This is always a good start to the IDP portion of the interview because it gets immediately to the heart of the IDS/IDP debate. Network security hardware and software vendors have confused many network professionals with markets and submarkets of intrusion detection. Originally, there was just “intrusion detection.” The systems (also called sensors) were either network-based, also known as a network IDS (NIDS), or host-based, also known as a host IDS (HIDS). The early systems simply tapped into the network at switches with monitored/mirrored ports.
The term IDS is now considered a first-generation term. Today, many vendors distinguish detection from prevention. Detection means passive monitoring, whereas prevention means active monitoring. With the introduction of the term prevention came the introduction of new acronyms — NIPS (Network IPS) and HIPS (Host IPS). Vendors like to call detection reactive and prevention proactive. The IPS devices have the ability to detect as well as prevent attacks using a response mechanism—if in a tap/span configuration — or blocking mechanism — if using an inline configuration. IPS is more of a second-generation term. Many equate an IDS to a burglar alarm. Network sensors detect an intrusion much the same way a door or window sensor detects unwanted entry. The home sensors alert the alarm company or home siren to the intruder. An IPS is a way to prevent attacks from penetrating
the network. Some vendors and even NIST have gone so far as to use the acronym IDP (Intrusion Detection and Prevention) to include both the IDS and IPS functionality. Throughout this chapter, we continue to use IDP to represent both IDS and IPS systems.
Showing posts with label Security interview questions. Show all posts
Showing posts with label Security interview questions. Show all posts
VPN Interview Q&A
The following questions provide an idea of some of the types of questions you should be able to answer.
Q: How many messages are exchanged during Phase I Aggressive mode, and would you recommendit for a site-to-site VPN?
A: Three and no: The identity of the peer is exposed during the reduced number of messages.
Q: What are some issues related to deploying IPsec with ESP across the network?
A: In tunnel mode, ESP adds a new IP and ESP header, which results in a larger packet size. In addition, ESP packets are marked Do Not Fragment (DF) in most vendor implementations. Configuring a Path MTU discovery feature or other vendor-specific feature is required to reduce your MSS to allow successful transmission of full-size packets.
Q: Please explain how you can identify which type of IPsec security protocol and mode are used with only a packet sniffer.
A: The next header field indicates which protocol is next. If TCP, then transport mode is used; if IP, then tunnel mode is used. In the IP header, the Protocol field will indicate what type of protocol is used (ESP IP protocol 50 or AH IP protocol 51).
Q: What protocols are required to pass through the edge of your network to an IPsec appliance running ESP with IKE?
A: ESP is IP Protocol 50, and IKE traditionally operations over UDP Port 500. If NAT Traversal is used, then UDP Port 4500 is traditionally used.
Q: Describe the purpose of a Security Assocation (SA) and what the minimum number are to establish a VPN tunnel with a remote peer using only ESP/tunnel mode.
A: An SA is a uni-directional set of parameters used to establish a secure communication channel with a far end gateway or host. A minimum of two SAs is required to establish bi-directional communication with the far-end peer.
Q: What is the minimum number of parameters needed to uniquely identify a Security
Association?
A: Three: SPI, peer IP address, and type of protocol used (ESP or AH).
Q: Please describe some of the resources you have used to evaluate and select an IPsec platform.
A: Depending on the business requirements (and any possible government regulations—FIPS 140-2), I would create a short list of vendors from sources such as Gartner, and Forrester because they review financials and customer support issues that may be difficult to confirm in a lab. Continuing to work against business requirements, I would review the IPsec vendor list from ICSA Labs (“Google ICSA Labs IPsec Certified”) if there are interoperability requirements with other
vendors or a planned migration. I would reference NIST’s Common Criteria Evaluation and Validation Scheme (CCEVS) to reduce my shortlist to a “very” short list. FIPS 140-2 evaluates the vendor’s cryptographic implementation for adherence with the standard. Selecting a vendor that meets or exceeds this standard can further reduce your short list. I would also reference the VPN Consortium to review any vendor- specific enhancements or interoperability issues. Finally, I would bring in the top three vendors that meet the stated business requirements, and work with the gear
Q: How many messages are exchanged during Phase I Aggressive mode, and would you recommendit for a site-to-site VPN?
A: Three and no: The identity of the peer is exposed during the reduced number of messages.
Q: What are some issues related to deploying IPsec with ESP across the network?
A: In tunnel mode, ESP adds a new IP and ESP header, which results in a larger packet size. In addition, ESP packets are marked Do Not Fragment (DF) in most vendor implementations. Configuring a Path MTU discovery feature or other vendor-specific feature is required to reduce your MSS to allow successful transmission of full-size packets.
Q: Please explain how you can identify which type of IPsec security protocol and mode are used with only a packet sniffer.
A: The next header field indicates which protocol is next. If TCP, then transport mode is used; if IP, then tunnel mode is used. In the IP header, the Protocol field will indicate what type of protocol is used (ESP IP protocol 50 or AH IP protocol 51).
Q: What protocols are required to pass through the edge of your network to an IPsec appliance running ESP with IKE?
A: ESP is IP Protocol 50, and IKE traditionally operations over UDP Port 500. If NAT Traversal is used, then UDP Port 4500 is traditionally used.
Q: Describe the purpose of a Security Assocation (SA) and what the minimum number are to establish a VPN tunnel with a remote peer using only ESP/tunnel mode.
A: An SA is a uni-directional set of parameters used to establish a secure communication channel with a far end gateway or host. A minimum of two SAs is required to establish bi-directional communication with the far-end peer.
Q: What is the minimum number of parameters needed to uniquely identify a Security
Association?
A: Three: SPI, peer IP address, and type of protocol used (ESP or AH).
Q: Please describe some of the resources you have used to evaluate and select an IPsec platform.
A: Depending on the business requirements (and any possible government regulations—FIPS 140-2), I would create a short list of vendors from sources such as Gartner, and Forrester because they review financials and customer support issues that may be difficult to confirm in a lab. Continuing to work against business requirements, I would review the IPsec vendor list from ICSA Labs (“Google ICSA Labs IPsec Certified”) if there are interoperability requirements with other
vendors or a planned migration. I would reference NIST’s Common Criteria Evaluation and Validation Scheme (CCEVS) to reduce my shortlist to a “very” short list. FIPS 140-2 evaluates the vendor’s cryptographic implementation for adherence with the standard. Selecting a vendor that meets or exceeds this standard can further reduce your short list. I would also reference the VPN Consortium to review any vendor- specific enhancements or interoperability issues. Finally, I would bring in the top three vendors that meet the stated business requirements, and work with the gear
Firewall Interview Q&A
Q: What is a packet filter firewall?
A: A packet filter firewall inspects traffic on a per-packet basis. It matches only on an individual packet basis. It is not capable of determining a packet flow or session. Packet filters can match a packet from the simple source and destination IP up to and including specific protocol flags such as TCP SYN and FIN. This varies based upon the vendor’s implementation of a packet filter.
