Network Fundamentals chapter 13
255 Questions
5 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does the first two octets represent in a Class B address?

  • Network address (correct)
  • Router address
  • Node address
  • Broadcast address

    • What is the purpose of the loopback address, 127.0.0.1?

  • To connect to a private network
  • To communicate with other machines
  • To connect to the internet
  • To refer to the NIC of the machine you are on (correct)

    • What is the use of private IP addresses?

  • To connect to the internet
  • To communicate with computers outside the network
  • To connect to a router
  • To communicate within a network (correct)

    • What is the role of a gateway router in network address translation?

    <p>To replace the private IP address with the public IP address</p> Signup and view all the answers

    What is the range of private IP addresses that can be used on a private network?

    <p>10.0.0.10 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255</p> Signup and view all the answers

    What is the purpose of NAT?

    <p>To replace the private IP address with the public IP address of the gateway router</p> Signup and view all the answers

    What type of IP address is used to communicate with computers outside the network?

    <p>Public IP address</p> Signup and view all the answers

    What is the class of IP address where the first three octets represent the network and the last octet represents the node?

    <p>Class C</p> Signup and view all the answers

    What is the purpose of a gateway router?

    <p>To perform network address translation</p> Signup and view all the answers

    What is the limitation of private IP addresses?

    <p>They cannot be routed over the internet</p> Signup and view all the answers

    What is the main purpose of subnetting?

    <p>To divide a network into smaller portions</p> Signup and view all the answers

    What is the minimum value of the first octet of a subnet mask?

    <p>255</p> Signup and view all the answers

    What is the effect of a subnet mask on the IP address?

    <p>It divides the IP address into node and network portions</p> Signup and view all the answers

    What is the main difference between traditional subnetting and VLSM?

    <p>VLSM uses a variable length subnet mask, while traditional subnetting uses a fixed length subnet mask</p> Signup and view all the answers

    What is the result of converting a subnet mask to binary?

    <p>Once you hit a zero, the rest are all zeros</p> Signup and view all the answers

    What is the significance of the part of the IP address covered with 1s?

    <p>It is reserved for the network</p> Signup and view all the answers

    How is the IP address and subnet mask combined by the computer?

    <p>Using a binary AND operation</p> Signup and view all the answers

    What is the purpose of DHCP protocol?

    <p>To handle dynamic IP address allocation</p> Signup and view all the answers

    What is the significance of an APIPA address?

    <p>It indicates that the machine is not capable of communicating with the network</p> Signup and view all the answers

    What is the CIDR notation used for?

    <p>To represent the IP address and the number of bits for the network</p> Signup and view all the answers

    What is the significance of IPv6 using a 128-bit address?

    <p>It ensures that IP addresses will never run out in the future.</p> Signup and view all the answers

    What is the purpose of the hex-numbering method in IPv6?

    <p>To make IPv6 addresses shorter and more readable.</p> Signup and view all the answers

    What is the format of IPv6 subnetting?

    <p>CIDE format with slash (/) and hexadecimal value.</p> Signup and view all the answers

    What does the link/machine-local address in IPv6 indicate?

    <p>The device could not obtain an IP address from a DHCP server.</p> Signup and view all the answers

    What is the equivalent of IPv4 private IP addresses in IPv6?

    <p>Site/network-local addresses.</p> Signup and view all the answers

    What is the purpose of the loopback address in IPv6?

    <p>To test the network interface.</p> Signup and view all the answers

    Why are IPv6 site/network-local addresses not routable on the internet?

    <p>They are private and only work on the local network.</p> Signup and view all the answers

    What is the primary advantage of using IPv6 over IPv4?

    <p>IPv6 uses a 128-bit address, preventing the exhaustion of IP addresses</p> Signup and view all the answers

    What is the format of IPv6 addresses?

    <p>Hexadecimal, with eight groups separated by colons</p> Signup and view all the answers

    What is the purpose of the Managed Address Configuration flag (M flag) in DHCPv6?

    <p>To enable DHCPv6 to obtain a stateful IPv6 address</p> Signup and view all the answers

    What is the characteristic of IPv6 link/machine-local addresses?

    <p>They start with fe80:: and are used when a device cannot obtain a DHCP address</p> Signup and view all the answers

    What is the difference between IPv6 site/network-local addresses and IPv4 private addresses?

    <p>IPv6 site/network-local addresses are not routable on the internet, while IPv4 private addresses are</p> Signup and view all the answers

    What is the purpose of the ::/128 address in IPv6?

    <p>It is the IPv6 loopback address</p> Signup and view all the answers

    What is the range of IPv6 site/network-local addresses?

    <p>FEC to FEF</p> Signup and view all the answers

    What is the advantage of using IPv6 over IPv4 in terms of address space?

    <p>IPv6 has a much larger address space than IPv4</p> Signup and view all the answers

    What is the purpose of the hex-numbering method in IPv6?

