Supporting Network Management Flashcards

Question

What historical method might IT departments have used for tracking IP usage?

Answer 1

Static Files.

Answer 2

verifying exactly what is connected to the network and what is being communicated over it. Processes and tools that facilitate identification of hosts present on a network or subnet. Windows firewall configurations makes a host visible to network browsers.

Answer 3

Utility that can probe a network to detect which IP addresses are in use by hosts. Performs host discovery and can establish the overall logical topology of the network in terms of subnets and routers.

Answer 4

A basic type of IP scanning that only attempts to determine if an IP address is "up"

Answer 5

Widely used for IP scanning, both as an auditing and as a penetration testing tool. Is open-source software with packages for most versions of Windows, Linux, and macOS. It can be operated with a command line or via a GUI (Zenmap). Basic syntax of an Nmap command is to give the IP subnet (or IP address) to scan

Answer 6

Nmap, Angry IP, or PRTG.

Answer 7

-sn This switch suppresses the port scan.

Answer 8

specifying the --traceroute switch.

Answer 9

Tries to identify which TCP and UDP ports are listening.

Answer 10

TCP SYN (-sS):This is a fast technique also referred to as half-open scanning. The scanning host requests a connection without acknowledging it. The target's response to the scan's SYN packet identifies the port state. Stealthy. TCP connect (-sT): A half-open scan requires Nmap to have privileged access to the network driver so that it can craft packets. Less stealthy. UDP scans (-sU): Scan UDP ports. As these do not use ACKs, Nmap needs to wait for a response or timeout to determine the port state, so UDP scanning can take a long time. A UDP scan can be combined with a TCP scan. Port range (-p): By default, Nmap scans 1,000 commonly used ports. Use the -p argument to specify a port range. You can also use --top-ports n, where n is the number of commonly used ports to scan

Answer 11

They probe a host more intensively to discover the software or software version operating each port.

Answer 12

Cisco Discovery Protocol A proprietary protocol used by Cisco network appliances to discover layer 2 adjacent devices or neighbors. Sends announcements every 60 seconds. Each device keeps a cache table of the data compiled from announcements it has received.

Answer 13

01:00:0c:cc:cc:cc

Answer 14

Link Layer Discovery Protocol. A standards-based protocol used by network appliances to discover layer 2 adjacent devices or neighbors. Sends announcements every 30 seconds by default.

Answer 15

01:80:c2:00:00:0e

Answer 16

They enable network devices to automatically, detect, identify, and map directly connected neighbors. Simplifying network management.

Answer 17

With the command: show cdp neighbors

Answer 18

Performance metrics are measurements of a value affecting system performance. Indicators include: -Bandwidth: The rated speed of all the interfaces available to the device -Utilization/Throughput: The actual amount of data transferred. -CPU and memory: If CPU and/or system memory utilization (measured as a percentage) is consistently very high, an upgrade might be required. High CPU utilization can also indicate a problem with network traffic. -Storage: If the device runs out of storage space, it could cause serious errors.

Answer 19

To establish the level of resource utilization at a point in time. Typically when the system is first installed. Changes to the system usually require a new baseline to be taken.

Answer 20

AKA heartbeat monitors, or uptime monitors. Processes and tools that trigger an alert or an alarm if a host or service experiences an outage or other unscheduled downtime. Most work by sending a probe to the target service and checking for a non-error response.

Answer 21

-The application or OS hosting the service has crashed -Hardware or power issues -The server hosting the service is overloaded (high CPU/memory/disk I/O utilization/disk space utilization). -Network congestion can be at the client or server end or both. -A broadcast storm can cause loss of network bandwidth. -DoS attack which can be signified by network congestion or high host CPU/memory utilization

Answer 22

-The baseline or golden configuration is a template for the state that a given device should be in. -The production configuration is the state that the device is actually in. Also, a device could have a running configuration that is different from its startup configuration. -A backup configuration is a point-in-time copy of a running or startup configuration.

Answer 23

Processes and tools that facilitate reporting and alerting when a host or app's configuration deviates from a baseline or golden configuration.

