Network Topologies, Protocols, and Configuration Part 3

a) Cat 3 cable or better

c) Shielded cabling

-PoE requires Cat 3 cable or better while PoE+ must use Cat 5e cable or better. Drawing power down the cable generates more heat that can adversely affect data rates.

-PoE should use shielded cabling as it is capable of dispersing heat more efficiently than unshielded cabling.

b) Cable crimper

-A cable crimper creates a patch cord and fixes a plug to a cable. The tools are specific to the connector and cable type, though some may have modular dies to support a range of RJ-type plugs.

b) Duplexing issue

-Setting both a NIC and switch port to auto-negotiate will solve a duplex mismatch which will slow the link down by causing high packet loss and late collisions.

-A short happens when two conductors join, usually because the insulating wire is damaged or poorly wired connectors.

a) Decibels

-Decibels (dB) express attenuation or the loss of signal strength. dB expresses the ratio between two measurements: signal strength at origin and signal strength at the destination.

-Noise is anything transmitted within or close to the channel that is not the intended signal, causing errors in data and forcing retransmissions. This is known as the signal-to-noise ratio (SNR).

a) Incorrect transceivers

b) Dirty optical cables

c) Mismatched coupled cables

-In fiber optic cables, dirt, dust, or grease in the transmission path will greatly reduce signal strength or block transmission completely.

-Manufacturers make the transceivers used in each optical interface, whether SFP, GBIC, or another type of media converter, for a specific type of optical fiber. Using incorrect transceivers can cause signal loss.

-Any mismatch between fiber optic cables coupled together will result in data loss. This can occur if the coupling does not properly align the cables, if they are different sizes, or if they are damaged.

NOTE: Fiber optic cables are not susceptible to electromagnetic interference which is noise that occurs when a magnetic filed around one electrical circuit or device interferes with the signal on an adjacent circuit.

d) By causing interference

-nstallers normally route the cable through conduits or wall spaces, avoiding excessive bends and proximity to electrical power cables and fittings, such as fluorescent lights, as these could cause interference.

-Reversing the transmit and receive (TX/RX reverse) happens when an installer connects the conductors from one pair to pins belonging to a different pair.

d) Router

-A router connects two or more packet-switched networks. It serves two primary functions: managing network traffic by forwarding data packets to their intended IP addresses and allowing multiple devices to use the same Internet connection.

d) An IPAM service

-IPAM or IP address management is designed to scan DHCP and DNS servers and log IP address usage to a database. It can be used to manage and reconfigure DHCP and DNS servers remotely.

b) A packet sniffer

-A packet sniffer is the minimum the network admin needs to gather information for examination later. A packet sniffer such as winpcap for Windows is able to read packets on a port and save the information to a file on disk.

-A packet sniffer will interrogate the frames received by a network adapter using a special driver; Windows uses winpcap. It can save the captured frame into a file such as a .pcap file.

-A protocol analyzer is a tool (hardware or software) used to capture and analyze signals and data traffic over a communication channel.

d) nslookup

-The nslookup command is a Windows utility that is used to troubleshoot domain name system (DNS) records. The command returns host (A) records by default and the set type argument is used to specify a record type. A mail exchanger (MX) record specifies an email server. An incorrect or missing MX record will cause mail delivery problems.

c) Signal Strength

-Depending on the position of the smart phone, the Wi-Fi analyzer can display how strong the signal is from the location of the access point (AP). This can be used to troubleshoot signal loss in certain areas.

-An AP list will show all available wireless access points that the smart phone is able to hear. The Service Set Identifier (SSID) of the AP will be listed.

d) WAP

-Wireless Access Points (WAP) allows wireless capable devices and wired networks to connect through a wireless standard. A WAP is a separate network device with a built-in antenna, transmitter, and adapter.

-A WiFi extender is used to extend the coverage area of a WiFi network. It works by receiving the existing WiFi signal, amplifying it, and then transmitting the boosted signal.

