1
Q
Network Analyst
A
- Monitor, analyze, detect, and respond to events/incidents within infrastructure devices and netflow
- ID security risk and develop mitigation plans
2
Q
Network Baseline
A
Defines what normal network conditions and traffic looks like
Can be used to test for abnormal conditions, rapidly deploy new networks, and ensure network is working as designed
3
Q
Cyber Threat Intelligence (CTI)
A
- Knowledge about adversaries and their motivations, intentions, and methods
- Enables orgs to deploy measures to detect, mitigate, and possibly prevent attacks
4
Q
Network Artifacts
– Definition
– Examples
A
- Piece of network traffic data that may be relevant to an investigation
- Helps develop network/host signatures
- Examples:
– Logs
– Files/directories
– Registry Keys
5
Q
Network Triage
A
- Sorting network violations into groups based on:
– Response to Outages
– Level of Compromise (CAT levels)
– Leverages Artifacts
– Mission Critical Systems - Helps analyst/unit prioritize important systems
6
Q
Sandbox
A
- Controlled environment used to test suspicious/malicious software without endangering entire network
7
Q
IDS
– Definition
– Examples
A
Intrusion Detection System
- Passively monitors network or systems for malicious activity/violations.
May send alerts for detections but does NOT prevent them. - Does not affect existing systems/infrastructure
- Examples:
– Snort
– Suricata
– Wireshark
8
Q
IPS
– Definition
– Examples
A
Intrusion Prevention System
- Detects and blocks possible network intrusion.
– Placed in-line with network traffic - Examples:
– Snort
– Suricata
9
Q
SIEM
A
Security Info & Event Management
- Group of technologies which aggregates relevant data from multiple sources to provide birds-eye view of a network and help identify deviations from the norm.
- Examples:
– ELK
– Splunk
– AlienVault
– SolarWinds
10
Q
Network Source Data Types
– 3 Types
A
- Full Packet Capture
- NetFlow & Related Flow-Based Collections
- Log Files
11
Q
Full-Packet Capture
– Definition
– File formats
– Benefits
– Drawbacks
A
- File containing all original packet data as seen at collection point
- Extension Formats:
– *.pcap
– *.pcapng
– *.cap
– *.dmp - Benefits
– Holy Grail of network data collection
– Facilitates deep analysis long after communication occurred
– Variety of tools available to examine pcap files with different approaches - Drawbacks
– Files can become extremely large
– Limited availability due to legal constraints
– Limited usefulness due to encryption
12
Q
NetFlow
– Definition
– Benefits
– Drawbacks
A
- Summary of network communication as seen at collection point
- No content, just summary and metadata
- Useful for quick triage
- Benefits
– Requires less storage
– Faster analysis process
– Fewer privacy concerns
– Analysis process applies equally to all protocols - Drawbacks
– Low level analysis may not be possible w/o content
– Many collection platforms require training/licenses
13
Q
Log Files
– Definition
– Benefits
– Drawbacks
A
- Application or platform-centric files describing activities handled or observed by the log creator
- Benefits
– Widely available
– Processes often in place to analyze them
– May be aggregated for centralized analysis - Drawbacks
– Varying levels of detail and formats
– Often requires additional data to corroborate findings
– If not aggregated, can be time consuming to find and analyze
14
Q
Port Mirror (switch)
– Definition
– Benefits
– Drawbacks
A
- “Software tap” that duplicates packets from one switch port to another
– Sometimes called a SPAN (Switch Port Analyzer) port - Benefits
– Simple to set up (quick config change, no downtime)
– Switch presence maximizes flexibility of platform placement - Drawbacks
– Only half-duplex, so may experience data loss with high-traffic networks
15
Q
Router Netflow Export
– Definition
– Benefits
– Drawbacks
A
- Export router netflow data for external analysis
- Benefits
– Only requires simple config change (little to no downtime)
– NetFlow is already collected, only needs to be exported - Drawbacks
– Generally does not provide ability to perform full-packet capture
16
Q
Layer 7 Devices (Network data collection)
– Definition
– Examples
– Benefits
– Drawbacks
A
- Any platform with control of or purview over a network link
– May provide any of the 3 types of Network Data, depending on the device - Examples:
– Web proxies
– Load balancers
– DHCP & DNS Servers - Benefits
– May offer many perspectives on the same incident - Drawbacks
– Logs may come in varying formats and levels of detail
– May require intensive parsing & analysis
– Platforms often scattered across enterprise
– Requires solid aggregation plan/platform
17
Q
Tap
– Definition
– Benefits
– Drawbacks
A
- Hardware device which duplicates data streams and may send them to a capture/observation platform
- “Aggregating” tap merges both directions of traffic
- “Regenerating” tap duplicates data streams and sends to multiple physical ports
- Benefits
– Specifically designed for network traffic capture
– Engineered for performance and reliability
– Most taps fail open during power loss - Drawbacks
– Expensive
– Downtime during installation
18
Q
Network-Based Processing Workflows
– List 6
A
- Establish Baselines
- Ingest and Distill
- Reduce and Filter
- Analyze and Explore
- Extract Indicators and Objects
- Scope and Scale
19
Q
Establish Baselines
– Goal
– Details
A
- Establish normal pattern of behaviour to help ID abnormal patterns.
