Jcac 6-3

Front 1

The most critical component in network baselining is/are _________.

Back 1

historical baselines

Front 2

baseline

Back 2

- statistical profile of a network, network device, application utilization response time or volume.
- critical 1st step in IDing a network problem
- helps in alerting to the types of cyber-attacks that cause changes in normal net/app traffic behavoir

Front 3

In detecting security breaches, the most beneficial data sources will be those that give you these 2 things

Back 3

- detailed network utilization
- application volume of the network and its applications

Front 4

multi-tiered baselining

Back 4

where the low, average, and high metric lvls are recorded hour-by-hour and day-by-day

Front 5

6 baselining methods and techniques

Back 5

- top-to-bottom network monitoring
- application monitoring
- detailed packet analysis
- continuous traffic capture
- threshold alarms
- packet analysis methodology

Front 6

a solution providing the capability to see the network from a high-lvl, holistic (summary) perspective

Back 6

top-to-bottom network monitoring

Front 7

identifying those applications consuming network resources

Back 7

application monitoring

Front 8

application monitoring:
well-known

Back 8

recognition of well-known apps like HTTP, SMTP/POP, or multimedia, like RTP or SIP

Front 9

application monitoring:
web-based

Back 9

some client/svr apps like FTP & mail are headed to web-based, using HTTP/HTTPS
needs to be able to distinguish between normal web traffic and these types of apps

Front 10

application monitoring:
complex

Back 10

some apps use a range of TCP ports for comms or they encapsulate higher-lvl apps
needs to be able to to ID/aggregate

Front 11

application monitoring:
custom

Back 11

recognize, Id and and report any custom app used on the network

Front 12

application monitoring:
unknown

Back 12

must ID/track extraneous apps, like Microsoft Svr Msg Blk (SMB)for example.

Front 13

allows security specialist to ID specific code used in attack and develop response/prevent future attack

Back 13

detailed packet analysis

Front 14

storing complete packet-by-packet net traffic audit trail for several days

Back 14

continuous traffic capture

Front 15

alerts security specialist to specific metrics like utilization, abnormal app usage or exceeded response times

Back 15

threshold alarms

Front 16

packet analysis methodology:
plan

Back 16

answers things like:
what are you trying to ID or prove w/ packet analysis?
what type of traffic to capture to help analysis?
what length of time to give the data points for analysis?
what capture tool is best for this analysis?

Front 17

packet analysis methodology:
deploy

Back 17

where do you need to place to app/device for optimum capture?

Front 18

packet analysis methodology:
capture

Back 18

process raw data into useable format
decide how to filter/display for analysis

Front 19

packet analysis methodology:
analyze

Back 19

determine if captured traffic IDs or proves original hypothesis

Front 20

packet analysis methodology:
refine

Back 20

adjust capture parameters/deployed location to provide better fidelity

Front 21

2 basic categories of protocols

Back 21

binary
textual

Front 22

binary protocol

Back 22

transmits cmds/data as binary info

Front 23

textual protocol

Back 23

transmits cmds/data as an easily readable format
HTTP/HTTPS, SMTP, POP, IMAP
(if it's not one of these in this mod, it's binary)

Front 24

DHCP

Back 24

transmission protocol is UDP

Front 25

Ethernet Header

Back 25

1st 14 bytes of an Ethernet frame
TMAC, SMAC, and next protocol type (or if less than 1500/0x5DC, it's frame length field in bytes)

Front 26

01:00:0C:CC:CC:CC

Back 26

Cisco multicast address often used with CDP

Front 27

ARP Header

Back 27

15-42/80 Bytes in Ethernet frame
hardware type - (2B) in ethernet, set to 0x0001
protocol type - (2B) 0x0800 is IP,
hardware size - (1B)
protocol size - (1B)
opcode - (2B) 1-rqst, 2-rply, 3-RARP
SMAC - (6B)
SIP - (4B) originator IP
TMAC (6B) 00:00:00:00:00:00
TIP - (4B) known IP MAC is requested for

Front 28

IPv4 Header

Back 28

makes up 15 -34B/up to 74 B (20-60B)
IPv-(4b) v4 or v6
IHL-(4b) min 5, max 15
ToS-(1B) default 0x00
TIPL-(2B) min 20, max 65535
ID-(2B) aids in assy of frags
IP flag-(3b) 2, 4, or 8
frag offset-(13b)
TTL-(1B)
next protocol-(1B)
checksum-(2B) checksum on IP header only
SIP-(4B)
TIP-(4B)
options-may or may not appear
padding- pads to next 32-bit boundary

Front 29

10th Byte of IP header common values

Back 29

1 (0x01) - ICMP (L3)
2 (0x02) - IGMP
6 (0x06) - TCP
8 (0x08) - EGP
17 (0x11) - UDP
88 (0x58) - IGRP
89 (0x59) - OSPF

Front 30

IPv6 Header

Back 30

fixed 40B size
IPv-(4b)
traffic class-(8b)
flow label-(20b)
payload length-(2B)
next header-(1B)0x06-TCP, 0x11-UDP,0x3A-ICMPv6
hop limit-(1B)
src addy-(16B)
dest addy-(16B)

Front 31

min MTU for IPv6

Back 31

1280, uses PATH MTU DISCOVERY to ensure route can handle

Front 32

ipv6.nxt == 06

Back 32

shows all IPv6 packets that contain TCP headers in wireshark

Front 33

What 2 things are critical to ensure the Ip packet's integrity is intact upon reassembly?

Back 33

Proper sequencing and
placement of fragments

Front 34

Every fragment must be the same size except _________.

