Computer Network Question Bank: FAQ's With Answers From Computer Network Domain
Computer Network Question Bank: FAQ's With Answers From Computer Network Domain
Computer Network Question Bank: FAQ's With Answers From Computer Network Domain
NETWORK
QUESTION BANK
FAQ’s with Answers from Computer Network Domain
Oral Question Bank
Define Network?
What is a Link?
At the lowest level, a network can consist of two or more computers directly connected by some
physical medium such as coaxial cable or optical fiber. Such a physical medium is called as Link.
What is a node?
A network can consist of two or more computers directly connected by some physical medium such
as coaxial cable or optical fiber. Such a physical medium is called as Links and the computer it
connects is called as Nodes.
A node that is connected to two or more networks is commonly called as router or Gateway. It
generally forwards message from one network to another.
If the physical links are limited to a pair of nodes it is said to be point-point link.
If the physical links are shared by more than two nodes, it is said to be Multiple Access.
a. Security/Encapsulation
b. Distributed database
c. Faster Problem solving
d. Security through redundancy
e. Collaborative Processing
What are the criteria necessary for an effective and efficient network?
a. Performance
It can be measured in many ways, including transmit time and response time.
b. Reliability
It is measured by frequency of failure, the time it takes a link to recover from a failure, and the
network's robustness.
c. Security
Security issues includes protecting data from unauthorized access and viruses.
a. Number of Users
b. Type of transmission medium
c. Hardware
d. Software
a. Frequency of failure
b. Recovery time of a network after a failure
a. Unauthorized Access
b. Viruses
What is Protocol?
a. Connectivity
b. Cost-effective Resource Sharing
c. Support for common Services
d. Performance
Define Routing?
The process of determining systematically hoe to forward messages toward the destination nodes
based on its address is called routing.
The processes on each machine that communicate at a given layer are called peer-peer process.
It is possible that a switch receives packets faster than the shared link can accommodate and stores
in its memory, for an extended period of time, then the switch will eventually run out of buffer
space, and some packets will have to be dropped and in this state is said to congested state.
The duration of time it takes to send a message from one end of a network to the other and back, is
called RTT.
If the message is sent from a source to a single destination node, it is called Unicasting.
If the message is sent to some subset of other nodes, it is called Multicasting.
If the message is sent to all the m nodes in the network it is called Broadcasting.
What is Multiplexing?
Multiplexing is the set of techniques that allows the simultaneous transmission of multiple signals
across a single data link.
What is FDM?
FDM is an analog technique that can be applied when the bandwidth of a link is greater than the
combined bandwidths of the signals to be transmitted.
What is WDM?
WDM is conceptually the same as FDM, except that the multiplexing and demultiplexing involve
light signals transmitted through fiber optics channel.
What is TDM?
TDM is a digital process that can be applied when the data rate capacity of the transmission
medium is greater than the data rate required by the sending and receiving devices.
In STDM, the multiplexer allocates exactly the same time slot to each device at all times, whether or
not a device has anything to transmit.
a. Physical Layer
b. Data Link Layer
c. Network Layer
d. Transport Layer
e. Session Layer
f. Presentation Layer
g. Application Layer
a. Physical Layer
b. Data link Layer and
c. Network Layers
a. Session Layer
b. Presentation Layer and
c. Application Layer
Which layer links the network support layers and user support layers?
The Transport layer links the network support layers and user support layers.
Physical layer coordinates the functions required to transmit a bit stream over a physical medium.
a. Physical characteristics of interfaces and media
b. Representation of bits
c. Data rate
d. Synchronization of bits
e. Line configuration
f. Physical topology
g. Transmission mode
The Data Link Layer transforms the physical layer, a raw transmission facility, to a reliable link and
is responsible for node-node delivery.
1. Framing: Frames are the streams of bits received from the network layer into manageable
data units. This division of stream of bits is done by Data Link Layer.
2. Physical Addressing: The Data Link layer adds a header to the frame in order to define
physical address of the sender or receiver of the frame, if the frames are to be distributed to
different systems on the network.
3. Flow Control: A flow control mechanism to avoid a fast transmitter from running a slow
receiver by buffering the extra bit is provided by flow control. This prevents traffic jam at
the receiver side.
4. Error Control: Error control is achieved by adding a trailer at the end of the frame.
Duplication of frames are also prevented by using this mechanism. Data Link Layers adds
mechanism to prevent duplication of frames.
5. Access Control: Protocols of this layer determine which of the devices has control over the
link at any given time, when two or more devices are connected to the same link.
The Network Layer is responsible for the source-to-destination delivery of packet possibly across
multiple networks (links).
a. Logical Addressing
b. Routing
The Transport Layer is responsible for source-to-destination delivery of the entire message.
a. Service-point Addressing
b. Segmentation and reassembly
c. Connection Control
d. Flow Control
e. Error Control
The Session layer is the network dialog Controller. It establishes, maintains and synchronizes the
interaction between the communicating systems.
a. Dialog control
b. Synchronization
The Presentation layer is concerned with the syntax and semantics of the information exchanged
between two systems.
a. Translation
b. Encryption
c. Compression
The Application Layer enables the user, whether human or software, to access the network. It
provides user interfaces and support for services such as e-mail, shared database management and
other types of distributed information services.
a. Network virtual Terminal
b. File transfer, access and Management (FTAM)
c. Mail services
d. Directory Services
What are the different link types used to build a computer network?
a. Cables
b. Leased Lines
c. Last-Mile Links
d. Wireless Links
a. Guided Media
i. Twisted - Pair cable
1. Shielded TP
2. Unshielded TP
ii. Coaxial Cable
iii. Fiber-optic cable
b. Unguided Media
i. Terrestrial microwave
ii. Satellite Communication
a. Single-Bit error
In a single-bit error, only one bit in the data unit has changed
b. Burst Error
A Burst error means that two or more bits in the data have changed.
What is CRC?
CRC, is the most powerful of the redundancy checking techniques, is based on binary division. CRC
appends a sequence of redundant bits derived from binary division to the data unit. The divisor in
the CRC generator is often represented as an algebraic polynomial.
What is Checksum?