#WLAN controller enables centralized management of WAPs.

#NOTE: When comptia talks about a network device used for improving wireless signal strength within homes and small offices, then they're just talking about wireless range extender.

a) Cisco router

-The ability to use a router as a TFTP server can be quite useful. The Cisco router is the best device to use to be configured as a TFTP server.

-A CSU/DSU (Channel Service Unit/Data Service Unit) is a hardware device about the size of a modem that converts digital data frames from the communications technology used on a LAN into frames appropriate to a WAN and vice versa.

c) The OUTPUT chain

-The OUTPUT chain is a firewall ruleset for outgoing connections. Verify that this chain does not prevent the outgoing connection using ping or the remote host's IP (Internet Protocol) address or name. Remote hosts need the connection going from the internal network.

-INPUT chain is a firewall ruleset for incoming connections. Other hosts are able to ping the LINUX server, so this chain does not have any issues.

-The FORWARD chain is a firewall ruleset for connections that are passing through the server.

-PREROUTING chain is processed before INPUT, OUTPUT or FORWARD chains.

a) 8 bits

-Telnet provides a bi-directional, 8-bit byte-oriented communications facility through which operations are sent as 8-bit bytes for the server to interpret. Telnet commonly provides remote access to a variety of communications systems. Telnet is often used for remote maintenance of network communications devices.

b) Try using a different channel on the WAP to reduce interference from other 2.4 GHz devices.

-A variety of factors can cause latency. In this scenario, interference is the most likely culprit. Checking for interference emitters is a good place to start. Also, check if the WAP is set to use the same channel as another WAP or a 2.4 GHz cordless phone system.

-NOTE: Moving the WAP to a lower physical location would most likely decrease the signal quality and increase latency.

d) arp -a

-To display the ARP table in this system, enter "arp -a." This command will also show the ARP table in the Windows command prompt. ARP Command is a TCP/IP utility used for viewing and modifying the local Address Resolution Protocol (ARP) cache. ARP cache contains recently resolved MAC addresses of IP hosts on the network.

#arp -e is not a valid command & will not display any results....LOL!!!

b) Show ip cache flow

-The show ip cache flow command displays the NetFlow accounting statistics. This would show a visualization of general NetFlow data.

-To obtain more administrative privileges and display the statistics for NetFlow accounting data export, including the main cache, use the command:

show ip flow-export

(in user EXEC or privileged EXEC mode) This command shows more advanced accounting statistics than the show ip cache flow command.

-Iperf is a network performance utility that can generate TCP and UDP traffic to test bandwidth, latency and packet loss.

-The show mls NetFlow ip displays NetFlow IP entries.

b) iptables

-The iptables command line utility is used to edit the rules enforced by the Linux kernel firewall. It can change INPUT, OUTPUT and FORWARD chains that are firewall rulesets.

a) Phishing

b) Social Engineering

d) Spoofing

-Phishing is a combination of social engineering and spoofing (disguising one computer resource as another).

-Spoofing uses social engineering. This is an attack technique where the attacker disguises their identity.

-Pharming is a means of redirecting users from a legitimate website to a malicious one. Pharming does not use social engineering techniques to trick the user, but corrupts the way the computer performs Internet name resolution.

a) Address Resolution Protocol (ARP)

b) Domain Name System (DNS)

-DNS poisoning compromises name resolution. It can redirect users to fraudulent sites (pharming), involve DoS attacks by directing traffic to an invalid IP, intercept and modify traffic, or pollute the client's name cache.

-ARP poisoning is where an attacker redirects an IP address to the MAC address of a computer that is not the intended recipient, and can be used to perform DoS, spoofing, and man-in-the-middle (MitM) attacks.

-War driving is a practice of using a Wi-Fi sniffer to detect WLANs and then either making use of them (if they are open/unsecured) or trying to break into them (using WEP and WPA cracking tools).

