Name the three kinds of components in the "nuts and bolts" view of the Internet.
1) Connected computing devices: hosts = end systems running network apps. 2) Communication links (fiber, copper, radio, satellite); transmission rate = bandwidth. 3) Packet switches that forward packets: routers and switches.
Why is the Internet called a "network of networks"?
Because it is made of interconnected ISPs.
What do RFC and IETF stand for?
RFC: Request for comments. IETF: Internet Engineering Task Force. (Internet standards.)
Describe the Internet from the "service view".
Infrastructure that provides services to applications (Web, VoIP, email, games, e-commerce, social nets…); provides programming interface to apps (hooks to "connect" to Internet); provides service options, analogous to postal service.
Complete: "Protocols define …"
Format, order of msgs sent and received among network entities, and actions taken on msg transmission, receipt.
What belongs to the network edge, and what to the network core?
Edge: hosts — clients and servers (servers often in data centers); access networks and physical media are the links. Core: interconnected routers, network of networks.
Which two questions should you keep in mind about any access network?
Bandwidth (bits per second) of access network? Shared or dedicated?
DSL: how do voice and data share the line, and where does each go?
Voice and data are transmitted at different frequencies over a dedicated line to the central office. Data over DSL phone line goes to Internet; voice goes to telephone net.
DSL transmission rates?
< 2.5 Mbps upstream (typically < 1 Mbps); < 24 Mbps downstream (typically < 10 Mbps).
Cable access network: what is HFC, and how do homes use the access network compared with DSL?
HFC = hybrid fiber coax. Homes share access network to cable headend, unlike DSL, which has dedicated access to central office. Asymmetric: up to 30 Mbps downstream, 2 Mbps upstream.
How does the cable network carry different channels?
Frequency division multiplexing: different channels transmitted in different frequency bands.
What does a home network contain?
Wireless access point (54 Mbps), wired Ethernet (100 Mbps), router, firewall, NAT, cable or DSL modem — often combined in a single box.
Compare wireless LANs with wide-area wireless access.
Wireless LANs: within building (100 ft); 802.11b/g (WiFi): 11, 54 Mbps. Wide-area: provided by telco (cellular) operator, 10's km, between 1 and 10 Mbps; 3G, 4G: LTE.
Packet transmission delay formula, and the other names for R?
Transmission delay = L (bits) / R (bits/sec). R = link transmission rate, aka link capacity, aka link bandwidth.
Guided vs unguided media?
Guided: signals propagate in solid media — copper, fiber, coax. Unguided: signals propagate freely, e.g., radio.
Twisted pair: what is it, and what rates do Category 5 and 6 support?
Two insulated copper wires. Category 5: 100 Mbps, 1 Gbps Ethernet. Category 6: 10 Gbps.
Three properties of fiber optic cable.
Glass fiber carrying light pulses, each pulse a bit; high-speed point-to-point transmission (10's–100's Gbps); low error rate: repeaters spaced far apart; immune to electromagnetic noise.
Describe coaxial cable.
Two concentric copper conductors; bidirectional; broadband: multiple channels on cable; HFC.
Radio: which propagation environment effects are listed?
Reflection, obstruction by objects, interference.
Satellite radio link: rate and end-end delay?
Kbps to 45 Mbps channel (or multiple smaller channels); 270 msec end-end delay; geosynchronous versus low altitude.
What does store-and-forward mean, and what is the end-end delay over two links?
Entire packet must arrive at router before it can be transmitted on next link. End-end delay = 2L/R (assuming zero propagation delay).
When do packets queue, and when are they lost?
If arrival rate (in bits) to link exceeds transmission rate of link for a period of time: packets queue, wait to be transmitted; packets can be dropped (lost) if memory (buffer) fills up.
Routing vs forwarding?
Routing: determines source-destination route taken by packets (routing algorithms). Forwarding: move packets from router's input to appropriate router output (using the local forwarding table).
Key characteristics of circuit switching.
End-end resources allocated to, reserved for "call"; dedicated resources: no sharing; circuit-like (guaranteed) performance; circuit segment idle if not used by call; commonly used in traditional telephone networks.
1 Mb/s link, each user 100 kb/s when active, active 10% of time. How many users for circuit switching and for packet switching?
Circuit-switching: 1000k/100k = 10 users. Packet switching: with 35 users, probability > 10 active at same time is less than .0004.
Advantages and problems of packet switching.
Great for bursty data: resource sharing; simpler, no call setup. But excessive congestion possible: packet delay and loss; protocols needed for reliable data transfer, congestion control.
Why not connect every access ISP directly to every other access ISP?
It doesn't scale: O(N²) connections.
How are competing global ISPs interconnected?
Through an IXP (Internet exchange point) and peering links.
What sits at the center of the Internet?
A small # of well-connected large networks: "tier-1" commercial ISPs (e.g., Level 3, Sprint, AT&T, NTT) with national & international coverage, and content provider networks (e.g., Google).
What is a content provider network?
A private network (e.g., Google) that connects its data centers to Internet, often bypassing tier-1, regional ISPs.
Write the nodal delay equation and name each term.
d_nodal = d_proc + d_queue + d_trans + d_prop: nodal processing, queueing, transmission, propagation.
What happens during d_proc, and what does d_queue depend on?
d_proc: check bit errors, determine output link (typically < msec). d_queue: time waiting at output link for transmission; depends on congestion level of router.
d_trans vs d_prop: formulas and what each variable means.
d_trans = L/R (L: packet length in bits; R: link bandwidth in bps). d_prop = d/s (d: length of physical link; s: propagation speed in medium, ~2×10⁸ m/sec).
Caravan analogy: what do a car, the caravan, and the toll-booth service time represent?
Car ~ bit; caravan ~ packet; the 12 sec toll-booth service time ~ bit transmission time. Answer for the ten-car caravan: lined up before the 2nd booth after 62 minutes (120 sec + 1 hr).
What happens to a packet that arrives at a full queue, and who may retransmit it?
It is dropped (aka lost). A lost packet may be retransmitted by previous node, by source end system, or not at all.
Define throughput; instantaneous vs average.
Throughput: rate (bits/time unit) at which bits transferred between sender/receiver. Instantaneous: rate at given point in time. Average: rate over longer period of time.
Define bottleneck link, and give the per-connection throughput when 10 connections fairly share a backbone link R.
Bottleneck link: link on end-end path that constrains end-end throughput. Per-connection throughput = min(Rc, Rs, R/10); in practice Rc or Rs is often the bottleneck.
What does each layer do?
Each layer implements a service via its own internal-layer actions, relying on services provided by layer below.
Why use layering?
Explicit structure allows identification, relationship of a complex system's pieces; modularization eases maintenance, updating (a layer's implementation change is transparent to the rest).
List the five Internet-stack layers with their jobs.
Application: supporting network applications. Transport: process-process data transfer. Network: routing of datagrams from source to destination. Link: data transfer between neighboring network elements. Physical: bits "on the wire".