- Established before, during, and after a mission
- Determines cycles based on time and date
- Determine typical cycles of traffic
– Top-talking hosts
– Ports/protocols
– GET vs POST ratios
20
Q
Ingest and Distill
– Goal
– Details
A
- Prepare for analysis and derive data that will more easily facilitate the rest of the analytic workflow
- Log source Data
- Distill pcap files to other data types
- Split data into time-based chunks
- Load data into analytic platforms
21
Q
Reduce & Filter
– Goal
– Details
A
- Reduce volume of input data
- Use known indicators and data points to reduce data volume
– IP addresses
– Ports/protocols
– Time frames
– Volume calculations
– Domain names
– Hostnames - Build filters to reduce visible data
22
Q
Analyze and Explore
– Goal
– Details
A
- ID traffic/artifacts that support investigative goals/hypotheses
- Analyze reduced data for suspicious traffic
– Content
– Context
– Anomalies
– Consistencies - Look for protocol anomalies
- Compare to baseline to ID deviations
23
Q
Extract Indicators & Objects
– Goal
– Details
A
- Find artifacts that help ID malicious activity
- Look for:
– field values
– byte sequences
– files
– other objects - Maintain artifact collection
- Includes obs about network traffic itself or nature of communications
- Extract artifacts
- Protect/share data IAW policies and security constraints
24
Q
Scope & Scale
– Goal
– Details
A
- Search more broadly within source data for behaviour that matches known indicators
- Scale up search w/ large-scale platforms/tools
- ID additional suspicious endpoints
- Pass indicators to security ops
25
Wireshark
Deep, protocol-aware packet exploration and analysis tool
Can extract over **140,000** data fields
26
TCPDump
Log or parse network traffic, similar to wireshark
27
Bro NSM
Creates log files to document observed network traffic
28
Snort/Suricata
Performs real-time traffic analysis and packet logging on IP networks
May work as an IDS or an IPS
Can detect variety of attacks/probes using sigantures
29
NetworkMiner
Protocol-aware object extraction tool that **writes files to a disk**
May trigger host defenses when writing files to disk
Network data fields can be exported to CSV
30
Cisco Hierarchical Network Design
-- 3 Layers
Access (lowest)
Distribution (middle)
Core (Highest)
31
Core Layer (Cisco Hierarchical Network Design)
- Aggregates distribution switches in large LANs
- Provides high forwarding rates
32
Distribution Layer (Cisco Hierarchical Network Design)
- Aggregation point for access switches
- Does not connect directly to end-user devices
- Provides **redundancy** and interconnectivity
33
Access Layer (Cisco Hierarchical Network Design)
- Connection point for end user devices
- Does not typically connect to other access switches
- Controls access to intranet resources
34
OS used by switches
Internetwork Operationg System (IOS)
35
3 Ways to access switch CLI
- Console - physical port
- Telnet - IP network
- SSH - IP network
36
Four types of switch memory
- ROM
- Flash
- NVRAM
- RAM
37
Location of startup-config
NVRAM
38
Location of Running-config
RAM
39
VLAN
- Advantages
- equals...