    <p>To avoid long addresses and make them more readable</p> Signup and view all the answers

    What is the difference between IPv6 and IPv4 in terms of subnetting?

    <p>IPv6 uses a different subnetting method, but both use CIDR notation</p> Signup and view all the answers

    What is the purpose of the 101 message sent to the browser?

    <p>To inform the browser that the protocol is changing</p> Signup and view all the answers

    What type of messages do error codes 400-499 represent?

    <p>Client errors</p> Signup and view all the answers

    What does a 301 error code indicate?

    <p>The requested resource has permanently moved to a new URL</p> Signup and view all the answers

    What type of errors do error codes 500-599 represent?

    <p>Server-side errors</p> Signup and view all the answers

    What does a 503 error code indicate?

    <p>The service requested is down, possibly overloaded</p> Signup and view all the answers

    What is the purpose of the HTTP GET message?

    <p>To request reading a web page</p> Signup and view all the answers

    What is the meaning of HTTP response codes in the range of 100-199?

    <p>Informational messages</p> Signup and view all the answers

    Which of the following HTTP messages is used to request appending to a page?

    <p>POST</p> Signup and view all the answers

    What is the purpose of the HTTP HEAD message?

    <p>To request reading the head section of a web page</p> Signup and view all the answers

    What is the error message displayed when a requested resource is not found?

    <p>Error 404: file not found</p> Signup and view all the answers

    What is the purpose of the HTTP LINK message?

    <p>To connect two existing resources</p> Signup and view all the answers

    What is the primary function of the header in a network packet?

    <p>To provide information for routing the packet</p> Signup and view all the answers

    What is the general structure of a network packet?

    <p>Header, payload, and footer</p> Signup and view all the answers

    What is the term for the chunks of data sent across a network?

    <p>Packets</p> Signup and view all the answers

    What is the purpose of capturing network packets in forensic analysis?

    <p>To analyze network traffic and gather evidence</p> Signup and view all the answers

    What is the difference between various types of network packets?

    <p>They have different structures and formats</p> Signup and view all the answers

    Why is the header of a network packet important in forensic analysis?

    <p>It provides information about the packet's source and destination</p> Signup and view all the answers

    Which protocol's header contains the source and destination MAC address?

    <p>Ethernet</p> Signup and view all the answers

    What information does the IP header contain?

    <p>Source and destination IP addresses, and the protocol number of the payload</p> Signup and view all the answers

    What is the purpose of the synchronization bits in the TCP header?

    <p>To establish and terminate communications between parties</p> Signup and view all the answers

    Which type of header lacks a sequence number and synchronization bits?

    <p>UDP</p> Signup and view all the answers

    What is the significance of the sequence number in the TCP header?

    <p>It provides information about the packet's order</p> Signup and view all the answers

    What is added to the packet when encryption is used, such as with IPSec or TLS?

    <p>An additional header</p> Signup and view all the answers

    What is the purpose of the ACK bit in a network packet?

    <p>To acknowledge the attempt to synchronize communications</p> Signup and view all the answers

    What is the result of sending a packet with the RST bit turned on?

    <p>The connection is reset</p> Signup and view all the answers

    What is the purpose of the SYN bit in a network packet?

    <p>To synchronize sequence numbers</p> Signup and view all the answers

    What is the purpose of sending a packet with the FIN bit turned on?

    <p>To indicate no more data from the sender</p> Signup and view all the answers

    What is the SYN flood DoS attack based on?

    <p>Flooding the target with SYN packets</p> Signup and view all the answers

    What is the purpose of the IP precedence bits?

    <p>To prioritize traffic</p> Signup and view all the answers

    What information does the IP header contain?

    <p>Source IP address, destination IP address, and protocol number</p> Signup and view all the answers

    What is the purpose of the sequence number in the TCP header?

    <p>To keep track of the order of packets in a transmission</p> Signup and view all the answers

    What type of header is used instead of TCP in certain types of traffic?

    <p>UDP header</p> Signup and view all the answers

    What information does the Ethernet header contain?

    <p>Source and destination MAC addresses</p> Signup and view all the answers

    What is added to the packet when encryption is used, such as with IPSec or TLS?

    <p>An additional header</p> Signup and view all the answers

    What is the significance of the synchronization bits in the TCP header?

    <p>They establish and terminate connections between communicating parties</p> Signup and view all the answers

    What is the purpose of the URG bit in a network packet?

    <p>To mark traffic as urgent</p> Signup and view all the answers

    What is the normal sequence of events in a network conversation?

    <p>SYN, SYN/ACK, ACK, FIN</p> Signup and view all the answers

    What is the purpose of an RST packet in a session hijacking attack?

    <p>To reset the connection</p> Signup and view all the answers

    What is the purpose of a SYN flood DoS attack?

    <p>To flood the target with SYN packets</p> Signup and view all the answers

    What is the purpose of the IP precedence bits?

    <p>To prioritize traffic when necessary</p> Signup and view all the answers

    What is the purpose of the FIN bit in a network packet?