Previous Next

a) VLAN hopping

b) On-path

d) Brute force

-Brute force is password attack.

-An on-path attack is a form of eavesdropping where the attacker makes an independent connection between two victims and steals information to use fraudulently.

-A rogue AP can be combined with de-authentication attack. This sends a stream of spoofed death frame to cause a client to de-authenticate from an AP.

a) Spoofing

d) Rogue access point

-Rogue AP is an unauthorized device or service, such as a wireless AP DHCP server or DNS, on a corporate or private network that allows unauthorized individuals to connect to the network.

-Spoofing is defined as disguising one computer resource as another. (two SSIDs with the same name is a hint of spoofing)

a) Phishing

c) Biometrics

d) De-authentication

-De-authentication sendsspoofed death frames to de-authenticate a client from an AP, which allows an attacker to interpose a rogue AP or perform a DoS attack.

-Biometrics is vulnerable to spoofing methods.

a) Spoofing

d) Evil Twin

-A rogue AP masquerading as a legitimate one is called an evil twin, and is sometimes known as Wiphishing. An evil twin might have a similar or same name (SSID) to the legitimate one, and the attacker might use some DoS technique to overcome the legitimate AP.

a) Ransomware

d) Crypto-malware

-Crypto-malware is ransomware that encrypts data files, and the user is unable to access files without obtaining the private encryption key. This attack is difficult to mitigate unless the user has backups of the encrypted files.

b) Distributed Denial of Service (DDoS)

c) Amplification Attack

d) Distributed Reflection Denial of Service (DRDoS)

a) Site survey

-A site survey is a critical planning tool to ensure that the Wireless Local Area Network (WLAN) delivers acceptable data rates to the supported number of devices in all the physical locations expected.

-A wiring diagram (or pin-out) shows detailed information about the termination of twisted pairs in an RJ-45 or RJ-48C jack or Insulation Displacement Connector (IDC).

-Rack diagram records the position of each appliance in the rack.

b) SOP

-Standard Operating Procedure (SOP) sets out the principal goals and considerations, such as budget, security, or customer contact standards, for performing a task. It also identifies lines of responsibility and authorization for performing it.

-An acceptable use policy (AUP) sets out the permitted uses of a product or service. It might also state explicitly prohibited uses. Organizations might use such a policy in different contexts.

a) Incident

-An incident response plan sets out the procedures, tools, methods of communication, and guidelines for dealing with security incidents. An incident occurs when there is a security breach or an attempted breach.

-Data loss prevention (DLP) is a software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.

a) Service level

-A service level agreement (SLA) is a contractual agreement setting out the detailed terms provided under an ongoing service.

NOTE: if it's a report completed by managed service providers , then it's an audit.

d) Logical

a) Floor plan

-A floor plan is a detailed diagram of wiring and port locations. For example, the IT department might use floor plans to document wall port locations and cable runs in an office.

a) Baseline

-A baseline is a snapshot of a known good configuration and how a device operates at that known good configuration.

a) Link state

-A link state algorithm allows a router to store the complete network topology and assess the least-cost paths from the topology database.

-For e.g: OSPF

c) Enhanced Interior Gateway Routing Protocol (EIGRP)

-EIGRP is a distance vector-based routing protocol and uses a metric composed of several administrator weighted elements.

b) Border Gateway Protocol (BGP)

-The Border Gateway Protocol (BGP) is designed between routing domains and used as the routing protocol on the Internet, primarily between Internet Service Providers (ISPs).

d) 1

-A static route (which is not OSPF, OSPF default AD value is 110) has a default administrative distance (AD) value of 1. The value expresses the relative trustworthiness of the protocol supplying the route.