Q: What is stateful inspection?
A: In stateful inspection, a firewall inspects traffic based upon the state of the connection. The firewall is aware of the beginning, middle, and end of a connection. If the connection goes out of state, the firewall is able to detect it.
Q: What is an application proxy firewall?
A: An application proxy firewall proxies connections that attempt to go through the firewall. The client’s request is always proxied to server. The server’s response is proxied back to the client as well. This allows the proxy to completely inspect the connection.
Q: What does the term DMZ stand for?
A: This stands for demilitarized zone. It is a term that represents a segmented network to which access is protected by a firewall.
Q: Why would you want a high-availability firewall deployment in your network?
A: Because a firewall is often placed at a critical point in your network. If it were to fail, you would lose access to critical resources such as Internet access.
Q: What are the characteristics of an appliance firewall?
A: An appliance-based firewall is a device that is built for a specific purpose. The purpose in this case is to be a firewall.
Q: What is NAT?
A: NAT stands for Network Address Translation. With NAT, a packet has either the source or destination IP address modified as it passes through a firewall.
Q: What is Unified Threat Management?
A: Unified Threat Management, or UTM, is a collection of technologies that are bundled together to eliminate threats on the network. These technologies include deep-packet inspection, antivirus, antispam, and URL filtering.
Q: What are the main configuration components in a firewall?
A: The firewall’s configuration (networking/routing), the firewall policy (the policy that restricts traffic for a device), and the firewall’s objects (the components used during the firewall’s policy configuration.
Q: What is a secure router?
A: A secure router is a device that couples the features of a router and a firewall, including the use of WAN interfaces, firewall services, and, often, a UTM feature set.
Q: What company was the first to implement firewall technologies?
A: Cisco Systems originally implemented firewall features in the form of packet filters on routers.
Q: Who are the three market leaders in the firewall technology space?
A: Cisco, Check Point, and Juniper Networks are the three market leaders. Cisco is the number one leader in firewall appliances. Check Point is the market leader in software-based firewalls. Juniper Networks is in second place behind Cisco for firewall appliances.
Q: What was Check Point’s most important impact on the firewall market?
A: The creation of an easy-to-use central management tool. This tool contained easy-to-use GUIs and still sets the bar for user interfaces today.
Q: What is the most basic deployment for a firewall?
A: The most basic deployment for a firewall is placing a firewall between an untrusted network, such as the Internet, and the local area network. This placement limits the access that the Internet has to the local area network. The local area network has important services that should not be Internet accessible. These services include file servers and e-mail servers.
Q: Can you list the three core firewall technologies?
A: Packet filter, stateful inspection, and application proxies are the core firewall technologies.
Q: What are three technologies you can find in the UTM feature set?
A: Antivirus inspection, antispam, and deep-packet inspection. Antivirus technologies often focus on the inspection of Web and e-mail traffic.
A: A packet filter firewall inspects traffic on a per-packet basis. It matches only on an individual packet basis. It is not capable of determining a packet flow or session. Packet filters can match a packet from the simple source and destination IP up to and including specific protocol flags such as TCP SYN and FIN. This varies based upon the vendor’s implementation of a packet filter.
Q: What is stateful inspection?
A: In stateful inspection, a firewall inspects traffic based upon the state of the connection. The firewall is aware of the beginning, middle, and end of a connection. If the connection goes out of state, the firewall is able to detect it.
Q: What is an application proxy firewall?
A: An application proxy firewall proxies connections that attempt to go through the firewall. The client’s request is always proxied to server. The server’s response is proxied back to the client as well. This allows the proxy to completely inspect the connection.
Q: What does the term DMZ stand for?
A: This stands for demilitarized zone. It is a term that represents a segmented network to which access is protected by a firewall.
Q: Why would you want a high-availability firewall deployment in your network?
A: Because a firewall is often placed at a critical point in your network. If it were to fail, you would lose access to critical resources such as Internet access.
Q: What are the characteristics of an appliance firewall?
A: An appliance-based firewall is a device that is built for a specific purpose. The purpose in this case is to be a firewall.
Q: What is NAT?
A: NAT stands for Network Address Translation. With NAT, a packet has either the source or destination IP address modified as it passes through a firewall.
Q: What is Unified Threat Management?
A: Unified Threat Management, or UTM, is a collection of technologies that are bundled together to eliminate threats on the network. These technologies include deep-packet inspection, antivirus, antispam, and URL filtering.
Q: What are the main configuration components in a firewall?
A: The firewall’s configuration (networking/routing), the firewall policy (the policy that restricts traffic for a device), and the firewall’s objects (the components used during the firewall’s policy configuration.
Q: What is a secure router?
A: A secure router is a device that couples the features of a router and a firewall, including the use of WAN interfaces, firewall services, and, often, a UTM feature set.
Q: What company was the first to implement firewall technologies?
A: Cisco Systems originally implemented firewall features in the form of packet filters on routers.
Q: Who are the three market leaders in the firewall technology space?
A: Cisco, Check Point, and Juniper Networks are the three market leaders. Cisco is the number one leader in firewall appliances. Check Point is the market leader in software-based firewalls. Juniper Networks is in second place behind Cisco for firewall appliances.
Q: What was Check Point’s most important impact on the firewall market?
A: The creation of an easy-to-use central management tool. This tool contained easy-to-use GUIs and still sets the bar for user interfaces today.
Q: What is the most basic deployment for a firewall?
A: The most basic deployment for a firewall is placing a firewall between an untrusted network, such as the Internet, and the local area network. This placement limits the access that the Internet has to the local area network. The local area network has important services that should not be Internet accessible. These services include file servers and e-mail servers.
Q: Can you list the three core firewall technologies?
A: Packet filter, stateful inspection, and application proxies are the core firewall technologies.
Q: What are three technologies you can find in the UTM feature set?
A: Antivirus inspection, antispam, and deep-packet inspection. Antivirus technologies often focus on the inspection of Web and e-mail traffic.
Understanding Regulations, Legislation, and Guidance Interview Q&A
Q: Why does my organization need to worry about regulations and legislation?
A: Two concepts drive this discussion: compliance and due diligence. If your organization falls under any particular piece of legislation or regulation, you must show that you are taking steps to be in compliance with the directive. If you are not in compliance, you may face fines or other sanctions against your organization. The other concept is due diligence. Due diligence addresses a logical, minimum, and necessary level of security within organizations to support and serve the customer and the employees. Failure with due diligence can result in customer dissatisfaction
and employee loss.
Q: Don’t all the regulations and legislation basically say the same thing?
A: Approximately 80 percent of all information security–related regulations and legislation basically say the same thing, which relates to the concept of due diligence. The remaining 20 percent relates to industry or governmental specific implementation requirements.
