Secure Sockets Layer and, in short, it’s the standard technology for keeping an internet connection secure and safeguarding any sensitive data that is being sent between two systems, preventing criminals from reading and modifying any information transferred, including potential personal details. The two systems can be a server and a client (for example, a shopping website and browser) or server to server (for example, an application with personal identifiable information or with payroll information).

It does this by making sure that any data transferred between users and sites, or between two systems remain impossible to read. It uses encryption algorithms to scramble data in transit, preventing hackers from reading it as it is sent over the connection. This information could be anything sensitive or personal which can include credit card numbers and other financial information, names and addresses.

TLS (Transport Layer Security) is just an updated, more secure, version of SSL. We still refer to our security certificates as SSL because it is a more commonly used term, but when you are buying SSL from DigiCert you are actually buying the most up to date TLS certificates with the option of ECC, RSA or DSA encryption.

HTTPS (Hyper Text Transfer Protocol Secure) appears in the URL when a website is secured by an SSL certificate. The details of the certificate, including the issuing authority and the corporate name of the website owner, can be viewed by clicking on the lock symbol on the browser bar.

Question 46

055 What is CSR?

Answer 46

A certificate signing request (CSR) is one of the first steps towards getting your own SSL/TLS certificate. Generated on the same server you plan to install the certificate on, the CSR contains information (e.g. common name, organization, country) the Certificate Authority (CA) will use to create your certificate. It also contains the public key that will be included in your certificate and is signed with the corresponding private key.

Question 47

056 What information is included in a CSR?

Answer 47

The CA will use the data from the CSR to build your SSL Certificate. The key pieces of information include the following.

1. Information about your business and the website you’re trying to equip with SSL, including:

Common Name (CN)
(e.g. *.example.com, www.example.com, mail.example.com)

The fully qualified domain name (FQDN) of your server.

Organization (O)

The legal name of your organization. (Do not abbreviate and include any suffixes, such as Inc., Corp., or LLC.)

For EV and OV SSL Certificates, this information is verified by the CA and included in the certificate.

Organizational Unit (OU)

The division of your organization handling the certificate.

City/Locality (L)

The city where your organization is located. This shouldn’t be abbreviated.

State/County/Region (S)

The state/region where your organization is located. This shouldn’t be abbreviated.

Country (C)
The two-letter code for the country where your organization is located.

Email Address
An email address used to contact your organization.

2. The public key that will be included in the certificate. SSL uses public-key, or asymmetric, cryptography to encrypt transmitted data during an SSL session. The public key is used to encrypt and the corresponding private key is used to decrypt.
3. Information about the key type and length. The most common key size is RSA 2048, but some CAs, including GlobalSign, support larger key sizes (e.g. RSA 4096+) or ECC keys.

Question 48

057 What is port 443?

Answer 48

Port 443 is a virtual port that computers use to divert network traffic. Billions of people across the globe use it every single day. Any web search you make, your computer connects with a server that hosts that information and fetches it for you. This connection is made via a port – either HTTPS or HTTP port. You would have seen these precursors on web addresses. They depict which port is being used.

It is essential to know the difference between the two. HTTPS is secure and is on port 443, while HTTP is unsecured and available on port 80. Information that travels on the port 443 is encrypted using Secure Sockets Layer (SSL) or its new version, Transport Layer Security (TLS) and hence safer. The TLS 1.2 is the latest version which has fixed several recent vulnerabilities.

Using HTTPS also helps minimize an attack by a hacker by identifying open ports and then blocking access with a firewall. It is highly advisable to access and transact on sites with HTTPS to protect yourself from malicious elements as it prevents your personal information, passwords, customer data, and business-critical data from being intercepted and stolen.

Question 49

058 What is VIP?

Answer 49

Stands for “Virtual IP Address.” A VIP (or VIPA) is a public IP address that may be shared by multiple devices connected to the Internet. Internally, each device has a unique local IP address, but externally, they all share the same one.

VIPs are common in home and office networks. When a device connects to the network, the router assigns it a unique local IP address, typically via DHCP. Examples of local IP addresses include 192.168.0.2, 192.168.0.3, etc, with the router IP address set to 192.168.0.1. Some routers use the IP address 10.0.1.1 and assign IP addresses 10.0.1.2, 10.0.1.3, etc. Local IPs are merged into a single public (or “virtual”) IP using network address translation (NAT). The virtual IP address is what identifies the devices on the Internet.

