Network + Chapter 7

DNS Servers

*If you are configuring static IP addresses, including the IP address of the default DNS servers as you configure each client. *If you are using DHCP, use the DHCP scope options to specify the IP addresses of the default DNS servers.

DHCP Lease Process

1) Discover: once a node comes online and loads a simple version of TCP/IP and it's ready to communicate with a DHCP server, it transmits a broadcast called a DHSP discover to the network's broadcast address of 255.255.255.255 to see if any DCHP servers are online and then request an IP address. 2) Offer: DHCP servers that are online respond with a directed lease offer packet that contains an IP address that the node can lease. 3) Request: the node accepts the first offer it receives and return a request to lease the IP address from the DHCP server, called a DHCP request 4) Achnowledge: The DHCP server acknowledges the request from the node with a DHCP ACK, which has the IP address and settings required for the leasing time and starts the lease. The DHCP server also updates the IP address in its database as being in use, to avoid reassigning the address.

Send data to over a TCP/IP network requires 4 steps

1) The Application layer encodes the data being sent 2) The Transportation layer splits the data into manageable chunks and adds port number information 3) the Internet layer adds IP addresses stating where the data is from and where it is going 4) The Network Access layer adds MAC address information to specify which hardware device the message came from and which hardware device the mediate is going to.

Telnet is defined in REFC 854, and uses the following defaults

1) Uses TCP Port 23; however, you can specify a different port if the host to which you are connecting is configured to use a different port. 2) Uses 25 lines in the buffer, but you can configure it for up to 399 lines 3) Uses VT100 as the default terminal emulation, but some versions allow you to configure your system with VT220, VT52 and TTY terminal emulation support.

IMAP4 can

1) a user can check an email header and also look for a specific string of characters in the contents of a message before downloading it. 2) Messages can also remain on the server while the client works with them as if they were local. 3) users can search through messages by keywords and choose which messages to download locally 4) Messages in the user's mailbox can be marked with different status flags, such as deleted or replies to. The mediates and their status flags stay in the mailbox until explicitly removed by the user. 5) An email message containing multimedia files can be partially downloaded, saving bandwidth. 6) A user can create, rename, or delete mailboxes on a nail server, and also arrange mailboxes in a hierarchical manner in a folder for email storage. 7) Unlike POP3, IMAP4 enables users to access folders other than their mailbox.

ANS- Authoritative Name Server

A DNS server that possesses an actual Cory of the records for a zone, as opposed to just caching a lookup from another DNS server.

Daemon

A background process that performs a specific operation. Daemon is a UNIX term, though daemons are supported on the other operating systems.

SMTP Simple Mail Transfer Protocol

A communication protocol for formatting and sending email messages from a client to a server or between servers. Application layer (layer 7) of the OSI model and the Application layer of the TCP/IP model. Uses Port 25 and 587 for standard communication and port 465 for encrypted communication. Runs on TCP. Uses a store-and-forwarded process.

Domain

A grouping of devices on the Internet or on another network based on the nature of their operations. Communication between this systems as a unit and other networks on the Internet, instead of maintaining individual connections for each of its systems. Domains are indemnified by their unique names; for example, com, gov, and edu.

Secure Shell SSH

A program that enables a user or an application to log on to another device over a network, execute commands, and manage files. SSH operates at the Application Layer (Layer 7) of the OSI model and the Application layer of the TCP/IP model. Port 22 and runs on TCP. *slogin command, the login session, including the password, is encrypted and protected again attacks. works with many different operating systems, including Windows, UNIX and Macintosh. Windows does not pride a native SSH client. Will have to down load and install an SSH client suck as PuTTY, WinSCP, or Teraterm Pro with the TTSSH extension * Two versions of Secure She'll available: SSH1 and SSH2

HTTPS HTTP Secure

A secure version of HTTP that provides a secure connection between a web browser and a server. Application layer (Layer 7) of the OSI model of the Application layer of the TCP/IP model. Uses a Secure Sockets Layer (SSL) security protocol to encrypt data.

APIPA Automatic Private IP Address.

A service that enables a DHCP client deceive to configure itself automatically with an IP address in the range of 169.254.0.1 to 169.254.255.254, in case no DHCP servers respond to the client's DHCP discover broadcast. DHCP failure, when the clients on the network cannon obtain IP addresses, the client can use APIPA to assign themselves an IP address in the 169.154.x.x address range to enable communication with other clients. Common usage is as a diagnostic tool.