Q: What is the difference between a requirement and guidance?
A: A requirement is something you must do. Guidance is something you might consider doing and implementing if it makes sense in your environment.
Q: What federal law regarding computer security and compliance applies to all government agencies under the executive branch of the United States government?
A: FISMA (Federal Information System Management Act).
Q: What FIPS document provides the guidance on the categorization and classification of risk for federal computer systems?
A: FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems.
Q: What two NIST Special Publications provide the listing of security controls for federal information systems and how to access the controls?
A: NIST SP 800-53 – Recommended Security Controls for Federal Information Systems and NIST SP 800-53A – Guide for Assessing the Security Controls in Federal Information Systems.
Q: What government agency has the authority to set requirements for systems that contain national intelligence information?
A: The Central Intelligence Agency (CIA). The Director, CIA establishes rules for intelligence systems working with DoD and the military services.
Q: What is considered to be national infrastructure?
A: Food supplies, water supplies, power, public health, national defense, national icons, and national financial stability.
Q: I am a publicly held health care organization. What regulations or legislation do I have to worry about?
A: HIPAA, Sarbanes-Oxley, state requirements, and possibly PCI.
Q: Why was Sarbanes-Oxley passed?
A: In the wake of financial scandals at Enron and other companies, Congress passed Sarbanes- Oxley in an attempt to get public companies to provide accurate and ethical financial results to protect shareholders and employees from being financially hurt by intentional actions of individual decision-makers in the organization. With Sarbanes-Oxley, CEOs and CFOs must account for the accuracy of the information in the financial statements and can be held individually
accountable if they are not accurate.
A: Two concepts drive this discussion: compliance and due diligence. If your organization falls under any particular piece of legislation or regulation, you must show that you are taking steps to be in compliance with the directive. If you are not in compliance, you may face fines or other sanctions against your organization. The other concept is due diligence. Due diligence addresses a logical, minimum, and necessary level of security within organizations to support and serve the customer and the employees. Failure with due diligence can result in customer dissatisfaction
and employee loss.
Q: Don’t all the regulations and legislation basically say the same thing?
A: Approximately 80 percent of all information security–related regulations and legislation basically say the same thing, which relates to the concept of due diligence. The remaining 20 percent relates to industry or governmental specific implementation requirements.
Q: What is the difference between a requirement and guidance?
A: A requirement is something you must do. Guidance is something you might consider doing and implementing if it makes sense in your environment.
Q: What federal law regarding computer security and compliance applies to all government agencies under the executive branch of the United States government?
A: FISMA (Federal Information System Management Act).
Q: What FIPS document provides the guidance on the categorization and classification of risk for federal computer systems?
A: FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems.
Q: What two NIST Special Publications provide the listing of security controls for federal information systems and how to access the controls?
A: NIST SP 800-53 – Recommended Security Controls for Federal Information Systems and NIST SP 800-53A – Guide for Assessing the Security Controls in Federal Information Systems.
Q: What government agency has the authority to set requirements for systems that contain national intelligence information?
A: The Central Intelligence Agency (CIA). The Director, CIA establishes rules for intelligence systems working with DoD and the military services.
Q: What is considered to be national infrastructure?
A: Food supplies, water supplies, power, public health, national defense, national icons, and national financial stability.
Q: I am a publicly held health care organization. What regulations or legislation do I have to worry about?
A: HIPAA, Sarbanes-Oxley, state requirements, and possibly PCI.
Q: Why was Sarbanes-Oxley passed?
A: In the wake of financial scandals at Enron and other companies, Congress passed Sarbanes- Oxley in an attempt to get public companies to provide accurate and ethical financial results to protect shareholders and employees from being financially hurt by intentional actions of individual decision-makers in the organization. With Sarbanes-Oxley, CEOs and CFOs must account for the accuracy of the information in the financial statements and can be held individually
accountable if they are not accurate.
IT Security Interview Q&A
Q: What is access control?
A: Access control provides the mechanism for ensuring that only authorized individuals can access organizational information. More stringent access control mechanisms are needed as the value of the information to the organization increases.
Q: What is Least Privilege?
A: Least Privilege states that users should have access only to exactly the information required to perform their job duties and nothing more.
Q: How do you define confidentiality?
A: Confidentiality basically means keeping private information private. You don’t want outside competitors seeing your organization’s work in research and development, and you don’t want sensitive customer information being stolen and used for identity theft or fraud.
Q: What is integrity as it applies to information security?
A: Integrity is ensuring that information remains in the proper state while it’s being used or stored. A loss of integrity occurs if information is modified in an unauthorized manner.
Q: What is availability?
A: Availability means that information is ready and waiting, right when you need to access it.
Q: How do you define risk?
A: Risk is a combination of threat, vulnerabilities, and impact to the organization (or value). Risk exists when all three of these elements are present simultaneously. For example, if an organization knows of a threat agent with a desire to steal its critical research information and a vulnerability exists that could allow that to happen, risk is present.
Q: What is the importance of classifying data?
A: Classifying data allows an organization to differentiate between routine information types and those types that have a critical impact on how it does business. Classifying also allows management to appropriately budget for the protection of varying information types, instead of protecting everything at the same level and wasting resources.
Q: How do you describe data labeling?
A: Data labeling is intended to aid with the identification of information. After information has been appropriately identified to users, steps can be taken to ensure the security of that information; such as storage and handling measures.
A: Access control provides the mechanism for ensuring that only authorized individuals can access organizational information. More stringent access control mechanisms are needed as the value of the information to the organization increases.
Q: What is Least Privilege?
A: Least Privilege states that users should have access only to exactly the information required to perform their job duties and nothing more.
Q: How do you define confidentiality?
A: Confidentiality basically means keeping private information private. You don’t want outside competitors seeing your organization’s work in research and development, and you don’t want sensitive customer information being stolen and used for identity theft or fraud.
Q: What is integrity as it applies to information security?
A: Integrity is ensuring that information remains in the proper state while it’s being used or stored. A loss of integrity occurs if information is modified in an unauthorized manner.
Q: What is availability?
A: Availability means that information is ready and waiting, right when you need to access it.
Q: How do you define risk?
A: Risk is a combination of threat, vulnerabilities, and impact to the organization (or value). Risk exists when all three of these elements are present simultaneously. For example, if an organization knows of a threat agent with a desire to steal its critical research information and a vulnerability exists that could allow that to happen, risk is present.
Q: What is the importance of classifying data?
A: Classifying data allows an organization to differentiate between routine information types and those types that have a critical impact on how it does business. Classifying also allows management to appropriately budget for the protection of varying information types, instead of protecting everything at the same level and wasting resources.
Q: How do you describe data labeling?
A: Data labeling is intended to aid with the identification of information. After information has been appropriately identified to users, steps can be taken to ensure the security of that information; such as storage and handling measures.