-BGP has default AD value of 20, EIGRP > 90, OSPF > 110.

c) Exterior gateway protocol

-An Exterior Gateway Protocol (EGP) is one that can advertise routes between autonomous systems. An EGP includes a field to communicate the network's autonomous system ID and allows network owners to determine whether they can use paths through another organization's network.

c) Distance vector

-Distance vector protocols use the number of hops to the destination as the metric. The route with the fewest hops is the least-cost path, and the network will select it for use.

d) Check if the TTL goes to 0.

-The TTL IP header field reduces by one every time a router (referred to as a hop) forwards a packet. When pinging a destination, the routing loop will eventually reduce the TTL value to 0.

-The IP header field has the pin sticking out, this is the TTL.

d) Enhanced Interior Gateway Routing Protocol (EIGRP)

-The EIGRP is a distance vector-based routing protocol and uses a metric composed of several administrator weighted elements such as "bandwidth" and "delay".

b) OSPF

-As the name implies open shortest path first (OSPF) is a link state type of routing protocol ideal for hierarchical systems and networks. OSPF is suitable for organizations with multiple redundant paths between networks.

b) The control plane decides how to prioritize traffic.

c) The service is basically a traffic shaper.

d) The data plane handles the switching of traffic.

#In terms of QoS, network functions divide into three planes.

-The control plane makes decisions about how to prioritize traffic and where it should switch them.

-The data plane handles the actual switching of traffic. This basically forwards packets through the router to their destination.

-Protocols, appliances, and software that can apply these three functions are known as traffic shapers or bandwidth shapers.

c) Configure a static route

-A static route is manually added to the routing table and only changes if edited by the administrator. This is ideal for temporary solutions to rapidly set up a route for network testing or quick troubleshooting.

b) Captive portal

-Most captive portal issues arise because the redirect does not work. The captive portal should use HTTPS. Most modern browsers will block redirection to sites that do not use TLS.

- An encryption protocol mismatch will cause the connection to fail, even if the correct credentials are supplied. Same with disassociation or de-authentication.

a) Channel overlap

b) Interference

-At least 25 MHz spacing should be allowed to avoid channel overlap.

-Interference could be caused by number of factors including neighboring equipment that may use the same frequency of radio waves.

-Absorption refers to the degree to which walls and windows will reduce signal strength.

-NOTE: The most likely cause of a frequency mismatch is where the AP is configured for 5 GHz operation, but a station does not have a 5 GHz radio.

d) Passphrase

-If SSID broadcast is suppressed, a station can still connect to a WLAN by entering the network name manually. If a passphrase is used, make sure it is entered correctly.

-RSSI is the strength of the signal from the transmitter at the client end.

a) Distance

-Wireless access points can only broadcast radio signals a certain distance. The further away from the wireless access point, the less signal strength, leading to poor connections.

a) SSID

b) Passphrase

b) Refraction

-Glass or water can cause radio waves to bend and take a different path to a receiver and cause the data rate to drop. This is known as refraction.

c) Incorrect antenna placement

-Incorrect antenna placement can cause signal issues. Some antennas are meant to be ceiling mounted while others are designed for wall placement. This is because some antenna signals function in certain directions.

-Keyword to distinguish if it's antenna type or antenna placement is by understanding that it is talking abt "beyond the current space". Just by placing the antenna at the correct space, this problem could be solved, saving u time & money that's required to replace a new antenna.

b) Incorrect antenna type

-A unidirectional (not omnidirectional) antenna is suitable for direct point-to-point connections.

b) Polarization

-Polarization refers to the orientation of the wave propagating from the antenna to maximize signal strength; the transmission and reception antennas should normally use the same polarization.

c) AP is in the wrong location

d) Furniture is absorbing the signal.

-Cubicles are used in an office situation, so even though it mentions furniture, we should understand these don't contain mirrors.

-Signal absorption that occurs through walls, windows, furniture, and even people will reduce signal strength. Concrete is the most effective absorber of radio signals.