Checksum is used by the higher layer protocols (TCP/IP) for error detection
Data link protocols are sets of specifications used to implement the data link layer. The categories
of Data Link protocols are
1. Asynchronous Protocols
2. Synchronous Protocols
a. Character Oriented Protocols
b. Bit Oriented protocols
The correction of errors is more difficult than the detection. In error detection, checks only any
error has occurred. In error correction, the exact number of bits that are corrupted and location in
the message are known. The number of the errors and the size of the message are important
factors.
Forward error correction is the process in which the receiver tries to guess the message by using
redundant bits.
Define Retransmission?
Retransmission is a technique in which the receiver detects the occurrence of an error and asks the
sender to resend the message. Resending is repeated until a message arrives that the receiver
believes is error-freed.
Flow control refers to a set of procedures used to restrict the amount of data that the sender can
send before waiting for acknowledgment.
Error control is both error detection and error correction. It allows the receiver to inform the
sender of any frames lost or damaged in transmission and coordinates the retransmission of those
frames by the sender. In the data link layer, the term error control refers primarily to methods of
error detection and retransmission.
Error control is both error detection and error correction. It allows the receiver to inform the
sender of any frames lost or damaged in transmission and coordinates the retransmission of those
frames by the sender. In the data link layer, the term error control refers primarily to methods of
error detection and retransmission. Error control in the data link layer is often implemented
simply: Any time an error is detected in an exchange, specified frames are retransmitted. This
process is called automatic repeat request (ARQ).
In Stop and wait protocol, sender sends one frame, waits until it receives confirmation from the
receiver (okay to go ahead), and then sends the next frame.
Error correction in Stop-and-Wait ARQ is done by keeping a copy of the sent frame and
retransmitting of the frame when the timer expires.
The protocol specifies that frames need to be numbered. This is done by using sequence numbers. A
field is added to the data frame to hold the sequence number of that frame. Since we want to
minimize the frame size, the smallest range that provides unambiguous communication. The
sequence numbers can wrap around.
What is Pipelining?
In networking and in other areas, a task is often begun before the previous task has ended. This is
known as pipelining.
The sliding window is an abstract concept that defines the range of sequence numbers that is the
concern of the sender and receiver. In other words, he sender and receiver need to deal with only
part of the possible sequence numbers.
What is subnet?
A generic term for section of a large networks usually separated by a bridge or router.
Transmission is a physical movement of information and concern issues like bit polarity,
synchronization, clock etc.
Communication means the meaning full exchange of information between two communication
media.
What is RAID?
A method for providing fault tolerance by using multiple hard disk drives.
When the computers on the network simply listen and receive the signal, they are referred to as
passive because they don't amplify the signal in any way. Example for passive topology -linear bus.
A gateway operates at the upper levels of the OSI model and translates information between two
completely different network architectures or data formats.
What is attenuation?
The address for a device as it is identified at the Media Access Control (MAC) layer in the network
architecture. MAC address is usually stored in ROM on the network adapter card and uniquely
identifies a device on the network. It is also known as physical address or Ethernet address. A MAC
address is made up of 6-bytes.
Bit rate is the number of bits transmitted during one second whereas baud rate refers to the
number of signal units per second that are required to represent those bits.
baud rate = (bit rate / N)
where, N is no-of-bits represented by each signal shift.
What is Bandwidth?
Every line has an upper limit and a lower limit on the frequency of signals it can carry. This limited
range is called the bandwidth.
Signals are usually transmitted over some transmission media that are broadly classified in to two
categories.
a.) Guided Media: These are those that provide a conduit from one device to another that include
twisted-pair, coaxial cable and fiber-optic cable. A signal traveling along any of these media is
directed and is contained by the physical limits of the medium. Twisted-pair and coaxial cable use
metallic that accept and transport signals in the form of electrical current. Optical fiber is a glass or
plastic cable that accepts and transports signals in the form of light.
b.) Unguided Media: This is the wireless media that transport electromagnetic waves without
using a physical conductor. Signals are broadcast either through air. This is done through radio
communication, satellite communication and cellular telephony.
1. 802.1 is an internetworking standard for compatibility of different LANs and MANs across
protocols.
2. 802.2 Logical link control (LLC) is the upper sublayer of the data link layer which is non-
architecture-specific, that is remains the same for all IEEE-defined LANs.
3. Media access control (MAC) is the lower sublayer of the data link layer that contains some
distinct modules each carrying proprietary information specific to the LAN product being
used. The modules are Ethernet LAN (802.3), Token ring LAN (802.4), Token bus LAN
(802.5).
4. 802.6 is distributed queue dual bus (DQDB) designed to be used in MANs.
1. Repeater: Also called a regenerator, it is an electronic device that operates only at physical
layer. It receives the signal in the network before it becomes weak, regenerates the original
bit pattern and puts the refreshed copy back in to the link.
2. Bridges: These operate both in the physical and data link layers of LANs of same type. They
divide a larger network in to smaller segments. They contain logic that allow them to keep
the traffic for each segment separate and thus are repeaters that relay a frame only the side
of the segment containing the intended recipient and control congestion.
3. Routers: They relay packets among multiple interconnected networks (i.e. LANs of
different type). They operate in the physical, data link and network layers. They contain
software that enable them to determine which of the several possible paths is the best for a
particular transmission.
4. Gateways: They relay packets among networks that have different protocols (e.g. between
a LAN and a WAN). They accept a packet formatted for one protocol and convert it to a
packet formatted for another protocol before forwarding it. They operate in all seven layers
of the OSI model.
What is ICMP?
ICMP is Internet Control Message Protocol, a network layer protocol of the TCP/IP suite used by
hosts and gateways to send notification of datagram problems back to the sender. It provides
messaging and communication for protocols within the TCP/IP stack. It uses the echo test / reply to
test whether a destination is reachable and responding. It also handles both control and error
messages that are used by network tools such as PING.
What are the data units at different layers of the TCP / IP protocol suite?
The data unit created at the application layer is called a message, at the transport layer the data unit
created is called either a segment or an user datagram, at the network layer the data unit created is
called the datagram, at the data link layer the datagram is encapsulated in to a frame and finally
transmitted as signals along the transmission media.
