Chapter 4: Network Protocols and Routing
True
IP is an unreliable, connectionless protocol, as it does not establish a session to send its packets.
False
IPv4 and IPv6 use the same packet format.
True
The cost of upgrading infrastructure has been a major factor in the slow adoption of IPv6.
Ethernet II
The current Ethernet standard. Ethernet II is distinguished from other Ethernet frame types in that it contains a 2-byte type field to identify the upper-layer protocol contained in the frame
Latency
The delay between the transmission of a signal and its receipt.
BGP (Border Gateway Protocol)
Dubbed the "protocol of the Internet," this path-vector routing protocol is the only current EGP and is capable of considering many factors in its routing metrics.
Traceroute
A TCP/IP troubleshooting utility available in Linux, UNIX, and macOS systems that sends UDP messages to a random port on the destination node to trace the path from one networked node to another, identifying all intermediate hops between the two nodes.
netstat
A TCP/IP troubleshooting utility that displays statistics and the state of current TCP/IP connections. It also displays ports, which can signal whether services are using the correct ports.
default route
A backup route, usually to another router, used when a router cannot determine a path to a message's destination.
route command
A command-line tool that shows a host's routing table.
ARP (Address Resolution Protocol)
A core protocol in the TCP/IP suite that belongs in the Network layer of the OSI model. ARP obtains the MAC (physical) address of a host, or node, and then creates a local database that maps the MAC address to the host's IP (logical) address.
ARP table
A database of records that maps MAC addresses to IP addresses. The ARP table is stored on a computer's hard disk where it is used by the ARP utility to supply the MAC addresses of network nodes, given their IP addresses.
routing table
A database stored in a router's memory that maintains information about the location of hosts and best paths for forwarding packets to them.
tcpdump
A free, command-line packet sniffer utility that runs on Linux and other UNIX operating systems
AS (Autonomous System)
A group of networks, often on the same domain, that are operated by the same organization.
IS-IS (Intermediate System to Intermediate System)
A link-state routing protocol that uses a best-path algorithm similar to OSPF's. IS-IS was originally codified by ISO, which referred to routers as "intermediate systems," thus the protocol's name. Unlike OSPF, IS-IS is designed for use on interior routers only.
Checksum
A method of error checking that determines if the contents of an arriving data unit match the contents of the data unit sent by the source.
Dynamic Routing
A method of routing that automatically calculates the best path between two networks and accumulates this information in a routing table. If congestion or failures affect the network, a router using dynamic routing can detect the problems and reroute data through a different path. Modern networks primarily use dynamic routing.
CSMA/CD (Carrier Sense Multiple Access with Collision Detection)
A network access method specified for use by IEEE 802.3 (Ethernet) networks. In CSMA/CD, each node waits its turn before transmitting data to avoid interfering with other nodes' transmissions.
AD (administrative distance)
A number indicating a protocol's reliability, with lower values being given higher priority. This assignment can be changed by a network administrator when one protocol should take precedence over a previously higher-rated protocol on a network.
Neighbor Discovery
A process whereby routers learn about all of the devices on their networks. On IPv4 networks, this process is managed by ARP with help from ICMP. On IPv6 networks, NDP (Neighbor Discovery Protocol) automatically detects neighboring devices and automatically adjusts when nodes fail or are removed from the network.
dynamic ARP table entry
A record in an ARP table that is created when a client makes an ARP request that cannot be satisfied by data already in the ARP table.
static ARP table entry
A record in an ARP table that someone has manually entered using the ARP utility. Static ARP table entries remain the same until someone manually modifies them with the ARP utility.
Edge Router
A router that connects an autonomous system with an outside network—for example, the router that connects a business to its ISP
border router
A router that connects an autonomous system with an outside network—for example, the router that connects a business to its ISP. Also called edge router.
exterior router
A router that directs data between autonomous systems, for example, routers used on the Internet's backbone.
Core Router
A router that directs data between networks within the same autonomous system.
interior router
A router that directs data between networks within the same autonomous system. Also called core router.
hybrid routing protocol
A routing protocol that exhibits characteristics of both distance-vector and link-state routing protocols.
Jumbo Frame
A setting on Ethernet network devices that allows the creation and transmission of extra-large frames, as high as 9198 bytes, depending on the type of Ethernet architecture used.
protocol analyzer
A software package or hardware based tool that can capture and analyze data on a network.
Layer 3 switch
A switch capable of interpreting Layer 3 data and works much like a router in that it supports the same routing protocols and makes routing decisions.
Layer 4 switch
A switch capable of interpreting Layer 4 data, which means it can perform advanced filtering, keep statistics, and provide security functions.
