lesson 3

Question 1

rfc 1918 addresses

Answer 1

• cannot be routed on the internet
• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Question 2

one to many nat

Answer 2

• called dynamic nat, source nat, or hide nat
• many computers represented by one ip address
• only allows connections from the local side of the firewall

Question 3

one to one nat

Answer 3

• called static nat and destination nat
• used to interconnect two ip networks with incompatible addressing
• each host has a unique ip address

Question 4

nat issues

Answer 4

• ip addresses within application data wont be translated by nat
• its’ use has delayed the adoption of ipv6

Question 5

dhcp request process

Answer 5

• dora
• client broadcasts discover packet to udp port 67
• server responds with an offer on udp port 68
• offer can include ip address, subnet mask, lease duration, server ip
• client sends request to obtain the offered ip address
• server sends acknowledgement

Question 6

dhcp options

Answer 6

• subnet mask
• broadcast address
• router
• dns server
• hostname
• domain name
• static routes
• arp cache timeout
• ntp servers
• netbios over tcp/ip name server
• smtp server
• requested ip address
• tftp server
• bootfile name

Question 7

dhcp security issues

Answer 7

• rogue dhcp servers

- dhcp starvation

Question 8

rogue dhcp servers

Answer 8

• attacker uses fake dhcp server to assign ip addresses to victims and perform man in the middle attacks
• dhcp snooping can be implemented on switches to only allow packets from trusted dhcp servers

Question 9

dhcp starvation

Answer 9

• attacker rapidly requests addressing from the dhcp server by changing their mac address each time which causes real requests to be denied
• use port security on switches to restrict the mac addresses allowed on a physical interface

Question 10

packet filter

Answer 10

• open bsd’s way of filtering tcp/ip traffic, doing nat, normalizing and conditioning tcp/ip traffic, providing bandwidth control, and packet prioritization
• takes place in the kernel
• pseudo device (/dev/pf) allows programs to control the packet filer behavior

Question 11

pfsense

Answer 11

• open source firewall and router software based on freebsd

- forked from m0n0wall project in 2004

Question 12

pfsense features

Answer 12

• stateful packet inspection
• dhcp
• dns
• nat
• vpn server
• high availability
• load balancing
• traffic shaping
• captive portal
• ids/ips (intrusion detection/prevention)
• transparent caching proxy
• web content filter
• geoIP blocking