Term
| What constitutes a network? |
|
Definition
computer systems
media
network interface
network protocols |
|
|
Term
| Why do people install networks? |
|
Definition
save more money than they cost
consolidate network storage
share peripherals
increase communication
-email
-collaboration |
|
|
Term
|
Definition
Hosts both provide and consume services.
+Easy to implement.
+Very inexpensive.
-Not scalable.
-Difficult to manage, no central control.
-Single point failures. |
|
|
Term
| What is Client / Server network? |
|
Definition
Server provides network services.
Clients consume network services.
+Highly scalable
+Easy to support
+Centralized
-Relatively expensive
-Takes a lot of planning |
|
|
Term
|
Definition
| Resides in a small geographic area. |
|
|
Term
|
Definition
A network that connects several LANs.
Internetworked together. |
|
|
Term
|
Definition
Subnets connected by routers
collection of devices that share the same subnet address. |
|
|
Term
|
Definition
| Actually a collection of networks that are inter-networked. |
|
|
Term
|
Definition
| All hosts can communicate directly with each other. Wifi Ad-Hoc would be an example. |
|
|
Term
| Multi-Station Access Unit? MSAU |
|
Definition
| Used in a physical Star logical Ring topology to route info to one host at a time until the correct home is found. |
|
|
Term
|
Definition
| Transport Layer Security - An improvement on SSL. |
|
|
Term
|
Definition
TCP is connection oriented protocol. Does error checking and ack
UDP is connectionless protocol. Used for things such as streaming media. Is faster than TCP. |
|
|
Term
|
Definition
| File transfer protocol that uses UDP. |
|
|
Term
|
Definition
Used between email servers and between client and server.
Only used to send mail. |
|
|
Term
|
Definition
pop3 mail is downloaded and removed.
IMAP mail stays on server. |
|
|
Term
|
Definition
| Network Time protocol. Accounts for latency. |
|
|
Term
|
Definition
| Network News Transport Protocol. USenet |
|
|
Term
|
Definition
| Used for managing and querying info from devices. |
|
|
Term
|
Definition
| Status indicator. ie. Ping |
|
|
Term
|
Definition
| Internet Group management protocol. Multicasting messaging to devices. |
|
|
Term
| OSI - Application Layer contains what protocols. |
|
Definition
| Http, Telnet, ftp, tftp, smtp, etc. |
|
|
Term
|
Definition
| Syntax, encryption, compression. |
|
|
Term
|
Definition
| Creating, maintaining, ending sessions. Uses a session ID. |
|
|
Term
|
Definition
| Concerned with how data is delivered through the network. Segmentation of files into blocks with sequence number. Sequencing. Host-to-host error correction. Flow control. TCP/UDP. Assignment of port numbers. |
|
|
Term
|
Definition
| Moving data throughoutt systems on the internetwork. Routing. Assignment of IP address (layer 3 address, logical address). As IP is addedded to segment from transport layer it becomes a Packet or datagram. |
|
|
Term
|
Definition
acting as an interface between the physical transmission media and devices and the network layer.
1. Logical Link Layer - interface mentioned above.
2. MaC
Data is called a frame, which now includes the MAC as well as a CRC.
Definition of the logical topology. |
|
|
Term
|
Definition
| Hardware - cables, NICs, cat5, rj45, v.35 (modems), Frame becomes bits (signals). |
|
|
Term
|
Definition
| 22-24 ga copper, pvc, pvc shield. Wires UTP - Twisted to avoid interference. 4 pairs. It is more susceptible to interference. Security concerns to someone |
|
|
Term
| Cat3 - What protocols does it support? |
|
Definition
| 10mbit Ethernet and 16mbit token ring. |
|
|
Term
| Cat5 - What protocols does it support? |
|
Definition
10/100/1000 Ethernet and ATM.
Cat5e supports 10/100/1000 with better EMI protection. |
|
|
Term
| Cat6 - What protocols does it support? |
|
Definition
Supports 10 gigabit Ethernet and high-bandwidth, broadband communications.
Cat 6 cables often include a solid plastic core that keeps the twisted pairs separated and prevents the cable from being bent too tightly.
Additional standards for Cat 6 include Cat 6a (advanced) and Cat 6e (enhanced) which provide better protection against EMI. |
|
|
Term
| What is required for ceiling Wiring? |
|
Definition
| Plenum cable is fire resistant and non-toxic. It must be used when wiring above ceiling tiles. PVC cable cannot be used to wire above ceilings because it is toxic when burned. |
|
|
Term
| Describe the types of coaxial cable. |
|
Definition
RG-58 10Base2 Ethernet networking (also called Thinnet) 50 ohms
RG-59 Cable TV and cable networking 75 ohms
RG-6 Cable TV, satellite TV, and cable networking
RG-6 has less signal loss than RG-59, and is a better choice for networking applications, especially where longer distances (over a few feet) are involved. 75 ohms
RG-8 10Base5 Ethernet networking (also called Thicknet) 50 ohms |
|
|
Term
| What 3 types of coaxial cable connectors are there? |
|
Definition
F-Type - TV/Satelite
BNC - 10base2
AUI - 10base5 it is a DB15 serial connector. |
|
|
Term
| What characterizes multi-mode fiber? |
|
Definition
Transfers data through the core using multiple light rays
The core diameter is around 50 to 100 microns
Cable lengths are limited in distance |
|
|
Term
| What characterizes single-mode fiber? |
|
Definition
Transfers data through the core using a single light ray (the ray is also called a mode)
The core diameter is around 10 microns
Supports a large amount of data
Cable lengths can extend a great distance |
|
|
Term
| What is unique about a Fiber ST connector? |
|
Definition
Keyed, bayonet-type connector Also called a push in and twist connector ALSO- Used with single and multi-mode cabling Each wire has a separate connector Nickel plated with a ceramic ferrule to insure proper core alignment and prevent light ray deflection As part of the assembly process, it is necessary to polish the exposed fiber tip to ensure that light is passed on from one cable to the next with no dispersion
[image] |
|
|
Term
| What is unique about fiber MT-RJ connectors? |
|
Definition
Uses metal guide pins to ensure it is properly aligned. ALSO- Used with single and multi-mode cabling Composed of a plastic connector with a locking tab A single connector with one end holds both cables Uses a ceramic ferrule to insure proper core alignment and prevent light ray deflection
[image] |
|
|
Term
| What is a fiber LC connector? |
|
Definition
What we use in the DC. Used with single- and multi-mode cabling Composed of a plastic connector with a locking tab, similar to a RJ-45 connector A single connector with two ends keeps the two cables in place Uses a ceramic ferrule to insure proper core alignment and prevent light ray deflection Half the size of other fiber-optic connectors
[image] |
|
|
Term
| What is a fiber SC connector? |
|
Definition
Used with single- and multi-mode cabling Push on, pull off connector type that uses a locking tab to maintain connection Each wire has a separate connector Uses a ceramic ferrule to insure proper core alignment and prevent light ray deflection As part of the assembly process, it is necessary to polish the exposed fiber tip
[image] |
|
|
Term
| UTP T568A Wiring Pattern. |
|
Definition
T568A--To use this standard, arrange the wires from pins 1 to 8 in each connector in the following order: GW, G, OW, B, BW, O, BrW, Br.