Answer 24

Its default behavior is to ping and send a TCP ACK packet to ports 80 and 443.

Answer 25

MAC address table sizes

Answer 26

A widely used framework for remote managements and monitoring of servers and network appliances. Consists of agents and a monitoring system.

Answer 27

A process (software or firmware) that runs on a switch router server or other SNMP compatible network device. A device running a SNMP agent is referred to as a managed device. The agent contains a data store called a MIB (management information base). Each parameter in a MIB is referred to by a OID.

Answer 28

Management information base. Database that stores Simple Network Management Protocol (SNMP) properties and values of a network device and its components. Each parameter stored in a MIB is referred to by a numeric OID (object identifier)

Answer 29

Object Identifier. Each parameter stored in a MIB is referred to by a numeric OID. OIDs are stored within a tree structure. Part of the tree is generic to SNMP and the other part can be defined by the device vendor.

Answer 30

With the community string or community name of the computers allowed to manage the agent and the IP address or host name of the server running the management system. The community string acts as a rudimentary type of password. An agent can pass information only to management systems configured with the same community string. There are usually two community strings; one for read-only access and one for read-write access (or privileged mode).

Answer 31

A management software that provides a location which you can oversee network activity. The monitor polls agents at regular intervals for information from their MIBs and displays the information for review. The monitor can retrieve information from a device one of 2 ways: -Get: The software queries the agent for a single OID. This command is used by the monitor to perform regular polling -Trap: The agent informs the monitor of a notable event, such as port failure. The threshold for triggering traps can be set for each value. The monitor can change certain variables using the set command.

Answer 32

In SNMP, a password like value that permits a management system to access an agent.

Answer 33

SNMP v2c: Many networks run on this. Has no support for robust authentication or encryption. SNMP v2c community strings are sent in plaintext and should not be transmitted over the network if there is any risk of interception. SNMP v3 : Supports encryption and strong user based authentication. Instead of community strings the agent is configured with a list of usernames and access permissions. When authentication is required, the SNMP message is signed with a hash of the user's passphrase. If authNoPriv mode is used, packets are not encrypted. authPriv enables encryption using the credential as a key.

Answer 34

auth = authentication Priv = encryption so authNoPriv would mean authentication and no encryption NOTE: auth comes first.

Answer 35

They record startup events and OS events. This includes kernel processes and drivers and can also include core services.

Answer 36

Records data for a single specific service. ex DNS, HTTP, a database etc.

Answer 37

Can also be described as an access log or security log. Records the use of authentication and authorization privileges. Generally records success/fail type events.

Answer 38

Records metrics for compute, storage, and network resources over a defined period.

Answer 39

it receives logs form numerous devices and puts them in a single storage location.

Answer 40

A protocol that facilitates log collection from diverse network devices. Can forward messages to a remote log collector. Provides an open format for event data Works over UDP 514.

Answer 41

A PRI code, a header (that contains a timestamp and host name), and a message part which contains a tag showing the source process plus content.

Answer 42

A system for prioritizing logs that require immediate response. Code 0=Emergency: The system is unusable (kernel panic) Code 1= Alert: A fault requiring immediate remediation has occurred Code 2=critical: A fault that WILL require immediate remediation is likely to develop. Code 3= error: A nonurgent fault has developed. Code 4=Warning: A nonurgent fault is likely to develop. Code 5=Notice: A state that could potentially lead to an error condition has developed. Code 6=Informational: A normal but reportable event has occurred. Code 7=Debug: Verbose status conditions used during development and testing

Answer 43

An alert means that the system has matched some sort of pattern or filter that should be recorded and highlighted. A notification means that the system sends a message to advertise the occurrence of the alert. ex. A low priority alert may simply be displayed in the system dashboard. A high priority alert might use some sort of active notification messaging, such as emailing a system administrator, sending a text message, triggering a physical alarm etc.

Answer 44

Security Information and Event Management. It is designed to integrate network and security monitoring through automated collection, aggregation, and analysis of log data. Its core function is to aggregate logs from multiple sources.