-The best location for an AP is at the center of the office floor and on the ceiling to minimize the signal absorption from furniture and cubicle walls.

a) Channel utilization

-When multiple APs use the same channel, opportunities to transmit are reduced. Channel utilization can be measured from the AP or using a Wi-Fi analyzer. As a design goal, a channel should exhibit no more than 50% utilization.

d) Spectrum analyzer

-Received signal strength indication (RSSI) signal strength can help identify WiFi signal issues. A spectrum analyzer, usually a handheld device, is used to analyze radio or electrical interferences. The exact location can be pinpointed using this device.

-A power meter or light meter is used to test a fiber optic cable to determine if there is a break in the cable.

-A protocol analyzer is a software tool like Wireshark. Working in conjunction with a packet sniffer, it can decode a captured frame to reveal its contents in a readable format.

c) Reflection

-Mirrors or shiny surfaces cause signals to reflect, meaning that a variable delay is introduced. Reflection causes packets to be lost and consequently the data rate to drop.

-Refraction just means glass or water can cause radio waves to bend!!!!!!!!!!!!

b) Overcapacity

-"Saturation" is the keyword here.

Overcapacity or device saturation occurs when too many client devices connect to the same AP. The maximum no. of clients that an AP can support varies, depending on the Wi-Fi standard used and the type of network traffic generated.

-Jitter is similar to latency, however, rather than steady delays, jitter is a variable delay in the Round Trip Time (RTT) of packets.

a) Captive portal

-A captive portal is a type of wireless setup with a web page or website to which a client is redirected before being granted full network access.

d) Wrong service set identifier (SSID)

-A Service Set Identifier (SSID) identifies a network. Connecting to an incorrect network is common when a location has multiple networks with varying access to resources (such as found with a guest network versus a private network).

-A variety of security types can be used in a wireless network. A mismatch will cause a connection to fail. In this case the connection does not fail but internal resources cannot be accessed.

a) Signal-to-noise ratio

b) Power level

d) Channel Overlap.

-Some devices allow for power level adjustments to help to cover longer distances.

-Channel overlap can cause signal issues. At least 25 MHz spacing should be allowed to avoid channel overlap. In practice, therefore, no more than three nearby 802.11b/g APs can have non-overlapping channels.

-The comparative strength of the data signal to the background noise is called the Signal-to-Noise Ratio (SNR). This figure should be at least 25 dB or higher.

a) Effective isotropic radiated power (EIRP)

-The power at which an access point transmits is configurable. EIRP is calculated as the sum of transmit power, antenna cable/connector loss, and antenna gain.

c) Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)

-CSMA/CA protocol uses schemes, such as "request to send", to gain access to the media. Nodes listen to the media before transmitting and transmit when the media is clear. A node wanting to transmit but detecting activity, must wait and try later.

-CSMA/CD protocol defines methods for detecting a collision. When a signal present on the interface transmits and receives lines simultaneously, the node broadcasts a jam signal.

b) Half-duplex

-The collision detection mechanism means that only half-duplex transmission is possible. This means that a node can transmit or receive, but it cannot do both at the same time.

-Full-duplex communication is not possible with collision detection.

d) Port mirroring

-Port mirroring copies all of the packets sent to one or more source ports to a mirror (or destination) port. On a Cisco switch, this refers to a Switched Port Analyzer (SPAN).

-A spanning tree is a means for bridges to organize themselves into a hierarchy. The bridge at the top of the hierarchy is the root bridge.

-STP information is packaged as a Bridge Protocol Data Unit (BPDU)

c) Hosts are allowed to discover other nodes.

d) Hosts can configure IPv6 addresses automatically.

-ND protocol features address auto-configuration that enables a host to configure IPv6 addresses for its interfaces automatically and detect whether an address is already in use on the local network.

-The ND protocol features local address resolution, which allows a host to discover other nodes and routers on the local network.

a) Each switch determines the shortest path to the root.

d) Switches are organized into a hierarchy.

-Each switch determines the shortest path to the root bridge by exchanging information with other switches. This STP information gets packaged as bridge protocol data unit (BPDU) multicast frames.