    <p>To indicate that no more data will be sent</p> Signup and view all the answers

    What is the primary purpose of a port scan?

    <p>To identify open ports on a target system</p> Signup and view all the answers

    Which type of port scan sends a packet with the FIN flag turned on?

    <p>FIN scan</p> Signup and view all the answers

    What is the characteristic of a packet sent in a null scan?

    <p>All flags are turned off</p> Signup and view all the answers

    What is the purpose of a hacker sending a packet with the URG, PUSH, and FIN flags set?

    <p>To identify open ports</p> Signup and view all the answers

    Why do administrators block incoming ICMP packets?

    <p>To prevent port scanning</p> Signup and view all the answers

    What is the result of sending a packet with the FIN flag turned on to an open port?

    <p>An error message is generated</p> Signup and view all the answers

    What is the purpose of a port scanning tool?

    <p>To identify open ports</p> Signup and view all the answers

    What is the characteristic of a Xmas tree scan?

    <p>Alternating flags are turned on and off</p> Signup and view all the answers

    Why do hackers use stealthy port scanning techniques?

    <p>To avoid detection by administrators</p> Signup and view all the answers

    What is the purpose of a hacker performing reconnaissance on a target system?

    <p>To gather information about the system</p> Signup and view all the answers

    What is the part of a packet that contains the actual information being transmitted?

    <p>Payload</p> Signup and view all the answers

    What is the purpose of the CRC in an Ethernet frame?

    <p>To check for errors in the transmission</p> Signup and view all the answers

    What happens when a packet fails the CRC check in Ethernet?

    <p>The packet is discarded and the receiver updates an internal counter</p> Signup and view all the answers

    What is the function of the trailer in a Layer 2 frame?

    <p>To provide error checking and indication of the end of transmission</p> Signup and view all the answers

    Which protocol requests a retransmission if a frame does not pass the CRC check?

    <p>TCP</p> Signup and view all the answers

    What is the purpose of padding in a packet?

    <p>To make the packet the right size</p> Signup and view all the answers

    What information can be gathered from the headers of an encrypted packet?

    <p>The protocol being used</p> Signup and view all the answers

    What is the purpose of the sequence number in the TCP header?

    <p>To track the sequence of packets in a connection</p> Signup and view all the answers

    Which layer of the OSI model does the trailer belong to?

    <p>Layer 2</p> Signup and view all the answers

    What is the result of a packet not passing the CRC check in Ethernet?

    <p>The packet is discarded</p> Signup and view all the answers

    What is the primary goal of a hacker performing reconnaissance on a target system?

    <p>To gather information about the target system's network architecture</p> Signup and view all the answers

    What is the purpose of a port scan?

    <p>To identify open ports on a target system</p> Signup and view all the answers

    What is the characteristic of a FIN scan?

    <p>It sends a packet with the FIN flag turned on</p> Signup and view all the answers

    What is the purpose of a Xmas tree scan?

    <p>To identify open ports on a target system</p> Signup and view all the answers

    What is the result of a null scan?

    <p>An error packet is sent, indicating that the port is open</p> Signup and view all the answers

    Why do hackers often use stealthy scans?

    <p>To avoid detection by intrusion detection systems</p> Signup and view all the answers

    What is the primary function of the trailer in a Layer 2 frame?

    <p>To provide error checking and indicate the end of transmission</p> Signup and view all the answers

    What is the significance of a port scan sending a packet with the FIN flag turned on?

    <p>It generates an error message if the port is open</p> Signup and view all the answers

    What happens when a receiving device detects an error in a Layer 2 frame?

    <p>It discards the frame and updates an internal counter</p> Signup and view all the answers

    What is the purpose of a hacker performing a port scan on a target system?

    <p>To identify open ports on the target system</p> Signup and view all the answers

    What is the purpose of padding in a packet?

    <p>To make the packet a fixed length</p> Signup and view all the answers

    What is the characteristic of a packet sent in a Xmas tree scan?

    <p>It has the URG, PUSH, and FIN flags set</p> Signup and view all the answers

    What is the difference between the TCP and UDP protocols in terms of error handling?

    <p>TCP requests retransmission, while UDP does not</p> Signup and view all the answers

    What is the result of a port scan identifying an open port on a target system?

    <p>The hacker can launch further attacks on the port</p> Signup and view all the answers

    What is the purpose of the header in a packet?

    <p>To specify the source and destination addresses and protocols</p> Signup and view all the answers

    What is the significance of the sequence number in the TCP header?

    <p>It helps the receiving device reassemble the packets in the correct order</p> Signup and view all the answers

    What is the purpose of the cyclic redundancy check (CRC) in an Ethernet frame?

    <p>To provide error checking and ensure the integrity of the data</p> Signup and view all the answers

    What happens when a packet has a fixed length but the payload is smaller than the fixed length?

    <p>The payload is padded with blank information or a specific pattern</p> Signup and view all the answers

    What is the difference between the payload and the header in a packet?