- Pin 1: Tx+
- Pin 2: Tx-
- Pin 3: Rx+
- Pin 4: Unused
- Pin 5: Unused
- Pin 6: Rx-
- Pin 7: Unused
- Pin 8: Unused
|
|
|
Term
| UTP T568B wiring pattern. |
|
Definition
To use this standard, arrange the wires from pins 1 to 8 in each connector in the following order: OW, O, GW, B, BW, G, BrW, Br.
- Pin 1: Tx+
- Pin 2: Tx-
- Pin 3: Rx+
- Pin 4: Unused
- Pin 5: Unused
- Pin 6: Rx-
- Pin 7: Unused
- Pin 8: Unused
|
|
|
Term
| How do you make a crossover cable? |
|
Definition
Connect 1 to 3 and 2 to 6.
(Use T568a on one side and T568b on the other.)
Pin 1: Tx+
Pin 2: Tx-
Pin 3: Rx+
Pin 4: Unused
Pin 5: Unused
Pin 6: Rx-
Pin 7: Unused
Pin 8: Unused |
|
|
Term
|
Definition
When you contract with a local exchange carrier (LEC) for data or telephone services, they install a physical cable and a termination jack onto your premises. The demarcation point (demarc) is the line that marks the boundary between the telco equipment and the private network or telephone system.
Typically, the LEC is responsible for all equipment on one side of the demarc, and the customer is responsible for all equipment on the other side of the demarc.
The demarc is also called the minimum point of entry (MPOE) or the end user point of termination (EU-POT).
The demarc is typically located in the bottom floor of a building, just inside the building. For residential service, the demarc is often a small box on the outside of the house.
For business installations, the demarc is often identified by an orange plastic cover on the wiring component. |
|
|
Term
|
Definition
| The main distribution frame (MDF) is the main wiring point for a building. The MDF is typically located on the bottom floor or basement. The LEC typically installs the demarc to the MDF. |
|
|
Term
|
Definition
| An intermediate distribution frame (IDF) is a smaller wiring distribution point within a building. IDFs are typically located on each floor directly above the MDF, although additional IDFs can be added on each floor as necessary. |
|
|
Term
|
Definition
25 pair cables consist of 25 pairs of copper wires in a single bundle (containing a total of 50 wires).
Individual wires within the 25 pair cable use the following color coding scheme:
A total of 10 colors are used in two different groups:
Group 1 colors are white, red, black, yellow, and violet.
Group 2 colors are blue, orange, green, brown, and slate.
There are 5 wires of each color.
Every colored wire in group 1 is paired with each color in group 2. For example, you will have the following pairs for the white wires:
White with blue
White with orange
White with green
White with brown
White with slate
Instead of using solid colors, some schemes use striped wires to uniquely identify each wire and its matching wire. For example, the white wire with a blue stripe is twisted with the blue wire with a white stripe, and the red wire with the orange stripe is twisted with the orange wire with the red stripe.
An RJ-21 connector is used to connect 25 pair cable to other wiring devices, or you can manually connect each wire to the necessary location. |
|
|
Term
| What are 2 common wiring blocks? |
|
Definition
66 typically used for Tele and 100 more suited for data.
110 uses retainer clips that carry the transfer. |
|
|
Term
| How do you wire a 110 block? |
|
Definition
C-4 connectors connect four pairs of wires; C-5 connectors connect five pairs of wires.
White wire with a blue stripe, followed by the solid blue wire.
White wire with an orange stripe, followed by the solid orange wire.
White wire with a green stripe, followed by the solid green wire.
White wire with a brown stripe, followed by the solid brown wire.
Use BLOGB (BLue-Orange-Green-Brown) to remember the wire order, and remember to start with the white striped wire first. |
|
|
Term
|
Definition
| Address Resolution Protocol. Sends out broadcast with the destination MAC set to all 'FF' |
|
|
Term
|
Definition
A host sends a frame to another host through the hub.
The hub duplicates the frame and sends it to every host connected to the hub.
The host to which the frame is addressed accepts the frame. Every other host ignores the frame.
Hubs are Layer 1 devices; they simply repeat incoming frames without examining the MAC address in the frame |
|
|
Term
|
Definition
A bridge is a device that connects two (or more) media segments on the same subnet, and filters traffic between both segments based on the MAC address in the frame. A bridge builds a database based on MAC addresses to make forwarding decisions.
Bridges operate at the OSI Layer 2; they read the MAC address contained in a frame to make forwarding decisions.
Frame forwarding happens independently of the upper-layer protocols (such as TCP/IP). |
|
|
Term
|
Definition
|
|
Term
| Describe Ethernet Topology |
|
Definition
Ethernet uses one or more of the following networking topologies:
Physical bus, logical bus -Not used
Physical star, logical bus -Hub
Physical star, logical star -Switch |
|
|
Term
| What makes up an Ethernet Frame |
|
Definition
1.The preamble is a set of alternating ones and zeroes terminated by two ones (i.e., 11) that marks it as a frame.
2.The destination address identifies the receiving host's MAC address.
3.The source address identifies the sending host's MAC address.
4.The data (packet), or the information that needs to be transmitted from one host to the other.
4.Optional bits to pad the frame. Ethernet frames are sized between 64 and 1518 bytes. If the frame is smaller than 64 bytes, the sending NIC places "junk" data in the pad to make it the required 64 bytes.
6.The CRC (cyclic redundancy check) is the result of a mathematical calculation performed on the frame. The CRC helps verify that the frame contents have arrived uncorrupted. |
|
|
Term
| Ethernet Cabling factoids |
|
Definition
The maximum cable length for UTP Ethernet "T" implementations is 100 meters for all standards.
Ethernet standards support a maximum of 1024 hosts on a single subnet.
10GBase standards ending in W (i.e. 10GBaseSW) are used for SONET implementations. |
|
|
Term
|
Definition
| 10BaseFL is fiber MMC 1000-2000 meters |
|
|
Term
|
Definition
100 Mbps (multimode cable)
200 Mbps (single-mode cable)
412 meters (multimode fiber)
2,000 meters (single-mode fiber) |
|
|
Term
| 1000BaseCX (short copper) |
|
Definition
1,000 Mbps (half duplex)
2,000 Mbps (full duplex)
Special copper (150 ohm)
25 meters, used within wiring closets |
|
|
Term
1000BaseSX (short)
1000BaseLX (long) |
|
Definition
1. 220 to 550 meters depending on cable quality
2.550 meters (multimode fiber)
5 kilometers (single-mode fiber) |
|
|
Term
1. 10GBaseSR/10GBaseSW
2. 10GBaseLR/10GBaseLW
3. 10GBaseER/10GBaseEW |
|
Definition
1. MMC 300 meters
2. SMC 10 km
3. SMC 40km
'W' designations mean the Sonet implementation is used to stack multiple signals, used in WAN. |
|
|
Term
| What is the terminator type of a serial connection? |
|
Definition
| RS-232. This is generally used on a rollover cable. 1-8,2-7,3-6,4-5 |
|
|
Term
| How many bits make up an IP address? |
|
Definition
| Is a 32-bit binary number represented as four octets (four 8-bit numbers). Each octet is separated by a period. |
|
|
Term
| What are the ranges for subnet classes? |
|
Definition
A 1.0.0.0 to 126.255.255.255 1-126
(00000001--01111110 binary) 255.0.0.0
B 128.0.0.0 to 191.255.255.255 128-191
(10000000--10111111 binary) 255.255.0.0
C 192.0.0.0 to 223.255.255.255 192-223
(11000000--11011111 binary) 255.255.255.0
D 224.0.0.0 to 239.255.255.255 224-239
(11100000--11101111 binary) n/a Multicast
E 240.0.0.0 to 255.255.255.255 240-255
(11110000--11111111 binary) n/a Experimental |
|
|
Term
| Who controls IP designations? |
|
Definition
The Internet Assigned Numbers Authority (IANA) manages the assignment of IP addresses on the Internet. IANA is operated by the Internet Corporation for Assigned Names and Numbers (ICANN).
