Section 2: Networking

road - the network(wireless, DSL, cable modem, ethernet switch)
truck - IP(internet protocol)
boxes - TCP and UDP holding information/data
rooms - ports for where data needs to be sent

client/ethernet header >> IP >> TCP >> TCP payload >> ethernet trailer/server

- Transmission Control Protocol
- formal connection setup and close
- "reliable delivery", recovery from errors, can manage out-of-order messagesetransmissions
- flow control mechanism, receiver can manage how much data is sent

- User Datagram Protocol
- connectionless, no formal open/close to the connection
- "unreliable delivery", no error recovery, no reordering of dataetransmissions
- no flow control, sender determines amount of data transmitted
- no receipt/knowledge of information that was really received by user

- real time communication, faster communication but it can't stop or retransmit
- ex: DHCP/TFTP (Dynamic Host Configuration Protocol) (Trivial File Transfer Protocol)

- return receipt
- ex: HTTPS/SSH(Hypertext Transfer Protocol Secure)(Secure Shell)

- to have traffic flow, you need server/client IP address/protocol, server/client port number

- most servers use permanent well-known port numbers
- 80=(HTTP), port=443(HTTPS), port=5004(VOIP), port=143(IMAP4)
- ports 0 to 1023

- temporary port numbers 1,024 to 65,535
- randomly chosen by client(web browser) to identify and setup transfer of data(address)

- for communication, not security
- TCP port numbers aren't the same as UDP port numbers
- client and server need to match port numbers
- important for firewall rules/security

- File Transfer Protocol
- tcp/port 20, used for data transfers
- tcp/port 21, controls data transfers
- transfers files between systems

- Secure Shell
- tcp/port 22, an encrypted communication link
- provides a secure terminal connection

- tcp/port 23, telecommunication network
- text based front end for remote console access, sends communication in clear text
- not as secure as SSH

- Simple Mail Transfer Protocol
- tcp/port 25, a server to server email transfer
- other protocols are used for clients to receive email, ex: IMAP, POP3

- Domain Name System
- udp/port 53, converts names to IP addresses and vice versa
- hierarchical

- Dynamic Host Configuration Protocol, released in 1997
- udp/port 67/68, automated configuration of IP address
- originally bootstrap, introduced in October 1993

- IP addresses are assigned in real time from a pool
- each system is given a lease and must renew at set intervals
- addresses are assigned by MAC address, manages addresses from one location

- Hypertext Transfer Protocol/Secure
- http is clear communication, while https is encrypted

- receive emails from email server
- tcp/port 110(Post office Protocol version 3), basic mail transfer functionality
- tcp/port 143(Internet Message Access Protocol v4), includes management of email inbox from multiple clients

- Server Message Block, also called CIFS(Common Internet File System), for file/printer sharing
- older windows will use NetBIOS(Network Basic Input/Output System), udp/port 137 - NetBIOS name services(nbname)
tcp/port 139 - NetBIOS session service(nbsession)
- modern versions of windows doesn't use NetBIOS
- tcp/port 445(NetBIOS-less), direct SMB communication over TCP without NetBIOS transport

- Simple Network Management Protocol, gathers stats from network devices
- queries infrastructure devices for performance details
- can configure device to monitor certain metrics, and if exceeded, an alert will be sent to the management station
- udp/port 161(queries)
- udp/port 162(traps)
- v1, original, sends structured information in the clear, non-encrypted form
- v2, data type enhancements, allows bulk transfers, still in the clear
- v3, message integrity, authentication, encryption of all SNMP data

- Lightweight Directory Access Protocol
- tcp/port 389, allows you to query Active Directory Server
- ex: Microsoft Active Directory

- Remote Desktop Protocol
- tcp/port 3389, commonly used for remote desktop sharing, mainly with windows

- routes traffic between IP subnets, sometimes called layer 3 device
- examines destination IP address of a packet when making a forwarding decision
- often connects diverse network types ex: LAN, WAN, copper, fiber