    <p>The payload is the actual data, while the header is the error-checking mechanism</p> Signup and view all the answers

    What is the significance of the MAC address in a Layer 2 frame?

    <p>It is used to identify the device at the data link layer</p> Signup and view all the answers

    What is the total number of possible ports available for communication?

    <p>65,635</p> Signup and view all the answers

    What is the primary purpose of port 22?

    <p>To remotely and securely log on to a system</p> Signup and view all the answers

    What is the difference between port 20 and port 21?

    <p>Port 20 is for data and port 21 is for control</p> Signup and view all the answers

    Which protocol is commonly used by network administrators to remotely log on to a system?

    <p>SSH</p> Signup and view all the answers

    What can be determined from the port number of a packet?

    <p>The protocol used by the packet</p> Signup and view all the answers

    What is the purpose of port 23?

    <p>To remotely log on to a system</p> Signup and view all the answers

    Why is it important for a forensic analyst to know certain port numbers?

    <p>To determine the protocol used by a packet</p> Signup and view all the answers

    What is the relationship between ports and channels?

    <p>A port is a channel through which communication can occur</p> Signup and view all the answers

    How many ports are commonly used by a forensic analyst?

    <p>A subset of commonly used ports</p> Signup and view all the answers

    What is the purpose of memorizing certain port numbers?

    <p>To determine the protocol used by a packet</p> Signup and view all the answers

    What is the purpose of SSH?

    <p>To provide greater security</p> Signup and view all the answers

    What is the function of port 80?

    <p>Displays web pages</p> Signup and view all the answers

    What is the purpose of Kerberos on port 88?

    <p>To authenticate</p> Signup and view all the answers

    What is the function of port 443?

    <p>To display web pages securely</p> Signup and view all the answers

    What is the purpose of capturing traffic on a database server on port 21?

    <p>To identify an intruder or insider not adhering to system policy</p> Signup and view all the answers

    What is the purpose of an old hacker trick using Telnet on port 23?

    <p>To grab the server's banner and determine the operating system</p> Signup and view all the answers

    What is the purpose of utilities like Back Orifice?

    <p>To give an intruder complete access to the target system</p> Signup and view all the answers

    What is the purpose of Timbuktu?

    <p>To allow remote access to a system</p> Signup and view all the answers

    What is the significance of observing frequent attempts to connect to a web server on port 23?

    <p>It is a sign of an intruder or insider not adhering to system policy</p> Signup and view all the answers

    What is the purpose of knowing the ports and their uses?

    <p>To identify an intruder or insider not adhering to system policy</p> Signup and view all the answers

    What is the primary goal of a Denial of Service (DoS) attack?

    <p>To prevent legitimate network traffic from passing</p> Signup and view all the answers

    What is the typical effect of a Ping of Death attack on a system?

    <p>The system crashes or locks up</p> Signup and view all the answers

    What is the main target of a network attack?

    <p>The network itself</p> Signup and view all the answers

    What is the purpose of a firewall in preventing a Ping of Death attack?

    <p>To block malformed or improperly sized ICMP packets</p> Signup and view all the answers

    What is the typical result of a successful DoS attack?

    <p>The network becomes unavailable</p> Signup and view all the answers

    What is the primary method used by an attacker in a DoS attack?

    <p>Sending malicious packets to the target system</p> Signup and view all the answers

    What is the impact of a DoS attack on the target network?

    <p>The network becomes unavailable</p> Signup and view all the answers

    What is the size of an ICMP echo packet that can cause a system to crash or lock up?

    <p>Greater than 84 bytes</p> Signup and view all the answers

    What is the intention of an attacker in using a Ping of Death attack?

    <p>To crash or lock up the target system</p> Signup and view all the answers

    What is the relationship between a DoS attack and the target network?

    <p>The DoS attack targets specific machines, which affects the network</p> Signup and view all the answers

    What is the primary goal of a teardrop attack?

    <p>To crash the target system by fragmenting packets</p> Signup and view all the answers

    What is the main issue with SYN flood attacks?

    <p>The target system is unable to respond to legitimate requests</p> Signup and view all the answers

    How do modern firewalls typically block SYN flood attacks?

    <p>By analyzing the entire conversation between client and server</p> Signup and view all the answers

    What is the primary difference between a teardrop attack and a SYN flood attack?

    <p>The goal of the attack</p> Signup and view all the answers

    What is the result of a target system receiving a large number of SYN packets?

    <p>The system is overwhelmed with phantom connection requests</p> Signup and view all the answers

    Why are SYN flood attacks often blocked by modern firewalls?

    <p>Because they are easily detected by analyzing the entire conversation</p> Signup and view all the answers

    What is the purpose of the ACK bit in a SYN packet?

    <p>To acknowledge the synchronization request</p> Signup and view all the answers

    What is the main weakness of a teardrop attack?

    <p>It can be blocked by patches released by vendors</p> Signup and view all the answers

    What is the primary goal of a SYN request?