Answer 45

To indicate the messages priority based on facility and severity level. This code helps in categorizing and prioritizing the messages for better management and analysis.

Answer 46

Their primary configuration is to generate some kind of alert.

Answer 47

A very important tool used for network support. It allows the inspection of traffic received by a host or passing over a network link. Can interpret each frame in a stream of traffic to reveal its header fields and payload contents in a readable format. Also preforms traffic analysis. Protocol analyzers depend on packet sniffers.

Answer 48

A monitor that records (or "sniffs") data from frames as they pass over network media, using methods such as a mirror port or TAP device.

Answer 49

SPAN (switched port analyzer)/port mirroring: The sensor is attached to a specially configured port on the switch that receives copies of frames addressed to nominated access ports (or all the other ports). Not a completely reliable method. Frame errors will not be mirrored, and frames may be dropped under heavy load. Passive TAP: A box with ports for incoming and outgoing network cabling and an inductor or optical splitter that physically copies the signal from the cabling to a monitor port. No logic decisions are made so the monitor port receives every frame corrupt or not. Copying is unaffected by load. Active TAP: A powered device that performs signal regeneration, which may be necessary in some circumstances. Gigabit signaling over copper wire is too complex for a passive tap to monitor, and some types of fiber links may be adversely affected by optical splitting. Because it performs an active function, the TAP becomes a point of failure for the links in the event of power loss. TAP=Test Access Point

Answer 50

A command line packet capture utility for Linux, it provides a user interface to the libpcap library. The basic syntax of the command is: tcpdump -i eth0

Answer 51

-w switch writes output to a file and -r switches read the contents of a capture file. The -v, -vv, and -vvv can be used to increase the amount of detail shown about each frame The -e switch shows the Ethernet header. The -i switch specifies the network interface to listen on.

Answer 52

In a 3 pane view. Top Pane shows each frame. Second Pane shows the fields from the currently selected frame. Last Pane shows the raw data from the frame in hex and ASCII.

Answer 53

American Standard Code.

Answer 54

An aggregation TAP combines the upstream and downstream traffic into a single channel for monitoring. Under heavy load, the capacity of this single channel may be exceeded, leading to dropped frames as it cannot keep up with the volume of data.

Answer 55

The amount of information that can be transmitted theoretically. Expresses that available capacity of the link. Measured in bps for data and Hz for audio

Answer 56

A point of poor performance that reduces the productivity for the whole network. May occur because a device is underpowered or faulty or because of a user or application behavior. To identify the bottleneck you must identify where and when on the network overutilization or excessive errors occur.

Answer 57

A server, router, or switch is overloaded. A power outage occurred. A firewall is blocking packets from a known destination. A malicious actor is interfering with network transmissions. Faulty firmware is causing packet processing errors. Knowing where and when the packet loss occurs can direct you to the device that is dropping the frames.

Answer 58

Latency: is the time it takes for a transmission to reach the recipient, measured in milliseconds (ms). (Speed) Jitter: Defined as being a variation in the delay. Manifests itself as an inconsistent rate of packet delivery. Also measured in ms

Answer 59

Latency: ping, pathping, mtr Jitter: mtr

Answer 60

Metrics recorded by a host or switch that enable monitoring of link state, resets, speed, duplex setting, utilization, and error rates. This helps to diagnose performance issues due to congestion, bottlenecking, bandwidth, or packet loss.

Answer 61

Utilization: The data transferred over a period. This can either be measured as the amount of data traffic both sent and received, or calculated as a percentage of the available bandwidth. Per-protocol utilization: The packet or byte counts for a specific protocol. It is often useful to monitor both packet counts and bandwidth consumption. Error rate: The number of packets per second that cause errors. Errors may occur as a result of interference or poor link quality causing data corruption in frames. Error rates should be under 1%; high error rates may indicate a driver problem if a network media problem can be ruled out. Error rate—The number of packets per second that cause errors. Errors may occur as a result of interference or poor link quality causing data corruption in frames. In general terms, error rates should be under 1%; high error rates may indicate a driver problem if a network media problem can be ruled out. Retransmissions: If you observe high levels of retransmissions, you must analyze and troubleshoot the specific cause of the underlying packet loss, which could involve multiple aspects of network configuration and connectivity.