- Advantages
-- Segmentation
-- Flexibility
-- Security
- Equals...
-- Broadcast Domain
-- Subnet
-- Logical Network
-- LAN
- By nature, they inhibit communication between VLANs
40
802.1Q
-- What is it
-- Tagging method
-- # VLANs supported
-- Spanning Tree
-- Multi-vendor support
-- Native VLAN
- VLAN Trunking protocol
- Handles frame tagging (inserts 4 bytes into OG frame, modifies FCS)
- Supports 4096 VLANs (4094 in practice)
- Mono Spanning Tree
- IEEE Open Standard
- Uses native VLAN
41
ISL
-- What is it
-- Tagging method
-- # VLANs supported
-- Spanning Tree
-- Multi-vendor support
-- Native VLAN
- Inter-switch link; alternative to 802.1Q
- Adds 26 byte header and 4 byte trailer to tag VLANs
- Supports 1000 VLANs
- Uses Per VLAN Spanning Tree
- Cisco Proprietary
- Does not use native VLAN
42
DTP
- Dynamic Trunk Protocol
- Handles negotiation of trunk links
43
Trunk Modes
- Trunk - Permanent trunk mode
- Access - Permanent non-trunk mode
- Dynamic Desirable - Port actively tries to convert link to trunk link
-- Becomes a trunk if neighbor is set to trunk, desirable, or auto
- Dynamic Auto - Port is willing to convert to trunk link
-- Becomes trunk if neighbor port is set to desirable
- NoNegotiate - Permanent trunk mode, prevents port from generating DTP frames
44
EtherChannel
- Allows parallel links (up to 8 ports) to function as one single link
- Increases bandwidth
- Reduces convergence and provides redundancy
45
VTP
-- Features
-- Modes (do they configure, vlan range, do they forward, do they sync)
-- Items required to forward updates
- Features
-- Advertises VLAN config info (trunk ports only)
-- Maintains VLAN config throughout domain
- Modes
-- Server - Configure VLANs 1-1005; Originates, forwards, and syncs updates
-- Client - Supports but does not configure VLANs 1-1005; forwards and syncs updates
-- Transparent - Configures VLANs 1-4094; forwards updates
- Matching VTP Domain name and password
46
Difference between VTP v1, v2, and v3
- Only v3 can be in "Off" mode
- v1 does not support Token Ring or Unrecognized TLVs
- v2 and v3 do not check VTP version before forwarding updates in transparent mode
- v1 does not support consistency checks
- v3 supports extended VLAN range
- v3 supports private VLANs
- v3 supports database propagation
- v3 encrypts password
47
VTP operation
-- General operation info
-- Requirements to function
-- VLAN config storage
- General:
-- Advertisements sent as multicast frames every 5 min, or if there is a change
-- servers/clients sync to latest revision num
- Function Requirements:
-- Links set up with ISL or 802.1Q
-- VTP domain name and password (if set) match
- Config Storage
-- vlan.dat in flash memory
48
Spanning Tree Protocol
-- Purpose
-- Features/Enhancements
- Prevents loops and provides path redundancy
- Prevents broadcast storms
- Stabilizes MAC table
- Eliminates multiple frame transmission
- Portfast
-- Minimizes wait time
- BPDU Guard
-- Enabled by default
-- Prevents switch operation on specified port (access mode or unused/disabled ports)
-- Port goes into err-disabled mode when BPDUs detected
- Root Guard
-- Enables BPDUs on specified port
-- Ignores superior BPDU messages (prevents rogue switch taking over as root bridge)
49
BPDU (Spanning Tree Protocol)
-- What is it
-- Types
-- Contains
-- Default Priority
- Bridge Protocol Data Unit
- 3 Types
-- Config BPDU
-- Topology Change Notification (TCN)
-- Topology Change Acknowledgement (TCA)
- Contains Bridge ID
-- Unique ID
-- Bridge Priority (2 bytes) and Bridge MAC (6 Bytes)
-- Default priority is 32768
-- Root bridge has lowest priority num
-- If priority is the same, lowest MAC wins
50
Spanning Tree Protocol States
-- 5 states
- Blocking
- Listening (15 sec)
-- Topology change detected
-- Does not forward frames
-- Inactive MACs removed from CAM table
- Learning (15 sec)
-- Does not forward frames
-- Switch adds new MACs to CAM table
- Forwarding
- Disabled (off)
51
Spanning Tree Protocol Versions
- IEEE 802.1D