Describe Routing Filters and What They Accomplish
Route filters are used in several routing protocols. Most common are the OSPF and BGP implementations.
OSPF uses route filters, or route maps, to restrict summary routes and prevent routes from being imported into the route table. Most route maps use match clauses to match prefixes that they wish to accept or deny.
BGP routers use route filters to enforce policy. There are three filter types that can be applied to match updates exchanged between BGP speakers:
❑ Path filters: Using the AS-PATH attribute, if the update matches the filter criteria, the update is accepted or denied.
❑ Prefix filters: Using the prefix in the NRLI, if the update matches the filter criteria, the update is accepted or denied.
❑ Route maps: As with the interior routing protocols, route maps can have more actions associated with the match criteria. Routes can be accepted or denied, but attributes can be changed as well. There is also work being done in the field of exchanging the route filters between BGP speakers.
For more information on OSPF and BGP route filtering, check out Routing TCP/IP, Volume 1 (2nd Edition) (CCIE Professional Development) by Jeff Doyle and Jennifer Carroll (Cisco Press. 2006). For more information on BGP outbound route filtering, check out “Outbound Route Filtering Capability for BGP-4 - draft-ietf-idr-route-filter-16.txt,” by E. Chen and Y. Rekhter.
OSPF uses route filters, or route maps, to restrict summary routes and prevent routes from being imported into the route table. Most route maps use match clauses to match prefixes that they wish to accept or deny.
BGP routers use route filters to enforce policy. There are three filter types that can be applied to match updates exchanged between BGP speakers:
❑ Path filters: Using the AS-PATH attribute, if the update matches the filter criteria, the update is accepted or denied.
❑ Prefix filters: Using the prefix in the NRLI, if the update matches the filter criteria, the update is accepted or denied.
❑ Route maps: As with the interior routing protocols, route maps can have more actions associated with the match criteria. Routes can be accepted or denied, but attributes can be changed as well. There is also work being done in the field of exchanging the route filters between BGP speakers.
For more information on OSPF and BGP route filtering, check out Routing TCP/IP, Volume 1 (2nd Edition) (CCIE Professional Development) by Jeff Doyle and Jennifer Carroll (Cisco Press. 2006). For more information on BGP outbound route filtering, check out “Outbound Route Filtering Capability for BGP-4 - draft-ietf-idr-route-filter-16.txt,” by E. Chen and Y. Rekhter.
Explain BGP, the Differences between BGP and OSPF, What Prefixes Are, and What Attributes and Types Are Used in BGP
The Border Gateway Protocol (BGP) is a favorite subject for many technical interviewers. It is the exterior routing protocol of choice in today’s networks and is quite different from interior routing protocols such as OSPF. BGP fulfills the role of mediating between two “administratively controlled” networks.
These administratively controlled networks are known as autonomous systems (ASs). BGP, requiring a reliable connection between peers, uses TCP port 179. Each peer session gets a single TCP session. BGP is an application layer protocol, so it requires the TCP session to be established before exchanging any route information. BGP sessions can be authenticated using MD5 signatures when exchanging updates.
An UPDATE message can have a variable number of attributes; however, they cannot be repeated. As for the prefixes, an UPDATE message can advertise only one route. It can, however, list routes to be deleted. BGP is considered a path vector protocol because it stores route information in addition to path attributes. The route selection is done in a deterministic fashion based on best route policy. The policy is based off the path attributes. Where interior routing protocols use metrics such as delay, link utilization, or hops, BGP does not. Understand that BGP is capable of running in two modes: exterior and interior.
EBGP is used for peering between different autonomous systems (AS). IBGP is used for routers within the same AS. Path attributes are different for the two modes; these are discussed shortly.
There are two key differences between BGP and OSPF (or any internal routing protocol). The first difference is how the protocols scale up to accommodate large numbers of routes. BGP scales up well because it sends a complete route update only once when a session is established with a peer. After that, the BGP speaker will send only incremental changes. Even though OSPF mostly sends link state information, there are still periods in which all its routing information is sent. The second key difference is the support for path attributes in BGP. BGP uses path attributes to form routing policies. This works well when you have to route between separately owned and maintained networks (autonomous systems). The routing policies allow you to make a decision as to whether to accept, reject, or change (summarize/aggregate)
routes from a peer network. This helps protect the network and control how routes are propagated throughout the internal network.
A prefix is the network portion of the IP address and implies the use of classless addressing. BGP uses prefixes in the Network Layer Reachability Information (NRLI) field in the UPDATE messages. The path attributes convey the prefix characteristics to the peer router. Another hot topic in BGP is the ability to perform route dampening. Route dampening is a feature that controls the frequency of routes changing state— up, down, up, down, and so on. This frequent changing of state is called route flapping. Most routers today can sense the flapping and remove the offending route. To do so, they monitor how often the flapping occurs and penalize the route each time. After the penalties exceed a set threshold, the route is removed and updates are ignored. The route can be reused after a certain
amount of time. One of the greatest arguments in BGP is which attributes should or should not be used when sharing information between two networks. (Just a quick definition note: The words update and advertisement are used interchangeably.) In BGP, there are numerous path attributes that accompany an update between
two BGP speakers who wish to exchange routing information. We draw from RFC 4271/1771 for the following information. There are four defined categories for BGP attributes:
❑ Well-known mandatory
❑ Well-known discretionary
❑ Optional transitive
❑ Optional nontransitive
As the name implies, any vendor who wishes to implement BGP must have the well-known attributes. The mandatory attributes are ones that have to be included in every update. Discretionary attributes do not. Optional attributes are ones that some BGP speakers may use and others may not. The transitive bit in the update determines whether a BGP neighbor propagates the attribute or simply deletes it. It is always good to review the well-known mandatory attributes first. There are three mandatory
attributes that are well-known: ORIGIN, AS_PATH, and NEXT_HOP. There are two well-known, discretionary attributes: Local Preference, and Atomic Aggregate. All these attributes are described in the following list:
❑ ORIGIN: The Origin code is how the route originated, or the source of the route. The choices are internal gateway protocol (IGP), external gateway protocol (EGP), or incomplete. A great follow-up question is, “What is the cause of an unknown/incomplete?” Some of the most common reasons are route aggregation/summarization and redistribution.
❑ AS_PATH: The AS_PATH attribute is simply a list of all the autonomous systems (AS) that the given route in the update transits through. As the update passes through each AS, each BGP host adds its own AS to the list.
❑ NEXT_HOP: The NEXT_HOP attribute is the IP address of the first router in the next AS. And this first router may be more than one hop away. When this is the case, the interior routing protocol will compute a route to the BGP NEXT_HOP IP address. Just remember that Internal BGP sessions will not change the NEXT_HOP attribute — only external BGP sessions do.
❑ LOCAL_PREF: The local preference attribute is used to inform internal BGP peers of the preferred AS egress point for the included route.