- determines where traffic should be forwarded based on the destination MAC address
- contains ASIC(application-specific integrated circuit), which forwards traffic at very high rates of speed
- contains many ports and features
- adds additional power to the connection using POE(Power Over Ethernet)
- layer 3/multilayer has the ability to turn on additional routing functionality

- few configuration options, plug and play
- fixed configuration, no VLANs (virtual LAN)
- little integration with other devices, no management protocols
- simple connect, low price

- VLAN support
- configuration to prioritize traffic
- STP(Spanning Tree Protocol) helps with redundancy support in order to prevent loops
- port mirroring, where you can copy all of the traffic of one port to another, used for troubleshooting and packet analysis
- enables SNMP

- a bridge, provides wireless connectivity for the local network
- extends the wired network, forwarding decisions based on MAC address

- used to manage network cables, connecting cables from devices on desks to switches
- easy to change setup, minimizes potential problems during reconfigurations

- OSI layer 4 device, filters traffic based on IP addresses and port numbers
- TCP/UDP ports operate at layer 4
- today, firewalls can be layer 7 device
- encrypts/protects network traffic between sites
- can proxy traffic, a common security technique

- Power over Ethernet, only needs one wire, eliminates the need for separate power sources
- endspan, power provided directly by switches
- midspan, power provided through injectors

- multi-port repeater, traffic going to one port is repeated to every other port
- can only operate at half duplex, outdated and less efficient than switches

- broadband commmunication over cable networks, supports video signals, phone lines, and internet
- follows DOCSIS standard(Data Over Cable Service Interface Specification)
- speeds up to 1GBs

ADSL(Asymmetric Digital Subscriber Line), telephone lines, download speed is faster than upload

- Optical Network Terminal
- device thats connected outside of your home, ex: fiber

- Network Interface Card, fundamental network device
- all devices connected to ethernet have a NIC card inside
- sometimes built into the motherboard, has many options like single/multi port, copper/fiber

- Software Defined Networking, transforms physical networking devices into software-based platforms suitable for the cloud
- infrastructure layer/data plane, handles packet-level functions such as forwarding, trucking, encryption, and network traffic
- control layer/plane, contains references for traffic forwarding and management, including dynamic routing protocols, forwarding tables, and network address translation
- application layer/management plane, manages access to devices via APIs, SSH, or graphical interfaces

- original 802.11 wireless standard, released in October 1999
- operates in the 5 GHz range and 54MBs
- not commonly seen today
- warehouse

- original 802.11 wireless standard, released in October 1999
- operates in the 2.4 GHz range and 11MBs
- not commonly seen today
- office
- longer range than 802.11a, and less absorption problems

- Wi-Fi 3
- upgrade to 802.11b, released in June 2003
- operates in 2.4 GHz range and 54MBs
- backwards compatible with 802.11b

- Wi-Fi 4
- update to Wi-Fi 3, released in October 2009
- can operate at both 5GHz and 2.4GHz, higher speeds at 600MBs
- 4 antennas, uses MIMO(multiple-input multiple-output) technology for improved performance
- devices can transfer more information simultaneously, up to 40MHz channel widths

- Wi-Fi 5, released in January 2014
- operates exclusively at 5GHz, supports 160MHz of channel bandwidth
- denser signaling modulation meaning faster data transfers
- 8 MU(multi-user) MIMO, 7GBs, 2x as many streams as Wi-Fi4

- Wi-Fi 6, released in February 2021
- operates both at 5GHz and 2.4GHz
- bandwidths of 20,40,80, and 160 MHz channel widths
- 1.2Gbs per channel
- OFDMA(Orthogonal frequency-devision multiple access), improves high-density installations
- improve efficiency in crowded environments

- 40 to 50 meters of range if using built in antennas
- minimal signal absorption and bounce
- wireless regulations are complex
- additional frequencies outside of 2.4GHz/5GHz may be available
- additional licensing may be required