IANA allocates blocks of IP addresses to Regional Internet Registries (RIRs). An RIR has authority for IP addresses in a specific region of the world.
An RIR assigns a block of addresses to Internet Service Providers (ISPs).
An ISP assigns one or more IP addresses to individual computers or organizations connected to the Internet. |
|
|
Term
|
Definition
Using classless addresses is made possible by a feature called Classless Inter-Domain Routing (CIDR). CIDR allows for non-default subnet masks (variable length subnet mask or VLSM). Routers use the following information to identify networks:
The beginning network address in the range
The number of bits used in the subnet mask |
|
|
Term
|
Definition
| The term convergence is used to describe the condition when all routers have the same (or correct) routing information. |
|
|
Term
|
Definition
| An Interior Gateway Protocol (IGP) routes traffic within an AS (Autonomous System). |
|
|
Term
|
Definition
| An Exterior Gateway Protocol (EGP) routes traffic between Autonomous Systems. |
|
|
Term
|
Definition
| A link cost is a relative number that represents the cost for using the route. For example, the link cost could relate to the actual cost of using a link, such as an expensive WAN link, or it might identify the desirability of using a specific link. |
|
|
Term
|
Definition
| distance vector method, routers share their entire routing table with their immediate neighbors. Routes learned from neighboring routers are added to the routing table, then shared with that router's neighbors. |
|
|
Term
|
Definition
| link state method, routers share only their directly-connected routes using special packets called link-state advertisements (LSAs) and link-state packets (LSPs). These route advertisements are flooded (forwarded) throughout the network. Routers use this information to build a topology database of the network. |
|
|
Term
|
Definition
| hybrid method combines characteristics of both the distance vector and link state methods. It shares its full routing table at startup, followed by partial updates when changes occur. |
|
|
Term
|
Definition
RIP is a distance vector routing protocol used for routing within an autonomous system (i.e.an IGP).
RIP uses the hop count as the metric.
RIP networks are limited in size to a maximum of 15 hops between any two networks. A network with a hop count of 16 indicates an unreachable network.
RIP v1 is a classful protocol; RIP v2 is a classless protocol.
RIP is best suited for small private networks. |
|
|
Term
|
Definition
EIGRP is a hybrid routing protocol developed by Cisco for routing within an AS (IGP).
EIGRP uses a composite number for the metric that indicates bandwidth and delay for a link. The higher the bandwidth, the lower the metric.
EIGRP is a classless protocol.
EIGRP is best suited for medium to large private networks. |
|
|
Term
|
Definition
OSPF is a link state routing protocol used for routing within an AS (IGP).
OSPF uses a relative link cost for the metric.
OSPF is a classless protocol.
OSPF divides a large network into areas.
Each autonomous system requires an area 0 that identifies the network backbone.
All areas are connected to area 0, either directly or indirectly through another area.
Routes between areas must pass through area 0.
Internal routers share routes within an area; area border routers share routes between areas; autonomous system boundary routers share routes outside of the AS.
A router is the boundary between one area and another area.
OSPF is best suited for large private networks. |
|
|
Term
|
Definition
IS-IS is a link state routing protocol used for routing within an AS.
IS-IS uses a relative link cost for the metric.
IS-IS is a classless protocol.
The original IS-IS protocol was not used for routing IP packets; use Integrated IS-IS to include IP routing support.
IS-IS divides a large network into areas. There is no area 0 requirement, and IS-IS provides greater flexibility than OSPF for creating and connecting areas.
L1 routers share routes within an area; L2 routers share routes between areas; an L1/L2 router can share routes with both L1 and L2 routers.
A network link is the boundary between one area and another area.
IS-IS is best suited for large private networks, supporting larger networks than OSPF. IS-IS is typically used within an ISP, and easily supports IPv6 routing. |
|
|
Term
|
Definition
BGP is an advanced distance vector protocol (also called a path vector protocol). BGP is an exterior gateway protocol (EGP) used for routing between autonomous systems.
BGP uses paths, rules, and policies instead of a metric for making routing decisions.
BGP is a classless protocol.
Internal BGP (iBGP) is used within an autonomous system; External BGP (eBGP) is used between ASs.
BGP is the protocol used on the Internet: ISPs use BGP to identify routes between ASs. Very large networks can use BGP internally, but typically only share routes on the Internet if the AS has two (or more) connections to the Internet through different ISPs. |
|
|
Term
| What are the private IPv4 address ranges |
|
Definition
The private IPv4 address ranges are:
A - 10.0.0.1 to 10.255.255.254
B - 172.16.0.1 to 172.31.255.254
C - 192.168.0.1 to 192.168.255.254 |
|
|
Term
| Internet Connection Sharing - what is the IP range for the built in DHCP server? |
|
Definition
Windows XP/Vista - IP address on the 192.168.0.0 subnet with a mask of 255.255.255.0.
Windows 7 - IP address in the range of 192.168.137.0 with a mask of 255.255.255.0. |
|
|
Term
|
Definition
| The ICS (Internet Connection Sharing) system is configured as a NAT router, a limited DHCP server, and a DNS proxy (name resolution requests from the private network are forwarded to DNS servers on the Internet). |
|
|
Term
| What is the makeup of an IPv6 address? |
|
Definition
The address is made up of 32 hexadecimal numbers, organized into 8 quartets.
The quartets are separated by colons.
Each quartet is represented as a hexadecimal number between 0 and FFFF. Each quartet represents 16-bits of data (FFFF = 1111 1111 1111 1111). |
|
|
Term
| 3 methods for ipv6 communication |
|
Definition
Dual stack, Tunneling, NAT-pt
Dual stack, hosts and all network equipment run both protocols.
Tunneling - IPv6 packet is wrapped in ipv4 info (more)
nat-pt - IPv6 headers are stripped and replaced with IPv4 |
|
|
Term
|
Definition
Tunneling wraps an IPv6 packet within an IPv4 packet, allowing IPv6 hosts or sites to communicate over the existing IPv4 infrastructure. With tunneling, a device encapsulates IPv6 packets in IPv4 packets for transmission across an IPv4 network, and then the packets are de-encapsulated to their original IPv6 packets by another device at the other end. Tunneling solutions include:
Intra-site Automatic Tunnel Addressing Protocol (ISATAP) for implementations within a site
6-to-4 tunneling for implementations across sites
Teredo for tunneling between two hosts
Use tunneling to allow an IPv6 host to communicate with another IPv6 host through an IPv4 network. |
|
|
Term
|
Definition
NAT-PT is a protocol that converts the IPv6 packet header into an IPv4 packet header, and vice versa. This method is different than tunneling because the packet headers are converted between the IPv4 and IPv6, whereas tunneling wraps the IPv6 packet into an IPv4 packet.