❑ ATOMIC_AGGREGATE: The atomic aggregate attribute is used when a BGP speaker has overlapping routes from one of its peers. The BGP speaker will set the attribute when it makes a less-specific route selection. Aggregation, also known as summarization, hides network reachability and topology information. The atomic aggregate attribute is the mechanism used to hide the AS path. Examples of the optional transitive attributes are the Aggregator, Communities, and Extended
Communities attributes.
❑ Aggregator: The Aggregator attribute is a way for a BGP speaker to notify its peer that it has aggregated a given route and provides its own AS number and IP address.
❑ Communities: Communities are the “catch-all” attributes. In most large networks today, BGP communities are used to enforce policy. They do not directly affect the route selection algorithm of BGP, but they can shape how routes are treated when received in an update. There are three communities that are commonly used: NO_EXPORT, NO_ADVERTISE, and NO_EXPORT_SUBCONFED. The NO_EXPORT community attribute is a tag that notifies the peer whether the route can be exported to an external AS. The NO_ADVERTISE community attribute notifies the peer to not advertise the route at all. The NO_EXPORT_SUBCONFED community extends the NO_EXPORT attribute to include confederated ASs.
❑ Extended Communities: Extended Communities extend the BGP attributes further. There are a number of Extended Communities in draft and used in some BGP implementations. Ones to mention include the Autonomous System Specific, Route Target, Route Origin, and Link Bandwidth.
❑ MULTI_EXIT_DISC: The MED attribute is an optional, nontransitive attribute that provides a means to advertise multiple exit points for the local AS. Each exit point is given a metric, and the lowest metric will be the preferred exit point. Much has been written on BGP but the great references for BGP are still the RFCs. There are many and they all deserve attention: RFC 4271 - A Border Gateway Protocol 4 (BGP-4); RFC 4272 - BGP Security Vulnerabilities Analysis; RFC 4273 - Definitions of Managed Objects for BGP-4; RFC 4276 - BGP-4 Implementation Report; RFC 1772 - Application of the Border Gateway Protocol in the Internet; RFC 1773 - Experience with the BGP-4 protocol; RFC 1774/4274 - BGP-4 Protocol Analysis; RFC 1997 - BGP Communities Attribute; and RFC 1998 - An Application of the BGP Community Attribute in Multi-home
Routing as well as Internet-Draft document draft-ietf-idr-bgp-ext-communities, BGP Extended Communities Attribute.
These administratively controlled networks are known as autonomous systems (ASs). BGP, requiring a reliable connection between peers, uses TCP port 179. Each peer session gets a single TCP session. BGP is an application layer protocol, so it requires the TCP session to be established before exchanging any route information. BGP sessions can be authenticated using MD5 signatures when exchanging updates.
An UPDATE message can have a variable number of attributes; however, they cannot be repeated. As for the prefixes, an UPDATE message can advertise only one route. It can, however, list routes to be deleted. BGP is considered a path vector protocol because it stores route information in addition to path attributes. The route selection is done in a deterministic fashion based on best route policy. The policy is based off the path attributes. Where interior routing protocols use metrics such as delay, link utilization, or hops, BGP does not. Understand that BGP is capable of running in two modes: exterior and interior.
EBGP is used for peering between different autonomous systems (AS). IBGP is used for routers within the same AS. Path attributes are different for the two modes; these are discussed shortly.
There are two key differences between BGP and OSPF (or any internal routing protocol). The first difference is how the protocols scale up to accommodate large numbers of routes. BGP scales up well because it sends a complete route update only once when a session is established with a peer. After that, the BGP speaker will send only incremental changes. Even though OSPF mostly sends link state information, there are still periods in which all its routing information is sent. The second key difference is the support for path attributes in BGP. BGP uses path attributes to form routing policies. This works well when you have to route between separately owned and maintained networks (autonomous systems). The routing policies allow you to make a decision as to whether to accept, reject, or change (summarize/aggregate)
routes from a peer network. This helps protect the network and control how routes are propagated throughout the internal network.
A prefix is the network portion of the IP address and implies the use of classless addressing. BGP uses prefixes in the Network Layer Reachability Information (NRLI) field in the UPDATE messages. The path attributes convey the prefix characteristics to the peer router. Another hot topic in BGP is the ability to perform route dampening. Route dampening is a feature that controls the frequency of routes changing state— up, down, up, down, and so on. This frequent changing of state is called route flapping. Most routers today can sense the flapping and remove the offending route. To do so, they monitor how often the flapping occurs and penalize the route each time. After the penalties exceed a set threshold, the route is removed and updates are ignored. The route can be reused after a certain
amount of time. One of the greatest arguments in BGP is which attributes should or should not be used when sharing information between two networks. (Just a quick definition note: The words update and advertisement are used interchangeably.) In BGP, there are numerous path attributes that accompany an update between
two BGP speakers who wish to exchange routing information. We draw from RFC 4271/1771 for the following information. There are four defined categories for BGP attributes:
❑ Well-known mandatory
❑ Well-known discretionary
❑ Optional transitive
❑ Optional nontransitive
As the name implies, any vendor who wishes to implement BGP must have the well-known attributes. The mandatory attributes are ones that have to be included in every update. Discretionary attributes do not. Optional attributes are ones that some BGP speakers may use and others may not. The transitive bit in the update determines whether a BGP neighbor propagates the attribute or simply deletes it. It is always good to review the well-known mandatory attributes first. There are three mandatory
attributes that are well-known: ORIGIN, AS_PATH, and NEXT_HOP. There are two well-known, discretionary attributes: Local Preference, and Atomic Aggregate. All these attributes are described in the following list:
❑ ORIGIN: The Origin code is how the route originated, or the source of the route. The choices are internal gateway protocol (IGP), external gateway protocol (EGP), or incomplete. A great follow-up question is, “What is the cause of an unknown/incomplete?” Some of the most common reasons are route aggregation/summarization and redistribution.
❑ AS_PATH: The AS_PATH attribute is simply a list of all the autonomous systems (AS) that the given route in the update transits through. As the update passes through each AS, each BGP host adds its own AS to the list.
❑ NEXT_HOP: The NEXT_HOP attribute is the IP address of the first router in the next AS. And this first router may be more than one hop away. When this is the case, the interior routing protocol will compute a route to the BGP NEXT_HOP IP address. Just remember that Internal BGP sessions will not change the NEXT_HOP attribute — only external BGP sessions do.
❑ LOCAL_PREF: The local preference attribute is used to inform internal BGP peers of the preferred AS egress point for the included route.
❑ ATOMIC_AGGREGATE: The atomic aggregate attribute is used when a BGP speaker has overlapping routes from one of its peers. The BGP speaker will set the attribute when it makes a less-specific route selection. Aggregation, also known as summarization, hides network reachability and topology information. The atomic aggregate attribute is the mechanism used to hide the AS path. Examples of the optional transitive attributes are the Aggregator, Communities, and Extended
Communities attributes.