Which two OSI layers are "missing" from the Internet stack, what do they do, and where are their services implemented if needed?
Presentation: allow applications to interpret meaning of data (e.g., encryption, compression, machine-specific conventions). Session: synchronization, checkpointing, recovery of data exchange. If needed, these services must be implemented in the application.
Name the encapsulated unit at the transport, network and link layers.
Transport: segment (Ht M). Network: datagram (Hn Ht M). Link: frame (Hl Hn Ht M). Application: message M.
Why don't app developers write software for network-core devices?
Network-core devices do not run user applications. Applications on end systems allows for rapid app development, propagation.
Characteristics of the server and of clients in the client-server architecture.
Server: always-on host; permanent IP address; data centers for scaling. Clients: communicate with server; may be intermittently connected; may have dynamic IP addresses; do not communicate directly with each other.
In P2P, new peers bring new service capacity, as well as new service demands. What is this property called?
Self scalability.
List the properties of the P2P architecture.
No always-on server; arbitrary end systems directly communicate; peers request service from other peers, provide service in return; self scalability; peers are intermittently connected and change IP addresses; complex management.
Give three pure P2P examples.
File distribution (BitTorrent), streaming (KanKan), VoIP (Skype).
Client process vs server process?
Client process: process that initiates communication. Server process: process that waits to be contacted.
What is a socket, and what is it analogous to?
A process sends/receives messages to/from its socket. Socket analogous to door: the sending process shoves the message out the door and relies on transport infrastructure on the other side to deliver it to the receiving process's socket.
Why isn't the IP address enough to identify a process? What is the identifier?
Many processes can be running on the same host. The identifier includes both IP address and port numbers associated with the process on the host.
Example port numbers for an HTTP server and a mail server.
HTTP server: 80; mail server: 25.
What four things does an app-layer protocol define?
Types of messages exchanged (e.g., request, response); message syntax (what fields & how delineated); message semantics (meaning of information in fields); rules for when and how processes send & respond to messages.
Open vs proprietary protocols (with examples).
Open: defined in RFCs, allows for interoperability, e.g., HTTP, SMTP. Proprietary: e.g., Skype.
Name the four transport-service needs of an app.
Data integrity, timing, throughput, security.
What are "elastic apps"?
Apps that make use of whatever throughput they get (unlike multimedia apps that require a minimum amount of throughput).
Which common apps are loss-tolerant, and what throughput does each need?
Real-time audio/video: audio 5kbps-1Mbps, video 10kbps-5Mbps. Stored audio/video: same as above. Interactive games: few kbps up. (The other apps need no loss.)
What does TCP provide, and what does it NOT provide?
Provides: reliable transport; flow control (sender won't overwhelm receiver); congestion control (throttle sender when network overloaded); connection-oriented setup. Does not provide: timing, minimum throughput guarantee, security.
What does UDP provide?
Unreliable data transfer between sending and receiving process. It does not provide reliability, flow control, congestion control, timing, throughput guarantee, security, or connection setup.
Which common applications may use TCP or UDP?
Streaming multimedia (HTTP e.g. YouTube, RTP) and Internet telephony (SIP, RTP, proprietary e.g. Skype). E-mail, remote terminal access, Web and file transfer use TCP.
What does SSL provide, and at which layer is it?
Encrypted TCP connection, data integrity, end-point authentication. SSL is at app layer: apps use SSL libraries, which "talk" to TCP.
What does a web page consist of, and how is each object addressed?
A base HTML-file which includes several referenced objects (HTML file, JPEG image, Java applet, audio file…). Each object is addressable by a URL: host name + path name.
HTTP uses which transport protocol and port, and what does "stateless" mean?
TCP, port 80. Stateless: the server maintains no information about past client requests.
Why are protocols that maintain "state" complex?
Past history (state) must be maintained; if server/client crashes, their views of "state" may be inconsistent and must be reconciled.
Non-persistent vs persistent HTTP.
Non-persistent: at most one object sent over a TCP connection, which is then closed; multiple objects need multiple connections. Persistent: multiple objects can be sent over a single TCP connection.
Define RTT and give the non-persistent HTTP response time.
RTT: time for a small packet to travel from client to server and back. Response time = 2RTT + file transmission time (one RTT to initiate TCP, one RTT for request + first bytes of response).
Three issues with non-persistent HTTP.
Requires 2 RTTs per object; OS overhead for each TCP connection; browsers often open parallel TCP connections to fetch referenced objects.
How does persistent HTTP work, and how few RTTs can the referenced objects need?
The server leaves the connection open after sending the response; subsequent messages go over the open connection; the client sends requests as soon as it encounters a referenced object — as little as one RTT for all the referenced objects.
The four components of cookies.
1) Cookie header line of HTTP response message; 2) cookie header line in next HTTP request message; 3) cookie file kept on user's host, managed by user's browser; 4) back-end database at Web site.
What can cookies be used for, and what is the privacy concern?
Authorization, shopping carts, recommendations, user session state (Web e-mail). Privacy: cookies permit sites to learn a lot about you.
What is the goal of a Web cache, and what does it do on a request?
Satisfy client request without involving origin server. If the object is in the cache, the cache returns it; else the cache requests it from the origin server, then returns it to the client.
Describe the two roles a Web cache plays, who typically installs it, and the reasons to use one.
Server for the original requesting client; client to the origin server. Typically installed by ISP (university, company, residential ISP). Reduces response time and traffic on an institution's access link.
Caching example with hit rate 0.4: access-link utilization and total delay?
Data rate over access link = 0.6 × 1.50 = .9 Mbps; utilization = 0.9/1.54 = .58; total delay = 0.6(2.01) + 0.4(~msecs) ≈ 1.2 secs — less than with a 154 Mbps link, and cheaper.
FTP's two connections: ports and what each carries.
Control connection: TCP, server port 21 — authorization, browsing the remote directory, commands ("out of band"). Data connection: TCP, server port 20 — opened by the server for each file, closed after transferring one file.
What "state" does an FTP server maintain?
Current directory, earlier authentication.
Three major components of e-mail, and what a mail server holds.
User agents, mail servers, SMTP. A mail server holds the mailbox (incoming messages for the user) and the message queue of outgoing (to be sent) mail messages.
Between two mail servers, which is the SMTP "client" and which the "server"?
Client: sending mail server. "Server": receiving mail server.
SMTP: transport, port, and the three phases of transfer.
TCP (reliable transfer from client to server), port 25; direct transfer from sending server to receiving server. Phases: handshaking (greeting), transfer of messages, closure.
SMTP vs mail access protocol; what POP and IMAP offer.
SMTP: delivery/storage to receiver's server. Mail access protocol: retrieval from server. POP [RFC 1939]: authorization, download. IMAP [RFC 1730]: more features, including manipulation of stored msgs on server. (HTTP: gmail, Hotmail, Yahoo! Mail.)