Answer 62

Processes and tools that facilitate reporting of network communication flows summarized by host or protocol type. Diagnosing performance issues depends on detailed information about network traffic flows.

Answer 63

Gather traffic flow data only and report it to a structured database. Allows for a better understanding of IP traffic flows as used by different network applications and hosts. Has been redeveloped as the IP Flow Information Export (IPFIX) IETF standard

Answer 64

Exporter: It defines traffic/cache flows. A traffic flow is defined by packets that share the same characteristics, such as Source IP Address, Destination IP Address, Source Port, Destination Port, and Protocol. These five bits of information are referred to as a 5-tuple. A 7-tuple flow adds the input interface and IP type of service data. When a flow expires or becomes inactive, the exporter transmits the data to a collector. Collector: Aggregates flows from multiple exporters. Needs a high-bandwidth network link and substantial storage capacity. The exporter and collector must support compatible versions of NetFlow and/or IPFIX. The most widely deployed versions of NetFlow are v5 and v9. Analyzer: Reports and interprets information by querying the collector and can be configured to generate alerts and notifications. The collector and analyzer components are often implemented as a single product.

Answer 65

Transfer a large file between two hosts. To determine your network throughput divide the file size by the amount of time taken to copy the file. Several software utilities can be used to automate this process such as: iperf, Ttcp, and BWPing

Answer 66

top talkers are the interfaces generating the most outgoing traffic top listeners are the interfaces receiving the most incoming traffic. Useful in identifying and eliminating performance bottlenecks.

Answer 67

A hosted utility used to measure actual speed obtained by an Internet link to a representative server or to measure the response times of websites from different locations on the Internet.

Answer 68

Broadband speed checkers: These test how fast the local broadband link to the Internet is. Mostly designed for SOHO use. Tests downlink and uplink speeds, will test latency using ping, and can usually compare the results with neighboring properties and other users of the same ISP. Website performance checkers: These query a nominated website to work out how quickly pages load. Since it is an online tool you can test your site's response times from the perspective of customers in different countries.

Answer 69

Congestion and Contention

Answer 70

Congestion: Where the network infrastructure is not capable of meeting the demands of peak load and starts to queue or drop packets. Contention: The ratio between demand for a service and its available capacity.

Answer 71

A header field used to indicate a priority value for a layer 3 (IP) packet to facilitate Quality of Service (QoS) or Class of Service (CoS) scheduling. Is a layer 3 service tagging mechanism. DiffServ traffic classes are typically grouped into three types: -Best Effort. -Assured Forwarding (which is broken down into sub-levels). -Expedited Forwarding (has the highest priority). A CoS (Class of Service) mechanism.

Answer 72

Can be used at layer 2 independetly or in conjunction with DiffServ. Classifies and prioritizes traffic passing over a switch or wireless access point. Defines a tagging mechanism within the 802.1Q VLAN field. A CoS (Class of Service) mechanism.

Answer 73

Allows fine-grained control over traffic parameters. ex. if a network link is congested, DiffServ and 802.1p cannot address it, but a protocol such as Multiprotocol Label Switching (MPLS) with QoS functionality can reserve required bandwidth and predetermine statistics such as acceptable packet loss and maximum latency and jitter when setting up the link.

Answer 74

Control plane: Makes decisions about how traffic should be prioritized and where it should be switched. Data plane: Handles the actual switching of traffic. Management plane: Monitors traffic conditions. NOTE: Protocols, appliances, and software that can apply these three functions can be described as traffic shapers or bandwidth shapers.

Answer 75

Delay certain packet types, based on their content to ensure that other packets have a higher priority. This can help to ensure that latency is reduced for critical applications. Will also store packets until there is free bandwidth available. Helps make the traffic smoother.

Supporting Network Management Flashcards

(99 cards)