❑ Aggregator: The Aggregator attribute is a way for a BGP speaker to notify its peer that it has aggregated a given route and provides its own AS number and IP address.
❑ Communities: Communities are the “catch-all” attributes. In most large networks today, BGP communities are used to enforce policy. They do not directly affect the route selection algorithm of BGP, but they can shape how routes are treated when received in an update. There are three communities that are commonly used: NO_EXPORT, NO_ADVERTISE, and NO_EXPORT_SUBCONFED. The NO_EXPORT community attribute is a tag that notifies the peer whether the route can be exported to an external AS. The NO_ADVERTISE community attribute notifies the peer to not advertise the route at all. The NO_EXPORT_SUBCONFED community extends the NO_EXPORT attribute to include confederated ASs.
❑ Extended Communities: Extended Communities extend the BGP attributes further. There are a number of Extended Communities in draft and used in some BGP implementations. Ones to mention include the Autonomous System Specific, Route Target, Route Origin, and Link Bandwidth.
❑ MULTI_EXIT_DISC: The MED attribute is an optional, nontransitive attribute that provides a means to advertise multiple exit points for the local AS. Each exit point is given a metric, and the lowest metric will be the preferred exit point. Much has been written on BGP but the great references for BGP are still the RFCs. There are many and they all deserve attention: RFC 4271 - A Border Gateway Protocol 4 (BGP-4); RFC 4272 - BGP Security Vulnerabilities Analysis; RFC 4273 - Definitions of Managed Objects for BGP-4; RFC 4276 - BGP-4 Implementation Report; RFC 1772 - Application of the Border Gateway Protocol in the Internet; RFC 1773 - Experience with the BGP-4 protocol; RFC 1774/4274 - BGP-4 Protocol Analysis; RFC 1997 - BGP Communities Attribute; and RFC 1998 - An Application of the BGP Community Attribute in Multi-home
Routing as well as Internet-Draft document draft-ietf-idr-bgp-ext-communities, BGP Extended Communities Attribute.
Draw the Diagram of a Typical OSPF Network and Explain Generally How It Works: DR, BDR, Election, ASBR, ABR, Route Redistribution, and Summarization
This question is a great one and often makes the interviewee wonder where to start. Intentionally openended, the responses vary widely. What you should convey in your answer is an in-depth knowledge of OSPF. Scratch the surface and dive in deeper if you see positive responses from your interviewers.
Preferably using a whiteboard, start with the hierarchy of OSPF — a two-level model — and draw a diagram like the one in Figure 2-9.
Discuss having a backbone Area 0 (or 0.0.0.0) and that all areas must connect to the backbone area. Other area types include the following: stub area (an area that does not receive AS external routes); total stubby area (an area that does not allow summary routes or external routes); and not-so-stubby area (an area that can import AS external routes and send them to the backbone area, but will not receive AS external routes from the backbone or other areas). You want to include the type of routers contained in the hierarchy: internal routers, area border routers (ABR), backbone routers, and autonomous system boundary routers (ASBR). Mention that the shortest path first (SPF) calculation is performed independently on each area. You should state that the time to converge is faster than distance-vector routing protocols (DVRPs) such as RIP. Include a brief statement on the low bandwidth requirement for LSAs. Also mention support for classless routing, Variable-Length Subnet Masking (VLSM), authentication, and multipath statements.
Describe the OSPF algorithm and generally how it works: Changes in the network generate LSAs, routers exchange the LSAs, and each router builds and maintains its own database. So if the network is in a steady state, there will be refresh LSAs only every 30 minutes. You want to cover the five types of routing protocol packets: Hello, Database description, Link-state request, Link-state update, and Link-state
acknowledgment. Hello packets are multicast on 224.0.0.5 and routers use them to form adjacency relationships.
You want to cover the types of Link State Advertisements (LSAs): Router link (LSA type 1), Network link (LSA type 2), Network summary (LSA type 3), ASBR (LSA type 4), External (LSA type 5), and NSSA external (LSA type 7). Do not neglect a discussion on IPv6 and that OSPFv3 supports it. You might want to discuss briefly how vendors implement OSPFv3 using a ships-in-the-night approach to support both v3 and v2 simultaneously. OSPFv3 distributes IPv6 prefixes and uses the same interfaces
and nearly the same LSA types as OSPFv2. It uses the same methods for neighbor discovery and adjacency forming. The only differences are that OSPFv3 has to use a network link rather than a subnet.
And there can be multiple instances of OSPFv3 on a given link. You should mention that the topology in OSPFv3 is a bit different as well — using a router ID and Link ID. And because OSPFv3 uses links, there’s a new Link LSA type as well as an Intra-Area Prefix LSA for the IPv6 prefixes.
To fully answer the question, you have to go through the process of neighbor finding and adjacency creation. Routers sharing a common network segment or link will become neighbors using the Hello protocol. Routers send Hello packets out each interface with the multicast address of 224.0.0.5. When a router sees its own primary address in a Hello packet from another router, the routers are then neighbors. As
neighbors, the routers have to agree on the following things: the area-id (of the area they belong to); a preshared password (for authentication); hello and dead intervals (how often hello packets are sent and how long to wait to for a neighbor’s hello); and a stub area flag (whether the router is in a stub area). Neighbor routers then form adjacencies. When the routers exchange their databases, they are adjacent. To limit the volume of information exchanged on a network segment, routers go through an election process. This election nominates a designated router (DR) and a backup designated router (BDR). The DR is the sole source for updates on the segment. All other routers on the segment exchange route information with the DR and BDR. Area Border Routers (ABRs) collect all the routes for the area and combine/
summarize them into a single advertisement to the backbone area (inter-area route summarization). The backbone routers then forward these summarized routes. External route summarization may occur as well when distributing the routes to another protocol.
For more information on interior routing protocols, check out Routing TCP/IP, Volume 1 (2nd Edition) (CCIE Professional Development) by Jeff Doyle and Jennifer Carroll (Cisco Press. 2006).
Preferably using a whiteboard, start with the hierarchy of OSPF — a two-level model — and draw a diagram like the one in Figure 2-9.
Discuss having a backbone Area 0 (or 0.0.0.0) and that all areas must connect to the backbone area. Other area types include the following: stub area (an area that does not receive AS external routes); total stubby area (an area that does not allow summary routes or external routes); and not-so-stubby area (an area that can import AS external routes and send them to the backbone area, but will not receive AS external routes from the backbone or other areas). You want to include the type of routers contained in the hierarchy: internal routers, area border routers (ABR), backbone routers, and autonomous system boundary routers (ASBR). Mention that the shortest path first (SPF) calculation is performed independently on each area. You should state that the time to converge is faster than distance-vector routing protocols (DVRPs) such as RIP. Include a brief statement on the low bandwidth requirement for LSAs. Also mention support for classless routing, Variable-Length Subnet Masking (VLSM), authentication, and multipath statements.