POP3 "download and delete" vs "download-and-keep"; is POP3 stateful?
Download and delete: Bob cannot re-read e-mail if he changes client. Download-and-keep: copies of messages on different clients. POP3 is stateless across sessions.
What does IMAP keep, and where?
All messages in one place: at server; lets the user organize messages in folders; keeps user state across sessions: names of folders and mappings between message IDs and folder name.
What is DNS (two parts of the definition)?
A distributed database implemented in a hierarchy of many name servers, and an application-layer protocol: hosts, name servers communicate to resolve names (address/name translation).
DNS services, and why DNS is not centralized.
Services: hostname to IP address translation; host aliasing; mail server aliasing; load distribution. Not centralized because of single point of failure, traffic volume, distant centralized database, maintenance — it doesn't scale.
Root vs TLD vs authoritative DNS servers.
Root: contacted by a local name server that can not resolve a name (13 root "servers" worldwide). TLD: responsible for com, org, net, edu, aero, jobs, museums and country domains. Authoritative: an organization's own DNS server(s) with authoritative hostname-to-IP mappings for its named hosts.
Where does a host send its DNS query first, and is that server part of the DNS hierarchy?
To the local DNS name server, which does not strictly belong to the hierarchy; each ISP has one ("default name server"); host queries go to it first; it has a local cache of recent name-to-address pairs (may be out of date) and acts as proxy, forwarding the query into the hierarchy.
Iterated vs recursive DNS query.
Iterated: the contacted server replies with the name of a server to contact ("I don't know this name, but ask this server"). Recursive: puts the burden of name resolution on the contacted name server.
What does the transport layer provide, and where do transport protocols run?
Logical communication between app processes running on different hosts. Transport protocols run in end systems.
What do the send side and receive side of the transport layer do?
Send side: breaks app messages into segments, passes to network layer. Rcv side: reassembles segments into messages, passes to app layer.
Transport layer vs network layer (one line each), with the household analogy.
Network layer: logical communication between hosts (postal service). Transport layer: logical communication between processes (Ann and Bill who demux to in-house siblings); it relies on and enhances network layer services.
Which services are not available from either TCP or UDP?
Delay guarantees and bandwidth guarantees.
Define multiplexing at the sender and demultiplexing at the receiver.
Multiplexing: handle data from multiple sockets, add transport header (later used for demultiplexing). Demultiplexing: use header info to deliver received segments to correct socket.
How does UDP demultiplex?
The host checks the destination port # in the segment and directs it to the socket with that port #.
UDP: what happens to datagrams with the same destination port but different sources?
Datagrams with the same dest. port # but different source IP addresses and/or source port numbers go to the same socket.
How is a TCP socket identified?
By a 4-tuple: source IP address, source port number, dest IP address, dest port number. The receiver uses all four values to direct a segment to the appropriate socket.
Why does a web server have many sockets on port 80?
A server host may support many simultaneous TCP sockets, each identified by its own 4-tuple: web servers have different sockets for each connecting client (and non-persistent HTTP has a different socket for each request).
Describe UDP's service.
"No frills," "bare bones" transport protocol; "best effort" service: segments may be lost or delivered out-of-order; connectionless: no handshaking, each segment handled independently.
What are the uses of UDP?
Streaming multimedia apps (loss tolerant, rate sensitive); DNS; SNMP. Reliable transfer over UDP: add reliability at application layer (application-specific error recovery).
What fields are in the UDP header, and what does "length" count?
Source port #, dest port #, length, checksum. Length is in bytes of the UDP segment, including header.
Why is there a UDP? (four reasons)
No connection establishment (which can add delay); simple: no connection state at sender, receiver; small header size; no congestion control: UDP can blast away as fast as desired.
How is the UDP checksum computed and checked?
Sender: treat segment contents (incl. header) as 16-bit integers; checksum = one's complement sum, put in the checksum field; a carryout from the most significant bit is added to the result. Receiver: compute checksum; if it differs from the field value, error detected; if equal, no error detected (but maybe errors nonetheless).
What determines the complexity of a reliable data transfer protocol?
The characteristics of the unreliable channel.
rdt_send(), udt_send(), rdt_rcv(), deliver_data(): who calls each?
rdt_send(): called from above (e.g., by app). udt_send(): called by rdt to send a packet over the unreliable channel. rdt_rcv(): called when a packet arrives on the rcv-side of the channel. deliver_data(): called by rdt to deliver data to upper layer.
What new mechanisms does rdt2.0 add?
Error detection (checksum) and receiver feedback: control msgs ACK (pkt received OK) and NAK (pkt had errors); sender retransmits pkt on receipt of NAK.
What is rdt2.0's fatal flaw, and how is it fixed?
If ACK/NAK is corrupted, the sender doesn't know what happened at the receiver and can't just retransmit (possible duplicate). Fix: sender retransmits current pkt and adds a sequence number to each pkt; receiver discards duplicate pkts.
Define "stop and wait".
Sender sends one packet, then waits for receiver response.
rdt2.1: why are two sequence numbers enough, and what can't the receiver know?
Two seq #s (0, 1) suffice for stop-and-wait (the state remembers whether 0 or 1 is expected). The receiver can not know if its last ACK/NAK was received OK at the sender.
How does rdt2.2 work without NAKs?
Receiver sends ACK for the last pkt received OK, explicitly including its seq #. A duplicate ACK at the sender results in the same action as a NAK: retransmit current pkt.
What does rdt3.0 assume and add?
Assumes the channel can also lose packets (data, ACKs). Adds a countdown timer: the sender waits a "reasonable" time for an ACK and retransmits if none arrives; duplicates from merely delayed packets are handled by seq #s.
Formula for sender utilization in stop-and-wait; its value for a 1 Gbps link, 8000-bit packets and RTT 30 ms.
U_sender = (L/R) / (RTT + L/R). For 1 Gbps, 8000-bit packet, RTT 30 ms: .008/30.008 = 0.00027 (≈33 kB/sec over a 1 Gbps link).
What is pipelining, and what does it require?
The sender allows multiple, "in-flight", yet-to-be-acknowledged pkts. Requires an increased range of sequence numbers and buffering at sender and/or receiver.
1 Gbps link, 8000-bit packets, RTT 30 ms: how much does 3-packet pipelining improve utilization?
By a factor of 3: U_sender = (3L/R)/(RTT + L/R) = .0024/30.008 = 0.00081.
GBN: meaning of ACK(n), the timer, and timeout(n).
ACK(n) ACKs all pkts up to and including seq # n (cumulative ACK). One timer for the oldest in-flight pkt. timeout(n): retransmit packet n and all higher seq # pkts in the window.
What does a GBN receiver do with an out-of-order packet?
Discards it (don't buffer: no receiver buffering!) and re-ACKs the pkt with the highest in-order seq #.
Selective repeat: ACKs, buffering, timers, and retransmission.