-- 1 instance for all VLANs
-- Slow (up to 50 sec) convergence
- Per VLAN ST (PVST)
-- 1 instance per VLAN
-- Supports ISL; PVST+ supports 802.1Q
-- Cisco Proprietary
- IEEE 802.1w (Rapid STP)
-- Faster (<10 sec) convergence
-- 1 instance for all VLANs
- Per VLAN RST
-- 1 RSTP Instance per VLAN
- IEEE 802.1s
-- Multiple Spanning Tree Protocol
-- Inspired by CISCO's MISTP
-- Multiple VLANs mapped to single instance of ST
52
Spanning Tree protocol
-- How it works
- Elect root bridge (one per network)
-- All interfaces forwarding
-- All ports are designated ports
- Elect root port (one per device) for non-root bridge
-- Lowest cost back to root bridge
- Elect designated port for each network segment
-- Lowest cost back to root bridge
- Cost determined by bandwidth
- STP recalculates after MAXAGE timer expires
53
Rapid Spanning Tree Protocol
-- State Differences
-- MaxAge Difference
-- Convergence Info
-- Additional Port Definitions
- Only has Discarding, Learning, and Forwarding states
- MaxAge is 6 sec vs 20 in STP
- Listening state removed, learning state time reduced
- Convergence < 10 sec
-- All switches generate/send Hello BPDUs
-- States no longer based on timers
-- Portfast now referred to as Edge Ports
- Designates an Alternate Port
-- Primary alternate for a root port
- Designates a Backup Port
-- Backup for an Alternate Port
54
Sub-interface
- Router equivalent of SVI
- Single interface may be divided into multiple sub interfaces to carry traffic for multiple VLANs
55
Inter-VLAN routing
- Must define a default gateway
56
DHCP Relay
- IP Helper-address
- Client server application to forward broadcast requests
-- Converts broadcast into unicast to DHCP server
- Allows DHCP requests to leave the LAN subnet (VLAN)
57
Router on a stick
- Single router w/ one interface
- Performs ISL/802.1Q trunking paired w/ sub interfaces to route VLAN traffic
58
SVI (Switch Virtual Interface)
- Layer 3 presence of a VLAN
- Virtual port, only existing in switch software
- Allows inter-VLAN routing
- Layer 2 VLAN must exist for this to function
59
HSRP (Hot Standby Routing Protocol)
- Designed to support failover of IP traffic
- Multiple routers (standby/HSRP group) appear as a single virtual router for hosts on the LAN
-- One router at a time is selected as the *active* router. Only the active router forwards packets
-- Active router is the one with **highest** HSRP priority
-- A backup for the active router is selected as the **standby** router
- Preempt enables a router to resume the active role
- Hold timer should be at least 3 times hello timer
60
Port security
- Limits MAC address on switch ports
-- NOT used on dynamic ports
- Can either be static (manually specified MACs) or dynamic (limit # of hosts per port)
- Static MACs saved to running-config
- Dynamic MACs not saved in running-config
-- Enabling Sticky allows dynamic MACs to be stored in running-config, essentially making them static
61
Switchport Security Violations
- 3 types
- Protected
-- Known MACs may continue sending traffic
-- No notification
- Restricted
-- Known MACs may continue sending traffic
-- Notification (SNMP) sent and violation counter incremented
- Shutdown
-- Default mode
-- Notification sent
-- Interface switched to err-disabled state
62
SSH
- Uses up to 2048-bit ciphers and RSA encryption
63
AAA
-- What is it
-- Radius vs TACACS+
- Authentication, Authorization, and Accounting
- Radius
-- UDP
-- Encrypts only PW
-- Open source, less granular authorization control
- TACACS+
-- TCP port 49
-- Encrypts full payload of each packet
-- Cisco proprietary, very granular authorization control
64
Routed Port
- Switch port using the *no switchport* command
- Acts like a port on a normal router
65
Routing Requirements
- Know destination address
- ID sources to learn from
- Discover possible routes
- Select best route
- Maintain/verify routing info
66
Types of routing
- Static
-- Static route
-- Static default route
- Dynamic
-- OSPF
-- EIGRP
67
Static Routing
