CyberSecurity2_Module 5 & 6-My questions

All computers that are connected to a network and that participate directly in network communication

end devices, endpoints, or nodes.

The web server runs web server software that allows many computers to access web pages.

The email server runs email server software that enables emails to be sent and received.

Internet Exchange Point

Are the set of rules that computers follow to communicate with eachother

• • DNS - Domain Name System.
• • DHCPv4 - Dynamic Host Configuration Protocol for IPv4.
• • DHCPv6 - Dynamic Host Configuration Protocol for IPv6.
• • SLAAC - Stateless Address Autoconfiguration.
• • SMTP - Simple Mail Transfer Protocol.
• • POP3 - Post Office Protocol version 3.
• • IMAP - Internet Message Access Protocol.
• • FTP - File Transfer Protocol.
• • SFTP - SSH File Transfer Protocol.
• • TFTP - Trivial File Transfer Protocol.
• • HTTP - Hypertext Transfer Protocol
• • HTTPS - HTTP Secure.
• • REST - Representational State Transfer

• • TCP - Transmission Control Protocol.
• • UDP - User Datagram Protocol.

• • IPv4 - Internet Protocol version 4.
• • IPv6 - Internet Protocol version 6
• • NAT - Network Address Translation.
• • ICMPv4 - Internet Control Message Protocol for IPv4
• • ICMPv6 - ICMP for IPv6.
• • CMPv6 ND - ICMPv6 Neighbor Discovery
• • OSPF - Open Shortest Path First
• • EIGRP - EIGRP - Enhanced Interior Gateway Routing Protocol.
• • BGP - Border Gateway Protocol.

• • ARP - Address Resolution Protocol.
• • Ethernet
• • WLAN - Wireless Local Area Network

refers to the process of removing headers and trailers as data passes from lower to upper layers. This process happens on the computer that is receiving data.

• • Flow control -This is the process of managing the rate of data transmission.
• • Response Timeout - how long to wait for a response from another device and what to do if response timeout occurs.
• • Access method - determines when someone can send a message.

• • This is the process of managing the rate of data transmission.
• • Flow control defines how much information can be sent and the speed at which it can be delivered.

Host on a network use response time out that specify how long to wait for responses from a another device and what action to take if a response timeout occurs.

A one-to-one delivery option is referred to as a unicast, meaning there is only a single destination for the message.

When a host needs to send messages using a one-to-many delivery option, it is referred to as a multicast.

If all hosts on the network need to receive the message at the same time, a broadcast may be used. Broadcasting represents a one-to-all message delivery option.

• • Assisting in protocol design because protocols that operate at a specific layer have defined information that they act upon and a defined interface to the layers above and below
• • Fostering competition because products from different vendors can work together
• • Preventing technology or capability changes in one layer from affecting other layers above and below
• • Providing a common language to describe networking functions and capabilities

Open System Interconnection (OSI) Reference Model

is sometimes referred to as the internet model.

• • There are 7 layers in the OSI model.
• • The following layers in the OSI model layers are:
• Layer 7 --> Application
• Layer 6 --> Presentation
• Layer 5 --> Session
• Layer 4 --> Transport
• Layer 3 --> Network
• Layer 2 --> Data Link
• Layer 1 --> Physical

• • There are 4 layers in the TCP/IP protocol model.
• • The following layers are in the TCP/IP protocol model.
• Layer 4 --> Application
• Layer 3 --> Transport
• Layer 2 -->Internet
• Layer 1 -->Network Access

OSI Model Layer	Description
7 - Application	The application layer contains protocols used for process-to-process communications.
6 - Presentation	The presentation layer provides for common representation of the data transferred between application layer services.
5 - Session	The session layer provides services to the presentation layer to organize its dialogue and to manage data exchange.
4 - Transport	The transport layer defines services to segment, transfer, and reassemble the data for individual communications between the end devices.
3 - Network	The network layer provides services to exchange the individual pieces of data over the network between identified end devices.
2 - Data Link	The data link layer protocols describe methods for exchanging data frames between devices over a common media
1 - Physical	The physical layer protocols describe the mechanical, electrical, functional, and procedural means to activate, maintain, and de-activate physical connections for a bit transmission to and from a network device.