Telnet Telecommunications Network

A terminal emulation protocol that enables users at one site to simulate a session on a remote host as if the terminal were directly attached. Translating keystrokes from the user's terminal into instructions that the remote host recognizes, and then carrying the output back and displaying in a format native to the user's terminal. Layer 7 of the OSI model and the Application layer of the TCP/IP model. Port 23 and runs on TCP.

-a

Allow use of any local interface during data connection binding

SNMP Simple Network Management Protocol

An Internet protocol that enables administrators to monitor and manage network devices and traffic. Working Application Layer (Layer 7) of the OSI model and the Application layer of the TCP/IP model. Uses ports 161 and 162. Collect information from and send configuration commands to networking devices such as routers, switches, servers, workstations, printers, and any other SNMP -enabled devices. Generally runs over UDP.

Socket

An identifier for an application process on a TCP/IP network. It is the combination of the IP address (or host name) and port number. Standard interface between a Windows TCP/IP client application and the underlying TCP/IP protocol stack. The Berkeley sockets interface is the interface between the TCP/IP based network and the network application that use it.

Name Server (NS)

Assigns a DNS zone to access the given authoritative name servers.

APIPA Support

Available on client systems including: Windows 7 and Windows 8 and server operating system including: Windows 2008, Windows 2008 R2, Windows 2012 and Windows 2012 R2 as well as Macintosh. Requires no administrative configuration. Used for small offices where local subnet communication is all that is required. APIPA cannon assign the affects of the default gateway or DNS server.

ping

Command is used to verify the network connectivity of a device, and also to check to see if the target device is active. Verifies the IP address, host name, and reach ability of the remote device by using and listening for echo replicas. Ping uses ICMP to check the connections with remote hosts by sending out echo request as ICMP ECHO_REQUEST packets to the host whose name or IP address you specify on the command line. Ping listens for reply packets.

pathping

Command provides information about latency and packet loss on a network. Combines the functionality of the ping and tracert commands. ping, pathping sends multiple ICMP echo request messages to each router between two hosts over a period of time, and then displays results based the number of packets returned by each router. Identifies the routes that are on the path. Maximum of 30 hops. Transfer between the hosts in a time span of over 25 seconds. System name and their IP addresses. Can be used to isolate a router or subnet with issues as it can display the degree f packet loss at any given router or link.

IP assesses Recovery

DHCP server can recover addresses leased to offline clients that no longer need the addresses.

DNS Components

DNS database is divided logically into a heieratchical grouping of domains. Physically into files called zones. Zone files contain the actual IP-to-host name mapping for one or more domains. Zone files is stored on the DNS server that is responsible for resolving hot names for the domains contained in the zone. Each network node in that domain will have a host record within the domain's zone files. Includes the node's host name, FQDN, and assigned IP address.

DNS Hierarchy

DNS name are built in a hierarchical structure. Top level domain Neva, then the first-level domain name, and so on, until the FQDN for an individual host is complete.

pathping options

Descriptions

tracert options

Descriptions

tracert command

Determines the route data takes to get to a particular destination. Node sends out messages with incrementally increasing TTL values. ICMP "Time Exceeded" messages are then send back from the routers to the note running tracert. TTL value is reduced before the packet is forwarded. TTL to count how many hops it is away from the destination

-i

Disable interactive prompting when transferring multiple files.

-g

Disable wildcard character support

ifconfig

Display the status of currently active network interface devices. Using options, you can dynamically change the status of the interfaces and their IP address. Supported on Linux and UNIX

ipconfig

Displays connection-specific DNS suffix, IP address, subnet mask and default gateway information. Also use ipconfig /all

Assign IP addressing

Each node needs an IP address to communicate on a TCP/IP netowrk. Administrator can manuallu assign these IP address. Can be done automaticall without manual interverntion.

SSH1

Employs user keys to identify users; host keys to identify systems; session keys to encrypt communication in a single session; and server keys, which are temporary keys that protect the session key

DHCP options

Enable you to configure specific values such as the address of the default gateway, the DNS server, the domain name suffix of the interface, and other IP-related information, relieving the administrator from having to manually configure

-d

Enables debugging, displaying all commands passed between the FTP client and server.

dhclient

Enables you to configure and manage DHCP settings on the network interfaces of a computer. Supported on Linix and UNIX

ipconfig /release

Forces the release of an IP address used by a client.