The address resolution protocol (ARP) is used to associate the 32 bit IP address with the 48 bit
physical address, used by a host or a router to find the physical address of another host on its
network by sending a ARP query packet that includes the IP address of the receiver.
The reverse address resolution protocol (RARP) allows a host to discover its Internet address when
it knows only its physical address.
What is the minimum and maximum length of the header in the TCP segment and IP
datagram?
The header should have a minimum length of 20 bytes and can have a maximum length of 60 bytes.
What is the difference between TFTP and FTP application layer protocols?
The Trivial File Transfer Protocol (TFTP) allows a local host to obtain files from a remote host but
does not provide reliability or security. It uses the fundamental packet delivery services offered by
UDP.
The File Transfer Protocol (FTP) is the standard mechanism provided by TCP / IP for copying a file
from one host to another. It uses the services offer by TCP and so is reliable and secure. It
establishes two connections (virtual circuits) between the hosts, one for data transfer and another
for control information.
1. BUS topology: In this each computer is directly connected to primary network cable in a
single line.
Advantages: Inexpensive, easy to install, simple to understand, easy to extend.
2. STAR topology: In this all computers are connected using a central hub.
Advantages: Can be inexpensive, easy to install and reconfigure and easy to trouble shoot
physical problems.
3. RING topology: In this all computers are connected in loop. Advantages: All computers
have equal access to network media, installation can be simple, and signal does not degrade
as much as in other topologies because each computer regenerates it.
A network in which there are multiple network links between computers to provide multiple paths
for data to travel.
In a baseband transmission, the entire bandwidth of the cable is consumed by a single signal. In
broadband transmission, signals are sent on multiple frequencies, allowing multiple signals to be
sent simultaneously.
Routable protocols can work with a router and can be used to build large networks. Non-Routable
protocols are designed to work on small, local networks and cannot be used with a router.
One of two sublayers of the data link layer of OSI reference model, as defined by the IEEE 802
standard. This sublayer is responsible for maintaining the link between computers when they are
sending data across the physical network connection.
Virtual channel is normally a connection from one source to one destination, although multicast
connections are also permitted. The other name for virtual channel is virtual circuit.
Along any transmission path from a given source to a given destination, a group of virtual circuits
can be grouped together into what is called path.
Sending a message to a group is called multicasting, and its routing algorithm is called multicast
routing.
It is a problem that can ruin TCP performance. This problem occurs when data are passed to the
sending TCP entity in large blocks, but an interactive application on the receiving side reads 1 byte
at a time.
It is a protocol used to advertise the set of networks that can be reached with in an autonomous
system. BGP enables this information to be shared with the autonomous system. This is newer than
EGP (Exterior Gateway Protocol).
What are the basic differences between Internet, Intranet and Extranet?
The terms Internet, Intranet and Extranet are used to describe how a network application should be
accessed. In Internet anyone can access the application from anywhere in world. In Intranet only
the authorized users from the company for which the application was built can access the
application. In Extranet selected external users are allowed to access the application which was
built for Internet.
What does the term topology defines in computer network?
A topology is the physical layout which defines how computers are connected with each other’s in a
computer network.
A company has offices in Jaipur and Delhi. What type of computer network it will use to
connect these offices?
WAN (Wide Area Network) network is used to connect the networks which are spread over the
different geographical location.
Based on physical location what are the two most common network types?
LAN (Local Area Network) and WAN (Wide Area Network) are the two most common network
types.
No, number of computers does not matter in LAN and WAN. This categorization is purely based on
geographical location of network. For example we may have 1000 computers connected together in
a network. If this network is located in a building or a campus, it will be considered as a LAN
network. Just like this, we may have a network of only two computers. If one computer is located in
one city and other computer is located in another city then this network will be considered as a
WAN network.
A physical topology describes how computers are connected with each other’s physically. While a
logical topology describes how data is being transmitted over the physical topology.
How will you consider a topology which uses HUB as a centralized device to connect all
computers?
Physically it is a star topology but logically it is a bus topology. Since this topology satisfies the
primary requirement of star topology, physically it can be considered as a star topology. But Hub
cannot filter the data traffic, so all computers will receive data packets from all computers just like
the bus topology. So physically it’s a star topology but logically it’s a bus topology.
Define Collision?
Collision is the effect of two devices sending transmissions simultaneously in Ethernet. When they
meet on the physical media, the signals from each device collide and damaged.
What is Brouter?
Brouters are the combination of router and bridge. It can be used as a bridge or router. Brouters are
the earlier implementation of the routers. At layer two it’s a fairly expensive device which cost
more than other high end switches that work much faster than it. At layer three it has a lot of
complexity. Due to these drawbacks it is rarely used. Gradually it has been replaced by high end
switch at layer 2 and by router at layer three.
It is the exchange of data between two devices via some form of transmission medium such as wire
cable. The communicating system must be part of a communication system made up of a
combination of hardware and software. The effectiveness of a data communication system depends
on three fundamental characteristics: delivery, accuracy and timeliness.
A subnet mask tells the network how big it is. When an address is inside the mask, it will be handled
internally as a part of the local network. When it is outside, it will be handled differently as it is not
part of the local network. The proper use and calculation of a subnet mask can be a great benefit
when designing a network as well as for gauging future growth.
The network which connects two or more networks together is considered as a backbone network.
Usually backbone network contains high speed data transferring devices such as routers and
switches. Backbone network should never be used for end user connectivity. The network which
provides end user connectivity should be connected through the backbone network.
What is Gateway?
Gateway is used to forward the packets which are intended for remote network from local network.
Till host is configured with default gateway address, every packet should have default gateway
address. A default gateway address is the address of gateway device. If packet does not find its
destination address in local network then it would take the help of gateway device to find the
destination address in remote network. A gateway device knows the path of remote destination
address. If require, it also change the encapsulation of packet so it can travel in other network to get
its destination address.
What is simplex?
It is the mode of communication between two devices in which flow of data is unidirectional i.e.
one can transmit and other can receive. E.g. keyboard and monitor.
What is half-duplex?