    <p>To initiate a connection with a target system</p> Signup and view all the answers

    What is the consequence of not responding to a SYN request with an ACK packet?

    <p>The target system is overwhelmed with connection requests</p> Signup and view all the answers

    What is the purpose of Stateful Packet Inspection (SPI) in firewall technology?

    <p>To block SYN flood attacks</p> Signup and view all the answers

    What is the effect of a Land Attack on a target computer?

    <p>It tricks the computer into thinking it is sending messages to itself</p> Signup and view all the answers

    What is the result of a Fraggle attack on a target network?

    <p>It causes a traffic jam in the target network</p> Signup and view all the answers

    What is the goal of a DHCP Starvation attack?

    <p>To exhaust the address space allocated by the DHCP servers</p> Signup and view all the answers

    What is the effect of an HTTP Post Attack on a web server?

    <p>It hangs the web server waiting for a message to complete</p> Signup and view all the answers

    What is the purpose of a PDoS attack?

    <p>To damage the system so badly that it needs an operating system reinstall</p> Signup and view all the answers

    What is the effect of a Login DoS attack on a website?

    <p>It makes the login process unavailable or unreasonably slow to respond</p> Signup and view all the answers

    What is the result of a packet mistreating attack on a network?

    <p>It results in congestion in a part of the network</p> Signup and view all the answers

    What is the purpose of a Smurf attack?

    <p>To generate a large number of ICMP echo requests</p> Signup and view all the answers

    What is the characteristic of a Fraggle attack?

    <p>It uses spoofed UDP packets</p> Signup and view all the answers

    What is the primary purpose of an IDS?

    <p>To analyze logs and detect possible incidents</p> Signup and view all the answers

    What type of logs show accounts related to a particular event and the authenticated user’s IP address?

    <p>Authentication logs</p> Signup and view all the answers

    What is the primary record of a person’s activities on a system or network?

    <p>A person’s log files</p> Signup and view all the answers

    What type of devices produce logs that can be used as evidence in an investigation?

    <p>Routers, VPNs, and other network devices</p> Signup and view all the answers

    What is the purpose of examining live traffic or logs in network traffic analysis?

    <p>To determine if a crime has been or is being committed</p> Signup and view all the answers

    What do application logs record?

    <p>The date and time the user started the application and how long it was used</p> Signup and view all the answers

    What is the focus of an end-to-end investigation?

    <p>The entire attack, from start to finish</p> Signup and view all the answers

    What is the purpose of network security devices such as firewalls and IDS?

    <p>To block malicious traffic and prevent hacking</p> Signup and view all the answers

    What type of information is contained in a device’s log files?

    <p>The primary records of a person’s activities on a system or network</p> Signup and view all the answers

    What type of events do operating systems typically log?

    <p>Use of devices, errors, and reboots</p> Signup and view all the answers

    What can be achieved by analyzing logs from servers and Windows security event logs?

    <p>Attributing activities to a specific user account</p> Signup and view all the answers

    What is a limitation of using log files for analysis?

    <p>They can be easily altered by hackers</p> Signup and view all the answers

    What is the purpose of an intrusion detection system (IDS)?

    <p>To record events that match known attack signatures</p> Signup and view all the answers

    What can be discovered by configuring an IDS to capture all network traffic associated with a specific event?

    <p>What commands an attacker ran and what files they accessed</p> Signup and view all the answers

    What type of logs provide information about activities on a network?

    <p>Network device logs</p> Signup and view all the answers

    What can be achieved by coordinating and synchronizing logs from different systems?

    <p>Creating a more complete picture of an attack</p> Signup and view all the answers

    What is a challenge of using log files as evidence?

    <p>They are easily lost or altered</p> Signup and view all the answers

    What can log files show about an attack?

    <p>How an attacker entered a network</p> Signup and view all the answers

    What is the indoor range of 802.11g wireless networks?

    <p>125 feet</p> Signup and view all the answers

    What is the bandwidth of 802.11n wireless networks?

    <p>100 to 140 mbps</p> Signup and view all the answers

    What technology uses multiple-input multiple-output (MIMO) to coherently resolve more information than is possible using a single antenna?

    <p>802.11n</p> Signup and view all the answers

    What is the throughput of 802.11ac wireless networks?

    <p>1 gbps</p> Signup and view all the answers

    Which wireless standard is also referred to as 'White-Fi' and 'Super Wi-Fi'?

    <p>802.11af</p> Signup and view all the answers

    What is the maximum data transmission rate of 802.11ad wireless networks?

    <p>7 gbps</p> Signup and view all the answers

    What is the frequency range of 802.11af wireless networks?

    <p>54 MHz to 790 MHz</p> Signup and view all the answers

    What is the rebranded version of 802.11ad for use in the 45-GHz unlicensed spectrum available in some regions of the world?

    <p>802.11aj</p> Signup and view all the answers

    What is the maximum bandwidth of 802.11n-2009 wireless networks with the use of four spatial streams at a channel width of 40 MHz?