- Manually configured
- Simplest form on small networks but complicated and not feasible in large
- Classful and Classless
- Hub and Spoke design
- Must configure routes for both directions
- Static Default route uses gateway of last resort
-- Any traffic that doesn't match another defined route gets sent to gateway of last resort
68
Dynamic Routing
-- General Info
-- Advantages
-- Disadvantages
- Routing information exchanged between routers
- Can load balance between multiple paths with equal/unequal costs
- Advantages
-- Suitable for any topology using multiple routers
-- Independent of network size
-- Automatically adapts to reroute traffic (if possible)
- Disadvantages
-- Can be complex to set up
-- Less secure due to broadcast and multicast updates
-- Route depends on current topology
-- Requires additional resources (CPU, memory, bandwidth)
69
Routing protocol Classifications
-- classified based on purpose (2), operation (3), or behaviour (2)
- Purpose
-- Interior Gateway Protocol (IGP) - Routing within an autonomous system (AS) (intra-AS routing)
-- Exterior Gateway Protocol (EGP) - Routing between Autonomous systems (AS) (inter-AS routing)
- Operations
-- Distance Vector - Routes advertised by providing *distance* and *vector*
-- Link-state - Each node in network constructs a connectivity map, then independently calculates the best paths. Good for large hierarchical networks needing fast convergence
-- Path-vector - Essentially distance vector protocol that analyzes the path itself to guarantee loop-free path
- Behaviour
-- Classful (legacy) - Do not send subnet mask info in routing updates. Create problems in *discontiguous networks*
-- Classless - Include subnet mask info in routing updates. Support VLSM and CIDR
70
IPv4 Routing Protocols
- 7 protocols
- RIPv1: IGP, Distance Vector, Classful
- IGRP: IGP, Distance Vector, Classful, Cisco-developed
- RIPv2: IGP, Distance Vector, Classless
- EIGRP: IGP, Distance Vector, Classless, Cisco-developed (can also be classful)
- OSPF: IGP, Link-state, Classless
- IS-IS: IGP, Link-state, Classless
- BGP: EGP, Path-vector, Classless
71
Autonomous System
Collection of routers under a common administration such as company or organization
72
Discontiguous Network
Network in which subnets from the same classful major network address are separated by a different classful network address
73
Administrative Distance
- Used by routers to select the best path when multiple routes exist from *different routing protocols*
- Defines reliability of a protocol
- *Some* default values:
-- Connected interface - 0
-- Static route - 1
-- EIGRP summary route - 5
-- BGP - 20
-- Internal EIGRP - 90
-- OSPF - 110
-- Unknown - 255
74
Distance Vector Routing Protocols
- Routing updates shared between neighbors
- Router is aware of networks on its own interfaces and those that can be reached through neighbors
- Some protocols send periodic updates
-- RIP sends updates to 255.255.255.255 (v1) or multicast 224.0.0.9 (v2) every 30 seconds
75
Routing Information Protocol (RIP)
-- Metric info
-- Timers
- Distance Metric: Hop Count
-- Max allowed is 15
-- 16 is infinity metric (host unreachable)
- Susceptible to loops and the "count to infinity" problem
- Timers, since last update
-- 240 sec Flush
-- 180 Sec Invalid
-- 180 sec Hold down (starts after invalid timer ends)
76
Split Horizon
- Method of preventing routing loops
- Routing info for a given packet is never sent back in the direction from which it was received
77
OSPF
-- algorithm
-- states (8)
-- method of sharing routes
- Utilizes shortest path first (SPF) algorithm
- States:
-- Down
-- Init
-- 2-way
-- DR Election
-- ExStart
-- Exchange
-- Loading
-- Full
- Propagates LSAs rather than routing table updates
- LSAs flooded to all OSPF routers in the area
78
EIGRP
-- details
-- metric
-- path determination
- Rapid convergence
- Reduced bandwidth
- Uses "5 Ks" to calculate Metric (distance)
-- K1: Bandwidth
-- K2: Load
-- K3: Delay
-- K4/K5: Reliability