It is the mode of communication between two devices in which flow of data is bi-directional but not
at the same time i.e. each station can transmit and receive but not at the same time. E.g walkie-
talkies are half-duplex system.
It is the mode of communication between two devices in which flow of data is bi-directional and it
occurs simultaneously. Here signals going in either direction share the capacity of the link. E.g.
telephone.
In this architecture 10 stands for speed, Base stands for Baseband transmission and 5 stands for
500 meters distance. This architecture can cover 500 meter distance per network segment. It uses
Baseband technology for data transmission. It provides maximum 10Mbps speeds. It is used in Bus
topology. It uses Thicknet coaxial cable.
Why 10Base2 and 10Base5 Ethernet architecture are no longer used in modern network?
Because both architectures are used in bus topology which is no longer used to build the networks.
To insure the data transmission over the network, OSI model provides several services including
following:
Data Segmentation: - In this process a large data file is divided into smaller segments
sufficient enough to transmit over the network.
Packet acknowledgment: - Every transferred segment is acknowledged with a return
message from recipient which insures that segment is delivered successfully.
Flow control: - This mechanism instructs sender computer to match its transmissions
speed with receiver computer.
Error detection and correction: - In this process receiving computer verify the content of
data.
If any segment is corrupted, it will inform the sender that specific piece of data was
damaged and must be retransmitted
Data compression: - To eliminate redundant, segments are compressed before
transmission.
Data encryption: - To increase the data safety, segments are encrypted with a key already
known by receiving system.
NAT is Network Address Translation. This is a protocol that provides a way for multiple computers
on a common network to share single connection to the Internet. A technology that can provide the
mapping between the private and universal addresses, and at the same time support virtual private
networks (VPN), is Network Address Translation (NAT)
Main advantages of star topology are scalability, easy to troubleshoot and centralized network
component. Adding and removing a device in this topology is much easier than the other topologies.
Besides this if there is any break in cable then only the device which is connected with that cable
will be down.
Main disadvantages of star topology are cost and centralized network component. In positive side a
centralized device makes administrator life easier but in downside if this device fails then the entire
network will be down.
This is mechanism of removing collision from network. When two or more nodes simultaneously
sense the wire and found no frame and each device places its frame on the wire. These frame would
be collide in wire and a collision will occur. If the NICs see a collision for their transmitted frames,
they have to resend the frames. In this situation, each NIC that was transmitting a frame when a
collision occurred creates a special signal, called a jam signal, on the wire, waits a small random
time period and examine the wire again. If no frame is currently on the wire, NIC will retransmit its
original frame again. This collision detection method is known as CSMA/CD.
What is UDP?
UDP is a connection less protocol. Connection-less transmission is said to be unreliable. Now, don't
get worried about the term "unreliable" this doesn't mean that the data isn't going to get its
destination; its only means that it isn't guaranteed to get its destination. Think of your options
when you are sending a postcard, put it in the mailbox, and chances are good that it will get where
it's supposed to go but there is no guarantee. There is always a chance of missing in the way. On the
other hand, it's cheap.
What is TCP?
TCP is a connection oriented protocol. Connection-oriented transmission is said to be reliable.
Think TCP as registry AD facility available in Indian post office. For this level of service, you have to
buy extra ticket and put a bunch of extra labels on it to track where it is going and where it has
been. You get a receipt when it is delivered. In this method you have a guaranteed delivery. All of
this costs you more—but it is reliable!
What is the purpose of cables being shielded and having twisted pairs?
The main purpose of this is to prevent crosstalk. Crosstalks are electromagnetic interferences or
noise that can affect data being transmitted across cables.
Unguided media transport electromagnetic waves without using a physical conductor. This type of
communication is referred as wireless communication. Here signals are broadcaster through air
and thus available to anyone who has a device to receive it.
In which topology all nodes have a direct connection to every other node on the network?
In mesh topology all nodes have a direct connection with each node in network.
Errors can be categorized as a single-bit error or burst error. A single bit error has one bit error per
data unit. A burst error has two or more bits errors per data unit.
Standard Description
802.5 Standards for token ring access and for communications between LANs and MANs
Network Description
Wide Area Network (WAN) connects multiple LANs which are separated by a
WAN
large geographical distance such as different continents
Metropolitan Area Networks (MAN) connects multiple LANs which are separated
MAN
in a metro city.
Intranet This is a private network. Outsiders are not allowed to connect in this network.
Extranet This network allows certain services from Intranet to known external users.
This network allows unknown external users to connect with internal resources
Internet
of network such as web server.
This network provides secure connection across the public network such as
VPN
Internet.
What is the equivalent layer or layers of the TCP/IP Application layer in terms of OSI
reference model?
The TCP/IP Application layer actually has three counterparts on the OSI model: the Session layer,
Presentation Layer and Application Layer.
How can you identify the IP class of a given IP address in binary representation?
By looking at the first octet of any given IP address, you can identify whether it's Class A, B or C. If
the first octet begins with a 0 bit, that address is Class A. If it begins with bits 10 then that address is
a Class B address. If it begins with 110, then it's a Class C network.
In parity check, a parity bit is added to every data unit so that the total number of 1s is even (or odd
for odd parity).Simple parity check can detect all single bit errors. It can detect burst errors only if
the total number of errors in each data unit is odd. In two dimensional parity checks, a block of bits
is divided into rows and a redundant row of bits is added to the whole block.
The number of bit positions in which codewords differs is called the Hamming Distance (i. e. The
hamming distance between two words [of same size] is number of differences between the
corresponding bits). The hamming distance can easily be found if we apply XOR operation (⊕) on
the two words and count the number of ‘1’s in the result (Note that hamming distance is a value
greater than or equal to zero).
It is the regulation of sender’s data rate so that the receiver buffer doesn’t become overwhelmed i.e.
flow control refers to a set of procedures used to restrict the amount of data that the sender can
send before waiting for acknowledgement.
In Go-Back-N ARQ, multiple frames can be in transit at the same time. If there is an error,
retransmission begins with the last unacknowledged frame even if subsequent frames arrived
correctly. Duplicate frames are discarded.
What is ICMP?