Describe the OSPF algorithm and generally how it works: Changes in the network generate LSAs, routers exchange the LSAs, and each router builds and maintains its own database. So if the network is in a steady state, there will be refresh LSAs only every 30 minutes. You want to cover the five types of routing protocol packets: Hello, Database description, Link-state request, Link-state update, and Link-state
acknowledgment. Hello packets are multicast on 224.0.0.5 and routers use them to form adjacency relationships.
You want to cover the types of Link State Advertisements (LSAs): Router link (LSA type 1), Network link (LSA type 2), Network summary (LSA type 3), ASBR (LSA type 4), External (LSA type 5), and NSSA external (LSA type 7). Do not neglect a discussion on IPv6 and that OSPFv3 supports it. You might want to discuss briefly how vendors implement OSPFv3 using a ships-in-the-night approach to support both v3 and v2 simultaneously. OSPFv3 distributes IPv6 prefixes and uses the same interfaces
and nearly the same LSA types as OSPFv2. It uses the same methods for neighbor discovery and adjacency forming. The only differences are that OSPFv3 has to use a network link rather than a subnet.
And there can be multiple instances of OSPFv3 on a given link. You should mention that the topology in OSPFv3 is a bit different as well — using a router ID and Link ID. And because OSPFv3 uses links, there’s a new Link LSA type as well as an Intra-Area Prefix LSA for the IPv6 prefixes.
To fully answer the question, you have to go through the process of neighbor finding and adjacency creation. Routers sharing a common network segment or link will become neighbors using the Hello protocol. Routers send Hello packets out each interface with the multicast address of 224.0.0.5. When a router sees its own primary address in a Hello packet from another router, the routers are then neighbors. As
neighbors, the routers have to agree on the following things: the area-id (of the area they belong to); a preshared password (for authentication); hello and dead intervals (how often hello packets are sent and how long to wait to for a neighbor’s hello); and a stub area flag (whether the router is in a stub area). Neighbor routers then form adjacencies. When the routers exchange their databases, they are adjacent. To limit the volume of information exchanged on a network segment, routers go through an election process. This election nominates a designated router (DR) and a backup designated router (BDR). The DR is the sole source for updates on the segment. All other routers on the segment exchange route information with the DR and BDR. Area Border Routers (ABRs) collect all the routes for the area and combine/
summarize them into a single advertisement to the backbone area (inter-area route summarization). The backbone routers then forward these summarized routes. External route summarization may occur as well when distributing the routes to another protocol.
For more information on interior routing protocols, check out Routing TCP/IP, Volume 1 (2nd Edition) (CCIE Professional Development) by Jeff Doyle and Jennifer Carroll (Cisco Press. 2006).
What Is the Difference between a Routed Protocol and a Routing Protocol?
This is another “softball” question but you would be surprised by how it trips up candidates. A routed protocol is one that defines the header within a network layer packet and is used at each Layer 3 packet inspection. For example, IP addresses are used to forward packets from device to device in the network.
A routing protocol is one that shares routing information between routers. Routing protocols use messages to exchange routes and network health information. Examples of routing protocols are Routing Information Protocol (RIP), Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), Interior Gateway Routing Protocol (IGRP), and Enhanced Interior Gateway Routing Protocol (EIGRP).
A routing protocol is one that shares routing information between routers. Routing protocols use messages to exchange routes and network health information. Examples of routing protocols are Routing Information Protocol (RIP), Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), Interior Gateway Routing Protocol (IGRP), and Enhanced Interior Gateway Routing Protocol (EIGRP).
Describe Variable-Length Subnet Masking (VLSM)
Similar to the previous question, this is another favorite fundamental question. VLSM is a feature of OSPF, RIPv2, and BGP that enables classless routing. With classful routing protocols such as RIPv1 or IGRP, every autonomous system uses the same subnet mask. For example, 192.168.16.0, 192.168.17.0, and 192.168.18.0 are all Class C networks and therefore have a /24 or 255.255.255.0 subnet mask.
VLSM allows an autonomous system to support different subnet masks such as 192.168.18.0/26 and 192.168.18.128/25 to support subnets. VLSM also supports “supernetting,” such as describing 192.168.20.0/23 to include all hosts in 192.168.20.0 and 192.168.21.0. Do not be surprised if you are asked to perform a
few subnet and supernet examples.
For more information on VLSM, Google “VLSM site:cisco.com.”
VLSM allows an autonomous system to support different subnet masks such as 192.168.18.0/26 and 192.168.18.128/25 to support subnets. VLSM also supports “supernetting,” such as describing 192.168.20.0/23 to include all hosts in 192.168.20.0 and 192.168.21.0. Do not be surprised if you are asked to perform a
few subnet and supernet examples.
For more information on VLSM, Google “VLSM site:cisco.com.”
What Iis the Difference between Classful and Classless Routing protocols?
This is another softball question and one that CCNAs are often asked. Classful routing protocols are ones that strictly follow the Class A (8-bit prefix), B (16-bit prefix), and C (24-bit prefix) address boundaries.
Examples include RIP and IGRP. Classless routing protocols are ones that throw out the traditional rules of classful routing and allow summarization of routes into smaller, more manageable groups.
Classless routing is also known as supernetting and formally known as Classless Inter-Domain Routing (CIDR). For example, with the traditional Class C address of 192.168.16.0/24, a classful routing protocol would advertise only the /24. Every network device on the network would share the same subnet. If you had subnetted your network to use 192.168.16.16/25, you would have to advertise this more specific route using a classless routing protocol. The same applies to summarization or aggregation. If you have multiple Class C networks such as 192.168.16.0/24 and 192.168.17.0/24, using a classless routing protocol, these routes could be written as 192.168.16.0/23. Classless routing protocols include EIGRP, OSPF, RIPv2, and BGP.
Examples include RIP and IGRP. Classless routing protocols are ones that throw out the traditional rules of classful routing and allow summarization of routes into smaller, more manageable groups.
Classless routing is also known as supernetting and formally known as Classless Inter-Domain Routing (CIDR). For example, with the traditional Class C address of 192.168.16.0/24, a classful routing protocol would advertise only the /24. Every network device on the network would share the same subnet. If you had subnetted your network to use 192.168.16.16/25, you would have to advertise this more specific route using a classless routing protocol. The same applies to summarization or aggregation. If you have multiple Class C networks such as 192.168.16.0/24 and 192.168.17.0/24, using a classless routing protocol, these routes could be written as 192.168.16.0/23. Classless routing protocols include EIGRP, OSPF, RIPv2, and BGP.
What Well-Known Port Numbers Are You Familiar With?
This is always a good question to probe how often a candidate deals with specific higher-layer protocols.