- Radio-Frequency Identification
- radar technology, radio energy transmitted to tag, ID is transmitted back
- ex: pet tags, access badges, NFC

- Wi-Fi networks, either 2.4GHz and/or 5GHz frequency range
- Channels, or groups of frequencies, are numbered by IEEE
- ideally non overlapping channels, most countries have regulations managing frequency use

- uses 2.4GHz frequency and unlicensed ISM(Industrial, Scientific, and Medical) part
- most devices operate within 10 meters, industrial devices can operate within 100 meters

- stores/manages files for network users
- ex: SMB for windows, and AFP(Apple Filing Protocol) for macOS

message logging

- responds to browser requests, stores web pages, downloads pages to browser
- uses HTTP/HTTPS, built with HTML, HTML5(Hypertext Markup Language)
- static pages or built dynamically in real-time

- login authentication and centralized management
- always available, and almost always an enterprise service
- not required on a home network, usually a set of redundant servers

- next-generation firewall, UTM(Unified Threat Management)/Web security gateway
- URL filter/Content inspection
- malware inspection, spam filter, CSU/DSU, router, switch, firewall, IDS/IPS, bandwidth shaper, VPN endpoint

- distributes the load to multiple servers and is invisible to the end-user
- large-scale implementations such as web server farms and database farms
- fault tolerance, where server outrages have no effects and very fast convergence

- intermediate server
- client makes the request to the proxy, proxy performs the request and provides results back to the client
- useful features such as access control, caching, URL filtering, and content scanning

- Supervisory Control and Data Acquisition System, multi-site Indisutral Control Systems
- large-scale, PC used to monitor power/equipment in facilities
- real-time information, system control
- generally segmented and no access from the outside

- legacy = old, could be really important
- embedded systems = purpose-built device ex: alarm system, door security, timecard system

- may require a segmented network to limit any security breaches
- ex: refrigerators, smart devicesAppliances - Refrigerators

- IPv4, primary protocol for everything we do
- IPv6 is now part of all major operating systems

- every device needs a unique IP address ex: 192.168.1.165
- a subnet mask is assigned by network admin to mask the IP address ex: 255.255.255.0
- you need both these numbers to assign an IP
- also need default gateway 192.168.1.1

- DORA, four-step process
- discover, find DHCP server
- offer, get an offer
- request, lock in the request
- acknowledge, DHCP confirmation

- Automatic Private IP Addressing, a link-local address
- no forwarding by routers
- IETF reserves 169.254.1.0 through 169.254.254.255
- uses ARP(Address Resolution Protocol) to confirm the address isn't in use

- RR(Resource Records), the database records of domain name services
- over 30 record types, IP addresses/certificates/host alias names/etc
- these are important and critical configurations

- defines the IP address of a host
- A records are for IPv4 addresses
- AAAA records are for IPv6 addresses

Mail Exchanger Records, determines the host name for the mail server - not an IP address, only a name

- Text Records, useful public information originally designed for informal information
- can be used for verification purposes
- commonly used for email security
- external email servers validate information from your DNS

Sender Policy Framework, a list of all servers authorized to send emails for this domain, prevents mail spoofing

- Domain Keys Identified Mail, digitally signs a domain's outgoing mail
- validated by mail servers, not usually seen by the end user
- the public key is in the DKIM TXT record

Domain based Message Authentication Reporting and Conformance, the extension of SPF and DKIM

- IP address range, excluded addresses, subnet mask, and lease durations
- other scope options include: DNS server, default gateway, and VOIP servers

- grouping of IP addresses, each subnet has its own scope
- ex: 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24, etc.
- a scope is generally a single contiguous pool of IP addresses, DHCP exceptions can be made inside

- dynamic assignment, DHCP server has a big pool of addresses to give out and addresses are reclaimed after lease period
- automatic assignment, similar to dynamic allocation, DHCP server saves past assignments and known IP addresses remain the same