ICMP is Internet Control Message Protocol. It provides messaging and communication for protocols
within the TCP/IP stack. This is also the protocol that manages error messages that are used by
network tools such as PING.
What is Ping?
Ping is a utility program that allows you to check connectivity between network devices on the
network. You can ping a device by using its IP address or device name, such as a computer name.
What is DNS?
DNS is Domain Name System. The main function of this network service is to provide host names to
TCP/IP address resolution.
DNS is the Internet’s phone book. The Domain Name System is what makes it possible to only have
to remember something like “cnn.com” instead of (at this particular moment) “157.166.226.26”. IP
address change all the time however, although less so for mega-level servers. Human friendly
names allow users to remember a something much easier and less likely to change frequently, and
DNS makes it possible to map to those new addresses under the hood. If you were to look in a
standard phone book and you know the name of the person or business you’re looking for, it will
then show you the number for that person. DNS servers do exactly the same thing but with updates
on a daily or hourly basis.
The tiered nature of DNS also makes it possible to have repeat queries responded to very quickly,
although it may take a few moments to discover where a brand new address is that you haven’t
been to before. From your home, say that you wanted to go to the InfoSec Institute’s home page.
You know the address for it, so you punch it in and wait. Your computer will first talk to your local
DNS server (likely your home router) to see if it knows where it is. If it doesn’t know, it will talk to
your ISP’s DNS server and ask it if it knows. If the ISP doesn’t know, it will keep going up the chain
asking questions until it reaches one of the 13 Root DNS Servers. The responding DNS server will
send the appropriate address back down the pipe, caching it in each location as it does so to make
any repeat requests much faster.
A hub acts as a multiport repeater. However, as more and more devices connect to it, it
would not be able to efficiently manage the volume of traffic that passes through it. A switch
provides a better alternative that can improve the performance especially when high traffic volume
is expected across all ports.
At first glance it may be difficult to judge the difference between a hub and a switch since
both look roughly the same. They both have a large number of potential connections and are used
for the same basic purpose- to create a network. However the biggest difference is not on the
outside, but on the inside in the way that they handle connections.
In the case of a hub, it broadcasts all data to every port. This can make for serious
security and reliability concerns, as well as cause a number of collisions to occur on
the network. Old style hubs and present-day wireless access points use this
technique.
Switches on the other hand create connections dynamically, so that usually only the
requesting port can receive the information destined for it. An exception to this rule
is that if the switch has its maintenance port turned on for an NIDS implementation,
it may copy all data going across the switch to a particular port in order to scan it for
problems. The easiest way to make sense of it all is by thinking about it in the case of
old style phone connections.
A hub would be a ‘party line’ where everybody is talking all at the same time. It is
possible to transmit on such a system, but it can be very hectic and potentially
release information to people that you don’t want to have access to it. A switch on
the other hand is like a phone operator- creating connections between ports on an
as-needed basis.
What is HDLC?
It is a bit oriented data link protocol designed to support both half duplex and full duplex
communication over point to point and multi point links. HDLC is characterized by their station
type, configuration and their response modes.
You need to connect two computers for file sharing. Is it possible to do this without using a
hub or router?
Yes, you can connect two computers together using only one cable. A crossover type cable can be
used in this scenario. In this setup, the data transmit pin of one cable is connected to the data
receive pin of the other cable, and vice versa.
To reduce the possibility of collision CSMA method was developed. In CSMA each station first listen
to the medium (Or check the state of the medium) before sending. It can’t eliminate collision.
What is client/server?
Client/server is a type of network wherein one or more computers act as servers. Servers provide a
centralized repository of resources such as printers and files. Clients refers to workstation that
access the server.
When you move the NIC cards from one PC to another PC, does the MAC address gets
transferred as well?
Yes, that's because MAC addresses are hard-wired into the NIC circuitry, not the PC. This also
means that a PC can have a different MAC address when the NIC card was replace by another one.
What is IP address?
The internet address (IP address) is 32bits that uniquely and universally defines a host or router on
the internet. The portion of the IP address that identifies the network is called netid. The portion of
the IP address that identifies the host or router on the network is called hostid. Every host and
router on the Internet has an IP address that can be used in the Source address and Destination
address fields of IP packets. A host typically has only a single link into the network; when IP in the
host wants to send a datagram, it does so over this link. The boundary between the host and the
physical link is called an interface. It is important to note that an IP address does not actually refer
to a host. It really refers to a network interface, so if a host is on two networks, it must have two IP
addresses. (Most hosts are on one network and thus have one IP address. In contrast, routers have
multiple interfaces and thus multiple IP addresses.)
What is subnetting?
Subnetting is the strategy used to partition a single physical network into more than one smaller
logical sub-networks (subnets).
Describe Ethernet?
Ethernet is one of the popular networking technologies used these days. It was developed during
the early 1970s and is based on specifications as stated in the IEEE. Ethernet is used in local area
networks.
In case one workstation on the network suffers a malfunction, it can bring down the entire network.
Another drawback is that when there are adjustments and reconfigurations needed to be
performed on a particular part of the network, the entire network has to be temporarily brought
down as well.
It is the method used to solve the channel allocation problem. It is used for: i) ground based radio
broadcasting ii) In a network in which uncoordinated users are competing for the use of single
channel. It is of two types: 1.Pure aloha 2.Slotted aloha.
In this method time is divided into discrete intervals, each interval corresponding to one frame. It
requires user to agree on slot boundaries. Here data is not send at any time instead it wait for
beginning of the next slot. Thus pure ALOHA is tuned into discrete one.
When a station has data to send, it first listens to the channel to see if anyone else is transmitting at
that moment. If channel is busy it waits until the station becomes idle. When collision occurs it
waits and then sends. It sends frame with probability 1 when channel is idle.
What is SMTP?
SMTP is short for Simple Mail Transfer Protocol. The TCP/IP protocol that supports electronic mail
on the internet is called Simple Mail Transfer Protocol. SMTP provides for mail exchange between
users on the same or different computer and supports Sending a single message to one or more
recipient Sending message that include text, voice, video, or graphics. Sending message to users on
network outside the internet. This protocol deals with all Internal mail, and provides the necessary
mail delivery services on the TCP/IP protocol stack.