Use NAT-PT to allow IPv4 hosts to communicate with IPv6 hosts. |
|
|
Term
|
Definition
| The Internet Group Management Protocol (IGMP) is used to identify group members and to forward multicast packets onto the segments where group members reside. IGMP routers keep track of the attached subnets that have group members. |
|
|
Term
|
Definition
A router sends out a host membership query. This query is addressed to the IP address of 224.0.0.1.
Hosts that are members of any group respond with a list of the groups to which the host belongs. Each group is identified with a multicast IP address in the range of 224.0.0.0 to 239.255.255.255.
The router uses these responses to compile a list of the groups on that subnet that have group members. Routers do not keep track of individual hosts that are members of a group; they simply compile a list of groups on the subnet that have at least one member.
When a host joins a new group, it automatically sends a join group message to the router. When the last host in a group leaves the group, it sends a leave group message to the router.
The IGMP router reports to upstream routers that they have members of a specific group.
Upstream routers are the routers that exist between the router and the server that sends out the multicast data stream.
Upstream routers keep track of downstream routers that have group members. |
|
|
Term
|
Definition
The sending server sends packets addressed to the multicast group.
Routers receive the multicast packets and check their lists of group members.
If the router is connected to a subnet that has group members, or if the subnet includes a downstream router with group members, the multicast packet is sent on that subnet.
If a subnet does not have any group members, the packet is not forwarded on that subnet.
If a router does not have any subnets with group members, the packet is dropped and not forwarded.
Each intermediary router performs the same tasks until the data stream eventually reaches the multicast client. |
|
|
Term
| Multicast group IP make up |
|
Definition
A multicast group is identified by a multicast IP address.
Each group is identified by a different address.
Multicast addresses are in the range 224.0.0.0 to 239.255.255.255.
The address 224.0.0.1 is never assigned to a group because it is used for the query messages sent by routers. |
|
|
Term
| Additional Multicast facts |
|
Definition
Frames that contain multicast traffic are sent to a special MAC address. The MAC address begins with 01-00-5E, with the last portion being a form of the IP multicast group address. Be aware that a single multicast MAC address could be shared by up to 5 other IP multicast addresses.
Routers do not keep track of which hosts are part of the group, only that there is at least one group member on the subnet (or that the subnet is connected to a downstream router that has group members). A router sends multicast traffic it receives on all subnets with group members.
A regular switch that receives multicast traffic sends the traffic out all ports, because the destination MAC address will be an unknown address. This means that a host might see multicast traffic on its segment, even if it isn't a member of the group. However, hosts that are not members of the group will not process the frame because they will not associate the multicast MAC address with their own address.
IGMP snooping on a switch allows the switch to control which ports get IGMP traffic for a specific group. With IGMP snooping, the switch identifies which ports include members of a specific multicast group. When a message is received for a group, the message is sent only to the ports that have a group member connected. |
|
|
Term
|
Definition
Packets are sent through an IP network. A VoIP call consists of two data flows:
The voice carrier stream, consisting of Real-Time Transport Protocol (RTP) packets containing the actual voice samples.
The call control signaling, consisting of one of several protocols which set up, maintain, teardown, and redirect the call. Protocols used in call control include the following:
H.323
Session Initiation Protocol (SIP)
Media Gateway Control Protocol (MGCP) |
|
|
Term
|
Definition
Network as a Service (NaaS) is similar to the offsite virtual network in that the servers and desktops are all virtualized and managed by a contracted third-party. Be aware of the following:
NaaS virtualizes the entire network infrastructure; all physical wiring for the network is virtual and is run at the service provider's site.
A basic network is implemented on the contracted site in order to get out to the service provider's site.
Typically, all administration tasks of the network are handled by the service provider. |
|
|
Term
| Frequency Hopping Spread Spectrum (FHSS) |
|
Definition
FHSS uses a narrow frequency band and 'hops' data signals in a predictable sequence from frequency to frequency over a wide band of frequencies.
Because FHSS shifts automatically between frequencies, it can avoid interference that may be on a single frequency.
Hopping between frequencies also increases transmission security by making eavesdropping and data capture more difficult. |
|
|
Term
| Direct-Sequence Spread Spectrum (DSSS) |
|
Definition
| The transmitter breaks data into pieces and sends the pieces across multiple frequencies in a defined range. DSSS is more susceptible to interference and less secure then FHSS. |
|
|
Term
| Describe Wifi media access |
|
Definition
Wireless networks use Carrier Sense Multiple Access/Collision Avoidance (CSMA/CA) to control media access and avoid (rather than detect) collisions. Collision avoidance uses the following process:
The sending device listens to make sure that no other device is transmitting. If another device is transmitting, the device waits a random period of time (called a backoff period) before attempting to send again.
If no other device is transmitting, the sending device broadcasts a Request-to-send (RTS) message to the receiver or access point. The RTS includes the source and destination, as well as information on the duration of the requested communication.
The receiving device responds with a Clear-to-send (CTS) packet. The CTS also includes the communication duration period. Other devices use the information in the RTS and CTS packets to delay attempting to send until the communication duration period (and subsequent acknowledgement) has passed.
The sending device transmits the data. The receiving device responds with an acknowledgement (ACK). If an acknowledgement is not received, the sending device assumes a collision and retransmits the affected packet.
After the time interval specified in the RTS and CTS has passed, other devices can start the process again to attempt to transmit.
Using RTS and CTS (steps 2 and 3 above) is optional and depends on the capabilities of the wireless devices. Without RTS/CTS, collisions are more likely to occur.
Wireless communication operates in half-duplex (shared, two-way communication). Devices can both send and receive, but not at the same time. Devices must take turns using the transmission channel. Typically, once a party begins receiving a signal, it must wait for the transmitter to stop transmitting before replying. |
|
|
Term
|
Definition
| Station (STA) |
An STA is a wireless network card (NIC) in an end device such as a laptop or wireless PDA. STA often refers to the device itself, not just the network card. |
| Access Point (AP) |
An access point (AP), sometimes called a wireless access point, is the device that coordinates all communications between wireless devices as well as the connection to the wired network. It acts as a hub on the wireless side and a bridge on the wired side. It also synchronizes the stations within a network to minimize collisions. |
| Basic Service Set (BSS) |
A BSS, also called a cell, is the smallest unit of a wireless network. All devices in the BSS can communicate with each other. The devices in the BSS depend on the operating mode:
- In an ad hoc implementation, each BSS contains two devices that communicate directly with each other.
- In an infrastructure implementation, the BSS consists of one AP and all STAs associated with the AP.
All devices within the BSS use the same radio frequency channel to communicate. |
| Independent Basic Service Set (IBSS) |
An IBSS is a set of STAs configured in ad hoc mode. |
| Extended Service Set (ESS) |
An ESS consists of multiple BSSs with a distribution system (DS). The graphic above is an example of an ESS. In an ESS, BSSs that have an overlapping transmission range use different frequencies. |
| Distribution System (DS) |
The distribution system (DS) is the backbone or LAN that connects multiple APs (and BSSs) together. The DS allows wireless clients to communicate with the wired network and with wireless clients in other cells. |
| Service Set Identifier (SSID) |
The Service Set Identifier (SSID), also called the network name, groups wireless devices together into the same logical network.
- All devices on the same network (within the BSS and ESS) must have the same SSID.
- The SSID is a 32-bit value that is inserted into each frame. The SSID is case-sensitive.
- The SSID is sometimes called the ESS ID (Extended Service Set ID) or the BSS ID (Basic Service Set ID). In practice, each term means the same thing. Note: Using BSS ID to describe the SSID of a BSS is technically incorrect.
|
| Basic Service Set Identifier (BSSID) |
The BSSID is a 48-bit value that identifies an AP in an infrastructure network or a STA in an ad hoc network. The BSSID allows devices to find a specific AP within an ESS that has multiple access points, and is used by STAs to keep track of APs when roaming between BSSs. The BSSID is the MAC address of the access point and is set automatically.
Note: Do not confuse the BSSID with the SSID. They are not the same thing.
|
|
|
|
Term
| Multiple Input Multiple Output (MIMO) |
|
Definition
802.11n uses multiple send and receive radios (MIMO). The use of multiple antennas both at the transmitter and receiver improves the performance (stronger signal and increased speed) of radio communication systems.
A system is described by the number of sending and receiving radios. The 802.11n specifications allow up to 4 sending and 4 receiving radios. The benefit of adding additional radios declines as the number increases. Going above 3x3 offers little practical return. |
|
|
Term
| What is wifi channel bonding |
|
Definition
Channel bonding combines two non-overlapping 20-MHz channels into a single 40-MHz channel, resulting in slightly more than double the bandwidth.
The 5.75 GHz range has a total of 23 channels, with 12 of those non-overlapping. This allows for a maximum of 6 non-overlapping bonded (combined) channels.
The 2.4 GHz range has a total of 11 channels, with 3 of those non-overlapping. This allows for a maximum of 1 non-overlapping channel. For this reason, channel bonding is typically not practical for the 2.4 GHz range. |
|
|
Term
|
Definition
| Frequency |
2.45 GHz |
| Speed |
Bluetooth 1.0--Up to 1 Mbps (practical rates are about 720 Kbps)
Bluetooth 2.0--Up to 3 Mbps (practical rates are about 2 Mbps) |
| Range |
30 Ft. |
| Signal |
FHSS |
You should know the following facts about Bluetooth:
- A Bluetooth network uses a master/slave networking mode:
- One master device controls up to seven slave devices.
- A PAN can have up to 255 total slave devices.
- Bluetooth uses a 128-bit proprietary encryption mechanism to encrypt its signals.
|
|
|
Term
|
Definition
|
|
Term
|
Definition
Uses Temporal Key Integrity Protocol (TKIP) for encryption.
Supports both Pre-shared Key (referred to as WPA-PSK or WPA Personal) and 802.1x (referred to as WPA Enterprise) authentication.
Can use dynamic keys or pre-shared keys.
Can typically be implemented in WEP-capable devices through a software/firmware update.
WPA keys can also be predicted by reconstructing the Message Integrity Check (MIC) of an intercepted packet, sending the packet to an access point, and observing whether the packet is accepted by the access point. |
|
|
Term
|
Definition
Uses Advanced Encryption Standard (AES) as the encryption method. It is similar to and more secure than TKIP, but requires special hardware for performing encryption.
Uses Counter Mode with CBC-MAC Protocol (CCMP), also known as AES-CCMP.
Supports both Pre-shared Key (referred to as WPA2-PSK or WPA2 Personal) and 802.1x (referred to as WPA2 Enterprise) authentication.
Can use dynamic keys or pre-shared keys. |
|
|
Term
|
Definition
| WIFI - An initialization vector (IV) is a seed value used in encryption. The seed value and the key are used in an encryption algorithm to generate additional keys or to encrypt data. WEP encryption reuses initialization vectors which can be observed through patterns and ultimately can be cracked (known as an IV attack). For security, the initialization vector should be large and it should be unpredictable. |
|
|
Term
|
Definition
|
1.544 Mbps
44.736 Mbps
|
- T-Carrier is a digital standard widely deployed in North America.
- T1 lines usually run over two-pairs of unshielded twisted pair (UTP) cabling, although they can also run over other media such as coaxial, fiber-optic, and satellite. T3 lines usually run over fiber-optic cable.
- A T1 line has 24 channels that each run at 64 Kbps. A T3 line has 672 channels that each run at 64 Kbps.
- A T1/T3 connection requires a Channel Service Unit (CSU) and a Data Service Unit (DSU). (A DSU reads and writes synchronous digital signals, and a CSU manages the digital channel.)
- To connect routers over their CSU/DSU interfaces, use a T1 crossover cable.
- T3 is also known as a Digital Signal 3 (DS3).
|
|
|
|
Term
|
Definition
| E1 |
2.048 Mbps |
- E-Carrier is a digital standard very similar to T-Carrier, but it is widely deployed in Europe.
- An E1 line has 32 channels that run at 64 Kbps. An E3 line transmits 16 E1 signals at the same time.
- E1/E3 connections also require a CSU/DSU.
|
| E3 |
34.368 Mbps |
|
|
|
Term
|
Definition
| J1 |
1.544 Mbps |
- J-Carrier is a digital standard very similar to T-Carrier, but it is widely deployed in Japan.
- A J1 line is virtually identical to a T1 line. A J3 line has 480 channels that run at 64 Kbps.
- J1/J3 connections also require a CSU/DSU.
|
| J3 |
32.064 Mbps |
|
|
|
Term
OC-1
Optical Carrier Lines |
|
Definition
| OC-1 |
51.84 Mbps |
- Optical carrier specifications define the types and throughput of fiber optic cabling used in SONET (Synchronous Optical Network).
- Each OC level is a multiple of the Base Rate (OC-1). To get the 622.08 Mbps throughput rating of OC-12, multiply the 51.84 Mbps Base Rate by 12.
- Optical carriers use the following types of Wavelength Division Multiplexing (WDM) to increase capacity of communication over fiber optic cabling:
- Coarse Wavelength Division Multiplexing (CWDM) (used in 10GBase-LX4 Ethernet networks)
- Dense Wavelength Division Multiplexing (DWDM) (used in fiber optic backbones and long distance data transmission, with speeds up to 400Gbps)
|
| OC-3 |
155.52 Mbps |
| OC-12 |
622.08 Mbps |
| OC-24 |
1244.16 Mbps |
| OC-48 |
2488.32 Mbps |
| OC-192 |
10 Gbps |
| OC-256 |
13.271 Gbps |
| OC-768 |
39.2 Gbps |
|
|
|
Term
|
Definition
| The local loop is the cable that extends from the central office to the customer location. The local loop is owned and maintained by the WAN service provider. Typically, it is UTP, but it can also be one or a combination of UTP, fiber optic, or other media. The local loop is often referred to as the "last mile" because it represents the last portion of the WAN up to the customer premises. |
|
|
Term
|
Definition
Integrated Services Digital Network (ISDN) is a WAN technology that provides increased bandwidth within the local loop. There are two forms of ISDN:
- ISDN BRI (basic rate interface) uses digital signals over POTS. The traditional phone line is divided into separate channels: two 64 Kbps bearer (B) channels and one 16 Kbps control (D) channel. ISDN BRI is often called 2B + 1D.
