Network Chapter 5

ARP supports IP by resolving IP addresses to MAC addresses. Address resolution in ARP is performed in the following three steps.

1) ARP receives an IP address from IP 2) Is ARP has the MAC address in its cache, it returns it to IP. If not, it issues a Layer 2 broadcast to resolve the IP address 3) A target node with the corresponding IP address responds with a Layer 2 unicast that includes its MAC address. ARP adds the MAC address into its cache and then sends it to IP as requested.

Uses for protocol analyzer

1) Analyzing current network traffic patterns and potential problems. 2) Detecting possible network intrusions. 3) monitoring network usage for performance analysis 4) Launching an eavesdropping attack.

Assiging IP address to nodes in a network, need to following certain rules

1) Every node (host) that connects to a network must have a unique IP address. 2) Ever subnet must have a unique network ID 3) All hosts on the same network/subnet must have the same network ID and same subnet mask. 4) The host part of an IP address cannot be all 1s and 0s 5) The IP address 127.0.0.1 is reserved for testing and cannot be used as a host ID

To implement TCP/IP on a network, administrators need to confugure three settings on each network node

1) IP address 2) Subnet mask 3) Default gateway

three main benefits of using IP on a network

1) IP addresses an subnet masks enable each individual network address. 2) Every network node can determine of a PDU is destined for a node on the local network or on a remote network. 3) Routers can use network addresses and default gateways to send PDUs to the correct networks

Parity Checking-Process used to detect error in memory or data communication.

1) a device checks the data sent and received on a word-by-word basis. 2) Sender adds one bit to each word of the data and then transmits to the receiver. if the number of 1s is odd, the bit will be another one, if the number of 1s is even, then the bit is 0 3) The receiver compares the number of 1s within a transmitted byte to those received. 4) If the counts matches, the data is assumed to be valid. it a word is determined to be corrupt, re receiver requests retransmission of the data.

Implement IPv6 on an IPv4 network

1)Implement IPv6 in phases throughout the organization 2) Ensure interoperability between IPv4 and IPv6 during the initial phase of the transition from IPv4 to IPv6, rather than trying to replace IPv4 completely with IPv6 3) Remember that the netowrk classes used in IPv4 will not apply to IPv6 4) Configure AAAA domain name service (DNS) records for IPv6 although IPv4 DNS services make use of a records. 5) upgrade the necessary hardware to support IPv6. This includes all nodes, host and router on the network 6) Ensure the the IPv6 enviroment, once implemented, is scalable to support the future requirements of your network, 7)Ensure that IPv6 packets that are sent on an IPv4 network are encapsulated. This can be done by tunneling

Class A IP Address

1.0.0.0 to 126.255.255.255 (example 10.28.220.19)

Private IP address ranges

10.0.0.0 to 10.255.255.255 172.16.0.0 to 172.21.255.255 192.168.0.0 to 192.168.255.255

Class B IP Address.

128.0.0.0 to 191.255.255.255 (example 155.128.120.86)

Class D IP Address

224.0.0.0 to 239.255.255.255 (example 230.43.160.48)

Class C IP Address

240.0.0.0 to 223.255.255.255 (example 102.208.120.86)

Class E IP Address

240.0.0.0 to 255.255.255.255 (example 250.217.39.190)

Permitted subnet masks

255.0.0.0 255.255.0.0 255.255.255.0 255.255.128.0 255.255.255.244

Illegal subnet mask

255.0.255.0 255.255.292.0 255.240.254.o 255.255.0.192

Private IP Addresses

Addresses that organizations use for nodes within enterprise networks requiring IP connectivity and not external connection to the Internet.

UDP- User Datagram Protocol

Also know as the Iniversal Datagram Protocol, is a connectionless Transport-layer protocol in the IP suite. Commonly used in steaming media sick as Voice over IP (VoIP), real-time video, and network management applications in which a device is polled regularly for its health.

Data Window

Constitute a flow control technique inwhich multiple packets are sent as a unit called a blocked or a window.

EDC Error Detection Code.

Determine if the data has been altered en rout.

Protocol Analyzers

Diagnostic software that can examine and display data packets that are being transmitted over a network. Examine packets from protocols that operate in the physical, data link, network and transport layers of the OSI models. Gather all information passed through a netwoek, or selectively record certain types of transactions based on various filtering mechanisms.

CIDR vs VLSM

Essentially the same thing. both use slash notation to represent a custom subnet mask. Difference is VLSM refers to lengthening the mask to create multiple subnets out of a single network

IP-Internet Protocol

Is a Network-Layer (OCI Layer 3) protocol that is responsible for routing individuals datagrams and addressing. Responsible for packet formatting and the logical addressing scheme.