Here if no one else is sending the station begins doing so itself. However if the channel is already in
use, the station doesn’t continuously sense it rather it waits for a random period of time and then
repeats. It leads better channel utilization but longer delay.
A receiver receives a signal before it becomes too weak or corrupted, regenerates the original bit
pattern, and puts the refreshed copy back onto the link. It operates on physical layer of OSI model.
Router relay packets among multiple interconnected networks. They receive packet from one
connected network and pass it to another network. They have access to network layer addresses
and certain software that enables them to determine which path is best for transmission among
several paths. They operate on physical, data link and network layer of OSI model.
Define IP?
What is TELNET?
TELNET is a client –server application that allows a user to log on to a remote machine, giving the
user access to the remote system. TELNET is an abbreviation of terminal Network.
What is Hypertext Transfer Protocol (HTTP) And What Port Does It Use?
It is the main protocol used to access data on the World Wide Web .the protocol transfers data in
the form of plain text, hypertext, audio, video, and so on. It is so called because its efficiency allows
its use in a hypertext environment where there are rapid jumps from one document to another.
While HTTP can use a number of different carrier protocols to go from system to system, the
primary protocol and port used is TCP port 80.
What protocol can be applied when you want to transfer files between different platforms,
such between UNIX systems and Windows servers?
Use FTP (File Transfer Protocol) for file transfers between such different servers. This is possible
because FTP is platform independent.
An ad hoc network is a network that is composed of individual devices communicating with each
other directly. The term implies spontaneous or impromptu construction because these networks
often bypass the gatekeeping hardware or central access point such as a router. Many ad hoc
networks are local area networks where computers or other devices are enabled to send data
directly to one another rather than going through a centralized access point.
background noise and relative timing between transmitter and receivers. This term is also known
as direct sequence code division multiple access.
A frame is a digital data transmission unit in computer networking and telecommunication. A frame
typically includes frame synchronization features consisting of a sequence of bits or symbols that
indicate to the receiver, the beginning, and end of the payload data within the stream of symbols or
bits it receives. If a receiver is connected to the system in the middle of a frame transmission, it
ignores the data until it detects a new frame synchronization sequence.
Character Count
This method uses a field in the header to specify the number of characters in the frame. When the
data link layer at the destination sees the character count, it knows how many characters follow,
and hence where the end of the frame is. The disadvantage is that if the count is garbled by a
transmission error, the destination will lose synchronization and will be unable to locate the start
of the next frame. So, this method is rarely used.
Character stuffing
In the second method, each frame starts with the ASCII character sequence DLE STX and ends with
the sequence DLE ETX.(where DLE is Data Link Escape, STX is Start of text and ETX is End of text.)
This method overcomes the drawbacks of the character count method. If the destination ever loses
synchronization, it only has to look for DLE STX and DLE ETX characters. If however, binary data is
being transmitted then there exists a possibility of the characters DLE STX and DLE ETX occurring
in the data. Since this can interfere with the framing, a technique called character stuffing is used.
The sender's data link layer inserts an ASCII DLE character just before the DLE character in the
data. The receiver's data link layer removes this DLE before this data is given to the network layer.
However character stuffing is closely associated with 8-bit characters and this is a major hurdle in
transmitting arbitrary sized characters.
Bit stuffing
The third method allows data frames to contain an arbitrary number of bits and allows character
codes with an arbitrary number of bits per character. At the start and end of each frame is a flag
byte consisting of the special bit pattern 01111110. Whenever the sender's data link layer
encounters five consecutive 1s in the data, it automatically stuffs a zero bit into the outgoing bit
stream. This technique is called bit stuffing. When the receiver sees five consecutive 1s in the
incoming data stream, followed by a zero bit, it automatically destuffs the 0 bit. The boundary
between two frames can be determined by locating the flag pattern.
What is piggybacking?
In two-way communication, whenever a data frame is received, the receiver waits and does not
send the control frame (acknowledgement or ACK) back to the sender immediately. The receiver
waits until its network layer passes in the next data packet. The delayed acknowledgement is then
attached to this outgoing data frame. This technique of temporarily delaying the acknowledgement
so that it can be hooked with next outgoing data frame is known as piggybacking.
Whenever party A wants to send data to party B, it will send the data along with this ACK
field. Considering the sliding window here of size 8 bits, if A has send frames up to 5 correctly (from
B), and wants to send frames starting from frame 6, it will send ACK6 with the data.
Three rules govern the piggybacking data transfer.
I. If station A wants to send both data and an acknowledgment, it keeps both fields there.
II. If station A wants to send just the acknowledgment, then a separate ACK frame is sent.
III. If station A wants to send just the data, then the last acknowledgment field is sent along
with the data. Station B simply ignores this duplicate ACK frame upon receiving.
Attenuation distortion arises because the attenuation of the signal in the transmitting media.
Attenuation distortion is predominant in case of analog signals. Delay distortion arises because
different frequency components of the signal suffer different delay as the signal passes through the
media. This happens because the velocity of the signal varies with frequency and it is predominant
in case of digital signals.
Between RZ and NRZ encoding techniques, which requires higher bandwidth and why?
RZ encoding requires more bandwidth, as it requires two signal changes to encode one bit.
In Manchester encoding, there is a transition in the middle of each bit period and the receiver can
synchronize on that transition. Hence better synchronization is achieved.
Advantage of FHSS:
Fundamentally much simpler to implement.
Better range, due to lower receiver sensitivity.
Good rejection of in band interference.
Good performance in multipath environments.
No "near/far" problems
Disadvantages of FHSS:
Long latency time.
Slow Lock-In, must search a channel.
No processing gain.
Must resynchronization with other after every hop.
Short outdoor range.
Lower overall data throughput.
Describe how MACA solve the Hidden and exposed terminals, near and far terminals
problems?
When a station is ready for transmission, it sends a request to send (RTS) frame to the receiver and
waits to receive a clear to send (CTS) frame from the receiver. As a result, all stations within the
range will refrain from transmitting a data frame. Once CTS is received, the sender can send
packets. In this way, the CTS frame can be heard by the hidden terminals and the medium for future
use by other sending terminal is reserved. The exposed terminal won't react to RTS and doesn't
receive CTS because the exposed terminal is not the receiver. The near and far terminals could be
solved in the similar way.