- Feasibility condition (feasible/calculated distance > reported/advertised distance) is used to detect paths with loops
- Successor is route with lowest metric that meets feasibility condition
- Feasible successor is a secondary route that also meets feasibility condition
- Use auto-summary to summarize subnets into classful addresses
79
Access Control List
-- Types (3)
-- Number Ranges
-- Details
**Types**
- Standard
-- Checks source address
-- Permits/denies all protocols
-- Number range 1-99, 1300-1999
- Extended
-- Checks both source and destination
-- Permits/denies specific protocols
-- Can also specify conditions for specific ports
-- Number Range 100-199, 2000-2699
- Named
-- Can be standard or extended, just uses name instead of number to identify
- Uses wildcard mask for filtering subnets
- Most restrictive statements should go at top of ACL
80
Domino Effect
- If a network layer is compromised, all network layers above it are also compromised
-- Ex: if data link layer is compromised, the network, transport, and application layers are also compromised
81
CAM Overflow
-- What is it
-- Mitigation
- Attacker floods CAM table with thousands of MAC addresses, causing it to fill up. When this happens, the switch starts to flood any traffic from new hosts out all ports
- Essentially turns a switch into a hub
- May be mitigated with port security or MAC address monitoring
82
ARP Spoofing
-- what is it
-- mitigation
- Attacker pretends to be default gateway and sends out a gratuitous ARP, so all users send traffic through the attacker instead of the real default gateway
- Only works within one VLAN
- May be mitigated with:
-- Static ARP table on critical stations
-- ARP ACL
-- Private VLANs
83
VLAN Hopping
Can occur in two ways:
- Switch Spoofing - Attacker configures device to work as trunk port. Switch will then trunk all available VLANs to that device
-- Mitigated by switching port to access mode, or setting nonegotiate
- Double tagging - Second 802.1q tag is added in front of the first
-- Only works with native VLANs
84
IPSEC
-- what's it used for
-- what does it provide
- Security protocol used with VPNs
- Operates at layer 3
- Provides:
-- Confidentiality
-- Integrity
-- Authentication
-- Anti-replay
85
IPSEC Stages
- Interesting Traffic initiates IPSEC process
- IKE Phase 1
-- IKE Authenticates Peers
-- Negotiates security association (SA) policy
-- Perform authenticated Diffie-Hellman exchange
-- Establishes secure channel
-- Two modes, Main and Aggressive
- IKE Phase 2
-- Negotiates IPSEC SA parameters
-- SAs periodically renegotiated for security
-- Performs DH exchange if perfect forward secrecy is desired
-- Security protocol is selected (Authentication Header or Encapsulation Security Payload)
- Data Transfer - Data transferred between IPSEC peers
- IPSEC Tunnel Termination - IPSEC SAs terminate through deletion or timeout
86
IP Payload Compression Protocol (IPComp)
Reduces amount of data sent in IPSEC
87
IPSEC "Interesting Traffic"
- Determined as part of security policy
- Access lists used to determine interesting traffic in Cisco routers and PIX firewalls
88
Items shared in IPSEC IKE Phase 1
- Encryption algorithms (DES, 3DES, AES)
- Authentication Algorithms (MD5, SHA)
- Diffie-Hellman Group
- Preshared key or RSA/DSA certs
89
Authentication Header (AH) Protocol
- Allows verification of authenticity and integrity of content as well as origin of packet
-- Only does source authentication and content integrity
90
Encapsulating Security Payload (ESP)
- Encrypts entire IP packet allows for authenticating its content
- Ensures privacy (encryption), source authentication, and content integrity (authentication)
91
IPSEC Modes
- two modes
- Tunnel - Encrypts both payload and header and appends new header
- Transport - Encrypts only payload and leaves header unencrypted
92
NAT IP Address names
- Inside Local - Local network, private IP
- Inside Global - Local Network, public IP
- Outside Global - Other network, public IP
