Week 6 - Verifying Connectivity* Flashcards
What does ICMP stand for?
Internet Control Message Protocol
How is ICMP mainly used? What uses it?
ICMP is mainly used by a router or remote host to communicate why the transmission failed back to the origin of the message
How many sections does an ICMP packet contain?
5 sections
What are the sections of a ICMP packet?
- Type (of message)
- Code (details, different codes)
- Checksum
- Rest of Header (optionally used by Type and Code field)
- Data Payload (contains entire IP header, first 8 bytes of error packet)
What is ping? What type of message is it?
Ping is a command in a program that sends out an ICMP echo request to a destination that asks if it’s there.
What is an echo request?
An Echo request asks the destination if it’s there, able to communicate
In what OS are you able to use ping?
All major OS
How do you ping something?
Type ping command to an IP address or domain name
What are some command line flags you can use to control Ping’s behavior?
The size of the ICMP request, the number sent, and how quickly
How do you interrupt a ping command event on macOS and Linux?
Control + C
Windows by default gives you 4 ICMP echo replies
What is an ICMP echo reply?
The destination, if functioning and able to communicate, sends a reply
What is a useful utility to help you determine where in a long chain of router hops the problems are?
Traceroute
What is traceroute?
Traceroute is a utility that allows us to track the path/hops between 2 nodes to identify bottlenecks and problems in the network
What are 2 tools similar to traceroute? What OS do they work on?
mtr - Linux, MacOS
pathping - Windows
Describe the 2 tools similar to traceroute’s functions
mtr - works in real time, continuous updates on output
pathping - runs for 50 seconds, displays final data at once
What’s the utility command to enable following the path of a packet from node to node on each OS?
Linux: traceroute
MacOS: traceroute
Windows: tracert
Describe the way traceroute manipulates TTL field on the IP level
traceroute manipulates TTL by duplicating each packet by 3 and assigning each packet a TTL that corresponds with the packet number
There will be a time-exceeded message at each router hop since TTL is short
What information is displayed with traceroute? 4
- number of the hop
- roundtrip time for all 3 packets
- IP of the device at each hop
- hostname if traceroute can resolve one
What’s included in a ping’s output? 4
- address sending the ICMP echo reply’
- how long it took for a roundtrip
- TTL
- how big the message is in bytes
What are 2 powerful Transport Layer utilities?
- netcat
- Test-NetConnection
What’s the difference between the 2 powerful Transport Layer tools in terms of OS?
netcat - Linux, MacOS
Test-NetConnection - Windows
What is the command for netcat?
nc
What are the 2 parts to netcat?
nc host and nc port
What’s the command if you’re only curious about a port status using netcat?
nc -z -v google.com 80
How do you initiate the netcat command for verbose? What does verbose do?
-v
verbose makes the output friendly for humans to read
What’s the command on Windows to test a connection?
Test-NetConnection
How do you test a port connection on Windows?
Test-NetConnection -port (#)
What type of request does Test-NetConnection send by default when only typing the host name (domain)?
ICMP echo request (like ping but with more data)
also displays what data link layer protocol is being used
The protocol used to communicate network errors is known as?
ICMP
Internet Control Message Protocol
By default, the ping utility sends what type of message?
Echo request
On which operating system does traceroute send UDP packets to very high port number?
Linux/Mac OS
What is the name resolution tool that displays what server was used to perform the request and the name resolution result?
nslookup
what OS is nslookup available on?
all 3 of them
how do you start interactive mode for nslookup?
enter nslookup without a host name until angle bracket appears
What tool would you use to find the IP address for a domain?
nslookup
nslookup twitter.com -> A record is returned
what happens if you type server (address) in nslookup interactive mode?
all the name resolution queries will try to be made using THAT server instead of default name server
what’s the command to return different resource records for a name resolution query?
set type=(resource record type) in nslookup interactive mode
What command displays the full response packets including any intermediary requests for the transport layer?
set debug
What protocol layer is nslookup?
Transport layer
What protocol layer is ping?
Internet layer