    <p>600 mbps</p> Signup and view all the answers

    What is the primary benefit of using wireless connections?

    <p>Ease of connection without cables</p> Signup and view all the answers

    What is the standard for wireless networking?

    <p>IEEE 802.11</p> Signup and view all the answers

    What is the frequency of operation for IEEE 802.11a?

    <p>5 GHz</p> Signup and view all the answers

    What is the bandwidth of IEEE 802.11b?

    <p>11 megabits per second (mbps)</p> Signup and view all the answers

    What is the indoor range of IEEE 802.11b?

    <p>125 feet</p> Signup and view all the answers

    What is a new security feature of WPA3?

    <p>Encryption of individual traffic even on open networks</p> Signup and view all the answers

    Where is wireless internet widely available?

    <p>In many public locations including fast-food restaurants, coffee shops, and retail stores</p> Signup and view all the answers

    What is Wi-Fi?

    <p>A type of wireless network</p> Signup and view all the answers

    What is the primary purpose of the initialization vector (IV) in WEP?

    <p>To prevent repetition of the same key</p> Signup and view all the answers

    What is the encryption method used in WPA2 to provide data confidentiality, origin authentication, and integrity?

    <p>AES using CBC-MAC</p> Signup and view all the answers

    What is the main advantage of WPA3 over its predecessors?

    <p>Making it harder and time-consuming to crack</p> Signup and view all the answers

    What is the key size used in WEP-40?

    <p>64-bit</p> Signup and view all the answers

    What is the purpose of TKIP in WPA?

    <p>To dynamically generate a new key for each packet</p> Signup and view all the answers

    What is the main weakness of WEP?

    <p>IV reuse and related key attacks</p> Signup and view all the answers

    What is the main function of ZigBee?

    <p>For mainly residential applications of wireless devices</p> Signup and view all the answers

    What is the purpose of Wi-Fi Easy Connect?

    <p>To connect devices by scanning a QR code</p> Signup and view all the answers

    What is the primary use of ANT+?

    <p>Bio-sensor data transmission</p> Signup and view all the answers

    What is the name of the wireless protocol used primarily for home automation?

    <p>Z-Wave</p> Signup and view all the answers

    What is the IEEE standard for Bluetooth?

    <p>IEEE 802.15.1</p> Signup and view all the answers

    What is the significance of Harald Bluetooth in the context of wireless protocols?

    <p>He united the tribes of Denmark</p> Signup and view all the answers

    What is the purpose of discovering wireless networks?

    <p>To identify potential security threats</p> Signup and view all the answers

    What is the primary concern when it comes to wireless networks in terms of forensic analysis?

    <p>Data theft through direct network attacks</p> Signup and view all the answers

    What is the purpose of tools like NetStumbler, MacStumbler, and iStumbler?

    <p>To discover and scan for wireless networks</p> Signup and view all the answers

    What is a common mistake people make when setting up wireless devices?

    <p>Not changing the default settings</p> Signup and view all the answers

    What is the significance of the MAC address in a packet?

    <p>It is used to determine the packet's destination</p> Signup and view all the answers

    What is the main difference between a switch and a router?

    <p>A switch can only connect computers on the same LAN, while a router can connect different logical networks</p> Signup and view all the answers

    What is the purpose of a router's routing table?

    <p>To determine the path of outgoing packets</p> Signup and view all the answers

    What is the main advantage of modern routers over older routers?

    <p>They can learn new routes automatically</p> Signup and view all the answers

    What is the main advantage of a switch over a hub?

    <p>It prevents traffic jams by ensuring data goes straight to its destination</p> Signup and view all the answers

    What is the primary function of a router?

    <p>To send packets to their destinations along thousands of pathways</p> Signup and view all the answers

    What is the primary function of a router in a network?

    <p>To forward data packets to a destination network</p> Signup and view all the answers

    What type of memory may contain the router's operating system?

    <p>Flash memory</p> Signup and view all the answers

    What is the main difference between a hub and a router?

    <p>A hub sends packets to every port except the one it received the packet from, while a router directs packets to their destination network</p> Signup and view all the answers

    What is the primary function of a network interface card (NIC)?

    <p>To handle media access control and data encapsulation</p> Signup and view all the answers

    What type of information does a router contain?

    <p>All of the above</p> Signup and view all the answers

    What is the primary difference between a switch and a router?

    <p>A switch is used to connect computers on a single network, while a router is used to connect multiple networks</p> Signup and view all the answers

    What is the primary goal of a router table poisoning attack?

    <p>To allow an attacker to access data in the compromised network</p> Signup and view all the answers

    Why is it important to not shut down the router when conducting forensic analysis?

    <p>Because it will potentially lose valuable evidence</p> Signup and view all the answers

    What is the function of Hyperterminal in router forensics?

    <p>To connect to and interact with the router</p> Signup and view all the answers

    What is the significance of documenting the process when conducting router forensics?