- Outside Local - Other network, private IP
93
NAT Types
- Static NAT
-- One to One mapping of private IP to public IP
-- Useful when device needs to be accessible from the internet
- Dynamic NAT
-- Mapping of private IP address to a public IP from a group of public IPs (NAT pool)
- PAT (overloaded NAT)
-- Map multiple private IP addresses to single public IP (most common today)
94
Major Wireless Topologies
- WPAN (personal area network)
-- 802.15.1 (bluetooth)
-- 20-30 ft
- WLAN
-- 802.11 (wifi)
-- up to 300 ft
- WMAN (metropolitan area network)
-- 802.16 (wi-max)
-- up to 30 miles
- WWAN (wide area network)
-- Mobile networks (CDMA/LET)
-- Worldwide coverage
95
WLAN components
- Access Point
-- RF Transceiver
-- Processor/software
-- Antennas
- User device w/ NIC
- Router
- Repeater (optional)
96
WLAN operating modes
-- 2 modes
- Infrastructure Mode
-- Clients communicate through access point
- Ad hoc mode
-- Clients communicate directly with one another (peer to peer)
97
Infrastructure Access Point Modes
-- 4 modes
- Root
-- Default mode
-- Each AP wired into LAN
- Bridge
-- AP connects two or more physically separate network segments
-- Multi-point or point to point
-- Only one root bridge, all non-root bridges must pass traffic through root
- Repeater
-- Re-broadcasts data to extend range of network
- Scanner
-- Scans nearby wireless signals
-- Used for wireless IDS, Troubleshooting, and wi-fi setup
98
802.11 Network Architecture
-- 3 Types
- Basic Service Set (BSS)
-- One AP, one or more clients
-- Most common
-- Uses BSSID -- 48 bits, MAC of BSS AP
-- Network advertised with SSID
- Extended Service Set (ESS)
-- Connects two or more BSS together
-- Uses common SSID to allow roaming between APs (ESSID)
- Independent Basic Service Set (IBSS)
-- Ad hoc or peer-to-peer mode
-- No AP, only clients
-- Not an infrastructure mode
-- Only one client may transmit at a time, and all must be on same frequency
99
Wireless Residential Devices
- AP and router (one device)
- Cable modem/DSL (may be included in AP)
- Easy to configure
- Commonly referred to as SOHO devices
100
Beacon Frame
Information sent by WAPs containing SSID, data rates, etc)
101
Probes (802.11 term)
- Client looking for SSID
- Directed probe requests will always trigger a response including properly configured SSID, making disabling SSID broadcast very weak security
102
Hidden Node Problem
If two nodes A and B are physically blocked from one another's radiation patterns, and both start transmitting to node C simultaneously, their signals will collide and they will be unable to detect the collision and the transmitted signals will become corrupted
103
MAC filtering (Wireless security)
Can easily be bypassed with MAC spoofing
104
WEP
- Wired Equivalent Privacy
- Encrypts all data in the frame including headers
- Very weak
- Uses RC4 encryption
- Does not protect against forgery or replay attacks
105
WPA1
- Replaced WEP
- Utilizes TKIP (Temporal Key Integrity Protocol)
-- Based on RC4
-- Each packet has unique encryption key
-- Includes Message Integrity Check and Rekeying mEchanism
-- Considered obsolete
106
WPA2
- Replaced WPA1
- Uses Cipher Block Chaining Message Authentication Code Mode Protocol (CCMP)
-- Uses AES encryption
- Supports TKIP for backwards compatibility
- 802.11i
- Two types
-- Personal - Pre shared key, SOHO use
-- Enterprise - Authentication server, for enterprise use; 802.1X standard
107
WAP3
- Released Jan 2018
- Individual devices will not share encryption key w/ other devices
- Up to 192 bit encryption if needed
- Setup mode for IOT and no screen devices
- Must be connected to de-authenticate
108
SSL VPN
- Does not require installation and config of client software (unlike IPSEC VPN)
- User connects to SSL VPN via web browser
- SSL VPN server is encrypted with SSL or TLS
109
Collapsed Core network model
First two layers of Cisco Hierarchy (Access and distribution)
Used for smaller networks not requiring the core to be a separate level