- also known as static DHCP assignment, static DHCP, static assignment, IP reservation
- administratively configured, addresses can be reserved
- table of MAC addresses, each MAC address has a matching IP address

- leasing your address is temporary, although it may seem permanent
- DHCP server assigns a lease time and is administratively configured
- during reallocation, rebooting your computer confirms the lease
- workstation can also manually release the IP address, moving you to another subnet

- T1 timer, check in with the lending DHCP server to renew the IP address
- 50% of the lease time by default
- T2 timer, if the original DHCP server is down, try rebinding with any DHCP server
- 87.5% of the lease time

Local Area Networks, a group of devices in the same broadcast domain

Virtual Local Area Networks, group of devices in the same broadcast domain, but separated logically instead of physically

- Virtual Private Networks, encrypted/private data traversing a public network
- encryption access device often integrated into a firewall
- deployment option ex: specialized cryptographic hardware
- used with client software, sometimes built into the OS
- a concentrator is used as an endpoint for remote devices connecting to a site over a VPN

- communication to a satellite, high cost
- non-terrestrial vs. terrestrial networking
- 50 MBit/s down, 3 MBit/s up
- remote sites, difficult-to-network sites
- high latency - 250 ms up, 250 ms down
- high frequencies, 2 GHz
- dependent on line of sight, ex: rain fade may result in delay

- high speed data communication
- higher installation cost than copper
- large installation in the WAN core
- fiber is slowly becoming the norm/more popular

- DOCSIS (Data Over Cable Service Interface Specification), data on the cable network
- transmission across multiple frequencies with different traffic types
- high speeds of 50 MBs to 1,000 MBs
- offers data, voice, and video services

- ADSL (Asymmetric Digital Subscriber Line), uses telephone lines
- download speed is faster than upload speed, 200MBs downstream and 20MBs upstream
- ~10,000 foot limitation from the central office, faster speeds if closer to CO

- Wireless Internet Service Provider, terrestrial internet access
- needs an outdoor antenna, speeds from 10MBs to 1,000MBs
- ex: 5G home internet, ruralemote locations

- Wide Area Network, connects LANs across a distance, but slower than LAN
- WAN technologie: point to point serial, multiprotocol label switching, and can be terrestrial and non-terrestrial

Personal Area Network, your own private network ex: bluetooth, IR(infrared), NFC

- Metropolitan Area Network, network in your city
- larger than a LAN, often smaller than a WAN
- usually owned by government
- ex: metro ethernet

- Storage Area Network, looks like a local storage device
- block-level access, very efficient reading and writing
- requires a lot of bandwidth

- Wireless LAN, within a building
- can expand coverage with additional access points ex: downtown area/large campus

- designed to add a connector on the end of coaxial/twisted pair/fiber cables
- connecting the modular connector to the cable is usually the final step of the process

- wireless networks are easy to monitor
- could be a purpose-built hardware or mobile device add-on
- used to identify errors and interference, validates antenna location and installation

- a toner probe identifies where a cable/wire goes by following the tone
- a tone generator adds a signal onto the copper wire
- an inductive probe held close to the cable will give indication

- relatively simple, continuity test helps identify missing pins and/or crossed wires
- not usually used for frequency testing like what the crosstalk value is or how much signal is lossed

- useful for testing physical ports or fooling your applications
- tests serial/RS-232 (9 pin or 25 pin)
- there are loopback plugs for ethernet, T1, and fiber connections
- not cross-over cables, as it is connecting the device to itself

- intercepts network traffic by sending a copy to a packet capture device
- physical taps allow you to disconnect the link, placing a tap in the middle, and takes a copy of all the data, allowing you to send it to an analyzer
- can be an active(copper, but requires power) or passive tap(doesn't require fiber)
- port mirror, tapping function built into switch, also called SPAN(Switched Port Analyzer)
- software-based tap, sends copy of data to a 3rd interface analyzer
- limited functionality but works well