    <p>To record everything that is done to the router</p> Signup and view all the answers

    What is the result of altering the routing data update packets in a router table poisoning attack?

    <p>Incorrect entries are made in the routing table</p> Signup and view all the answers

    What is the primary challenge of conducting router forensics?

    <p>Being careful not to alter anything</p> Signup and view all the answers

    What information does the show version command provide about the router?

    <p>The platform, operating system version, system image file, and interfaces</p> Signup and view all the answers

    What is the primary purpose of comparing the startup and running configurations?

    <p>To identify potential hacker modifications to the system</p> Signup and view all the answers

    What is the primary purpose of the show ip route command?

    <p>To display the routing table</p> Signup and view all the answers

    What is the significance of the show running-config command?

    <p>It displays the currently executing configuration</p> Signup and view all the answers

    What is the primary way that hackers infiltrate routers, according to the text?

    <p>By altering the routing table</p> Signup and view all the answers

    What is the purpose of the show startup-config command?

    <p>To display the system's startup configurations</p> Signup and view all the answers

    What type of firewall is also referred to as a screened firewall?

    <p>Packet Filer</p> Signup and view all the answers

    What is the primary benefit of using Stateful Packet Inspection firewalls over Packet Filer firewalls?

    <p>They are less susceptible to ping floods, SYN floods, and spoofing</p> Signup and view all the answers

    What is the purpose of examining firewall logs in network forensic analysis?

    <p>To identify potential security threats</p> Signup and view all the answers

    What is the fundamental part of network forensic analysis that involves examining the firewall?

    <p>Examining the firewall</p> Signup and view all the answers

    What is the characteristic of a connection in firewall forensics?

    <p>It is all the traffic going through the firewall</p> Signup and view all the answers

    What is the primary difference between Packet Filer and Stateful Packet Inspection firewalls?

    <p>The context in which they filter packets</p> Signup and view all the answers

    What is the range of well-known ports?

    <p>0 through 1024</p> Signup and view all the answers

    What is the purpose of analyzing TTL fields in packet responses?

    <p>To detect decoy scans and spoofed addresses</p> Signup and view all the answers

    What is the term for the concatenation of an IP address and a port number?

    <p>Socket</p> Signup and view all the answers

    What is the purpose of a decoy scan strategy?

    <p>To hide the attacker's IP address among decoy machines</p> Signup and view all the answers

    What should you carefully check in the firewall logs?

    <p>Connections or attempted connections on common ports</p> Signup and view all the answers

    What is the significance of the TTL field in a packet?

    <p>It indicates the number of routers between a source and destination</p> Signup and view all the answers

    Study Notes

    IPv6

    • IPv6 uses a 128-bit address, which prevents IP address exhaustion
    • IPv6 uses a hexadecimal numbering method to avoid long addresses
    • IPv6 uses the CIDE format for subnetting (e.g. /48, /64)
    • The loopback address for IPv6 is ::/128
    • Link/machine-local IPv6 addresses start with fe80::
    • Site/network-local IPv6 addresses start with FE and have C to F as the third hexadecimal digit (e.g. FEC, FED, FEE, FEF)

    Firewall Forensics

    • Firewalls are a crucial part of network forensic analysis
    • Firewall logs contain valuable evidence of network activity
    • There are two types of firewalls:
      • Packet Filter: filters incoming packets based on set rules
      • Stateful Packet Inspection (SPI): examines packets in context of the entire conversation

    Collecting Data

    • A connection consists of two IP addresses and two port numbers
    • A socket is the combination of an IP address and a port number
    • There are three ranges of port numbers:
      • Well-known ports: 0-1023
      • Registered ports: 1024-49151
      • Dynamic ports: 49152-65535

    Port Scanning

    • Port scanning is a common reconnaissance technique used by hackers
    • There are several types of port scans:
      • FIN scan: sends a packet with the FIN flag set to test if a port is open
      • Xmas tree scan: sends a packet with multiple flags set to test if a port is open
      • Null scan: sends a packet with no flags set to test if a port is open
    • These scans can be detected by analyzing packet headers and flags

    Packet Structure

    • A packet consists of a header, payload, and trailer
    • The header contains information about the packet's protocol, source, and destination
    • The payload is the actual content being transmitted
    • The trailer is used for error checking and contains a Cyclic Redundancy Check (CRC)

    Ports and Protocols

    • There are 65,635 possible ports, but some are used more often than others
    • Certain ports are associated with specific protocols:
      • FTP: 20, 21
      • SSH: 22
      • Telnet: 23
      • SMTP: 25
      • DNS: 53
      • HTTP: 80
      • HTTPS: 443
      • NetBIOS: 137-139
      • SNMP: 161, 162
      • Kerberos: 88, 464
      • LDAP: 389
      • IMAP: 220