TCP/IP Model Layer	Description
4 - Application	Represents data to the user, plus encoding and dialog control.
3 - Transport	Transport Supports communication between various devices across diverse networks.
2 - Internet	Determines the best path through the network.
1 - Network	Access Controls the hardware devices and media that make up the network.

is the process of dividing a stream of data into smaller units for transmissions over the network

• • It increases speed
• • Increases efficiency

• • A protocol data unit is the form that a piece of data takes at any layer.
• • contains layer-specific information necessary for a message to be transmitted through a network

Data

• If it is TCP its called a Segment
• But If it’s a UDP its called a datagram

Packet

Frame

Bits

• Application through session layers --> Data
• Transport layer PDU --> Segment
• Network layer PDU --> Packet
• Data Link layer PDU --> Frame
• Physical layer PDU--> Bits

MAC Address aka physical address

IP addresses aka network host address

port addresses

encapsulated data defined by the data link layer. A frame can have both a header and a trailer.

• encapsulated data defined by the Network layer. A header contains the
• source and destination IP addresses

encapsulated data as defined by the Transport layer. Information such as the source and destination ports or sequence and acknowledgment numbers are included in the header.

the IEEE 802.2 and 802.3 standards.

the data link layer and the physical layer.

• 64 bytes is the minimum
• 1518 bytes is the maximum

Its any ethernet frame less than 64 bytes in length is automatically discarded by receiving stations.

An ethernet frame with more than 1500 bytes of data

• The Preamble (7 bytes) and Start Frame Delimiter (SFD), also called the Start of Frame (1 byte), fields are used for synchronization between the sending and receiving devices. These first eight bytes of the frame are used to get the attention of the receiving nodes. Essentially, the first few bytes tell the receivers to get ready to receive a new frame.
• NOTE: the preamble and SFD are not included in the Ethernet Frame Field

This 6-byte field is the identifier for the intended recipient. As you will recall, this address is used by Layer 2 to assist devices in determining if a frame is addressed to them. The address in the frame is compared to the MAC address in the device. If there is a match, the device accepts the frame. Can be a unicast, multicast or broadcast address.

This 6-byte field identifies the originating NIC or interface of the frame. A source MAC address can only be a unicast address.

• This 2-byte field identifies the upper layer protocol encapsulated in the Ethernet frame. Common values are, in hexadecimal, 0x800 for IPv4, 0x86DD for IPv6 and 0x806 for ARP.
• Note: You may also see this field referred to as EtherType, Type, or Length.

This field (46 - 1500 bytes) contains the encapsulated data from a higher layer, which is a generic Layer 3 PDU, or more commonly, an IPv4 packet. All frames must be at least 64 bytes long. If a small packet is encapsulated, additional bits called a pad are used to increase the size of the frame to this minimum size.

The Frame Check Sequence (FCS) field (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC). The sending device includes the results of a CRC in the FCS field of the frame. The receiving device receives the frame and generates a CRC to look for errors. If the calculations match, no error occurred. Calculations that do not match are an indication that the data has changed; therefore, the frame is dropped. A change in the data could be the result of a disruption of the electrical signals that represent the bits.

Media Access Control

• provides services to allow end devices to exchange data across networks.
• Allows for end-to-end communications across network

48-bit binary value expressed as 12 hexadecimal digits (4 bits per hexadecimal digit).

• The OUI/ vendor ID is the 1st 6 hex numbers or the 1st 24 bits.
• The vendor assigned serial number is the last 6 hex numbers or the last 24 bits.

• • Addressing end devices
• • Encapsulation
• • De-encapsulation
• • Routing

○ IP address locates the device, MAC address identifies the device.

ARP -a

to allow end devices to exchange data across networks.

