Telematics Exam: DNS Security Solutions

Unencrypted requests/responses, non-verified answers, non-authorized servers, unprotected caches - all is based on the simple assumption: “don't lie about others” and trust among the involved systems.

<p>Uniqueness of top level, within each top-level uniqueness of second level, within each second level uniqueness of third level etc. On each level NIC/admin of level manages/distributes names to owners, owner is registered in data base.</p> Signup and view all the answers

<p>Iterative: node will return a pointer to the requestor for further requests</p> Signup and view all the answers

<p>Congestion control: focus on network, try to avoid congestion in the network, needed to keep network stable. Flow control: focus on end-system, try to avoid overloading of the receiver, both are needed to avoid packet loss due to buffer overflow (n routers of end-systems, respectively).</p> Signup and view all the answers

<p>At least some packets go through the network, no severe congestion of complete link failure. Fast recovery avoids slow-start (congestion window starts at 1 MSS), but starts right away with ½ old congestion window.</p> Signup and view all the answers

<p>Receiver window: shows the capabilities of the receiver, has to be taken into account by receiver, can be even 0 to choke transmission</p> Signup and view all the answers

<p>Implicit: sender experiences time-out, ACKs to late, missing ACKs and concludes from late/missing ACKs congestion in network</p> Signup and view all the answers

<p>Flat address space, no address aggregation would require storing all addresses individually in switches logical tree structure to avoid loops not feasible in large/world-wide networks, no TTL requires this.</p> Signup and view all the answers

<p>Hierarchies, routing concerns only limited regions, IGP/EGP, AS with IGP used inside, EGP to connect, AS black box from outside, no complete view of topology needed, routing inside AS independent from outside, only EGP must be compatible worldwide.</p> Signup and view all the answers

<p>Routing often SW, forwarding with HW support</p> Signup and view all the answers

<p>Drop rate</p> Signup and view all the answers

<p>Paths exchanged, different policies can be applied, paths dropped or accepted based on policies, advertisement of paths also based on policies</p> Signup and view all the answers

<p>BGP based on trust between peering partners, original version does not allow for verification of routing data, false announcements cannot be verified, AS can claim to be owner of prefix, path announcements can be manipulated.</p> Signup and view all the answers

<p>TLS can encrypt content, but can do nothing against e.g. forged certificates or blackholing; attacker can manipulate routing; thus, traffic may never reach web server or may be redirected, web server not wares of attack, DoS made easy.</p> Signup and view all the answers

<p>TCP and UDP exist for many years, and thus, their headers are often the only accepted ones for layer 4; these protocols are “hard wired” in many systems, not only end-systems, but also middle boxes</p> Signup and view all the answers

<p>Middle boxes, such as NAT, keep state and, thus, &quot;follow&quot; the states of a TCP connection, may even ACK bytes acting as proxies; incoming packets from an unknown TCP connection (known only via another path) are typically not accepted and, thus, dropped.</p> Signup and view all the answers

<p>Use of several TCP connections; for the network these TCP-connections belonging to a single MPTCP connection look like “normal” TCP connections with individual states; MPTCP mux/demux the data stream on top of the regular, build-in TCP of the OS.</p> Signup and view all the answers

<p>Even HTTP/2 that allows the mux of several http requests and the out-of-order delivery of responses suffers from head-of-line blocking; TCP may cause when a segment is lost; TCP segmentation is independent of the semantics of requests/responses; a lost segment may block the delivery of correct received segments/data to the browser and thus nothing is displayed unless the lost data has been retransmitted; user experience suffers.</p> Signup and view all the answers

<p>QUIC offers several independent streams e.g. for different objects on web pages; data loss in one stream does not influence other streams; using UDP all received data is immediately forwarded to the next higher layer(QUIC); using UDP circumvents the ossification as UDP is well-accepted; QUIC is handled in end-systems only, the network only sees partially encrypted UDP packets</p> Signup and view all the answers

<p>No, data is something abstract, we always need a physical representation; we need a mapping of data elements to physical signal elements; modulation of physical signals based on data.</p> Signup and view all the answers

<p>The effective bandwidth of a physical medium limits the max. available data rate; Shannon's law: data rate = bandwidth * log_2 (1 + S/N); limitation of the symbol rate.</p> Signup and view all the answers

<p>Provide falling/rising edge always in the middle of a bit (Manchester); ensure that no long sequences of Os (or) 1s exist – then use (differential) NRZ (4B5B etc.); separate clock line if distance is short.</p> Signup and view all the answers

<p>A really mean error could map a valid codeword onto another valid one – this is impossible to detect; receiver does not know what the sender has send, thus all legal codewords are fine; CRC does not detect e.g. multiples of the generator polynomial added to transmitted data.</p> Signup and view all the answers