Receiver individually acknowledges all correctly received pkts and buffers them as needed for in-order delivery. Sender has a timer for each unACKed pkt and only resends pkts for which no ACK was received.
GBN vs Selective Repeat on a timeout.
GBN: retransmit all unacked packets (single timer for the oldest). Selective Repeat: retransmit only that unacked packet (timer per packet).
List the properties of TCP.
Point-to-point; reliable, in-order byte stream (no message boundaries); pipelined (congestion and flow control set window size); full duplex data; MSS; connection-oriented (handshaking inits state); flow controlled.
What do the ACK, RST/SYN/FIN flags and the receive window field mean?
ACK: ACK # valid. RST, SYN, FIN: connection estab (setup, teardown commands). Receive window: # bytes rcvr willing to accept.
Define TCP sequence number and acknowledgement number.
Sequence number: byte stream "number" of the first byte in the segment's data. ACK: seq # of the next byte expected from the other side (cumulative ACK).
How does a TCP receiver handle out-of-order segments?
TCP spec doesn't say — up to implementor.
Why must the TCP timeout be neither too short nor too long?
Too short: premature timeout, unnecessary retransmissions. Too long: slow reaction to segment loss. (It must be longer than RTT, but RTT varies — so SampleRTTs are averaged to a "smoother" estimate.)
What three features does TCP use to build rdt on IP, and what triggers retransmissions?
Pipelined segments, cumulative acks, single retransmission timer. Retransmissions are triggered by timeout events and duplicate acks.
TCP receiver: in-order segment with expected seq #, all earlier data already ACKed. Action?
Delayed ACK: wait up to 500 ms for the next segment; if no next segment, send ACK.
TCP receiver: in-order segment arrives while one other segment has an ACK pending. Action?
Immediately send a single cumulative ACK, ACKing both in-order segments.
TCP receiver: out-of-order segment (gap detected), or a segment that fills the gap. Actions?
Gap: immediately send a duplicate ACK, indicating the seq # of the next expected byte. Filling segment: immediately send ACK, provided the segment starts at the lower end of the gap.
What triggers TCP fast retransmit, and what is resent?
Receiving 3 ACKs for the same data ("triple duplicate ACKs"). The sender resends the unacked segment with the smallest seq # without waiting for the timeout.
What is TCP flow control and how does it work?
The receiver controls the sender so the sender won't overflow the receiver's buffer. The receiver advertises free buffer space in the rwnd field; the sender limits unacked (in-flight) data to rwnd, guaranteeing the receive buffer will not overflow.
How is the RcvBuffer size set?
Via socket options (typical default is 4096 bytes); many operating systems autoadjust RcvBuffer.
Why can a 2-way handshake fail?
Variable delays, retransmitted messages (e.g., req_conn(x)) due to message loss, message reordering, and the sides can't "see" each other — leading to e.g. a half open connection with no client, or duplicate data accepted.
Give the three segments of the TCP 3-way handshake with their fields.
1) Client SYN: SYNbit=1, Seq=x. 2) Server SYNACK: SYNbit=1, Seq=y, ACKbit=1, ACKnum=x+1. 3) Client ACK: ACKbit=1, ACKnum=y+1 (may contain client-to-server data).
Define congestion and give its two manifestations.
"Too many sources sending too much data too fast for network to handle" (different from flow control). Manifestations: lost packets (buffer overflow at routers), long delays (queueing in router buffers).
End-end vs network-assisted congestion control. Which does TCP use?
End-end: no explicit feedback from network; congestion inferred from observed loss, delay — the approach taken by TCP. Network-assisted: routers provide feedback (single congestion bit — SNA, DECbit, TCP/IP ECN, ATM — or an explicit rate).
Additive increase and multiplicative decrease in TCP.
Additive increase: increase cwnd by 1 MSS every RTT until loss detected. Multiplicative decrease: cut cwnd in half after loss. (AIMD saw tooth behavior.)
How does TCP slow start grow cwnd?
Initially cwnd = 1 MSS; double cwnd every RTT (by incrementing cwnd for every ACK received) until the first loss event — slow start, but exponential ramp-up.
TCP Reno vs Tahoe: reaction to timeout and to 3 duplicate ACKs.
Timeout: cwnd set to 1 MSS, grows exponentially to threshold, then linearly. 3 dup ACKs (Reno): cwnd cut in half, then grows linearly. Tahoe always sets cwnd to 1 (timeout or 3 duplicate acks).
TCP fairness goal.
If K TCP sessions share the same bottleneck link of bandwidth R, each should have an average rate of R/K.
What does the network layer do on the sending side and on the receiving side?
Sending side: encapsulates segments into datagrams. Receiving side: delivers segments to the transport layer. Network layer protocols run in every host and router.
Forwarding vs routing, with the trip analogy.
Forwarding: move packets from router's input to appropriate router output (getting through a single interchange). Routing: determine route taken by packets from source to dest (planning the trip).
How do the routing algorithm and the forwarding table relate?
The routing algorithm determines the end-end path through the network; the forwarding table determines local forwarding at this router (header value → output link).
What is "connection setup" at the network layer, and in which architectures?
A 3rd function in some architectures (ATM, frame relay, X.25): before datagrams flow, the two end hosts and intervening routers establish a virtual connection — routers get involved.
Example network service-model guarantees for individual datagrams and for a flow.
Individual datagrams: guaranteed delivery; guaranteed delivery with less than 40 msec delay. Flow: in-order datagram delivery; guaranteed minimum bandwidth; restrictions on changes in inter-packet spacing.
Datagram network vs VC network service, and how they differ from TCP/UDP services.
Datagram: network-layer connectionless service; VC: network-layer connection service. Unlike transport: service is host-to-host, there is no choice (network provides one or the other), and it is implemented in the network core.
Internet (datagram) vs ATM (VC): where is the complexity, and why?
Internet: "smart" end systems (computers) that can adapt and recover — simple inside network, complexity at "edge". ATM: evolved from telephony with "dumb" end systems (telephones) and strict timing needs — complexity inside network.
Two key router functions, and which plane does each belong to?
Run routing algorithms/protocols (RIP, OSPF, BGP) — routing, management control plane (software). Forward datagrams from incoming to outgoing link — forwarding data plane (hardware: input ports, high-speed switching fabric, output ports).
The three parts of the Internet network layer.
Routing protocols (path selection: RIP, OSPF, BGP) → forwarding table; IP protocol (addressing conventions, datagram format, packet handling conventions); ICMP protocol (error reporting, router "signaling").
IP header: what do "time to live" and "upper layer" mean?
Time to live: max number remaining hops (decremented at each router). Upper layer: upper layer protocol to deliver payload to.
Which IP header fields are used for fragmentation/reassembly? What is the overhead of TCP over IP?
16-bit identifier, flgs, fragment offset. Overhead: 20 bytes of TCP + 20 bytes of IP = 40 bytes + app layer overhead.
What is MTU, and where are fragments reassembled?
