Gibson - Chapter 3: Exploring Network Technologies

Question 1

Sniffing Attack

Answer 1

answer

Question 2

DoS & DDoS

Answer 2

answer

Question 3

Poisoning Attack

Answer 3

answer

Question 4

OSI (Open Systems Interconnection) model

Answer 4

answer

Question 5

TCP (Transmission Control Protocol)

• provides connection-oriented traffic
• guaranteed delivery
• uses 3-way handshake
• SYN : SYN/ACK : ACK

Answer 5

Guaranteed delivery via 3- way handshake

• (vs best effort /connectionless UDP)

Question 6

UDP (User Datagram Protocol)

• connectionless sessions (w/out 3-way handshake)
• best effort to deliver traffic (w/out extra traffic to ensure delivery
• ICMP traffic such as ping, audio/video, network based DoS

Answer 6

Best effort / connectionless
- (vs guaranteed delivery via 3- way handshake for TCP)

Question 7

IP (Internet Protocol)

• identifies hosts in a TCP/IP network
• delivers traffic from one host to another using IP addressed
• IPv4 (32 bit dotted decimal)
• IPv6 (128 bit hexadecimal)

Answer 7

IP (Internet Protocol)

Question 8

ICMP (Internet Control Message Protocol)

• used for testing basic connectivity
• tools include ping, pathping, tracert
• blocking ICMP prevents many DoS attacks

Answer 8

ICMP (Internet Control Message Protocol)

Question 9

ARP (Address Resolution Protocol)

• resolves IPv4 addresses to MAC (Media Access Control) addresses
• ARP poisoning attacks redirect or interrupt network traffic

Answer 9

ARP (Address Resolution Protocol)

Question 10

RTP (Real Time Transport Protocol)

• delivers audio & video over IP networks
• includes VoIP (Voice over Internet Protocol), streaming media, video teleconferencing etc
• unsecure

Answer 10

RTP (Real Time Transport Protocol)

Question 11

SRTP (Secure Real-time Transport Protocol)

• provides encryption
• provides message authentication
• provides integrity
• protects against Replay Attacks
• can be used for both unicast and multicast transmissions

Answer 11

SRTP (Secure Real-time Transport Protocol)

Question 12

SIP (Session Initiation Protocol)

• used to initiate, maintain, and terminate voice, video, and messaging sessions
• use request and response messages when establishing a session
• are text so easy to read if captured
• contain metadata about sessions (not data)

Answer 12

SIP (Session Initiation Protocol)

Question 13

FTP (File Transfer Protocol)

• uploads and downloads large files to and from an FTP server
• by default transmits data in clear text

(Gibson 601; Chapter 3, pg 324)

Answer 13

TCP port 20/21

• TCP port 21 (for CONTROL SIGNALS)

— (both ACTIVE & PASSIVE MODE)

• TCP port 20 (for DATA in ACTIVE MODE)
• Passive (PASV) uses random DATA port

(Transmission Control Protocol)

Question 14

TFTP (Trivial File Transfer Protocol)

• used to transfer smaller amounts data

– i.e. when communicating with network devices

• not essential protocol on most networks
• commonly disabled

(Gibson 601; Chapter 3, pg 324)

Answer 14

UDP port 69

Question 15

SSH (Secure Shell)

• encrypts traffic in transit
• SSH + FTP = SFTP (Secure File Transfer Protocol)
• can also encrypt TCP Wrappers

— (TCP Wrappers are a type of access control list (ACL) used on Linux systems to filter traffic)

• Secure Copy (SCP) is based on SSH

(Gibson 601; Chapter 3, pg 324)

Answer 15

TCP port 22

Question 16

SSL (Secure Sockets Layer)

Answer 16

primary encryption for HTTP (Hypertext Transfer Protocol)

compromised, replaced by TLS

Question 17

TLS (Transport Layer Security)

Answer 17

replacement for SSL

Question 18

IPSec (Internet Protocol security)

• used to encrypt IP traffic
• native to IPv6, also works with IPv4
• encapsulates and encrypts IP packet payloads
• uses Tunnel mode to protect VPN (virtual private network) traffic
• two main components

– AH (Authentication Header)

—-[protocol ID number 51)

– ESP (Encapsulating Security Payload)

—-[protocol number 50)

• uses IKE (Internet Key Exhange) over UDP 500

Answer 18

UDP port 500

Question 19

SFTP (Secure File Transfer Protocol)

• secure implementation of FTP
• is an extension of Secure Shell (SSH)
• uses SSH to transmit the files in an encrypted format

(Gibson 601; Chapter 3, pg 325)

Answer 19

TCP port 22

Question 20

FTPS (File Transfer Protocol Secure)

• an extension of FTP
• uses TLS (Transport Layer Security) to encrypt FTP traffic
• difference between FTPS & SFTP is TLS vs SSH

Answer 20

TCP ports 989/990

(some) TCP ports 20/21

(Transmission Control Protocol)

Question 21

SMTP (Simple Mail Transfer Protocol)

Answer 21

SMTP (Simple Mail Transfer Protocol)

Question 22

POP3 (Post Office Protocol v3)

Answer 22

POP3 (Post Office Protocol v3)

Question 23

IMAP4 (Internet Message Access Protocol v4)

Answer 23

IMAP4 (Internet Message Access Protocol v4)

Question 24

HTTP (Hypertext Transfer Protocol)

Answer 24

HTTP (Hypertext Transfer Protocol)

Question 25

**HTTPS** (**H**yper**t**ext **T**ransfer **P**rotocol **S**ecure)

Answer 25

**HTTPS** (**H**yper**t**ext **T**ransfer **P**rotocol **S**ecure)

Question 26

**LDAP** (**L**ightweight **D**irectory **A**ccess **P**rotocol)

Answer 26

**LDAP** (**L**ightweight **D**irectory **A**ccess **P**rotocol)

Question 27

**LDAPS** (**L**ightweight **D**irectory **A**ccess **P**rotocol **S**ecure)

Answer 27

**LDAPS** (**L**ightweight **D**irectory **A**ccess **P**rotocol **S**ecure)

Question 28

**RDP** (**R**emote **D**esktop **P**rotocol)

Answer 28

**RDP** (**R**emote **D**esktop **P**rotocol)

Question 29

**OpenSSH**

Answer 29

**OpenSSH**

Question 30

**NTP** (**N**etwork **T**ime **P**rotocol)

Answer 30

**NTP** (**N**etwork **T**ime **P**rotocol)

Question 31

**DHCP** (**D**ynamic **H**ost **C**onfiguration **P**rotocol)

Answer 31

**DHCP** (**D**ynamic **H**ost **C**onfiguration **P**rotocol)

Question 32

**IPv4**

Answer 32

**IPv4**

Question 33

**IPv6**

Answer 33

**IPv6**

Question 34

DHCP Snooping

Answer 34

DHCP Snooping

Question 35

DHCP Discover

Answer 35

DHCP Discover

Question 36

DHCP Offer

Answer 36

DHCP Offer

Question 37

DHCP Request

Answer 37

DHCP Request

Question 38

DHCP Acknowledge

Answer 38

DHCP Acknowledge

Question 39

**DNS** (**D**omain **N**ame **S**ystem) * A * AAAA * PTR * MX * CNAME * SOA

Answer 39

**DNS** (**D**omain **N**ame **S**ystem)

Question 40

DNS Poisoning

Answer 40

DNS Poisoning

Question 41

**DNSSEC** (**D**omain **N**ame **S**ystem **Sec**urity Extensions)

Answer 41

**DNSSEC** (**D**omain **N**ame **S**ystem **Sec**urity Extensions)