IPv4 IPv6
IPv4 addresses are 32 bit length. IPv6 addresses are 128 bit length.
IPv4 addresses are binary IPv6 addresses are binary numbers represented
numbers represented in decimals. in hexadecimals.
IPsec support is only optional. Inbuilt IPsec support.
Fragmentation is done by sender and
Fragmentation is done only by sender.
forwarding routers.
Packet flow identification is available within
No packet flow identification.
the IPv6 header using the Flow Label field.
Checksum field is available in IPv4 header No checksum field in IPv6 header.
No option fields, but IPv6 Extension headers are
Options fields are available in IPv4 header.
available.
Address Resolution Protocol (ARP) is Address Resolution Protocol (ARP) is replaced
available to map IPv4 addresses to MAC with a function of Neighbor Discovery Protocol
addresses. (NDP).
Internet Group Management Protocol (IGMP)
IGMP is replaced with Multicast Listener
is used to manage multicast group
Discovery (MLD) messages.
membership.
Broadcast messages are not available. Instead a
link-local scope "All nodes" multicast IPv6
Broadcast messages are available.
address (FF02::1) is used for broadcast similar
functionality.
Manual configuration (Static) of IPv4
addresses or DHCP (Dynamic configuration) Auto-configuration of addresses is available.
is required to configure IPv4 addresses.
Spread spectrum techniques involve spreading the bandwidth needed to transmit data – which
does not make sense at first sight. Spreading the bandwidth has several advantages. The main
advantage is the resistance to narrowband interference.
Mobile IP (or IP mobility) is an Internet Engineering Task Force (IETF) standard communications
protocol that is designed to allow mobile device users to move from one network to another while
maintaining a permanent IP address
Explain what is the difference between flow control and error control?
Flow control: adjust and confirm data flow rate for successful transmission.
Error Control: a way to recover corrupted data.
What is socket?
A socket is an abstraction that represents an endpoint of communication. Most applications that
consciously use TCP and UDP do so by creating a socket of the appropriate type and then
performing a series of operations on that socket. The operations that can be performed on a socket
include control operations (such as associating a port number with the socket, initiating or
accepting a connection on the socket, or destroying the socket) data transfer operations (such as
writing data through the socket to some other application, or reading data from some other
application through the socket) and status operations (such as finding the IP address associated
with the socket).
TCP includes several mechanisms that attempt to sustain good data transfer rates while avoiding
placing excessive load on the network. TCP's "Slow Start", "Congestion Avoidance", "Fast
Retransmit" and "Fast Recovery" algorithms are summarised in RFC 2001. TCP also mandates an
algorithm that avoids "Silly Window Syndrome" (SWS), an undesirable condition that results in
very small chunks of data being transferred between sender and receiver. SWS Avoidance is
discussed in RFC 813. The "Nagle Algorithm", which prevents the sending side of TCP from flooding
the network with a train of small frames, is described in RFC 896.
Access mode is used to connect end devices (host) to switches while trunk mode is used to connect
between switches.
What is DHCP?
Dynamic Host Configuration Protocol (DHCP) is the default way for connecting up to a network. The
implementation varies across Operating Systems, but the simple explanation is that there is a
server on the network that hands out IP addresses when requested. Upon connecting to a network,
a DHCP request will be sent out from a new member system. The DHCP server will respond and
issue an address lease for a varying amount of time. If the system connects to another network, it
will be issued a new address by that server but if it re-connects to the original network before the
lease is up- it will be re-issued that same address that it had before.
In IPv4, entire 127.0.0.0 IP range is reserved for loopback addresses. We can use any address
from range 127.0.0.0 to 127.255.255.255. However, mostly 127.0.0.1 is used for this purpose.
In IPv6, only a single address is reserved for loopback testing and that is ::1.
‘ipconfig’ is one of the primary network connection troubleshooting and information tools available
for Windows Operating Systems. It allows the user to see what the current information is, force a
release of those settings if set by DHCP, force a new request for a DHCP lease, and clear out the local
DNS cache among other functions it is able to handle. ‘ifconfig’ is a similar utility for Unix/Linux
systems that while at first glance seems to be identical, it actually isn’t. It does allow for very quick
(and thorough) access to network connection information, it does not allow for the DHCP functions
that ipconfig does. These functions in fact are handled by a separate service/daemon called dhcpd.
What is SNMP?
SNMP is the “Simple Network Management Protocol”. Most systems and devices on a network are
able to tell when they are having issues and present them to the user through either prompts or
displays directly on the device. For administrators unfortunately, it can be difficult to tell when
there is a problem unless the user calls them over. On devices that have SNMP enabled however,
this information can be broadcast and picked up by programs that know what to look for. In this
way, reports can be run based on the current status of the network, find out what patches are
current not installed, if a printer is jammed, etc. In large networks this is a requirement, but in any
size network it can serve as a resource to see how the network is fairing and give a baseline of what
its current health is.
For delivering audio and video for playback, TCP may be appropriate. Also, with sufficiently long
buffering and adequate average throughput, near-real-time delivery using TCP can be successful, as
practiced by the Netscape WWW browser. TCP may often run over highly lossy networks (e.g., the
German X.25 network) with acceptable throughput, even though the uncompensated losses would
make audio or video communication impossible.
However, for real-time delivery of audio and video, TCP and other reliable transport protocols such
as XTP are inappropriate. The three main reasons are:
Reliable transmission is inappropriate for delay-sensitive data such as real-time audio and
video. By the time the sender has discovered the missing packet and retransmitted it, at
least one round-trip time, likely more, has elapsed. The receiver either has to wait for the
retransmission, increasing delay and incurring an audible gap in playout, or discard the
retransmitted packet, defeating the TCP mechanism. Standard TCP implementations force
the receiver application to wait, so that packet losses would always yield increased delay.
Note that a single packet lost repeatedly could drastically increase delay, which would
persist at least until the end of talkspurt.
TCP cannot support multicast.