MTU (max. transfer size): the largest possible link-level frame; different link types have different MTUs. Fragments are reassembled only at the final destination.
4000-byte datagram, MTU 1500. Give each fragment's length, flag and offset.
(1500, fragflag 1, offset 0), (1500, fragflag 1, offset 185), (1040, fragflag 0, offset 370); same ID x. Data: 3980 = 1480 + 1480 + 1020.
How is the fragment offset computed?
Offset = position (in bytes) of the fragment's first data byte ÷ 8. E.g., 1480/8 = 185; 2960/8 = 370.
What is an IP address, and what is an interface?
IP address: 32-bit identifier for host, router interface. Interface: connection between host/router and physical link. IP addresses are associated with each interface (routers typically have multiple).
Subnet part vs host part; definition of a subnet.
Subnet part: high order bits; host part: low order bits. Subnet: device interfaces with the same subnet part of IP address, which can physically reach each other without intervening router.
Recipe for finding the subnets in a network.
Detach each interface from its host or router, creating islands of isolated networks; each isolated network is called a subnet.
What does CIDR stand for, and what does x mean in a.b.c.d/x?
Classless InterDomain Routing: subnet portion of arbitrary length; x is the # bits in the subnet portion of the address (e.g., 200.23.16.0/23).
Two ways for a host to get an IP address; DHCP's goal.
Hard-coded by system admin in a file, or DHCP ("plug-and-play"). DHCP goal: allow a host to dynamically obtain its IP address from a network server when it joins the network (lease renewal, address reuse, support for mobile users).
The four DHCP messages, in order.
DHCP discover (host broadcasts) [optional] → DHCP offer (server) [optional] → DHCP request (host) → DHCP ack (server).
What can DHCP return besides the IP address?
Address of first-hop router for client; name and IP address of DNS server; network mask (network vs host portion of the address).
How is a DHCP request carried on the LAN?
Encapsulated in UDP, in IP, in 802.1 Ethernet; the Ethernet frame is broadcast (dest: FFFFFFFFFFFF) and received at the router running the DHCP server.
How does an organization get its subnet part, and what is route aggregation?
It gets an allocated portion of its provider ISP's address space. Route aggregation: hierarchical addressing lets the ISP advertise one prefix (e.g., "Send me anything with addresses beginning 200.23.16.0/20").
What happens to routing when Organization 1 moves to ISPs-R-Us?
ISPs-R-Us advertises a more specific route: "199.31.0.0/16 or 200.23.18.0/23".
What is ICANN and what does it do?
Internet Corporation for Assigned Names and Numbers: allocates addresses, manages DNS, assigns domain names, resolves disputes.
What does NAT make the outside world see?
All datagrams leaving the local network have the same single source NAT IP address with different source ports.
What are the benefits of NAT?
One address from ISP; change internal addresses or ISP without notifying the outside; inside devices not explicitly addressable from outside (a security plus).
Three things a NAT router must do.
Outgoing: replace (source IP, port #) with (NAT IP, new port #). Remember every translation pair in the NAT translation table. Incoming: replace (NAT IP, new port #) in dest fields with the stored (source IP, port #).
How many simultaneous connections can NAT support with one LAN-side address, and why is NAT controversial?
16-bit port-number field: 60,000 simultaneous connections. Controversial: routers should only process up to layer 3; violates end-to-end argument (apps such as P2P must account for NAT); address shortage should instead be solved by IPv6.
What is ICMP used for?
Used by hosts & routers to communicate network-level info: error reporting (unreachable host, network, port, protocol) and echo request/reply (ping).
How is an ICMP message carried, and what does it contain?
ICMP msgs are carried in IP datagrams; message = type, code + first 8 bytes of the IP datagram causing the error.
ICMP type/code for echo request, echo reply, TTL expired, and dest port unreachable.
Echo request (ping): 8/0. Echo reply (ping): 0/0. TTL expired: 11/0. Dest port unreachable: 3/3.
How does traceroute discover the routers on a path, and when does it stop?
It sends UDP segments with TTL = 1, 2, 3, …; the nth router discards the nth set and returns ICMP type 11, code 0 (with its name and IP address); the source records RTTs. It stops when the destination returns ICMP "port unreachable" (type 3, code 3).
IPv6: address size, and the purpose of priority, flow label and next header.
128-bit source and destination addresses. Priority: priority among datagrams in flow. Flow label: identify datagrams in the same "flow". Next header: identify upper layer protocol for data.
Three changes in IPv6 besides the address size.
Checksum removed entirely (to reduce processing time at each hop); options allowed but outside the header, indicated by "Next Header"; ICMPv6 with additional message types (e.g., "Packet Too Big") and multicast group management.
What is tunneling in the IPv4-to-IPv6 transition, and why is it needed?
An IPv6 datagram is carried as payload in an IPv4 datagram among IPv4 routers — needed because not all routers can be upgraded simultaneously (no "flag days").
What is the cost of a path, and what does a routing algorithm find?
Cost of path = sum of its link costs: c(x1,x2) + c(x2,x3) + … + c(xp−1,xp). A routing algorithm finds the least cost path. (Link cost could always be 1, or inversely related to bandwidth or to congestion.)
Global vs decentralized routing algorithms.
Global: all routers have complete topology and link cost info ("link state"). Decentralized: router knows neighbors and link costs to them; iterative computation and exchange with neighbors ("distance vector").
Static vs dynamic routing algorithms.
Static: routes change slowly; dynamic: routes change more quickly (periodic update, in response to link cost changes).
What does Dijkstra's algorithm assume and compute?
Net topology and link costs are known to all nodes (via "link state broadcast"). It computes least cost paths from one node (the source) to all other nodes, giving that node's forwarding table. After k iterations, least cost paths to k destinations are known.
Dijkstra notation: c(x,y), D(v), p(v), N'.
c(x,y): link cost from x to y (∞ if not direct neighbors). D(v): current cost of path from source to v. p(v): predecessor node along the path to v. N': set of nodes whose least cost path is definitively known.
Dijkstra's update rule.
For all v adjacent to w and not in N': D(v) = min( D(v), D(w) + c(w,v) ) — new cost to v is either the old cost or the shortest path cost to w plus the cost from w to v.
Complexity of Dijkstra's algorithm, and what problem can occur?
n(n+1)/2 comparisons: O(n²) (more efficient implementations possible: O(n log n)). Oscillations are possible, e.g., when link cost equals the amount of carried traffic.
Write the Bellman-Ford equation and say how the next hop is chosen.
dx(y) = min over all neighbors v of { c(x,v) + dv(y) }. The node achieving the minimum is the next hop on the shortest path, used in the forwarding table.
Distance vector: when does a node send its DV?
From time to time, and whenever its DV changes.
Why is the distance vector algorithm "iterative, asynchronous" and "distributed"?
Iterative, asynchronous: each local iteration is caused by a local link cost change or a DV message from a neighbor. Distributed: each node notifies neighbors only when its DV changes; they notify theirs if necessary.