Global options Scope Options Class Options Reserved Client ooptions

Globally for all DHCP servers and their clients To clients that obtain leases within a particular scope To clients that specify a class when obtaining a scope lease To any client with a scope reservation for its IP address

-w timeout

If many of your responses on the tracert are timing out, by using the -w option, you can increase the number of milliseconds to wait before continuing,

Step 5: Other domain servers

If the top-level domain cannot resolve the name because of additional levels in the FQDN, it sends the IP address to the second-level DNS server

DNS Domain Name Service

Is a TCP/IP name resolution service that translates FQDNs into IP addresses. System of hierarchical databases that are stored on separate DNS servers on all networks that connect to the Internet. DNS servers store, maintains and update databases, they respond to DNS client name resolution requests to translate host names into IP addresses.

File Transfer Protocol

Is a TCP/IP protocol that enables the transfer of files between a user's workstation and a remote host. May need to be installed on the client. FTP commands must be entered in lowercase and are available both as Windows command-line and UNIX commands. Works on Application Layer 7 or the OSI model and the Application layer of the TCP/IP model.

DHCPv6

Is a network protocol for configuring IPv6 hosts with IP addresses, IP prefixes and other configuration data required to operate in an IPv6 network. It is the IPv6 equivalent of DHCP for IPv4 networks. May automatically generate IP addresses internally using stateless address autoconfiguration, or they may be assigned configuration data to with DHCPv6

HTTP Hypertext transfer Protocol

Is a network protocol that works on the Application layer (Layer 7) of the OSI model and the Application Layer of the TCP/IP model to provide web services. Uses port 80. Data is encoded and decoded using XML.

DHCP Dynamic Host Configuration Protocol

Is a network service that automatically assigns IP addresses and other TCP/IP configuration information on network nodes configured as DHCP clients. Server allocates IP addresses to DHCP clients dynamically. Should be configured with at least one DHCP scope. Scope contains a range of IP addresses and a subnet mask, and can contain other options, such as a default gateway and Domain Name System. Scope also needs to specify the duration of the lease and usage of an IP affects after which the node needs to renew the lease with the SHCP server. Determines the duration, which can be set for a defined time period or for an unlimited length of time.

Ports

Is a number that represents a process running on a network. Advocated with OSI Layer 5, but in every packet, there will be both a source and destination port embedded in the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) header. All ports are assigned a number in a range from 0 to 65,535. Internet Assigned Number Authority (IANA) separates port numbers into three blocked: Weel-known ports, which are preassigned to system processes by IANA; registered ports, which are available to user processes and are listed as a convenience by IANA.

HOSTS file

Is a plaintext file configured on a client device containing a list of IP addresses and their associated host names, separated by at least one space. HOST file provides an alternative method of host name resolution. A device will aways consult its HOSTS file first to see it the desired IP address is there before querying a DNS server. File requires a lot of maintenance, so it is recommended that you use it only when other methods of host name resolution are not supported, or temporarily unavailable for troubleshooting purposes.

SMB Server Message Block

Is a protocol that works on the Application layer ( Layer 7) of he OSI model and helps share resources such as files, printers, and serial ports among devices. SMB uses port 445 and runs on TCP.

IMAP4 Internet Message Access Protocol version 4

Is a protocol used for retrieving messages from a mail server. IMAP4 works at the Application layer (layer 7) of the OSI model and the application layer of theTCP/IP model.

DHCP Relay Agent

Is a service that captures a BOOTP or DHCP broadcast and forwards it through the router as a unicast transmission to the DHCP server on another subnet. Uses a local broadcast that cannot be sent through routers on the network. You must wither have a DHCP server on each subnet and configure the router to forwarded the broadcasts, or configure a DHCP relay agent. Ensure a higher degree of faulty tolerance as the unavailability of a DHCP server on a subnet does not prevent nodes from requesting or renewing their leases. Internet Protocol Helper (IP Helper) is API used by C and C++ programmers t retrieve and modify network configuration settings on the local computer.

TFTP trivial file transfer protocol

Is a simple version of FTP that uses UDP as the transport protocol, and does not require logon to the remote host don't not support error correction but provides for higher data integrity. Use for bootstrapping and loading applications and not for file transfer. FTP traffic is not encrypted and all transmissions are in clear text. User name, passwords, commands, and data to can be read by anyone able to perform packet capture (sniffing)on the network. Browsers can support FTP in a graphical user interface mode. Site can be made by browsing the Internet, logging on, and connecting. Can drag files on and off the FTP side he same way you would from file explorer.

NetBIOS

Is a simple, broadcast-based naming service. Name can be any combination of alphanumeric characters excluding spaces and the following characters /:*?;\|. WINS is an implementation of he NetBIOS Name Service. (NBNS)

NTP Network Time Protocol

Is an Internet protocol that synchronizes the clock times of devices in a network by exchanging time signals. Works on the Application Layer (Layer 7) of the OSI model and the Application layer f the TCP/IP model. Running continuously in the background on a device, NTP sends periodic time requests to servers t obtain the server time stamp and then adjusts the client's clock braces on the server time stamp received.

Primary and Secondary DNS Servers

Is common to specify both a primary and a secondary DNS server to provide a more reliable name resolution process. When two DNS servers are listed in a client's TCP/IP settings, the client queries the primary server first.

Network Firewall

Is configured to not allow a tracert or ping through, you might not be able to trace the route all the way to then end; it might appear to end at the firewall. "Destination Unreachable" a router is not able to figure out how to get to the next destination.

GNU General Public License

Is responsible for licensing and distributing MTR

TCP/IP Protocol Stack

Is the collection of protocols that work together to provide communications on IP-based networks such as the Internet.

SOA- Start of Authority

Is the first DNS server to create the zone. Typically the primary DNS server, meaning that it holds the only writable copy of the zone.

SOAP

Is used to transport the data via open protocol

-d

Is you are having trouble resolving host names when using tracert, use -d option to prevent tracert from trying to resolve host names. Speeds up response time.

DHCP Reservation

Lease assignments in SHCP that enable you to configure a permanent IP address for a particular client on the subnet. based on the client's media access control (MAC) address. Reserved IP address differ from statically configured IP addresses; when there are any changes in network parameters on the DHCP server, IP address receive the changes when they renew their leases.

Address (A)

Makes a host name to its IP address by using a 32-bit IPv4 address

Mail Exchanger (MX)

Maps a domain name to a email server list

IPv6 Address(AAAA)

Maps a host name to its IP address by using a 128-bit IPv6 address

Pointer (PTR)

Maps an IP address to the host name for the purpose of reverse lookup

Canonical Name (CNAME)

Maps multiple canonical names (aliases) to an A record

SSH2

More secure; it does not use server keys; SSH2 includes a secure replacement for FTP called Secure File Transfer Protocol. All traffic (including passwords) is encrypted by SSH to eliminate connection hijacking. Eavesdropping and other network-level attacks, such as IP source routing, IP spoofing and DNS spoofing.

FQDN- Fully Qualified Domain Name

Name resolution device maps the FQDN of the node to its IP address so that users can use names instead of IP addresses to communicate with other network nodes and the Internet. Written standard dot-delimited notation, and a dot separates each section of the name. Length of an FQDN is 255 characters. Each dot-delimited section can be up to 63 characters long. Have more than one host name assigned to it. Primary name is its hot name; the other names are called canonical names (CNAMEs), or aliases.

-w: [windowsize]

Override the default transfer buffer size

Packet count- Specifies the number of packets with which a remote host is pinged. The default is four packets. You can specify a higher number of packets with the -n option.

Ping target [-n packet count]

Well-Known Ports

Port range: 0 to 1,023 Ports are preassigned for use by common, or well-known, services. Often, the services that run on these ports must e started by a privileged user. Services in this range include Hypertext Transfer Protocol (HTTP) on TCP port 80, Internet Message Access Protocol (IMAP) on TCP port 143, and DNS on UDP port 53.

Registered Prots

Port range: 1,024 to 49,151 These ports are registered by software makers for use by specific applications and services that are not as well-known as the services in the well-known range. SErvices in the registered port range include Socket Secure (SOCKS) proxy on TCP port 1080, and Xbox live on TCP and UDP port 3074.

Dynamic or Private ports

Port range: 49,152 to 65,535 These ports are set aside for use by unregistered services needing a temporary connection.

-v

Prevent remote server command responses being shown

RDP Remote Desktop Protocol

Proprietary protocol created by Microsoft for connecting to and managing deceives that are not necessarily located at the same place as the administrator. It uses port 3389, runs on TCP, and works on the Application Layer (Layer 7) of the OSI model. Is a multichannel capable protocol that allows for separate virtual channels for carrying device communication and presentation data from the server

Types of DNS Records Record Type

Purpost

ipconfig /renew

Requests the renewal of an IP address for a client.

Static IP Address Assignment

Requires that an administrator visit each node to manually enter IP address information for that node. Node moves to a different subnet. , the administrator must manually reconfigure the node's TCP/IP information for its new network location. Static address are typically assigned only to systems with a dedicated functionality, such as router interface, network-attached printers, or servers that host applications on a network.

-s: [filename]

Run all the FTP commands contained in the [filename] file

POP3 Post Office Protocol 3

So a protocol used to retrieve email mediates from a mailbox on a mail server. POP3 works at the Application layer (Layer 7) of the OSI model and the Application layer of the TCP/IP model. POP3 uses port 110 for regular transmission and port 195 for encrypted transmissions and it runs on TCP. Is designed by default to download messages to the local device and delete them from the email server, is not the best email protocol to use when users need to access their email from multiple devices. Leave their mediates on the server, they will have to delete old messages manually to avoid exceeding mailbox size limits, which may also lead to messages being split across multiple devices.

ICMP Clocking

Some public Internet hosts and routers might be configured to clock incoming packets that are generated by the ping command. Might also clock packets from other TCP/IP diagnostic utilities suck as the tracery command

Service Locator (SRV)

Specifies a generic service location record for newer protocols.

Start of Authority (SOA)

Specifies authoritative information about a DNS zone

-i

Specify a source IP address

-n

Specify that host name resolution can be skipped

-4 address

Specify the IPv4 addresses that are to be used

-6 address

Specify the IPv6 addresses that are to be used

-h Maximum hops

Specify the maximum number of hops to locate a destination

-n

Suppress auto-logon at initial connection

Step 1: Client request

The DNS request is passed to a DNS client service for resolution by using locally cached information on the client.

Step 2: Preferred DNS server

The DNS server, upon receiving the request, first checks if the requested name is in its DNS cache in tires or its local DNS database, and returns the IP afresh to the client. If there is no match for the requested name, the DNS server sends the request to a root name server asking which DNS server has the entires for the appropriate top-level domain.

Step 4: Top-Level Domain server

The client's DNS server contains the IP address of the top-level domain of the requested name. The DNS server then contacts the top-level domain's DNS server to resolve the name. The top-level domain server reads the second-level domain of he requested name, and if it can resolve the name, it sends the desired IP address back to the client's DNS server.

-h max_hops

The default number of hops tracert will attempt to reach is 30. Using the -h option, you can specify more or fewer hops for it to check

BOOTO (The Bootstrap Protocol)

The predecessor of DHCP. Developed to assign IP addresses to disk less, workstations that had no way of storing their operating system.

Step 7: Host Address

The preferred DNS server provides the client with the IP address of the target host.

Step 6: Host name resolution

This communication between DNS servers continues until it reaches the level in the DNS hierarchy where a DNS server can resolve the host name.

Host name

Unique name given to a node on a TCP/IP network. It enables users and technicians to recognize the node more easily

Domain Name

Unique name that identifies an entity on the Internet. Also know as site names, domain names appear as part of the complete address of a web resource. Which can have no more than 63 characters. Identifies a collection of devices on the network of a particular domain. A host name is a unique name that identifies a specified device in a network

Step 3: Root name server

Upon receiving the request, the root name server read the top-level domain of that name and sends a message that contains the IP address of the server for that top-level domain. The root name server then sends a reply to the client's DNS server.

My traceroute (MTR)

Utility combines ping and traceroute into a single function. MTR displays the routers traversed, the average time taken for round trip, and packet loss of each router.

Iterative query

When the client requests only the information a server already has in its cache for a particular domain. If the receiving the server cannot resolve the request, it notifies the client, but does not forward the request on to any other server.

Recursive query

When the client requests that its preferred DNS server find data on other DNS servers. Starting with the client requesting a name to be resolved to an IP address of its preferred DNS server.

TCP/IP

You can assign IP address information statically to nodes by manually entering IP addressing information on each individual network node. Can assign IP addresses dynamically, by using the Dynamic Host Configuration Protocol (DHCP) service

NOTE

You can manually release and renew a DHCP lease in Linux by issuing the following command at a command prompt: studio dhclient -v -r

-j host-list

You can use the -j option to force the outgoing Datagram to pass through a specific router.

FTP session

ftp/IP address of remote host

IPv6- ping using IPv6

ping target -6

Continuous ping- Pings the specified host until the command is interrupted by the pressing Ctrl+C

ping target -t

Packet Size- by default, data packets are sent as 32 bytes. You can specify a larger size to test response time, the maximum size being 65,500 bytes. To change the packet size, user -1 option followed by the packet length

ping target [-1 size]

TTL- a value that determines how many hops an IP packet can traverse before being discarded. Each hop is a router that was crossed.

ping target [-i TTL]

Command and Utilities for IP Networks that might be useful

route tracert in Windows, and traceroute in UNIX and Linux pathping mtr utility in UNIX and Linux