    Utilities and Tools

    • Some ports are associated with malicious utilities and tools:
      • Back Orifice: 31337
      • B02K: 54320/54321
      • Beast: 6666
      • Donald Dick: 23476/23477
      • Reachout: 43188
      • Timbuktu: 407### Network Basics
    • IP Addresses:
      • IPv4 address: a series of four decimal numbers between 0 and 255, each representing 8 bits (an octet)
      • 32-bit address, allowing for over 4.2 billion possible addresses
    • Converting decimal to binary: divide by 2, using remainders, until you get to 1

    IP Address Classes

    • Class A: 0-126 (extremely large networks, all addresses have been assigned)
    • Class B: 128-191 (large corporate and government networks, all addresses have been assigned)
    • Class C: 192-223 (most common group of IP addresses, often used by ISPs)
    • Reserved IP addresses: 127.x.x.x (testing, loopback address: 127.0.0.1)

    Private IP Addresses

    • Cannot be routed over the internet
    • Used on private networks
    • Three specific ranges: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, 192.168.0.0 to 192.168.255.255

    Network Address Translation (NAT)

    • Translates private IP addresses to public IP addresses for internet communication
    • Used by ISPs to assign public IP addresses to customers

    Network Traffic Analysis

    • Analyzing logs to determine if a crime has been committed and to gather evidence
    • Uses logs from devices, firewalls, and intrusion detection systems
    • Can help identify patterns of activity and unusual events

    Denial of Service (DoS) Attacks

    • Attacks that target the network itself
    • Types of DoS attacks:
      • Ping of Death: sends a large ICMP echo packet to crash the target machine
      • Teardrop Attack: sends fragmented packets with bad values to crash the target system
      • SYN Flood Attacks: sends unlimited SYN requests to overwhelm the target system
      • Land Attack: sends a fake TCP SYN packet with the same source and destination IP addresses
      • Smurf Attack: generates a large number of ICMP echo requests to cause a traffic jam
      • Fraggle Attack: similar to Smurf attack, but uses spoofed UDP packets
      • DHCP Starvation: exhausting the address space allocated by DHCP servers
      • HTTP Post Attack: sends a legitimate HTTP post message with a slow message body
      • PDoS (Permanent Denial of Service): damages the system so badly that it needs an OS reinstall or new hardware
      • Login DoS: overloads the login process with repeated requests
      • Packet Mistreating Attacks: compromised router mishandles packets, causing congestion### HTTP Messages
    • HTTP messages can be classified into five categories based on their response codes:
      • 100-199: Informational messages, informing the browser of the protocol change
      • 200-299: Success messages, indicating successful processing of the request
      • 300-399: Redirect messages, redirecting the browser to another URL
      • 400-499: Client error messages, indicating errors on the client-side
      • 500-599: Server error messages, indicating errors on the server-side

    HTTP Request Methods

    • GET: Request to read a web page
    • HEAD: Request to read the head section of a web page
    • PUT: Request to write a web page
    • POST: Request to append to a web page
    • DELETE: Remove the web page
    • LINK: Connects two existing resources
    • UNLINK: Breaks an existing connection between two resources

    Network Packets

    • A packet is divided into three sections: header, payload, and footer
    • The header contains information on the packet's source and destination
    • The payload carries the actual data being transmitted
    • The footer contains error-checking data

    TCP Header

    • The TCP header contains the following information:
      • Source and destination port numbers
      • Sequence number
      • Synchronization bits (URG, ACK, SYN, FIN, RST)

    Synchronization Bits

    • URG (1 bit): Marks traffic as urgent
    • ACK (1 bit): Acknowledges the attempt to synchronize communications
    • SYN (1 bit): Synchronizes sequence numbers
    • FIN (1 bit): No more data from sender
    • RST (1 bit): Resets the connection

    Subnetting and CIDR

    • Subnetting is dividing a network into smaller portions
    • Variable Length Subnet Mask (VLSM) is used to define the network and node portions of an IP address
    • The subnet mask is a 32-bit number that divides the 32-bit IP address into network and node portions

    IPv6

    • IPv6 uses 128-bit addresses
    • IPv6 addresses are written in hexadecimal format
    • IPv6 uses the CIDE format for subnetting
    • The loopback address for IPv6 is ::/128
    • IPv6 link/machine-local addresses start with fe80::

    Wi-Fi Security

    • WEP (Wired Equivalent Privacy) uses the stream cipher RC4 to secure data
    • WPA (Wi-Fi Protected Access) uses Temporal Key Integrity Protocol (TKIP)
    • WPA2 uses the Advanced Encryption Standard (AES) in Counter Mode with CBC-MAC Protocol (CCMP)
    • WPA3 requires attackers to interact with your Wi-Fi for every password guess

    Other Wireless Protocols

    • ANT+: Used for sensor data in applications such as bio-sensors and exercise tracking
    • ZigBee: Used for residential applications of wireless devices
    • Z-Wave: Used for home automation
    • Bluetooth: Used for short-distance radio communication
    • Low-energy options are available in Bluetooth 5.2

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Description

    Test your knowledge of network basics, including IP addresses, MAC addresses, and other essential concepts for analyzing network traffic.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser