Telematics Exam: DNS Security Solutions

Attackers can exploit vulnerabilities in DNS to redirect traffic, manipulate data, or disrupt internet services. This is done by altering or manipulating DNS records, spoofing servers, or intercepting DNS requests and responses.

DNS is vulnerable due to its reliance on trust and lack of adequate security measures. Unencrypted communication, unverified responses, and the absence of authorization mechanisms make it susceptible to attacks.

Cache poisoning involves manipulating DNS caches with incorrect data, leading to incorrect resolution of domain names. This results in redirection of traffic to malicious servers.

When a DNS server provides incorrect responses, it can direct traffic to malicious sites, disrupt service, or compromise user data.

DNSSEC (Domain Name System Security Extensions) is a security mechanism that adds digital signatures to DNS data, ensuring the authenticity and integrity of records.

By choosing a specific DNS resolver, users can control the source of DNS information, potentially avoiding corrupted or manipulated data.

DNS ensures uniqueness of names by creating a hierarchical structure with unique names at each level. The Internet Corporation for Assigned Names and Numbers (ICANN) oversees the management of top-level domains.

Recursive name resolution involves receiving a complete answer to a DNS request, even if it requires multiple queries to other servers. The client does not have to be involved in subsequent requests.

Iterative name resolution returns a pointer to the next server for further queries. The client needs to send multiple requests to different servers to find the final answer.

Congestion control focuses on maintaining network stability by preventing congestion in the network. It regulates the flow of data to prevent overloading of network infrastructure.

Flow control aims to prevent buffer overflow at the receiver by regulating the rate of data sent by the sender. It ensures that the receiver can handle the incoming data without dropping packets.

A duplicated ACK in TCP signals that some packets are reaching the receiver, indicating that the network is not severely congested. It prompts the sender to proceed with sending more data.

Fast Recovery in TCP is a technique that allows the sender to quickly recover from a congestion event. It avoids the slow-start phase and allows the sender to resume transmission at a higher rate.

RTT (Round Trip Time) measures the time it takes for a packet to travel from sender to receiver and back. It influences TCP's congestion window size and determines the rate of data transmission.

The error rate in TCP affects the frequency of retransmissions and influences the rate of data transfer. A high error rate slows down the transmission process.

The receiver window in TCP indicates the receiver's capacity to receive data and influences the sending rate. A small or zero receiver window signals a temporary pause or congestion at the receiver.

The link layer data rate affects TCP's flow by influencing buffer fill state in routers. Higher link layer data rates result in faster transmission and potentially larger buffer fill, impacting RTT.

The congestion window in TCP limits the rate of data transmission to prevent network congestion. It dynamically adapts to network conditions to avoid overloading the network.

TCP detects congestion implicitly by observing retransmissions, timeouts, and missing acknowledgments. These events indicate that packets are being lost due to congestion.

TCP detects congestion explicitly using the ECN (Explicit Congestion Notification) bits in the IP header. Routers experiencing congestion can set these bits to notify the sender.

Switches alone are insufficient for large networks due to limitations in address scalability and lack of support for logical hierarchies.

The Internet addresses the scalability challenge through hierarchical routing. It uses Autonomous Systems (AS) with internal routing protocols (IGP) and external routing protocols (EGP) to maintain a distributed and scalable system.

Routing involves determining optimal paths for data packets, while forwarding focuses on actually moving packets based on destination addresses.

BGP (Border Gateway Protocol) handles policy-based routing and path selection, addressing limitations of link-state and distance vector protocols. It allows for route control, path selection, and preference.

RPKI (Resource Public Key Infrastructure) helps secure the internet by verifying the ownership of IP addresses and routes, preventing false announcement of paths and improving network security.

Ossification refers to the situation where existing protocols become entrenched and difficult to change due to widespread adoption and reliance. This makes it challenging to introduce new protocols or functionalities.

Middle boxes, such as firewalls, NATs, and load balancers, act as intermediaries and rely on specific protocols. Updating these boxes with new protocol support is often complex and challenging.

Sending segments from the same TCP connection over different paths can lead to problems with middle boxes, such as NAT, which track the state of connections. These boxes may not recognize the packets from different paths, causing packets to be dropped.

MPTCP circumvents ossification by multiplexing several TCP connections into a single logical connection. For the network, these appear as separate TCP connections, while the application sees a single, faster connection.

TCP's segment-based approach can lead to head-of-line blocking, where loss of a single segment can delay delivery of subsequent segments, impacting web page loading speed.

QUIC solves the issue of TCP slowdowns in HTTP by providing multiple independent streams for data transfer. Loss in one stream does not affect the others, ensuring faster delivery of web page content.

QUIC uses UDP as the transport protocol, which is widely accepted and circumvents ossification. By using multiple streams and independent data transfer, QUIC provides faster webpage loading and a more user-friendly experience.

We cannot transmit data directly as data is an abstract concept. A physical representation is required, using a mapping between data elements and physical signal elements.

Bandwidth limitations of a physical medium restrict the maximum achievable data rate. Shannon's law relates data rate to bandwidth and signal-to-noise ratio, highlighting bandwidth as a limiting factor.

Using more discrete signal levels for quantization increases susceptibility to interference. As levels come closer, weaker interference can cause bit errors.

Bit synchronization ensures that sender and receiver agree on the timing of bit transitions. Techniques like Manchester coding or differential NRZ ensure consistent bit timing.

Framing is necessary to separate continuous bitstreams into frames for easier processing and error detection. Framing methods include start-of-frame patterns, bit stuffing, or byte counting with length fields.

It's impossible to detect all possible errors because a malicious error could transform a valid codeword into another valid codeword. The receiver cannot distinguish between original and corrupted data if they both appear valid.