VIPs are also used by servers. For example, multiple web servers may share the same IP address, allowing them to distribute requests across multiple machines. This is useful for load balancing and redundancy, A “high availability” server, for instance, may have a single IP address shared by two separate computers.

Question 50

059 What is a network pool?

Answer 50

When the device is serving as a DHCP server, one or more pools of IP addresses must be defined, from which the device will allocate IP addresses to DHCP clients. Each network pool contains a range of addresses that belong to a specific subnet. These addresses are allocated to various clients within that subnet.

When a client requests an IP address, the device as DHCP server allocates an IP address according to the following:

• Directly-Attached Client—The device allocates an address from the network pool whose subnet matches the subnet configured on the device’s IP interface from which the DHCP request was received.
If the message arrived directly (not via DHCP Relay) the pool is a Local pool and belongs to one of IP subnets defined on the input layer 2 interface. In this case, the IP mask of the pool equals to the IP mask of the IP interface and the minimum and maximum IP addresses of the pool belong to the IP subnet.

• Remote Client—The device takes an IP address from the network pool with the IP subnet that matches the IP address of the DHCP relay agent.
If the message arrived via DHCP relay, the address used belongs to the IP subnet specified by minimum IP address and IP mask of the pool and the pool is a remote pool.

Up to 16 network pools can be defined.

Question 51

060 What are SSL profiles?

Answer 51

An SSL profile is a collection of settings for SSL entities. It offers ease of configuration and flexibility. Instead of configuring the settings on each entity, you can configure them in a profile and bind the profile to all the entities that the settings apply to.

Question 52

061 What is the difference between persistent and non-persistent HTTP connection?

Answer 52

Non-persistent and persistent are the two types of HTTP connections used to connect the client with the webserver. The non-persistent connection has connection type 1.0, while the persistent connection has connection type 1.1.

Non-persistent
The non-persistent connection takes a total time of 2RTT + file transmission time. It takes the first RTT (round-trip time) to establish the connection between the server and the client. The second RTT is taken to request and return the object. This case stands for a single object transmission.

After the client receives the object in non-persistent, the connection is immediately closed. This is the basic difference between persistent and non-persistent. The persistent connection ensures the transfer of ​multiple objects over a single connection.

Persistent
A persistent connection takes 1 RTT for the connection and then transfers as many objects, as wanted, over this single connection.

RTT stands for the round-trip time taken for an object request and then its retrieval. In other words, it is the time taken to request the object from the client to the server and then retrieve it from the server back to the client.

Sample problem
Suppose 10 images need to be downloaded from the HTTP server. The total time taken to request and download 10 images in a non-persistent and persistent connection is:

Non-persistent
2 RTT (Connection time) + 2 * 10 RTT= 22 RTT
22RTT

Persistent
2 RTT (Connection time) + 10 RTT= 12 RTT
12RTT

Question 53

062 What is compression?

Answer 53

Data Compression reduces the amount of data that needs to be retained in order to ensure that the original information content of the data is maintained. When moving data across a network it can reduce the size of the data set that needs to be transmitted. This can be done in a lossless or in a lossy way. Lossless compression removes data from the data set in such a way that it can be added again when the data arrives at its destination. For example, removing characters that repeat and instead including a value saying how many of these characters there should be. Lossy compression removes data that is not required for the receiver to use the data. A typical example is reducing the colour depth information in images. Often this can be reduced significantly without noticeable degradation to the transmitted image.

Question 54

063 What is Caching?

Answer 54

What is Caching?
In computing, a cache is a high-speed data storage layer which stores a subset of data, typically transient in nature, so that future requests for that data are served up faster than is possible by accessing the data’s primary storage location. Caching allows you to efficiently reuse previously retrieved or computed data.
How does Caching work?
The data in a cache is generally stored in fast access hardware such as RAM (Random-access memory) and may also be used in correlation with a software component. A cache’s primary purpose is to increase data retrieval performance by reducing the need to access the underlying slower storage layer.

Trading off capacity for speed, a cache typically stores a subset of data transiently, in contrast to databases whose data is usually complete and durable.