- ISDN PRI (primary rate interface) uses digital signals over a T1 line with 23 64 Kbps B channels and one 64 Kbps D channel in North America (up to 1.544 Mbps), or over an E1 line with 30 64 Kbps B channels and one 64 Kbps D channel (up to 2.048 Mbps). ISDN PRI is often referred to as 23B + 1D.
ISDN has the following characteristics:
- ISDN is a circuit switching technology.
- ISDN is only a local loop technology; once calls reach the WAN cloud, they are converted to another protocol for transmission through the WAN.
- With ISDN BRI, you can use one channel for voice and one channel for data, or both channels for different voice calls. Depending on the implementation, you can also bond both B channels to use them together.
- ISDN PRI requires a CSU/DSU for the T1 line.
|
|
|
Term
|
Definition
Frame Relay is a protocol used to connect to a WAN over dedicated (leased) lines.
- Frame Relay is a packet switching technology that supports variable-sized data units called frames.
- Frame Relay establishes a permanent virtual circuit between two locations. This circuit is virtual, meaning it is not a physical path through the network. Because the circuit is permanent, there is no call setup or termination required.
- Virtual circuits can be configured as one of the following:Frame Relay can be implemented over a variety of connection lines (T1, T3).
- A point-to-point circuit is established between two locations.
- A point-to-multipoint circuit is a single circuit that can be used to reach multiple locations.
- Routers at the customer site connect to the T1 line through a CSU/DSU.
- When congestion occurs, the Frame Relay network simply drops packets to keep up. Frame Relay networks provide error detection but not error recovery. It is up to end devices to request a retransmission of lost packets.
- When you sign up for Frame Relay service, you are assigned a level of service called a Committed Information Rate (CIR). At times your actual bandwidth could be higher than the CIR, but the CIR represents the maximum guaranteed data transmission rate you will receive on the Frame Relay network.
|
|
|
Term
| ATM - Asynchronous Transmission Mode |
|
Definition
ATM is a WAN communication technology originally designed for carrying time-sensitive data such as voice and video. However, it can also be used for regular data transport.
- ATM is a packet switching technology that uses fixed-length data units called cells. Each cell is 53-bytes.
- ATM establishes a virtual circuit between two locations.The cell header includes labels that identify the virtual path information. ATM switches in the WAN cloud use the virtual path to switch cells within the WAN to the destination.
- A virtual channel is a data stream sent from one location to another.
- A virtual path is a collection of data streams with the same destination.
- ATM is connection-oriented (compared to Frame Relay which is connectionless).
|
|
|
Term
| SONET - Synchronous Optical Network |
|
Definition
SONET is a subset or variation of the Synchronous Digital Hierarchy (SDH) standards for networking over an optical medium. It was originally developed as a WAN solution to interconnect optical devices from various vendors.
- SONET is a packet switching technology that uses different frame sizes based on the bandwidth used on the SONET network.
- SONET is classified as a transport protocol, in that it can carry other types of traffic such as ATM, Ethernet, and IP.
- Most PSTN networks use SONET within the long-distance portion of the PSTN network.
- SONET networks use dual, counter-rotating fiber optic rings. If a break occurs in one ring, data can be routed over the other ring to keep traffic flowing.
- Data rates for SONET vary from between 51 Mbps up to about 160 Gbps.
|
|
|
Term
| MLPS - Multiprotocol Label Switching |
|
Definition
MPLS is a WAN data classification and data carrying mechanism.
- MPLS is a packet switching technology that supports variable-length frames.
- MPLS adds a label to packets between the existing Network and Data Link layer formats. Labels are added when the packet enters the MPLS network, and removed when the packet exits the network.
- Information in the label is used to switch the packet through the MPLS network to the destination.
- MPLS labels can identify the route or even the network type to use. MPLS labels are often used to provide different classes of service for data streams.
- MPLS is a connection-oriented protocol.
|
|
|
Term
|
Definition
Asymmetrical DSL (ADSL) 12 Mbps downstream and 1-3.5 Mbps upstream. Newer ADSL2+ provides up to 24 Mbps downstream.
Symmetrical DSL (SDSL) provides equal download and upload speeds. Depending on the region, speeds are between 1.544-2.048 Mbps. Newer SHDSL provides between 4.6-5.696 Mbps.
Very high DSL (VDSL or VHDSL) is similar to asymmetrical DSL with higher speeds.
Speeds can be up to 52 Mbps downstream and 12-16 Mbps downstream, depending on the distance. Newer VDSL2 provides up to 100 Mbps at a distance of 300 meters. |
|
|
Term
|
Definition
2G data speeds were slow (14.4 Kbps) and were used mainly for text messaging, not Internet connectivity. 2.5G was an evolution that supported speeds up to 144 Kbps.
EDGE (also called 2.75G) networks are an intermediary between 2G and 3G networks. EDGE is the first cellular technology to be truly Internet compatible, with speeds between 400-1,000 Kbps.
3G (third generation) offers simultaneous voice and data. Minimum speeds for stationary users are quoted at 2 Mbps or higher. The following extensions enhance 3G networks:
HSPA+ (also known as smart antenna) uses multiple-input and multiple-output (MIMO), and significantly increases data throughput and link range without additional bandwidth or increased transmit power.
Long Term Evolution (LTE) and Long Term Evolution (LTE) Advanced increase downlink/uplink speeds to 100/50 Mbps and 1Gbps/500Mbps, respectively.
4G is available with minimum speeds around 3-8 Mbps with over 100 Mbps possible. 4G:
Uses(MIMO)
Is not compatible with 3G; 4G requires a complete retrofit on the part of service providers and new equipment for the consumer.
Has a sub-technology named Worldwide Interoperability for Microwave Access (WiMAX). WiMAX delivers high-speed Internet service (up to 1 Gbps for stationary users) to large geographical areas |
|
|
Term
| RAS - Remote access service |
|
Definition
1. Physical connection
2. Connection parameters - Upper-layer protocol suite (such as IP)
Network-layer addressing
Compression (if any)
Encryption (if any)
The authentication method to use (PPP/PPoE0
3. Authentication - CHAP, MS-CHAP, EAP
4. Authorization - what resources are available to clients?
5. Accounting - Tracks Activity |
|
|
Term
| Remote Authentication Dial-In User Service (RADIUS) |
|
Definition
RADIUS is used by Microsoft servers for centralized remote access administration. RADIUS:
Combines authentication and authorization using policies to grant access.
Uses UDP.
Encrypts only the password.
Often uses vendor-specific extensions. RADIUS solutions from different vendors might not be compatible.
When configuring a RADIUS solution, configure a single server as a RADIUS server. Then configure all remote access servers as RADIUS clients. |
|
|
Term
| Terminal Access Controller Access-Control System Plus (TACACS+) |
|
Definition
TACACS+ was originally developed by Cisco for centralized remote access administration. TACACS+:
Provides three protocols, one each for authentication, authorization, and accounting. This allows each service to be provided by a different server.
Uses TCP.
Encrypts the entire packet contents.