Most Windows devices include basic protocol analyzer tool called Network Monitor and enables you to to save each network capture to a log.

Linux distributions include tcpdump, a popular command-line utility for capturing packets. tcpdump can capture IP addresses, session state and header information as well as data. netstat in most UNIX and Linux distributions. netstat can provide a wide range of information, including open ports, and sockets, packets transmitted on those ports.

Acknowledged Connectionless

Nodes do not establish a virtual connection. However, they do achnowledge the successful receipt of packets. Web (HTTP) communications use this type of connection service.

Connection-oriented

Nodes establish a virtual connection for the duration of the session. Nodes negotiate communication parameters and typically share security information to establish a connection.

SYN

The active open is performed by the client sending a SYN packet to the server. The client sets the packet's sequence number to a random value A.

ACK

The client sends an ACK packet back to the server. The sequence number is set to the received acknowledgement value, and the acknowledgement number is set to one more than the receiver sequence number

TCP has built in mechanism to continuously communicate the receiver's buffer size to the sender, so that the sender knows how much data it can send at any one time without waiting for an acknowledgement from the receiver.

UDP has no such mechanism. Instead, it discards any packets it cannot accommodate, expecting the application to manage any errors. Because most UDP applications incorporate a continuous stream of content (voice, live video)or repeated requests (Simple Network Management Protocol (SNMP) management, DNS queries), buffer-related errors are tolerated to compensated for by the application

ICMP-Internet Control Message Protocol

Used with IP that attempts to report on the conditiion of a connection between two nods. Notify a sender of network condition by reporting on errors. OSI Layer 3. If a node is sending data so quickly that the receiving node's buffers flood, the receiving noes sends an ICMP source quench meddage to slow down data transmission from the sending node.

CIDR Classless inter-domain routing

a classless addressing method that considers a custom subnet mask as a 32-bit binary word

Custom Subnets

a collection of leased IP addresses that are divided into smaller groups to serve a network's needs.

Connection-Oriented

a data transmission method in which a connectioon is established before any data can be sent.

Buffering

a flow control technique in which data received is stored on a temporary high-speed memory location, until the main system components are ready to work with the data.

Flow Control

a technique for optimizing data exchange between systems,

Connections

a virtual link between two nodes established for the duration of a communication session.

Connectionless Protocols.

are a data transmission method that does not establish a connection between devices and where data may be connection-oriented transport protocol. UDP is an example of connectionless. information is transmitted from a source to a destination without checking to see of the destination is prepared to receive the information. Sender may have to retransmit the information multiple times before the destination receives the complete message.

Protocol Binding

assinging a protocol to a network interface card (NIC) is referred to as protocol binding. bind the protocol to the netowrk interface as it creates a path for the flow of data. Multiple protocols can be bound to a NIC. NIC can use any of the protocols that are bound to it to communicate with other nodes on the network.

Custom Subnet mask

divide a single IP address block into multiple subnets.

Promiscuous Mose

enables the device running the analyzer to recognize all packets being sent over the network, irrespective of the source or destination.

PDU Protocol Data Unit

exist at Layer 4 are segments (for TCP) and datagrams (for UDP)

SYN-ACK

in response, the server replies with a SYN-ACK packet. The acknowledgement number is set to one more than the received sequence number(i.e, A+1) and the sequence number that the server chooses for the packet is another random number, B

TCP-Transmission Control Protocol

is a connection-oriented, guaranteed-delivery protocol used to send data packets between devices over a network such as the internet

TCP/IP Model

is a four-layer model developed by the United State Department of Defense. Was developed to allow the additional of new technologies and create a more flexible architecture.

Subnet Masks

is a number assinged to each host for dividing the IP address into network and node portions.

ARP-Address Resolution Protocol

maps an IP address to a physical or media access control (MAC) address recognized within a local network. resides on Layer 2 (Data Link layer).

IGMP-Internet Group Management Protocol

protocol in the TCP/IP suite that supports multicasting in a routed enviroment. Operating at Layer 3 of the OSI model.

Default Gateway

the IP address of a router that routes remote traffic from the device's local subnet to remote subnets.

Error Detection

the process of determining if transmitted data has been received correctly and completely,

subnetting

the process of logically dividing a network into smaller subnetworks or subnets.

Unacknowledge Connectionless

ths service provides no achnowledgement of successfully transmitted data. The application must provide its own reliability checks. Simplex communication use this type of service.