Question 55

064 What is the difference between a node and a pool member?

Answer 55

A node is a logical object on the BIG-IP system that identifies the IP address of a physical resource on the network. You can explicitly create a node, or you can instruct the BIG-IP system to automatically create one when you add a pool member to a load balancing pool.

The difference between a node and a pool member is that a node is designated by the device’s IP address only (10.10.10.10), while designation of a pool member includes an IP address and a service (such as 192.168.1.1:80).

A primary feature of nodes is their association with health monitors. Like pool members, nodes can be associated with health monitors as a way to determine server status. However, a health monitor for a pool member reports the status of a service running on the device, whereas a health monitor associated with a node reports status of the device itself.

Nodes are the basis for creating a load balancing pool. For any server that you want to be part of a load balancing pool, you must first create a node, that is, designate that server as a node. After designating the server as node, you can add the node to a pool as a pool member. You can also associate a health monitor with the node, to report the status of that server.

There is quite a difference in what happens with a node or pool member monitor when one is marked down. When an object is marked down at the node all pool members using that IP, in all pools, will also be marked down This is because the monitor shows the device down and if the device is down then by association so would the services that reside there.

Question 56

065 What is Proxy Server?

Answer 56

A proxy server acts as a gateway between you and the internet. It’s an intermediary server separating end users from the websites they browse. Proxy servers provide varying levels of functionality, security, and privacy depending on your use case, needs, or company policy.

If you’re using a proxy server, internet traffic flows through the proxy server on its way to the address you requested. The request then comes back through that same proxy server (there are exceptions to this rule), and then the proxy server forwards the data received from the website to you.

Modern proxy servers do much more than forwarding web requests, all in the name of data security and network performance. Proxy servers act as a firewall and web filter, provide shared network connections, and cache data to speed up common requests. A good proxy server keeps users and the internal network protected from the bad stuff that lives out in the wild internet. Lastly, proxy servers can provide a high level of privacy.

Question 57

066 What is a Load Balancer?

Answer 57

A load balancer is a device that acts as a reverse proxy and distributes network or application traffic across a number of servers. Load balancers are used to increase capacity (concurrent users) and reliability of applications. They improve the overall performance of applications by decreasing the burden on servers associated with managing and maintaining application and network sessions, as well as by performing application-specific tasks.

Load balancers are generally grouped into two categories: Layer 4 and Layer 7. Layer 4 load balancers act upon data found in network and transport layer protocols (IP, TCP, FTP, UDP). Layer 7 load balancers distribute requests based upon data found in application layer protocols such as HTTP.

Requests are received by both types of load balancers and they are distributed to a particular server based on a configured algorithm. Some industry standard algorithms are:

Round robin
Weighted round robin
Least connections
Least response time

Layer 7 load balancers can further distribute requests based on application specific data such as HTTP headers, cookies, or data within the application message itself, such as the value of a specific parameter.

Load balancers ensure reliability and availability by monitoring the “health” of applications and only sending requests to servers and applications that can respond in a timely manner.

Question 58

067 What is SSL offloading?

Answer 58

SSL offloading is the process of removing the SSL-based encryption from incoming traffic to relieve a web server of the processing burden of decrypting and/or encrypting traffic sent via SSL. The processing is offloaded to a separate device designed specifically for SSL acceleration or SSL termination.

SSL termination is particularly useful when used with clusters of SSL VPNs, because it greatly increases the number of connections a cluster can handle.

Question 59

068 What is SSL bridging?

Answer 59

SSL bridging is a process where a device, usually located at the edge of a network, decrypts SSL traffic and then re-encrypts it before sending it on to the Web server. SSL bridging can be useful when the edge device performs deep-packet inspection to verify that the contents of the SSL-encrypted transmission are safe, or if there are security concerns about unencrypted traffic traversing the internal network.

An alternative to SSL bridging is SSL Termination. SSL termination generally offers higher overall throughput for SSL Offloading. The F5 BIG-IP® product family with SSL Acceleration Feature Module performs SSL offloading.

Question 60

069 What are TCP flags?

Answer 60

In TCP connection, flags are used to indicate a particular state of connection or to provide some additional useful information like troubleshooting purposes or to handle a control of a particular connection. Most commonly used flags are “SYN”, “ACK” and “FIN”. Each flag corresponds to 1 bit information.

Types of Flags:

Synchronization (SYN) – It is used in first step of connection establishment phase or 3-way handshake process between the two hosts. Only the first packet from sender as well as receiver should have this flag set. This is used for synchronizing sequence number i.e. to tell the other end which sequence number they should accept.

Acknowledgement (ACK) – It is used to acknowledge packets which are successfully received by the host. The flag is set if the acknowledgement number field contains a valid acknowledgement number.

Finish (FIN) – It is used to request for connection termination i.e. when there is no more data from the sender, it requests for connection termination. This is the last packet sent by sender. It frees the reserved resources and gracefully terminate the connection.

Reset (RST) – It is used to terminate the connection if the RST sender feels something is wrong with the TCP connection or that the conversation should not exist. It can get send from receiver side when packet is send to particular host that was not expecting it.

Push (PSH) – Transport layer by default waits for some time for application layer to send enough data equal to maximum segment size so that the number of packets transmitted on network minimizes which is not desirable by some application like interactive applications(chatting). Similarly transport layer at receiver end buffers packets and transmit to application layer if it meets certain criteria.
This problem is solved by using PSH. Transport layer sets PSH = 1 and immediately sends the segment to network layer as soon as it receives signal from application layer. Receiver transport layer, on seeing PSH = 1 immediately forwards the data to application layer.
In general, it tells the receiver to process these packets as they are received instead of buffering them.

Urgent (URG) –Data inside a segment with URG = 1 flag is forwarded to application layer immediately even if there are more data to be given to application layer. It is used to notify the receiver to process the urgent packets before processing all other packets. The receiver will be notified when all known urgent data has been received.

Question 60

070 What is IANA?

Answer 60

The Internet Assigned Numbers Authority (IANA) is a standards organization that oversees global IP address allocation, autonomous system number allocation, root zone management in the Domain Name System (DNS), media types, and other Internet Protocol-related symbols and Internet numbers.

Question 61

071 What are private and public IP addresses?

Answer 61

A public IP address identifies you to the wider internet so that all the information you’re searching for can find you. A private IP address is used within a private network to connect securely to other devices within that same network. Each device within the same network has a unique private IP address.

Question 62

072 What are RFC1918 private IP addresses and what is the purpose of them?

Answer 62

An RFC1918 address is an IP address that is assigned by an enterprise organization to an internal host. These IP addresses are used in private networks, which are not available, or reachable, from the Internet.

In fact, one of the basic requirements of the Internet is that each host has a unique IP address. RFC1918 removes this requirement. RFC1918 IP addresses can be used on multiple networks, as long as they’re private and isolated from each other. To implement this solution every Internet router must be configured to discard IP packets with these addresses. IP packets carrying private addresses can only flow on internal, private networks.

RFC1918 Motivations
This RFC was drafted in 1996 when it became clear to Internet operators that the IPv4 address space, consisting of 4,294,967,296 unique addresses, was not sufficient to address every single computer in the world. By that time, the Internet was rapidly growing beyond initial expectations. Soon, no IPv4 addresses would be available to use, limiting the Internet’s growth. As a solution, RFC1918 was drafted to enable private organizations to use these addresses internally. Private addresses can be used without asking permission to the Internet Assigned Numbers Authority (IANA), which governs the IP addresses assignment.

The only drawback of RFC1918 is that computers configured with private addresses cannot be reached from the Internet. With this new standard, computers were basically divided between public and private hosts. Hosts configured with private addresses are basically “clients”: they can connect to Internet servers, or other internal hosts, but can’t be reached from the Internet.

RFC1918 Subnets
The RFC1918 address space includes the following networks:

10.0.0.0 – 10.255.255.255 (10/8 prefix)
172.16.0.0 – 172.31.255.255 (172.16/12 prefix)
192.168.0.0 – 192.168.255.255 (192.168/16 prefix)
The ten-dot network (10/8) is typically used within large organizations that have thousands of hosts. The 172 and 192 subnets are more common within smaller organizations or home networks. If you are reading this article from home, most probably, your laptop is configured via DHCP with a 192 address.

Question 63

073 What is CIDR?

Answer 63

CIDR (Classless inter-domain routing)
CIDR (Classless inter-domain routing) is a method of public IP address assignment. It was introduced in 1993 by Internet Engineering Task Force with the following goals:

1. to deal with the IPv4 address exhaustion problem
2. to slow down the growth of routing tables on Internet routers

Before CIDR, public IP addresses were assigned based on the class boundaries:

Class A – the classful subnet mask is /8. The number of possible IP addresses is 16,777,216 (2 to the power of 24).
Class B – the classful subnet mask is /16. The number of addresses is 65,536
Class C – the classful subnet mask is /24. Only 256 addresses available.

Some organizations were known to have gotten an entire Class A public IP address (for example, IBM got all the addresses in the 9.0.0.0/8 range). Since these addresses can’t be assigned to other companies, there was a shortage of available IPv4 addresses. Also, since IBM probably didn’t need more than 16 million IP addresses, a lot of addresses were unused.

To combat this, the classful network scheme of allocating the IP address was abandoned. The new system was classsless – a classful network was split into multiple smaller networks. For example, if a company needs 12 public IP addresses, it would get something like this: 190.5.4.16/28.

The number of usable IP addresses can be calculated with the following formula:

2 to the power of host bits – 2

In the example above, the company got 14 usable IP addresses from the 190.5.4.16 – 190.5.4.32 range because there are 4 host bits and 2 to the power of 4 minus 2 is 14 The first and the last address are the network address and the broadcast address, respectively. All other addresses inside the range could be assigned to Internet hosts.

Question 64

074 What is APIPA?

Answer 64

Automatic Private IP Addressing (APIPA) is a feature of Windows-based OSes, that enables a Dynamic Host Configuration Protocol client to automatically assign an IP address to itself when there’s no DHCP server available to perform that function. APIPA serves as a DHCP server failover mechanism and makes it easier to configure and support small LANs.

When a DHCP client computer connects to the network, it attempts to communicate with a DHCP server. If a server is available, it will assign an IP address and other network parameters to the DHCP client. In some cases, a DHCP server may not be available. For example, the server may be down temporarily or there’s no DHCP server on the network.

If this occurs and APIPA is enabled, the client computer selects an IP address from a range of predefined addresses – 169.254.0.0 to 169.254.255.255 – and automatically assigns that address to itself. The Internet Assigned Numbers Authority (IANA) reserves these addresses specifically for APIPA use cases to ensure they don’t conflict with DHCP routable addresses.

Question 65

075 What is VoIP?

Answer 65

VoIP, the abbreviation for Voice over Internet Protocol, sometimes also referred to as IP telephony, is a technology that converts voice into digital signals that can be transmitted over internet digital data packets via your local area network/WAN/other infrastructure to enable phone calls. VoIP uses RTP (real-time protocol) to ensure that these packets get delivered timely.

Question 66

076 What are the 7 attributes of subnetting?

Answer 66

1. Network ID
2. Broadcast IP
3. First host IP
4. Last host IP
5. Next network
6. Total number of IP addresses
7. CIDR / Subnet

Question 67

077 What is VLSM and FLSM?

Answer 67

For subnetting an IP address for a network, one of two approaches can be used: VLSM or Fixed Length Subnet Mask (FLSM). These methods differ in three key ways: FLSM creates subnets of the same size and an equal number of host identifiers, while VLSM creates subnets with varying sizes with a variable number of hosts.

Question 68

078 How does the subnetting cheatsheet look like?

Answer 68

128 64 32 16 8 4 2 1
128 192 224 240 248 252 254 255
/25 /26 /27 /28 /29 /30 /31 /32
/17 /18 /19 /20 /21 /22 /23 /24
/9 /10 /11 /12 /13 /14 /15 /16
/1 /2 /3 /4 /5 /6 /7 /8

Question 69

079 How can we answer the following question and what is the answer?

“If we start with /18, what size of sub-net do we need to create 100 sub-nets?”

Answer 69

We will use so called network doubling technique:

As we start at /18, /19 contains two times more networks, /20 four times more, etc…

So we just find the first power of 2, that is higher than the desired number of subnets and add it to the CIDR notation.

In this case it’s 2 ** 7 which is 128. So we add 7 to 18, which gives us 25, which is the correct answer.

Question 70

080 How can we answer the following question and what is the answer?

“If we start with /21, how many sub-nets containing 50 IP addresses can we create?”

Answer 70

Our starting point is 21, so first we need to determine our ending point.

We do that by answering the question: “What is the smallest network that can contain 50 IP addresses?”

The answer is /26. It can contain up to 64 addresses.

Now we subtract the starting point from the ending point and use the result as a power of 2 to get the final number of subnets.

So in this case it is 26 - 21, which gives us 5.

2 to the power of 5 is 32, which is the correct answer.

Question 71

081 What is super-netting or IP aggregation?

Answer 71

Taking sub-nets and summarizing them into a single network.

Question 72

082 What is an Access port (or Untagged port)?

Answer 72

An Access port is a switch port that is a member of only one VLAN.

When configuring a port as an Access port, the administrator also designates the VLAN number that port is a member of. Whenever the switch receives any traffic on an Access port, it accepts the traffic onto the configured VLAN.

Question 73

083 What is a Trunk (or Trunk port or Tagged port)?

Answer 73

In order to extend a VLAN to the second switch, a connection is made between one Access port on both switches for each VLAN. While functional, this strategy does not scale. Imagine if our topology was using ten VLANs, on a 24 port switch nearly half of the ports would be taken up by the inter-switch links.

Instead, there is a mechanism which allows a single switch port to carry traffic from multiple VLANs. This is referred to as a Trunk port. A Trunk port is a switch port that carries traffic for multiple VLANs.

Typically, switch ports connected to end-host devices are configured as Access ports (e.g., workstations, printers, servers). Conversely, switch ports connected to other network devices are configured as Trunk ports (e.g., other switches, routers).

Question 74

084 What are Tagged Ports and Untagged Ports?

Answer 74

A Trunk port on a switch can receive traffic for more than one VLAN. So the receiving switch has to determine which frames belong to which VLAN.

To account for this, whenever a Switch is sending frames out a Trunk port, it adds to each frame a tag to indicate to the other end what VLAN that frame belongs to. This allows the receiving switch to read the VLAN tag in order to determine what VLAN the incoming traffic should be associated to.

An Access port, by comparison, can only ever carry or receive traffic for a single VLAN. Therefore, there is no need to add a VLAN Tag to traffic leaving an Access port.

Since VLANs are a Layer 2 technology, the VLAN Tag is inserted within the Layer 2 header. The standard Layer 2 header in modern networks is the Ethernet header, which has three fields: Destination MAC Address, Source MAC Address, and Type.

When an Ethernet frame is exiting a Trunk port, the switch will insert a VLAN Tag between the Source MAC address and the Type fields.

This allows the receiving switch to associate the frame with the appropriate VLAN.

Question 75

085 Should all traffic on VLAN include VLAN tags?

Answer 75

The general precedent is traffic to end-hosts should not include any VLAN tags, Hosts can and should remain blissfully ignorant of what VLANs they are in, or even whether VLANs are being utilized at all.

A possible exception would be if a single Physical Host is hosting multiple Virtual Machines (VMs) — like a Hypervisor. In some cases, each of those VMs need to exist in separate VLANs. Therefore, the Physical Host must be connected to a Trunk port, and must send and received VLAN tags in order to confine the virtual machine traffic to a specific VLAN.

Question 76

086 What is a native VLAN?

Answer 76

Without the tag, the switch will not know what VLAN the traffic belongs to, therefore the switch associates the untagged traffic with what is configured as the Native VLAN. Essentially, the Native VLAN is the VLAN that any received untagged traffic gets assigned to on a Trunk port.

Additionally, any traffic the switch forwards out a Trunk port that is associated with the Native VLAN is forwarded without a VLAN Tag.

The Native VLAN can be configured on any Trunk port. If the Native VLAN is not explicitly designated on a Trunk port, the default configuration of VLAN #1 is used.

That being said, it is crucially important that both sides of a Trunk port are configured with the same Native VLAN.

The destination host will never get this traffic. Even worse, due to a switch’s flooding behavior, wrong destination host might inadvertently get the traffic that was destined to the correct destination host.

Question 77

087 What is a recursive DNS server?

Answer 77

A recursive DNS server is a domain name system server that takes website name or URL (uniform resource locator) requests from users and checks the records attained from authoritative DNS servers for the associated IP address.

Recursive DNS servers are required to support the authoritative DNS servers, which would not otherwise be able to handle the workload created by the huge number of user requests. Recursive DNS servers further distribute this load to make website name requests supportable.

When a user types in www.whatis.techtarget.com, for example, this address itself does not contain the direction to find the site on the internet. It is only through DNS servers that the IP address is located and used to reach the site (unless the request has been made before from that computer and the response IP address has been cached locally).

Recursive servers are the first ones contacted as the result of a request. Should the contacted server have a cached response for the IP address from an authoritative server with a valid time to live (TTL), it is delivered. If the recursive server doesn’t have the IP address, then it begins its check through the hierarchy of authoritative DNS servers. Authoritative DNS servers in turn have their records supplied by the internet registrars where website owners set up their site names.

DNS servers are a weak point in the internet, as was demonstrated in late 2016 when a wide-scale botnet attack took down access to many major sites.

Question 78

088 What is a Proxy ARP?

Answer 78

The original thought process for Proxy ARP was to accommodate hosts with misconfigured subnet masks.

As we’ve discussed before, when a host is speaking to another host on the same IP network, the target for the ARP request is the other host’s IP address. If a host is speaking to another host on a different IP network, the target for the ARP request will be the Default Gateway’s IP address.

The item which tells a host whether another IP address is on the same network or a different network is the subnet mask.

Host A is configured with the IP address 10.0.0.11 and a subnet mask of 255.255.255.0 (or /24 in CIDR). Host A will consider any IP address in the range of 10.0.0.0 – 10.0.0.255 on its local network.

Host B is configured with the IP address 10.0.0.22 and misconfigured with a subnet mask of 255.255.0.0 (or /16 in CIDR). Host B will consider any IP address in the range of 10.0.0.0 – 10.0.255.255 on its local network.

Presume both of these hosts are trying to speak to Host D, which exists on a different network and has the IP address 10.0.4.44.

When Host A tries to speak to 10.0.4.44, it would (correctly) consider Host D on a different network and would use traditional ARP to send the packet to the default gateway.

However, when Host B tries to speak to 10.0.4.44, it would (incorrectly) consider Host D on the same network and would instead try to ARP for Host D’s MAC address directly.

Host B’s ARP Request will be broadcast to the local network, but will never make it across the Router to Host D. Therefore, the ARP Request will go unanswered, and Host B will be unable to communicate with Host D.

Unless the Router itself responds to Host B’s ARP Request on behalf of Host D – which is the exact definition of a Proxy ARP.

Proxy ARP also plays an important role with NAT on firewalls.

Question 79

089 What is a Gratuitous ARP?

Answer 79

A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast, as a way for a node to announce or update its IP to MAC mapping to the entire network.

There are 3 types of usecases:

1. Updating ARP Mapping

The first use case is pretty straight forward, a node can use a Gratuitous ARP to update the ARP mapping of the other hosts on the network should the node’s IP to MAC mapping change.

This might happen if a user manually modifies their MAC address – they retain the same IP address, but now have a new MAC address. Therefore, the ARP mapping for all the nodes which are communicating with this user must be updated.

2. Announcing a Node’s Existence

The intent motivating this action is useful — it is an attempt to preemptively populate ARP caches of neighboring hosts without requiring them to initiate the Traditional ARP process.

However, there is no mandate for hosts to cache ARP mappings in every Gratuitous ARP they receive. As a result, this use case provides little benefit. It causes no significant harm though, so this behavior is not discouraged.

3. Redundancy or Failover

Much more substantial is Gratuitous ARP’s use case in situations where redundancy or failover between two devices are used.

With redundancy, you typically have two scenarios: two devices sharing an IP address, but each having their own MAC address. Or, two devices sharing both an IP address and a MAC address.

In both of these cases, Gratuitous ARP is critically important to ensure the continued ability to communicate with the IP address as it shifts between the two redundant devices. Below are examples of each scenario and how Gratuitous ARP is employed:

3a) Redundant IP Addresses

In this scenario, only the IP address is redundant. Two devices will share a single IP address, but each device has their own unique MAC addresses.

Our example will use two Routers sharing the IP address 10.0.0.1. The hosts in our example will be using this shared IP address as their default gateway.

When one of the routers experiences a failure, the other router sends a Gratuitous ARP.