Static Routing
A technique in which a network administrator programs a router to use specific paths between networks.
three-way handshake
A three-step process in which Transport layer protocols establish a connection between nodes. The three steps are: Node A issues a SYN packet to node B, node B responds with SYN-ACK, and node A responds with ACK.
link-state routing protocol
A type of routing protocol that enables routers to share information beyond neighboring routers, after which each router can independently map the network and determine the best path between itself and a message's destination node.
EIGRP (Enhanced Interior Gateway Routing Protocol)
A type of routing protocol used by edge routers and exterior routers to distribute data outside of autonomous systems. BGP is the only modern example of an exterior gateway protocol.
IGP (Interior Gateway Protocol)
A type of routing protocol, such as OSPF and IS-IS, used by interior routers and border routers within autonomous systems.
routing cost
A value assigned to a particular route as judged by the network administrator; the more desirable the path, the lower its cost.
D
You have been tasked with the replacement of OSPF with EIGRP throughout your organization, which consists of a mixture of Cisco routers and routers from other vendors. What statement is accurate? A. Increased traffic will result from the switch to EIGRP. B. EIGRP will increase CPU utilization on core routers. C. Convergence time will be increased with EIGRP. D. EIGRP may not be available on non-Cisco routers.
distance-vector routing protocol
The simplest type of routing protocols; used to determine the best route for data based on the distance to a destination. Some distance-vector routing protocols only factor in the number of hops to the destination, while others take into account latency and other network traffic characteristics.
convergence time
The time it takes for a router to recognize a best path in the event of a change or network outage.
hop
The trip a unit of data takes from one connectivity device to another. Typically, hop is used in the context of router-to-router communications.
B
Which routing protocol started as a Cisco proprietary protocol and combines some of the features of a link-state protocol with that of distance-vector protocols? A. BGP B. EIGRP C. OSPF D. IS-IS
B
Which statement does NOT accurately describe characteristics of the OSPF protocol? A. OSPF provides low network overhead. B. OSPF requires very little CPU or memory resources. C. OSPF has no hop limits on a transmission path. D. OSPF maintains a database of other routers' links.
B
Which statement regarding the Border Gateway Protocol (BGP) is accurate? A. BGP is limited to a single autonomous system. B. BGP utilizes TCP for communicating updates. C. BGP is exclusively a distance-vector protocol. D. BGP is a more advanced version of OSPF.
A
Which traceroute command will perform a trace using ICMP echo requests instead of UDP datagrams to the host srv1.mycompany.com? A. traceroute -I srv1.mycompany.com B. traceroute -w srv1.mycompany.com C. traceroute -i srv1.mycompany.com D. traceroute -o ICMP srv1.mycompany.com
C
You are connected to your network's Cisco router, and need to verify the route table. What command should you enter? A.route print B. route -a C. show ip route D. show route-table
D
You have been tasked with maintaining a network that is jumbo frame enabled. What does this mean? A. The network is not based on the Ethernet standard B. The MTU for the network is set at 65,535 bytes. C. Fragmented frames will be consolidated into whole frames before being sent. D. The MTU for the network can be as high as 9198 bytes.
ICMP and ARP
10. Which two protocols manage neighbor discovery processes on IPv4 networks? a. ICMP and ARP b. IPv4 and IPv6 c. TCP and UDP d. BGP and OSPF
TCP is Connection-oriented, sequencing and checksum, and flow control.
11. What three characteristics about TCP distinguish it from UDP?
TCP Three-Way Handshake
12. What process is used to establish a TCP connection?
Dynamic ARP table entries are created when a client makes an ARP request for information that could not be satisfied by data already in the ARP table; once received, the new information is recorded in the table for future reference. Static ARP table entries are those that someone has entered manually using the ARP utility.
13. What is the difference between dynamic ARP table entries and static ARP table entries?
Preamble and SFD
14. Which two fields in an Ethernet frame help synchronize device communications but are not counted toward the frame's size?
1,500 bytes
9. What is the Internet standard MTU? a. 65,535 bytes b. 1,522 bytes c. 1,500 bytes d. 9,198 bytes
pathping
A Windows utility that combines the functionality of the tracert and ping utilities to provide deeper information about network issues along a route; similar to UNIX's mtr command.
tracert
A Windows utility that uses ICMP echo requests to trace the path from one networked node to another, identifying all intermediate hops between the two nodes.
OSPF (Open Shortest Path First)
An IGP and link-state routing protocol that makes up for some of the limitations of RIP and can coexist with RIP on a network.
RIP (Routing Information Protocol)
An updated version of the original RIP routing protocol that generates less broadcast traffic and functions more securely than its predecessor. However, RIPv2's packet forwarding is still limited to a maximum 15 hops.
A
What IPv6 field is similar to the TTL field in IPv4 packets? A. hop limit B. flow label C. next header D. distance vector
SMTP
Simple Mail Transfer Protocol
EGP (Exterior Gateway Protocol)
The protocol responsible for exchanging routing information between two neighboring gateways.