LS vs DV: message complexity.
LS O(nE); DV only between neighbors.
LS vs DV: speed of convergence.
LS O(n²), may oscillate; DV varies, may have routing loops and the count-to-infinity problem.
LS vs DV: robustness.
LS nodes advertise only link costs and compute their own tables; in DV a wrong path cost spreads because each node's table is used by others.
Why is routing hierarchical, and what is an autonomous system?
Scale (600 million destinations; table exchange would swamp links) and administrative autonomy. An AS is a region of aggregated routers that run the same intra-AS routing protocol; a gateway router sits at its edge with a link to another AS.
The two inter-AS routing tasks of AS1.
1. Learn which destinations are reachable through AS2 and which through AS3. 2. Propagate this reachability info to all routers in AS1.
What is hot potato routing?
Send the packet towards the closest of the gateways: use intra-AS routing info to find the least-cost path to each gateway, choose the gateway with the smallest least cost, and enter (x, I) for the interface leading to it.
RIP: algorithm, metric, max hops, update period, advertisement size.
Distance vector; metric = # hops, each link cost 1; max = 15 hops; DVs exchanged with neighbors every 30 sec (advertisement); up to 25 destination subnets per advertisement.
RIP: router D reaches z in 7 hops via B. Neighbor A advertises z at 4 hops. How does D update its entry for z?
A advertises z at 4 hops; via A, D reaches z in 4 + 1 = 5 hops, fewer than its current 7 via B, so D changes its entry for z to next router A, 5 hops.
Which process manages RIP tables, and how are advertisements sent?
An application-level process called route-d (daemon); advertisements are sent in UDP packets, periodically repeated.
OSPF: algorithm, how advertisements spread, and how they are carried.
Link state algorithm with Dijkstra's route computation; each advertisement carries one entry per neighbor and is flooded to the entire AS; carried in OSPF messages directly over IP (not TCP or UDP). IS-IS is nearly identical.
OSPF "advanced" features not in RIP.
Security (all OSPF messages authenticated); multiple same-cost paths allowed (only one in RIP); multiple cost metrics per link for different TOS; integrated uni- and multicast support (MOSPF).
What is BGP, and what do eBGP and iBGP do?
Border Gateway Protocol: the de facto inter-domain routing protocol ("glue that holds the Internet together"). eBGP: obtain subnet reachability info from neighboring ASs. iBGP: propagate reachability info to all AS-internal routers. Routes are chosen by reachability info and policy.
Why are intra-AS and inter-AS routing different? (policy, scale, performance)
Policy: inter-AS admins want control over how traffic is routed and who routes through their net; intra-AS has a single admin, so no policy decisions. Scale: hierarchical routing saves table size and update traffic. Performance: intra-AS can focus on performance; inter-AS policy may dominate.
What is the responsibility of the data-link layer? What is its packet called?
Transferring a datagram from one node to a physically adjacent node over a link. Its layer-2 packet is a frame, which encapsulates the datagram.
Link-layer terminology: nodes and links.
Nodes: hosts and routers. Links: communication channels that connect adjacent nodes along the communication path (wired links, wireless links, LANs).
Link-layer transportation analogy: what do the tourist, the transport segment, the transportation mode and the travel agent stand for?
Tourist = datagram; transport segment = communication link; transportation mode = link layer protocol; travel agent = routing algorithm.
Framing and link access: what happens, and how are source and destination identified?
The datagram is encapsulated into a frame, adding header and trailer; channel access if shared medium; "MAC" addresses in frame headers identify source and dest — different from IP address!
When is reliable delivery between adjacent nodes seldom used, and where is it needed?
Seldom used on low bit-error links (fiber, some twisted pair); wireless links have high error rates.
Error detection vs error correction at the link layer.
Detection: the receiver detects the presence of errors (caused by signal attenuation, noise) and signals the sender for retransmission or drops the frame. Correction: the receiver identifies and corrects bit error(s) without resorting to retransmission.
What does half duplex mean?
Nodes at both ends of the link can transmit, but not at the same time.
Where is the link layer implemented?
In each and every host, in an "adaptor" (network interface card, NIC) or on a chip (Ethernet card, 802.11 card, Ethernet chipset); it implements the link and physical layers, attaches to the host's system buses, and is a combination of hardware, software, firmware.
What are EDC and D, and is error detection 100% reliable?
EDC = Error Detection and Correction bits (redundancy); D = data protected by error checking (may include header fields). Not 100% reliable: the protocol may miss some errors, but rarely; a larger EDC field yields better detection and correction.
Single bit parity vs two-dimensional bit parity.
Single bit parity: detect single bit errors. Two-dimensional bit parity: detect and correct single bit errors.
At which layer is the Internet checksum used?
At the transport layer only.
CRC: what are G, r and R, and what property must <D,R> have?
G: an r+1 bit pattern (the generator). R: r CRC bits chosen so that <D,R> is exactly divisible by G (modulo 2).
How does a CRC receiver detect errors, and which burst errors are always detected? Where is CRC used?
It divides <D,R> by G; a non-zero remainder means error detected. It detects all burst errors less than r+1 bits. Widely used: Ethernet, 802.11 WiFi, ATM.
Write the formula for the CRC bits R.
R = remainder[ D·2^r / G ] (from D·2^r XOR R = nG).
Two types of links, with examples.
Point-to-point: PPP for dial-up access; link between Ethernet switch and host. Broadcast (shared wire or medium): old-fashioned Ethernet, upstream HFC, 802.11 wireless LAN.
What is CSMA?
Carrier sense multiple access: listen before transmit. If the channel is sensed idle, transmit the entire frame; if busy, defer transmission ("don't interrupt others!").
Why can collisions still occur with CSMA, and what is wasted?
Propagation delay means two nodes may not hear each other's transmission. A collision wastes the entire packet transmission time; distance and propagation delay affect collision probability.
What does CSMA/CD add, and why is collision detection easy in wired but difficult in wireless LANs?
Collisions are detected within a short time and colliding transmissions are aborted, reducing channel wastage. Wired: measure and compare transmitted and received signal strengths. Wireless: received signal strength is overwhelmed by local transmission strength.
Ethernet CSMA/CD: what does the NIC do when it detects another transmission while transmitting?
It aborts and sends a jam signal, then enters binary (exponential) backoff.
Binary (exponential) backoff after the mth collision.
The NIC chooses K at random from {0, 1, 2, …, 2^m − 1}, waits K·512 bit times, and returns to Step 2 (sense the channel). More collisions → longer backoff interval.
IP address vs MAC address: size and use.
IP: 32 bits, network-layer address used for layer 3 forwarding. MAC: 48 bits (most LANs), used "locally" to get a frame from one interface to another physically-connected interface (same network); burned in NIC ROM.
Who administers MAC addresses, and what analogy contrasts MAC and IP?
IEEE administers allocation (manufacturers buy portions of the address space). MAC address: like a Social Security Number (flat, portable). IP address: like a postal address (hierarchical, not portable — depends on the subnet).