Supports more protocol suites than RADIUS. |
|
|
Term
| Packet filtering firewall |
|
Definition
A packet filtering firewall makes decisions about which network traffic to allow by examining information in the IP packet header such as source and destination addresses, ports, and service protocols. A packet filtering firewall:
Uses access control lists (ACLs) or filter rules to control traffic.
Operates at OSI layer 3 (Network layer).
Offers high performance because it only examines addressing information in the packet header.
Can be implemented using features that are included in most routers.
Is a popular solution because it is easy to implement and maintain, has a minimal impact on system performance, and is fairly inexpensive.
A packet filtering firewall is considered a stateless firewall because it examines each packet and uses rules to accept or reject each packet without considering whether the packet is part of a valid and active session. |
|
|
Term
|
Definition
A circuit-level proxy or gateway makes decisions about which traffic to allow based on virtual circuits or sessions. A circuit-level gateway:
Operates at OSI Layer 5 (Session layer).
Keeps a table of known connections and sessions. Packets directed to known sessions are accepted.
Verifies that packets are properly sequenced.
Ensures that the TCP three-way handshake process occurs only when appropriate.
Does not filter packets. Rather it allows or denies sessions.
A circuit-level proxy is considered a stateful firewall because it keeps track of the state of a session. A circuit-level proxy can filter traffic that uses dynamic ports because the firewall matches the session information, and not the port numbers, for filtering. In general, circuit-level proxies are slower than packet filtering firewalls, although if only the session state is being used for filtering, a circuit-level gateway can be faster after the initial session information has been identified. |
|
|
Term
| Application level gateway |
|
Definition
An application level gateway is a firewall that is capable of filtering based on information contained within the data portion of a packet. An application level gateway:
Examines the entire content (not just individual packets).
Operates at OSI Layer 7 (Application layer).
Understands or interfaces with the application-layer protocol.
Can filter based on user, group, and data such as URLs within an HTTP request.
Is the slowest form of firewall because entire messages are reassembled at the Application layer.
One example of an application level gateway is a proxy server. A proxy server is a device that stands as an intermediary between a secure private network and the public. Proxies can be configured to:
Control both inbound and outbound traffic.
Increase performance by caching heavily accessed content. Content is retrieved from the proxy cache instead of being retrieved from the original server.
Filter content.
Shield or hide a private network.
Restrict access by user or by specific Web sites. |
|
|
Term
|
Definition
20 TCP
21 TCP |
File Transfer Protocol (FTP) |
| 22 TCP and UDP |
Secure Shell (SSH) |
| 23 TCP |
Telnet |
| 25 TCP |
Simple Mail Transfer Protocol (SMTP) |
| 53 TCP and UDP |
Domain Name Server (DNS) |
67 UDP
68 UDP |
Dynamic Host Configuration Protocol (DHCP) |
| 69 UDP |
Trivial File Transfer Protocol (TFTP) |
| 80 TCP |
HyperText Transfer Protocol (HTTP) |
| 110 TCP |
Post Office Protocol (POP3) |
| 119 TCP |
Network News Transport Protocol (NNTP) |
| 123 UDP |
Network Time Protocol (NTP) |
| 143 TCP and UDP |
Internet Message Access Protocol (IMAP4) |
161 TCP and UDP
162 TCP and UDP |
Simple Network Management Protocol (SNMP) |
| 389 TCP and UDP |
Lightweight Directory Access Protocol |
| 443 TCP and UDP |
HTTP with Secure Sockets Layer (SSL) |
| 3389 TCP and UDP |
Remote Desktop Protocol (RDP) |
|
|
|
Term
|
Definition
ICANN specifies three categories for ports.
Well known ports range from 0 to 1023 and are assigned to common protocols and services.
Registered ports range from 1024 to 49151 and are assigned by ICANN to a specific service.
Dynamic (also called private or high) ports range from 49,152 to 65,535 and can be used by any service on an ad hoc basis. Ports are assigned when a session is established, and released when the session ends. |
|
|
Term
| Point-to-Point Tunneling Protocol (PPTP) |
|
Definition
PPTP was one of the first VPN protocols. Developed by Microsoft, PPTP:
Uses standard authentication protocols, such as Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP).
Supports TCP/IP only.
Encapsulates other LAN protocols and carries the data securely over an IP network.
Uses Microsoft's MPPE for data encryption.
Is supported by most operating systems and servers.
Uses TCP port 1723. |
|
|
Term
| Layer Two Tunneling Protocol (L2TP) |
|
Definition
L2TP is an open standard for secure multi-protocol routing. L2TP:
Supports multiple protocols (not just IP).
Uses IPSec for encryption.
Is not supported by older operating systems.
Uses TCP port 1701 and UDP port 500. |
|
|
Term
|
Definition
IPSec provides authentication and encryption, and can be used in conjunction with L2TP or by itself as a VPN solution. IPSec includes the following three protocols for authentication, data encryption, and connection negotiation:
- Authentication Header (AH) provides authentication features. Use AH to enable authentication with IPSec.Encapsulating Security Payload (ESP) provides data encryption. Use ESP to encrypt data.
- AH provides a message integrity check with the Hashed Keyed Message Authentication Code (HMAC). With HMAC, a symmetric key is embedded into a message before the message is hashed. When the message is received, the recipient's symmetric key is added back into the message before hashing the message. If the hash values match, message integrity is proven.
- AH uses SHA-1 (Secure Hashing Algorithm 1) or MD5 (Message Digest v5) for integrity validation.
- Internet Key Exchange (IKE) negotiates the connection. As two end points are securing an IPSec network, they have to negotiate what is called a Security Association (SA). An inbound and outbound SA is necessary for each connection with a remote endpoint.IKE uses the following functions:
- Internet Security Association Key Management Protocol (ISAKMP) establishes a framework for the negotiation.
- The Diffie-Hellman key exchange generates symmetric keys used for the encryption of the negotiation of the SA.
If you use only AH, data is not encrypted.
IPSec can be used to secure the following types of communications:
- Host-to-host communications within a LAN.
- VPN communications through the Internet, either by itself or in conjunction with the L2TP VPN protocol.
- Any traffic supported by the IP protocol including Web, e-mail, Telnet, file transfer, and SNMP traffic as well as countless others.
IPSec uses either digital certificates or pre-shared keys. |
|
|
Term
|
Definition
The SSL protocol has long been used to secure traffic generated by other IP protocols such as HTTP, FTP, and e-mail. SSL can also be used as a VPN solution, typically in a remote access scenario. SSL:
Authenticates the server to the client using public key cryptography and digital certificates.
Encrypts the entire communication session.
Uses port 443, a port that is often already opened in most firewalls.
Implementations that use SSL for VPN tunneling include Microsoft's SSTP and Cisco's SSL VPN. |
|
|
Term
| What is the difference between Identification and authentication? |
|
Definition
Identification is the initial process of confirming the identity of a user requesting credentials and occurs when a user types in a user ID to log on. Identity proofing occurs during the identification phase as the user proves that they are who they say they are in order to obtain credentials. If a person has previously been identified, but cannot provide their assigned authentication credentials (such as a lost password), then identity proofing is called upon again.