Upon receiving the Gratuitous ARP, all the hosts update their ARP tables with the new mapping so they can continue to send traffic to their default gateway IP address through the non-failed Router.

3b) Redundant IP and MAC Addresses

In this scenario, both the IP address and the MAC address are redundant. Two devices will share both an IP address and a MAC address.

Our example will again use two Routers, but this time they will be sharing the IP address 10.0.0.1 and the MAC address 0053.ffff.1111.

The hosts will still use the shared IP address as their default gateway, but in this example their ARP mapping will never need to change – the shared IP address 10.0.0.1 will always map to the shared MAC address 0053.ffff.1111.

Gratuitous ARP - Shared IP and MAC

Despite the hosts’ ARP mapping never needing to be updated, Gratuitous ARP is still crucial. But not for the sake of updating the hosts’ ARP mapping, but for the sake of updating the switch’s MAC address table so the shared MAC address is associated with the correct port. Recall, switches learn MAC address mappings from the Source MAC address of any received frame.

Notice, as a router fails, the other router sends a Gratuitous ARP. The switch then updates its MAC address table with the new location of the device that owns the shared MAC address.

Question 79

090 What are ARP Probe and ARP Announcement?

Answer 79

We finally come to the last iteration of ARP that this article series will discuss. They are the ARP Probe and the ARP Announcement. Both of these are used in a process known as Duplicate Address Detection.

The idea is if a host acquires and puts to use an IP address that happens to already be in use on the network, it will cause connectivity issues for both hosts. As such, it is beneficial for a host to first test an IP address before putting it to use to ensure it is indeed unique.

One such way of determining if an IP address in use is to use ARP. Or specifically, an ARP Probe.

The process is pretty straight forward, send a few ARP Probes (typically 3), and if no one responds, officially claim the IP address with an ARP Announcement.

Both the ARP Probes and the ARP Announcements are sent as Broadcast frames – using the destination MAC address of ffff.ffff.ffff in the Ethernet header.

Both are sent without being solicited by a request, which therefore makes them “gratuitous”. But technically, they are not exactly the same as a Gratuitous ARP.

Question 80

091 What is PAT?

Answer 80

Port Address Translation, or PAT, implies a translation of an IP address and Port to another IP address and Port.

PAT affects both the L3 header and the L4 header. Which means the IPv4 Header, as well as either the TCP or UDP header, will be modified.

We could consider PAT as a subset of NAT (i.e., Network Address Translation along with a Port translation), but there isn’t really a common use case for a Port translation only without an accompanying IP address translation as well. Therefore, nearly every instance of a PAT will also typically include an IP address translation as well.

In summary, a NAT modifies only the L3 header, and a PAT modifies both the L3 and L4 header. Or, said another way, a NAT modifies only the IP, and a PAT modifies both the IP and Port.

Question 81

092 What is the differnce between static and dynamic translation?

Answer 81

Static Translations

In a Static translation, the post-translation attributes are explicitly defined by the administrator (IP address for a NAT, or IP:Port for a PAT). A Static translation implies the pre-translation IP or IP:Port will permanently map to the same, constant post-translation IP or IP:Port.

A Static mapping is sometimes referred to as a One-to-One translation – implying that in a Static translation, a single IP or IP:Port can only ever appear as another single IP or IP:Port.

Dynamic Translations

In a Dynamic translation, the post-translation attributes are selected by the router at the time that the packet is received – the final post-translation attributes are not permanently mapped to pre-translation attributes.

The scope of post-translation attributes must be defined by the administrator, but the exact mapping is determined by the device, at the time the packet is received.

A Dynamic mapping is sometimes referred to as a One-to-Many or Many-to-One translation – implying that in a Dynamic translation, many addresses can appear as one, or one address can appear as many.

Question 82

093 What is TCP windowing concept?

Answer 82

TCP windowing concept is primarily used to avoid congestion in the traffic.

It controls the amount of unacknowledged data a sender can send before it gets an acknowledgement back from the receiver that it has received it.

It is one of the key factors for efficient data transmission.

It can also be known as a form of flow control where the host indicates the sender how much data can be accepted and wait for the further instructions.

More details at:

https://www.extrahop.com/company/blog/2017/tcp-windowing/

Question 83

094