There are too many ports to mention, but the critical ones are the following: FTP (20-21/TCP:UDP),secure shell (22/TCP:UDP), Telnet (23/TCP:UDP), TACACS (49/TCP:UDP), DNS (53/TCP:UDP), SMTP (25/TCP:UDP), TFTP (69/UDP), HTTP (80/TCP), SSL (443/TCP), POP3 (110/TCP), RADIUS (1812-1813/UDP), SNMP (161-162/UDP), BGP (179/TCP), LDAP (389/TCP:UDP), RDP (3389/TCP), and IKE/ISAKMP (500/TCP:UDP).
There are too many ports to mention, but the critical ones are the following: FTP (20-21/TCP:UDP),secure shell (22/TCP:UDP), Telnet (23/TCP:UDP), TACACS (49/TCP:UDP), DNS (53/TCP:UDP), SMTP (25/TCP:UDP), TFTP (69/UDP), HTTP (80/TCP), SSL (443/TCP), POP3 (110/TCP), RADIUS (1812-1813/UDP), SNMP (161-162/UDP), BGP (179/TCP), LDAP (389/TCP:UDP), RDP (3389/TCP), and IKE/ISAKMP (500/TCP:UDP).
Description of TCP and UDP Packet Headers
Interviewers love to throw this question in to see how well you know the fields in the TCP and UDP headers. RFC 791 defines the standard TCP header. RFC 768 defines the standard UDP header. The TCP header has a minimum size of 20 bytes and a maximum of 60 bytes, and it uses the IP protocol number of 6. The UDP header has a static size of 8 bytes and uses the IP protocol number of 17.
Following is a list of the fields in the TCP header (shown in Figure 2-7):
❑ Source Port (16 bits): Defines the source port of the connection.
❑ Destination Port (16 bits): Defines the destination port of the connection.
❑ Sequence Number (32 bits): Identifies the byte count relative to the initial sequence number established in the first SYN packet during the three-way handshake.
❑ Acknowledgment Number (32 bits): Contains the last sequence number of the current transmission as well as those received correctly by the host.
❑ Data Offset (4 bits): Identifies the number of 32-bit words in the header portion of the packet.
❑ Reserved (6 bits): As the name implies, this field is not currently used and is reserved for future use.
❑ Flags (6 bits): These are a series of 1-bit fields that are controls for the connection, as follows:
Urgent (URG); Acknowledgment (ACK); Push (PSH); Reset (RST); Synchronize (SYN); and
Finish (FIN).
❑ Window (16 bits): This field defines how many packets can be sent before an acknowledgment is received. This is critical to the performance of a connection, and the window size is adjusted accordingly.
❑ Checksum (16 bits): This field is a simple ones-complement function of a pseudo-header, the TCP header, and data that is computed by the client and recomputed by the server for integrity. If these do not match, a packet retransmission occurs. The pseudo header is the source and destination IP addresses and the TCP header.
❑ Urgent Pointer (16 bits): This field is the byte location of any urgent data that signals to the destination host to process immediately as opposed to buffering.
❑ Options and Padding (32 bits): These fields are used to pad the length of the TCP header so that it results in a multiple of 32 bits.
❑ Data: This is the data passed from the application layer (of the TCP/IP model).
As stated earlier in the chapter, UDP is used by applications that are not concerned with reliability or packet loss. These applications just need to transmit quickly and with as little overhead as possible. The UDP header has four 16-bit fields (see Figure 2-8), making the total overhead 8 bytes. Similarly to TCP, the Source Port and Destination Port fields define the ports to be used. The Length field is the length of the entire packet (header and data). As is the TCP checksum, the UDP checksum field is a onescomplement of a pseudo header, the UDP header and the data. One important note is that the UDP checksum is optional and can be set to 0.
Following is a list of the fields in the TCP header (shown in Figure 2-7):
❑ Source Port (16 bits): Defines the source port of the connection.
❑ Destination Port (16 bits): Defines the destination port of the connection.
❑ Sequence Number (32 bits): Identifies the byte count relative to the initial sequence number established in the first SYN packet during the three-way handshake.
❑ Acknowledgment Number (32 bits): Contains the last sequence number of the current transmission as well as those received correctly by the host.
❑ Data Offset (4 bits): Identifies the number of 32-bit words in the header portion of the packet.
❑ Reserved (6 bits): As the name implies, this field is not currently used and is reserved for future use.
❑ Flags (6 bits): These are a series of 1-bit fields that are controls for the connection, as follows:
Urgent (URG); Acknowledgment (ACK); Push (PSH); Reset (RST); Synchronize (SYN); and
Finish (FIN).
❑ Window (16 bits): This field defines how many packets can be sent before an acknowledgment is received. This is critical to the performance of a connection, and the window size is adjusted accordingly.
❑ Checksum (16 bits): This field is a simple ones-complement function of a pseudo-header, the TCP header, and data that is computed by the client and recomputed by the server for integrity. If these do not match, a packet retransmission occurs. The pseudo header is the source and destination IP addresses and the TCP header.
❑ Urgent Pointer (16 bits): This field is the byte location of any urgent data that signals to the destination host to process immediately as opposed to buffering.
❑ Options and Padding (32 bits): These fields are used to pad the length of the TCP header so that it results in a multiple of 32 bits.
❑ Data: This is the data passed from the application layer (of the TCP/IP model).
As stated earlier in the chapter, UDP is used by applications that are not concerned with reliability or packet loss. These applications just need to transmit quickly and with as little overhead as possible. The UDP header has four 16-bit fields (see Figure 2-8), making the total overhead 8 bytes. Similarly to TCP, the Source Port and Destination Port fields define the ports to be used. The Length field is the length of the entire packet (header and data). As is the TCP checksum, the UDP checksum field is a onescomplement of a pseudo header, the UDP header and the data. One important note is that the UDP checksum is optional and can be set to 0.
TCP Three-Way Handshake and Relate It to the TCP State Diagram
The purpose of this question is to probe how well you know basic fundamentals. The first part of the question is relatively easy. The second part is the kicker. The TCP three-way handshake establishes a TCP session, or connection, and is the foundation for all reliable communication on the Internet today. As shown in Figure 2-5, the originating client will send the first packet with a SYN flag and a sequence number (X). The destination server replies with a SYN/ACK, its own sequence number (Y), and an acknowledgment of the clients’ sequence number (X+1). The client returns an ACK and increments its own sequence number (X+1) and the sequence number of the server (Y+1). The connection is now established and the client can begin transmitting the data. The connection will remain open until one of the following happens: The client or server sends a FIN packet to finish or an RST packet to reset the connection, or the connection times out. All this exchange is referenced in the TCP state diagram shown in Figure 2-6. It is well worth the time to understand and be able to draw this diagram from memory. It is impressive to see candidates who understand the inner workings of the protocol.
Subscribe to:
Posts (Atom)