What does an ARP table entry contain, and what is its TTL?
< IP address; MAC address; TTL >. TTL (Time To Live): time after which the mapping is forgotten — typically 20 min.
ARP on the same LAN: how are the query and the reply sent?
Query: broadcast, dest MAC FF-FF-FF-FF-FF-FF, containing B's IP address; all nodes receive it. Reply: B sends its MAC address to A's MAC address (unicast).
What is "soft state", and why is ARP "plug-and-play"?
Soft state: information that times out (goes away) unless refreshed — like cached ARP entries. ARP is plug-and-play because nodes create their ARP tables without intervention from the net administrator.
Sending from A to B via router R: which addresses stay the same and which change?
IP source A and IP destination B stay the same end to end. The frame from A has R's MAC address as destination; R removes the datagram and sends a new frame with B's MAC address as destination (and R's own MAC on that side as source).
Why did Ethernet become the "dominant" wired LAN technology?
Cheap ($20 for NIC); first widely used LAN technology; simpler, cheaper than token LANs and ATM; kept up with speed race: 10 Mbps – 10 Gbps.
Bus vs star Ethernet topology.
Bus (popular through mid 90s, coaxial cable): all nodes in the same collision domain. Star (prevails today): active switch in center; each "spoke" runs a separate Ethernet protocol, so nodes do not collide with each other.
Ethernet frame fields in order, and the purpose of the preamble.
Preamble, dest. address, source address, type, data (payload), CRC. Preamble: 7 bytes of 10101010 then one byte 10101011, used to synchronize receiver and sender clock rates.
When does an Ethernet adapter pass a frame up, and what do "type" and CRC do?
It passes the data up if the destination address matches its own or is a broadcast address (e.g., ARP); otherwise it discards the frame. Type: higher layer protocol (mostly IP). CRC: checked at the receiver; error detected → frame dropped.
Why is Ethernet "connectionless" and "unreliable", and what is its MAC protocol?
Connectionless: no handshaking between NICs. Unreliable: the receiving NIC sends no acks or nacks; dropped data is recovered only if the sender uses higher-layer rdt (e.g., TCP). MAC protocol: unslotted CSMA/CD with binary backoff.
What do the different 802.3 Ethernet standards share, and how do they differ?
They share a common MAC protocol and frame format; they differ in speed (2 Mbps, 10 Mbps, 100 Mbps, 1 Gbps, 10 Gbps) and physical layer media (fiber, cable — e.g., 100BASE-TX copper, 100BASE-FX fiber).
Three properties of an Ethernet switch.
Link-layer device that takes an active role (stores and forwards frames, selectively forwarding by MAC address); transparent (hosts are unaware of switches); plug-and-play, self-learning (no configuration needed).
Why are there no collisions on a switched Ethernet, and what can happen simultaneously?
Hosts have dedicated, direct connections to the switch; links are full duplex; each link is its own collision domain. So A-to-A' and B-to-B' can transmit simultaneously, without collisions.
What is in a switch table entry, and how does the switch learn it?
(MAC address of host, interface to reach host, time stamp). When a frame arrives, the switch learns the sender's location from the incoming LAN segment and records the sender/location pair.
Switch frame filtering/forwarding rules.
Record incoming link and source MAC; look up the destination MAC. Found on the arrival segment → drop; found on another interface → forward on that interface; not found → flood on all interfaces except the arriving one.
Switches vs routers: layer and how the forwarding table is built.
Both are store-and-forward with forwarding tables. Routers: network-layer devices; compute tables using routing algorithms and IP addresses. Switches: link-layer devices; learn tables using flooding, learning and MAC addresses.
Network security: what does confidentiality mean?
Only sender, intended receiver should "understand" message contents: sender encrypts message, receiver decrypts message.
Authentication vs message integrity.
Authentication: sender, receiver want to confirm identity of each other. Message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection.
What does "access and availability" mean?
Services must be accessible and available to users.
Who are Alice, Bob and Trudy?
Bob, Alice want to communicate "securely"; Trudy (intruder) may intercept, delete, add messages.
Give real-life examples of "Bob and Alice".
Web browser/server for electronic transactions (e.g., on-line purchases); on-line banking client/server; DNS servers; routers exchanging routing table updates.
Impersonation vs hijacking.
Impersonation: can fake (spoof) source address in packet (or any field in packet). Hijacking: "take over" ongoing connection by removing sender or receiver, inserting himself in place.
What is denial of service?
Preventing a service from being used by others (e.g., by overloading resources).
What do m, K_A(m) and K_B(K_A(m)) mean?
m: plaintext message. K_A(m): ciphertext, encrypted with key K_A. m = K_B(K_A(m)): decrypting the ciphertext with Bob's key K_B gives back the plaintext.
Which three security services does SSL provide? What is its variation called?
Confidentiality, integrity, authentication. Variation: TLS — transport layer security, RFC 2246.
What were SSL's original goals?
Web e-commerce transactions; encryption (especially credit-card numbers); Web-server authentication; optional client authentication; minimum hassle in doing business with new merchant.
Where does SSL sit in the protocol stack, and what does it give applications?
Application / SSL / TCP / IP: SSL runs over TCP, and SSL provides an application programming interface (API) to applications. It is available to all TCP applications (secure socket interface).
What are the four purposes of the SSL handshake?
1. server authentication; 2. negotiation: agree on crypto algorithms; 3. establish keys; 4. client authentication (optional).
SSL handshake steps 1–2: what does each side send?
1: client sends list of algorithms it supports, along with client nonce. 2: server chooses algorithms from list; sends back choice + certificate + server nonce.
SSL handshake step 3: what does the client do with the certificate?
Client verifies certificate, extracts server's public key, generates pre_master_secret, encrypts it with server's public key, sends to server.
From what do client and server compute their keys, and which keys?
They independently compute encryption and MAC keys from pre_master_secret and nonces (step 4).
Why do the last 2 handshake steps send a MAC of all the handshake messages?
They protect the handshake from tampering: the client offers a range of algorithms, some strong, some weak, and a man-in-the-middle could delete the stronger algorithms from the list.
Why does SSL use two random nonces?
Against replay: if Trudy replays a recorded sequence of records the next day, Bob's different random nonce for each connection makes the encryption keys different, so Trudy's messages fail Bob's integrity check.
SSL record protocol: what is in the record header and in the MAC? How big is a fragment?
Record header: content type; version; length. MAC: includes sequence number, MAC key M_x. Each SSL fragment 2^14 bytes (~16 Kbytes).
SSL record format: field sizes, and what is encrypted?
Content type 1 byte, SSL version 2 bytes, length 3 bytes; then data and MAC. Data and MAC are encrypted (symmetric algorithm).
What is network-layer confidentiality and why is it called "blanket coverage"?