-Switches are organized into hierarchy, with the switch at the top of the hierarchy being the root. The switch with the lowest ID, comprising a priority value and the MAC address, will be selected as the root.

b) Auxiliary VLAN

d) Multiple broadcast domains

-Auxiliary means supplementing or supporting. So, in this case, voice or auxiliary VLAN is used to distinguish a PC/data & VoIP without having to configure a trunk. Most switches now support the concept of a voice or auxiliary VLAN.

-A VLAN creates its own broadcast domain. Therefore, the engineer uses multiple broadcast domains when integrating a data and voice network with VLANs.

a) Switched port analyzer

d) Port mirroring.

-By default, sniffing of unicast traffic by hosts attached to the same switch is prevented. Port mirroring copies all packets sent to one or more source ports to a mirror (or destination) port.

-There are circumstances in which capturing and analyzing the network traffic is a legitimate activity. This capability can be configured on a Cisco switch and referred to as a switched port analyzer (SPAN).

b) Link aggregation

-Port aggregation combines two or more separate links into a single channel. The Link Aggregation Control Protocol (LACP) can recover from a failed link between a switch port and end system.

-A tagged port refers to a virtual LAN (VLAN) configuration and will normally be the port operating as a trunk. That is, it is capable of transporting traffic addressed to multiple VLANs.

-A port security configuration validates the MAC address of end systems that connect to a switch port.

b) Port aggregation

-Failover is the ability to seamlessly and automatically switch to a reliable backup system.

Either redundancy or moving into a standby operational mode when a primary system component fails should achieve failover and reduce or eliminate negative user impact.

The Link Aggregation Control Protocol (LACP) can auto-negotiate the bonded link between the switch ports and end systems.

b) Trunks

-A trunk interconnects between switches on large networks. A sysadmin will configure each switch as a trunk port for this purpose.

d) Speed

-Switches support a range of Ethernet standards so older and newer network adapters can all connect to the same network. In most cases, a sysadmin sets a port on the switch to autonegotiate speed (10/100/1000 Mbps.)

b) Duplicate MAC address

-A duplicate MAC address causes both hosts to contend with each other when responding to ARP queries. Then, communications could be split between them or reach only one of the hosts.

a) Jumbo frames

-A jumbo frame supports a data payload of up to around 9,000 bytes (rather than 1500). This reduces the number of frames that need transmitting, which reduces the number of processing that switches and routers do.

a) MAC

-MAC refers to the methods a network technology uses. Ethernet uses a contention-based MAC system. Each network node connected to the same media is in the same collision domain.

-Contention is a media access method that is used to share a broadcast medium. In contention, any computer in the network can transmit data at any time. This system breaks down when two computers attempt to transmit at the same time (also called collision.)

b) The crossover cable uses T568A on one end and T568B on the other end.

d) Transmit occurs on pins 3 and 6 of the switch.

-As an intermediate system, a switch port uses MDI-X and receives on pins 1 and 2 and transmits on pins 3 and 6.

The cable between the host interface port and switch interface port should be straight through (either T568A on both ends or T568B on both ends) and not a crossover cable.

d) When the MAC address table cannot find the MAC address

-If the system cannot find a MAC address in the MAC address table, then the switch acts like a hub and transmits the frame out of all of the ports, except for the source port.

a) 5G

-5G real-world speeds range from about 50 Mbps to 300 Mbps currently. 5G uses different spectrum bands from low (sub-6 GHz) to medium/high (20-60 GHz).

-4G or LTE (Long Term Evolution) speed ==> 150 Mbps. Real world speed is 20 Mbps.

-3G speed ==> 3.1 Mbps downlink and 1.8 Mbps uplink (CDMA2000/EV-DO)

-2G speed ==> 14.4 kbps (GSM-based phones can only use SIM card if they're unlocked!!!!!!!!)GSM uses TDMA.