False
UDP provides error checking, but not sequencing.
probe
(1) A repeated trial message transmitted by the tracert and traceroute utilities to trigger routers along a route to return specific information about the route. (2) A small electronic device that emits a tone when it detects electrical activity on a wire pair. When used in conjunction with a tone generator, it can help locate the termination of a wire pair. Also called a tone locator. (3) In 802.11 wireless networking, a type of frame issued by a station during active scanning to find nearby access points.
TCP
1. Which protocol's header would a Layer 4 device read and process? a. IP b. TCP c. ARP d. HTTP
Connect dissimilar networks, such as a LAN and a WAN, which use different types of routing protocols. Interpret Layer 3 and often Layer 4 addressing and other information (such as quality of service indicators). Determine the best path for data to follow from point A to point B. The best path is the most efficient route to the message's destination calculated by the router, based upon the information the router has available to it. Reroute traffic if the path of first choice is down but another path is available.
15. What four functions do all routers perform?
Routing table which maintains information about where the hosts are located.
16. What database does a router consult before determining the most efficient path for delivering a message?
Hop count MTU (maximum transmission unit) Routing cost
17. Give three examples of routing metrics used by routers to determine the best of various available routing paths.
RIP, RIPv2 OSPF IS-IS
18. List three IGPs (interior gateway protocols).
Tcpdump
19. Which Linux utility provides output similar to Wireshark's?
Checksum
2. What field in a TCP segment is used to determine if an arriving data unit exactly matches the data unit sent by the source? a. Source port b. Acknowledgment number c. DiffServ d. Checksum
NDP (Neighbor Discovery Protocol)
20. Which protocol is supported by ICMPv6 to facilitate neighbor discovery on an IPv6 network?
Network layer
3. At which OSI layer does IP operate? a. Application layer b. Transport layer c. Network layer d. Data Link layer
Network layer
4. Which OSI layer is responsible for directing data from one LAN to another? a. Transport layer b. Network layer c. Data Link layer d. Physical layer
Static route
5. What kind of route is created when a network administrator configures a router to use a specific path between nodes? a. Trace route b. Static route c. Default route d. Best path
Gateway of last resort
6. When a router can't determine a path to a message's destination, where does it send the message? a. Default gateway b. Routing table c. Administrative distance d. Gateway of last resort
AD
7. A routing protocol's reliability and priority are rated by what measurement? a. Routing table b. MTU c. Latency d. AD
BGP
8. Which routing protocol does an exterior router use to collect data to build its routing tables? a. RIPv2 b. BGP c. OSPF d. IP
A
By default, what is the MTU size on a typical Ethernet network? A. 1500 bytes B. 1492 bytes C. 1518 bytes D. 1522 bytes
C
If the VLAN tag is present in an Ethernet frame, what is the maximum frame size? A. 1492 bytes B. 1518 bytes C. 1522 bytes D. 1500 bytes
collision
In Ethernet networks, the interference of one node's data transmission with the data transmission of another node sharing the same segment.
B
In IPv6, what field is used to indicate what sequence of packets from one source to one or multiple destinations a packet belongs to? A. traffic class B. flow label C. group ID D. traffic exchange
B
In a TCP segment, what field indicates how many bytes the sender can issue to a receiver before acknowledgment is received? A. URG flag B. sliding-window C. PSH flag D. urgent pointer
True
In general, a Layer 3 or Layer 4 switch is still optimized for fast Layer 2 data handling.
C
In the event of a duplicate MAC address shared by two hosts on a switched network, what statement is accurate? A. The hosts that share the same MAC addresses will be completely unable to communicate with any other devices. B. The hosts will generate new MAC addresses until the conflict is resolved. C. The hosts will still send and receive traffic, but traffic may not always reach the correct destination. D. The network switch will eventually crash due to being unable to properly forward traffic.
A
Originally codified by ISO, what does the "intermediate system" in IS-IS (Intermediate System to Intermediate System) stand for? A. An IS-IS capable network router. B. The autonomous systems used by an organization. C. An entire network consisting of various network devices. D. The administrative boundaries of an organization.
routing metric
Properties of a route used by routing protocols to determine the best path to a destination when various paths are available. Routing metrics may be calculated using any of several variables, including hop count, bandwidth, delay, MTU, cost, and reliability.
False
Routing Information Protocol (RIP) is an interior gateway protocol that uses a link-state algorithm.
B
Routing protocols that enable routers to communicate beyond neighboring routers, allowing each router to independently map the network, are known as which type of protocols? A. border gateway protocols B. link-state protocols C. distance vector protocols D. interior gateway protocols
SLI
Scalable Link Interface or System Level Integration or Scanline Interleave Mode
S.M.A.R.T
Self-Monitoring, Analysis, and Reporting Technology
SMB
Server Message Block or Small to Midsize Business
SNMP
Simple Network Management Protocol
SEC
Single Edge Connector
SFF
Small Form Factor
SOHO
Small Office/Home Office
SoDIMM
Small Outline Dual Inline Memory Module
packet sniffer
Software or hardware used to collect data travelling over a network.