Between two network entities, the sending entity encrypts the datagram payload (TCP or UDP segment, ICMP message, OSPF message …), so all data sent from one entity to the other is hidden: web pages, e-mail, P2P file transfers, TCP SYN packets ….
List the four IPsec services.
Data integrity; origin authentication; replay attack prevention; confidentiality.
IPsec transport mode vs tunneling mode.
Transport mode: IPsec datagram emitted and received by end-system; protects upper level protocols. Tunneling mode: edge routers IPsec-aware (or hosts IPsec-aware).
AH vs ESP: which services does each provide?
AH (Authentication Header): source authentication & data integrity but not confidentiality. ESP (Encapsulation Security Protocol): source authentication, data integrity, and confidentiality; more widely used than AH.
How many IPsec mode/protocol combinations are possible, and which is the most common?
Four: host mode with AH, host mode with ESP, tunnel mode with AH, tunnel mode with ESP. Tunnel mode with ESP is the most common and most important.
What does a firewall do?
It isolates the organization's internal net from the larger Internet, allowing some packets to pass, blocking others.
Why use firewalls? (three reasons)
Prevent denial of service attacks (e.g., SYN flooding); prevent illegal modification/access of internal data; allow only authorized access to inside network (set of authenticated users/hosts).
What is SYN flooding?
The attacker establishes many bogus TCP connections, so no resources are left for "real" connections.
Name the three types of firewalls.
Stateless packet filters; stateful packet filters; application gateways.
On what does a stateless packet filter base its forward/drop decision?
Source IP address, destination IP address; TCP/UDP source and destination port numbers; ICMP message type; TCP SYN and ACK bits. It filters packet-by-packet.
What is the result of blocking inbound TCP segments with ACK=0?
It prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside.
Which firewall setting prevents your network from being tracerouted?
Drop all outgoing ICMP TTL expired traffic.
Which firewall setting prevents your network from being used for a smurf DoS attack?
Drop all ICMP packets going to a "broadcast" address (e.g. 130.207.255.255).
What does an application gateway filter on?
On application data as well as on IP/TCP/UDP fields.
Telnet through an application gateway: the three steps.
1. Require all telnet users to telnet through gateway. 2. For authorized users, gateway sets up telnet connection to dest host; gateway relays data between 2 connections. 3. Router filter blocks all telnet connections not originating from gateway.
Give the limitations of firewalls and gateways.
IP spoofing (router can't know if data "really" comes from claimed source); each app needing special treatment has its own gateway; client software must know how to contact the gateway (e.g., proxy IP in the browser); all-or-nothing policy for UDP; tradeoff between communication with the outside world and level of security; highly protected sites still suffer from attacks.
Packet filtering vs IDS.
Packet filtering operates on TCP/IP headers only, with no correlation check among sessions. An IDS does deep packet inspection (looks at packet contents, e.g. character strings against a database of known virus, attack strings) and examines correlation among multiple packets.
Why use multiple IDSs?
Different types of checking at different locations (e.g., IDS sensors inside the internal network and in the demilitarized zone with the Web, FTP and DNS servers).
Define network management.
"Network management includes the deployment, integration and coordination of the hardware, software, and human elements to monitor, test, poll, configure, analyze, evaluate, and control the network and element resources to meet the real-time, operational performance, and Quality of Service requirements at a reasonable cost."
Why does a network need management, like a jet airplane or a nuclear power plant?
An autonomous system ("network") has 1000s of interacting hardware/software components; such complex systems require monitoring, control.
What do managed devices contain?
Managed objects whose data is gathered into a Management Information Base (MIB); each managed device has an agent.
Name the parts of the network management infrastructure.
Managing entity; managed devices (with an agent and managed objects/MIB data); network management protocol between them.
OSI CMIP vs SNMP.
CMIP (Common Management Information Protocol): designed 1980's as the unifying net management standard; too slowly standardized. SNMP: Internet roots (SGMP); started simple; deployed, adopted rapidly; currently SNMP V3; de facto network management standard.
What are the 4 key parts of SNMP?
MIB (management information base); SMI (Structure of Management Information); SNMP protocol; security, administration capabilities.
What is the MIB?
A distributed information store of network management data.
What is SMI?
Structure of Management Information: the data definition language for MIB objects.
Which SNMP part was the major addition in SNMPv3?
Security, administration capabilities.
What is the purpose of SMI?
Syntax, semantics of management data well-defined, unambiguous.
OBJECT-TYPE vs MODULE-IDENTITY.
OBJECT-TYPE: data type, status, semantics of managed object. MODULE-IDENTITY: groups related objects into MIB module.
How are a MIB module and its objects specified?
The MIB module via SMI MODULE-IDENTITY (100 standardized MIBs, more vendor-specific); the objects via SMI OBJECT-TYPE construct.
ipInDelivers: SYNTAX, MAX-ACCESS and meaning.
SYNTAX Counter32; MAX-ACCESS read-only; "The total number of input datagrams successfully delivered to IP user-protocols (including ICMP)".
What is ipMIB, and what does it exclude?
A MODULE-IDENTITY: "The MIB module for managing IP and ICMP implementations, but excluding their management of IP routes."
UDP MIB module: what do UDPInDatagrams and UDPNoPorts count?
UDPInDatagrams: total # datagrams delivered at this node. UDPNoPorts: # undeliverable datagrams: no application at port. Both Counter32.
What is udpTable in the UDP MIB module?
A SEQUENCE: one entry for each port in use by app, gives port # and IP address.
How does SNMP name every possible standard object?
With the ISO Object Identifier tree: hierarchical naming of all objects; each branchpoint has name, number.
Which object is 1.3.6.1.2.1.7.1?
udpInDatagrams (path: ISO → ISO-ident. Org. → US DoD → Internet → management → MIB2 → UDP → udpInDatagrams).
What are the two ways SNMP conveys MIB info and commands?
Request/response mode (managing entity requests, agent responds) and trap mode (agent sends a trap msg to the managing entity).
Which SNMP messages go from manager to agent?
GetRequest, GetNextRequest, GetBulkRequest ("get me data": instance, next in list, block) and SetRequest (set MIB value).
Response vs Trap.
Both are agent-to-mgr. Response: value, response to Request. Trap: inform manager of exceptional event.
What is InformRequest?
Mgr-to-Mgr: here's MIB value.
Which fields are in the SNMP get/set header and in the trap header?
Get/set header: PDU type (0-3), Request ID, Error Status (0-5), Error Index. Trap header: PDU type 4, Enterprise, Agent Addr, Trap Type (0-7), Specific code, Time stamp.
List the four SNMP security and administration mechanisms.
Encryption: DES-encrypt SNMP message. Authentication: compute, send MIC(m,k). Protection against playback: use nonce. View-based access control: database of access rights, policies for various users.
What is MIC(m,k)?
A hash (MIC) computed over the message (m) and a secret shared key (k); it is computed and sent for authentication.
In view-based access control, what is special about the access-rights database?
The database itself is accessible as a managed object.