Authentication is the verification of the issued identification credentials. It is usually the second step in the identification process, and establishes the user's identity, ensuring that users are who they say they are. |
|
|
Term
| 3 ways a user can prove identity to an authentication server. |
|
Definition
Type 1 - something you know: passwords, pins
Type 2 - something you have: swipe cards, rsa tokens, fobs, smartcards
Type 3 - something you are: biometric scanners |
|
|
Term
| Types of token based authentication (type 2) |
|
Definition
Using a (static password), the password is saved on the token device. Swiping the token supplies the password for authentication.
A (synchronous dynamic password) generates new passwords at specific intervals on the hardware token. Users must read the generated password and enter it along with the PIN to gain access.
An (asynchronous dynamic password) generates new passwords based on an event, such as pressing a key.
A (challenge-response password) generates a random challenge string. The challenge text is entered into the token, along with the PIN. The token then uses both to generate a response used for authentication. |
|
|
Term
| Types of combination Authentication? |
|
Definition
Two-factor
Three-factor
Multi-factor |
Requires two (or more) different authentication types to be deployed. |
To enter a secured building, you must insert your key card (Type 2) and undergo a retina scan (Type 3). |
| Strong |
Requires two or more methods, but they can be of the same type. |
To log on to an online banking system, you enter your username, password, and then must answer a random personal question (such as your birthplace or mother's maiden name). |
| One-factor |
Uses credentials of only one type, but may require multiple methods within the same type |
To log in, you supply a username and a password (the username is not used for authentication, so the only credential supplied for authentication is the password)
To log in, you supply a username, PIN, and a pass phrase (all credentials are of the same type) |
| Mutual |
Requires that both parties authenticate with each other before beginning communications. |
To log in, your computer sends its digital certificate to prove its identity to a network server. The server then proves its identity to your computer before they will exchange messages. |
|
|
|
Term
|
Definition
CHAP is a three-way handshake (challenge/response) authentication protocol used for remote access connections. Both devices are configured with a password called a shared secret. For unique user authentication, this value is associated with a user account. Authentication using a challenge/response mechanism occurs as follows:
The server generates a message called a challenge message and sends this to the client.
The client uses the shared secret to hash the challenge message and returns this value along with the username to the server (the response).
The server uses its copy of the shared secret for that user to perform the same hash. The server compares its hashed value with the hashed value received from the client.
With CHAP, plaintext versions of the password are never sent, only the hashed challenge message is sent between devices.
MS-CHAP is Microsoft's proprietary, challenge-response authentication method used for remote access connections.
MS-CHAP encrypts the shared secret on each system so that it is not saved in plain text.
MS-CHAP provides a mechanism for changing the password over the remote connection.
MS-CHAP v2 allows for mutual authentication, where the server authenticates to the client.
MS-CHAP is considered more secure than CHAP, and should be used if supported on both devices. |
|
|
Term
| EAP Extensible Authentication Protocol |
|
Definition
EAP allows the client and server to negotiate the characteristics of authentication.
EAP is used to allow authentication using smart cards, biometrics (user physical characteristics), and certificate-based authentication. |
|
|
Term
|
Definition
Kerberos is used for both authentication and authorization to services. Kerberos grants tickets (also called a security token) to authenticated users and to authorized resources. The process of using tickets to validate permissions is called delegated authentication. Kerberos uses the following components:
An authentication server (AS) accepts and processes authentication requests.
A service server (SS) is a server that provides or holds network resources.
A ticket granting server (TGS) grants tickets that are valid for specific resources on specific servers. |
|
|
Term
| Explain the Kerberos process |
|
Definition
Keberos works as follows:
The client sends an authentication request to the authentication server.
The authentication server validates the user identity and grants a ticket granting ticket (TGT). The TGT validates the user identity and is good for a specific ticket granting server.
When the client needs to access a resource, it submits its TGT to the TGS. The TGS validates that the user is allowed access, and issues a client-to-server ticket.
The client connects to the service server and submits the client-to-server ticket as proof of access.
The SS accepts the ticket and allows access.
Tickets are valid during the entire session and do not need to be re-requested. Windows Active Directory uses Kerberos for user authentication and for controlling resource access. Kerberos requires that all servers within the process have synchronized clocks to validate tickets. |
|
|
Term
|
Definition
| A port authentication method on switches and WAPs. It typically uses a RADIUS server for authentication. |
|
|
Term
|
Definition
| A policy is a document that describes the overall goals and requirements for a network. A policy identifies what should be done, but may not necessarily define how the goal is to be reached. |
|
|
Term
|
Definition
| A procedure is a step-by-step process outlining how to implement a specific action. The design of a procedure is guided by goals defined in a policy, but go beyond the policy by identifying specific steps that are to be implemented. The use of consistent procedures ensures that the goals defined in a policy are met, and provides consistency of action by multiple administrators. |
|
|
Term
|
Definition
Management Information Base (MIB)- The MIB is a database of host configuration information. Agents report data to the MIB, and the manager can then view information by requesting data from the MIB. Object Identifiers (OID) identify managed objects in a MIB hierarchy.
Trap - an event configured on an agent. When the event occurs, the agent logs details regarding the event. |
|
|
Term
|
Definition
Spanning tree is a protocol on a switch that allows the switch to maintain multiple paths between switches within a subnet. The spanning tree protocol runs on each switch and is used to select a single path between any two switches.
Without the spanning tree protocol, switches that are connected together with multiple links would form a switching loop, where frames are passed back and forth continuously.
Spanning tree provides only a single active path between switches. Switch ports that are part of that path are placed in a forwarding state.
Switch ports that are part of redundant but unused paths are placed in a blocking (non-forwarding) state.
When an active path goes down, the spanning tree protocol automatically recovers and activates the backup ports necessary to provide continued connection between devices.
Spanning tree provides fault tolerance in case a switch port or network segment is broken, but does not provide increased performance (because only one path is active at a time). |
|
|
Term
|
Definition
| Common Address Redundancy Protocol (CARP) is an implementation of fault tolerance which allows multiple firewalls and/or routers on the same local network to share a set of IP addresses. If one of the firewalls or routers fails, the shared IP address allows host to continue communicating with or through the firewall or router without interruption. |
|
|
Term
|
Definition
A traffic shaper (also called a bandwidth shaper) is a device that is capable of modifying the flow of data through a network in response to network traffic conditions. Specific applications for a traffic shaper include:
A device used with QoS guarantees to ensure timely delivery of time-sensitive data streams.
Bandwidth throttling to restrict the amount of data sent within a specific time period, such as to limit the amount of data that can be downloaded from a Web site in an hour.
Rate limiting to restrict the maximum bandwidth available to a customer (used by an ISP or a WAN provider). |
|
|
Term
|
Definition
Smart jack - Used by an ISP to test local loop.
Time Domain Reflector (TDR) - The TDR measures the echo received on the same wire in response to a signal on the wire. Measures impedance, length, location of shorts.
Certifier - verifies throughput
Toner probe - to trace a wire using a tone. Used on punchdowns.
Butt set - lineman's handset |
|
|
Term
| Common troubleshooting commands. |
|
Definition
Tool Option(s)
ARP arp -a shows the IP address-to-MAC address mapping table (the address cache)
netstat netstat shows the active connections
netstat -a shows detailed information for active connections
netstat -r or route print shows the routing table of the local host
netstat -s shows TCP/IP statistics
nbtstat nbtstat -c shows the IP address-to-NetBIOS name mapping table (the name cache) |
|
|