IP version 4 (IPv4) and IP version 6 (IPv6)

• • Addressing end devices
• • Encapsulation
• • De-encapsulation
• • Routing

• • Connectionless - There is no connection with the destination established before sending data packets.
• • Best Effort - IP is inherently unreliable because packet delivery is not guaranteed.
• ○ NOTE: Other protocols manage the process of tracking packets and ensuring packet delivery.
• • Media Independent - Operation is independent of the medium (i.e., copper, fiber-optic, or wireless) carrying the data.

By adding an IP header

Segment, packet

Contains a 4-bit binary value set to 0100 that identifies this as an IPv4 packet.

Formerly called the type of service (ToS) field, the DS field is an 8-bit field used to determine the priority of each packet. The six most significant bits of the DiffServ field are the differentiated services code point (DSCP) bits and the last two bits are the explicit congestion notification (ECN) bits.

This is used to detect corruption in the IPv4 header.

TTL contains an 8-bit binary value that is used to limit the lifetime of a packet. The source device of the IPv4 packet sets the initial TTL value. It is decreased by one each time the packet is processed by a router. If the TTL field decrements to zero, the router discards the packet and sends an Internet Control Message Protocol (ICMP) Time Exceeded message to the source IP address. Because the router decrements the TTL of each packet, the router must also recalculate the Header Checksum.

This field is used to identify the next level protocol. This 8-bit binary value indicates the data payload type that the packet is carrying, which enables the network layer to pass the data to the appropriate upper-layer protocol. Common values include ICMP (1), TCP (6), and UDP (17).

This contains a 32-bit binary value that represents the source IPv4 address of the packet. The source IPv4 address is always a unicast address.

This contains a 32-bit binary value that represents the destination IPv4 address of the packet. The destination IPv4 address is a unicast, multicast, or broadcast address.

• These fields are used to identify and validate the packet.
• Internet Header Length (IHL) is 4 bits or (0.5) bytes, Total Length 16 bits or 2 bytes, and Header Checksum is 16 bit or 2 bytes

They are used to keep track of the fragments and used to reorder a fragmented packet. Identification is 2 byte, Flags is 3 bits or 0.375 bytes, and Fragment Offset is 13 bits or 1.625 bytes

32 bit/4 bytes, 4 bytes (4 groups of 8 bits),

Network address portion and host address portion

• ○ This is the number that is assigned to a whole network
• ○ The bits within the network portion of the address must be identical for all devices that reside in the same network.

• ○ An host Id is assigned to host within an network for example tables, computers, printers and ect
• ○ The bits within the host portion of the address must be unique to identify a specific host within a network.

The IPv4 subnet mask is used to differentiate the network portion from the host portion of an IPv4 address.

Designed to support extremely large networks.

Designed to support the needs of moderate to large size networks

Designed to support small networks with a maximum of 254 hosts.

This is IPv4 addresses that are only used inside a network, if data is going across the default gateway the address changes from private address to an public address and vice vera when it is being sent into the network.

0.0.0.0/8 to 127.0.0.0/8

128.0.0.0 /16 – 191.255.0.0 /16

192.0.0.0 /24 – 223.255.255.0 /24

• 10.0.0.0 /8
• or
• 10.0.0.0 to 10.255.255.255

• 172.16.0.0 /12
• or
• 172.16.0.0 to 172.31.255.255

• 192.168.0.0 /16
• or
• 192.168.0.0 to 192.168.255.255

• to omit any leading 0s (zeros) in any hextet.
• For example
• ○ 01ab can be represented as 1ab
• ○ 09f0 can be represented as 9f0
• ○ 0a00 can be represented as a00
• ○ 00ab can be represented as ab

• a double colon (::) can replace any single, contiguous string of one or more 16-bit hextets consisting of all zeros.
• ○ For example
• ○ 2001:db8:cafe:1:0:0:0:1 (leading 0s omitted) could be represented as 2001:db8:cafe:1::1.
• ○ Note that the can only be used one with in an address so the following example is incorrect 2001:db8::abcd::1234.