SFC
System File Checker
False
TCP uses a four-step process called a four-way handshake to establish a TCP connection.
True
The Border Gateway Protocol is considered to be a hybrid routing protocol.
False
The CTRL + S key combination can be used to stop an actively running command.
A
The IP connectionless protocol relies on what other protocol to guarantee delivery of data? A. TCP B. ARP C. UDP D. ICMP
Spoofing
The act of impersonating fields of data in a transmission, such as when a source IP address is impersonated in a DRDoS attack.
MTU (maximum transmission unit)
The largest IP packet size in bytes allowable by routers in a path without fragmentation and excluding the frame size.
Routing Protocols
The means by which routers communicate with each other about network status. Routing protocols determine the best path for data to take between networks.
best path
The most efficient route from one node on a network to another, as calculated by a router. Under optimal network conditions, the best path is the most direct path between two points. However, when traffic congestion, segment failures, and other factors create obstacles, the most direct path might not be the best path.
Hop Limit
The number of times that an IPv6 packet can be forwarded by routers on the network; similar to the TTL field in IPv4 packets.
False
The pathping utility sends 10 pings per hop by default.
Collision Domain
The portion of an Ethernet network in which collisions could occur if two nodes transmit data at the same time. Today, switches and routers separate collision domains.
gateway of last resort
The router on a network that accepts all unroutable messages from other routers.
Internetwork
To traverse more than one LAN segment and more than one type of network through a router.
A
What command will list only current connections, including IP addresses and port numbers? A. netstat -n B. netstat -s C. portstat D. show ip stats
A
What field in an IPv4 packet informs routers the level of precedence they should apply when processing an incoming packet? A. Differentiated Services (DiffServ) B. Internet header length (IHL) C. Time to Live (TTL) D. Padding
D
What happens when a router receives a packet with a TTL of 0? A. The router attempts to forward the traffic on a local network. B. The router marks the packet as corrupted and forwards it to the next hop. C. The router resets the TTL to 128. D. The router drops the packet and sends an ICMP TTL expired message back to the host.
A
What is NOT one of the three characteristics of TCP in its role as a reliable delivery protocol? A. Framing B. Sequencing and checksums C. Flow Control D. Connection-oriented Protocol
D
What is routing protocol convergence time defined as? A. It is the amount of time involved in configuration of the routing protocol. B. It is the amount of time it takes after initial configuration of the protocol for all routes to become known. C. It is the time it takes for the protocol to recognize that a change has occurred. D. It is the time it takes for the protocol to recognize the best path in the event of a network change.
A.
What is the purpose of the checksum TCP field? A. It allows the receiving node to determine whether the TCP segment became corrupted during transmission. B. It confirms receipt of data via a return message to the sender. C. It identifies the data segment's position in the stream of data segments being sent. D. It specifies special options, such as the maximum segment size a network can handle
B
What occurs when a collision happens on a network? A. Each node on the network stops transmitting, until manually told to reconnect and transmit. B. Each node on the network waits a random. amount of time and then resends the transmission C. The collision will create an error in the network switch, but otherwise, no issues will occur as a result. D. The collision goes undetected, and data transmission continues.
D
What routing metric affects a path's potential performance due to delay? A. load B. theoretical bandwidth C. MTU D. latency
C
What statement regarding the differences between the Windows tracert utility and the Linux/UNIX/macOS traceroute utility is accurate? A. Only tracert can send UDP messages for tracing a path. B. The Windows tracert utility does not place limits on the TTL of repeated trial messages. C. By default, the tracert utility uses ICMP echo requests, while traceroute uses UDP datagrams or TCP SYN messages. D. The tracert utility expects an ICMP port unreachable error message as the final reply to a trace.
B
What tcpdump command can be used to filter out all traffic except SSH traffic? A. tcpdump -f +ssh B. tcpdump port 22 C. tcpdump only ssh D. tcpdump -p 22
A
What utility is the equivalent to the pathping command on a Linux system? A. mtr B. traceroute C. hping D. tracepath
D
When using the Routing Information Protocol (RIP), what is the maximum number of hops a message can take between its source and its destination before the destination is considered unreachable? A. 20 B. 8 C. 32 D. 15
B
Which command will produce statistics about each message transmitted by a host, separated according to protocol type? A. netstat -an B. netstat -s C. ipstat -a D. ipconfig -s
D
Which of the following is not a task handled by a router? A. A router can interpret Layer 3 and often Layer 4 addressing. B. A router can connect dissimilar networks. C. A router can reroute traffic if the path of first choice is down but a second path is available. D. A router forwards broadcasts over the network.