The TCP congestion control mechanisms decreases the congestion window when packet
losses are detected ("slow start"). Audio and video, on the other hand, have "natural" rates
that cannot be suddenly decreased without starving the receiver. For example, standard
PCM audio requires 64 kb/s, plus any header overhead, and cannot be delivered in less than
that. Video could be more easily throttled simply by slowing the acquisition of frames at the
sender when the transmitter's send buffer is full, with the corresponding delay. The correct
congestion response for these media is to change the audio/video encoding, video frame
rate, or video image size at the transmitter, based, for example, on feedback received
through RTCP receiver report packets.
An additional small disadvantage is that the TCP and XTP headers are larger than a UDP header (40
bytes for TCP and XTP 3.6, 32 bytes for XTP 4.0, compared to 8 bytes). Also, these reliable transport
protocols do not contain the necessary timestamp and encoding information needed by the
receiving application, so that they cannot replace RTP. (They would not need the sequence number
as these protocols assure that no losses or reordering takes place.)
While LANs often have sufficient bandwidth and low enough losses not to trigger these problems,
TCP does not offer any advantages in that scenario either, except for the recovery from rare packet
losses. Even in a LAN with no losses, the TCP slow start mechanism would limit the initial rate of
the source for the first few round-trip times.
Default
Timers Uses
Values
180
Hold down timer Used to hold the routing information for the specified time
seconds
Invalid route 180
Used to keep track of discovered routes
timer seconds
Route update
30 seconds Used to update routing information
timer
240 Used to set time interval for any route that becomes invalid
Route flush timer
seconds and its deletion from the routing table
180
Hold down timer Used to hold the routing information for the specified time
seconds
Write packet tracer command to see routing table of specific router and explain fields of
routing table displayed.
v. The time clock after that is called the Holddown timer. In any dynamic routing
protocol, messages are sent at a certain interval (30 seconds in RIP). Each time a
hello message is received, this timer is reset. If no response is received within 180
seconds this route is removed or an alternate route is found.
vi. The final column is the outgoing interface to reach the gateway.
What are the difference between private IP address and public IP address?
Private IP addresses are reserved for local networks and cannot be accessed from a public network
such as Internet. Vice versa a public network cannot be accessed from a private IP address.
Following IP ranges are reserved for private IP addresses.
10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255
Public IP addresses are publicly accessible from any public network such as Internet. In order to
access a public IP address, we must have to use a public IP address.
Except private IP addresses, all IP addresses of class A, B and C are public IP addresses.
In IPv4 following addresses are reserved and cannot be assigned to end devices.
A physical topology describes how computers are connected with each other’s physically. While a
logical topology describes how data is transmitted over the physical topology.
A cookie is a small piece of information that is stored in user’s browser by a website for various
purposes such as tracking, advertising, etc.
Which addresses are required to deliver a data packet across the network?
Following addresses are required to deliver a data packet correctly to the destination: -
Port address: - Locate the correct application at destination
IP address: - Locate the correct network and host
MAC address: - Locate the correct node in network
What is segmentation?
Segmentation is a transport layer function which breaks large data stream in smaller chunks known
as segments.
Due to some security reasons a company wants to hide its actual server IP address from
external world. Which service should it configure in router to achieve this goal?
NAT (Network address Translation) service allows us to translate an IP address. Company can
configure this service to hide its internal IP structure from the external world. It can configure NAT
service in a router which connects it with external world.
You are asked to connect two branch offices which are using same IP addresses. Due to some
technical reasons you are not allowed to make any change in existing IP structure of both
offices. Which service will you use to connect them?
To connect the two different networks which are using same IP addresses, NAT service is used. NAT
service allows us to map different IP addresses with existing IP addresses. Later these different IP
addresses can be used to connect with other network.
How many broadcast domain and collision domain are created by hub, switch and router
respectively?
An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes
under the control of one or more network operators on behalf of a single administrative entity or
domain that presents a common, clearly defined routing policy to the internet.
What Is EGP?
An Exterior Gateway Protocol (EGP) refers to a routing protocol that handles routing between
different Autonomous Systems (AS). Example: - Border Gateway Protocol (BGP).
What Is IGP?
An Interior Gateway Protocol (IGP) refers to a routing protocol that handles routing within a single
autonomous system. Example - RIP, IGRP, EIGRP, and OSPF.
Broadcast Control: Broadcasts are needed for the regularly function of a network. Many protocols
and application rely on broadcast communication to function properly. A layer 2 switched network
is basically in a single broadcast domain and the broadcasts can reach the network segments which
are so far where a particular broadcast has no scope and consume available network bandwidth. A
layer 3 device (typically a Router) is utilized to segment a broadcast domain. If we segment a large
LAN to smaller VLANs we will reduce broadcast traffic as each broadcast will be sent on to the
relevant VLAN only .
Security: VLANs present enhanced network security. In a VLAN network environment, with
multiple broadcast domains, network administrators have control over each port and user. A nasty
user can no longer just connect their workstation into any switch port and sniff the network traffic
using a packet sniffer. The network administrator controls each port and whatever resources it is
allowed to use. VLANs make it easier to restrict vulnerable traffic originating from an enterprise
department within itself.
Cost: Segmenting a massive VLAN to smaller VLANs will cost less than creating a routed network
with routers because normally routers costlier than switches.
Physical Layer Transparency: VLANs are transparent on the physical topology and also medium
over which the network is connected.
A Collision Domain is a scenario in which when a device sends out a message to the network, all
other devices which are included in its collision domain have to pay attention to it, no matter if it
was destined for them or not. This causes a problem because, in a situation where two devices send
out their messages simultaneously, a collision will occur leading them to wait and re-transmit their
respective messages, one at a time. Remember, it happens only in case of a half-duplex mode.
A Broadcast Domain is a scenario in which when a device sends out a broadcast message, all the
devices present in its broadcast domain have to pay attention to it. This creates a lot of congestion
in the network, commonly called LAN congestion, which affects the bandwidth of the users present
in that network.
Enter the maximum number of valid subnets and usable hosts per subnet that you can get
from the network 172.26.0.0 255.255.252.0?