Back 34

the last one

Front 35

ICMP

Back 35

provides error reporting, flow ctrl and 1st-hop gateway direction

Front 36

ICMPv4 Header

Back 36

Type (1B)
Code (1B)
Checksum (2B)
Type 3 and 11 - (4B) unidentified
Type 5 - (4B) redirect addr
Type 0 and 8- ID (2B) Seq # (2B)

Front 37

where is the ICMP Header?

Back 37

fits in packet directly following the IP header

Front 38

two types of ICMP msgs

Back 38

informational and error
0x00 - echo reply; info
0x03 - Destination unreachable; error
0x05 - redirect; error
0x08 - echo request; info
0x0B - TTL exceeded; error

Front 39

Data area of an ICMP error msg must contain__________.

Back 39

original (offending) IP header, including all options and at least 8B of additional data

Front 40

Type 3 error msg codes

Back 40

0 - Network unreachable
1 - Host unreachable
2 - Protocol unreachable
3 - Port unreachable
13 - Communication administratively prohibited

Front 41

ICMP filtering in wireshark

Back 41

icmp.type==3 and icmp.code==3
would show all dest unreachable/port unreachable error

Front 42

TCP header uses ________ and _________ to maintain order and assure reciept.

Back 42

Seq #
Acknowledgement #

Front 43

TCP header contains 11 fields:

Back 43

Src port (2B)
Dest port (2B)
Seq # (4B)
Acknowledgement #(4B)
Data offset (4b)
Reserved (4b)
Ctrl flag (1B)
window size (2B) {max size of window size:FFFF before more data can be sent to host)
TCP checksum (2B)
Urgent pntr (2B) points to last byte of URG data under ctrl flag

Front 44

Ctrl flags

Back 44

2-URG; moves to top of stack to be pushed up
1-ACK; ID's ack field as significant, may or may not contain data, if so, stored in receiver's buffer
8-PSH; push up the stack as soon as possible
4-RST; the port is closed, reset connex
2-SYN; synchronize Seq #s
1-FIN; sender has no more data to send

Front 45

4-way graceful teardown

Back 45

either side can start this:
Client - FIN/ACK
Svr - ACK
Svr - FIN/ACK
Client - ACK

Front 46

phantom bit

Back 46

(1B) (0x0001) used to update SEQ# and ACK# exchange when no data is sent

Front 47

TCP Header exploits

Back 47

OS enumeration by ISN
service enumeration through TCP ports
TCP session hijacking
customizing flag settings to bypass ACL, aid in enumeration through filtering devices,and DoS exploitation

Front 48

UDP

Back 48

connectionless, unreliable transport mechanism
does not mean UDP comms are unreliable, upper layer protocols assume these responsibilities

Front 49

UDP header

Back 49

Src Port (2B)
Dest Port (2B)
UDP msg length (2B)
UDP checksum (2B) optional, 0 if not used

Front 50

UDP filtering in wireshark

Back 50

udp.port == 53; shows all DNS queries
udp.srcport == 53; shows all DNS responses

Front 51

DHCP

Back 51

based on Bootstrap protocol
filter in wireshark using bootp, not DHCP
2 types: dynamic and manual

Front 52

dynamic DHCP

Back 52

svr assigns IP to client for limited time (lease)

Front 53

manual DHCP

Back 53

client's IP assigned by admin, DHCP just conveys the addr

Front 54

DORA

Back 54

DHCP assignment process
1. client broadcasts DISCOVER msg
2. all DHCP svrs hearing, send OFFER
3. client REQUESTS from one svr, denying any others
4. DHCP svr broadcasts ACKNOWLEDGEMENT msg

Front 55

DHCP NAK

Back 55

Svr to client
network addr is incorrect (new subnet,lease expired)

Front 56

DHCP Decline

Back 56

client to svr
network addr already in use

Front 57

DHCP Release

Back 57

client to svr
client gives up addr, cancelling remaining lease

Front 58

DHCP Inform

Back 58

client to svr
asks for only local config items
client has externally config'd addr

Front 59

DHCP filtering in wireshark

Back 59

bootp; shows all DHCP traffic
udp.port == 67 or udp.port == 68; shows all DHCP traffic

Front 60

Active FTP

Back 60

UDP ports 20 (data) 21 (cmds)
user initiates ctrl connex, svr does the rest (svr pushes data)

Front 61

Passive FTP

Back 61

UDP ports 21 (cmds)
user initiates ctrl connex, opens data channel (goes and gets) on svr's advertised port
more secure, good for firewalls/ACLs (SYN/ACK traffic)

Front 62

FTP:
Bye

Back 62

ASCII:
QUIT
terminates session

Front 63

FTP:
dir

Back 63

ASCII:
LIST
detailed version of ls cmd (ls -al)

Front 64

FTP:
get

Back 64

ASCII:
RETR
svr transfers copy of file to requester

Front 65

FTP:
ls

Back 65

ASCII:
NLST
list contents of specified dir, files only

Front 66

FTP:
mkdir

Back 66

ASCII:
MKD
creates dir on FTP svr

Front 67

FTP:
put

Back 67

ASCII:
STOR (not STORE)
svr stores data sent to it as a file, over writes if already there

Front 68

HTTP

Back 68

application-lvl protocol over TCP port 80
generic, stateless; used for distributing HTML docs

Front 69

HTTP communication

Back 69

1. Client establishes TCP connex using given URL (3-way handshake)
2. Client sends HTTP request
3. Svr provides document
4. TCP connex closed

Front 70

HTTP cmd:
GET

Back 70

a rqst to retrieve whatever info is ID'd by recipient

Front 71

HTTP cmd:
HEAD

Back 71

Same as GET, except svr must not returna msg-body, only meta-info

Front 72

HTTP cmd:
POST (think msgs)

Back 72

used to request the server to accept enclosed data as a new subordinate of the svr resource ID'd in rqst
- post a msg to BBS, newsgrp, mx list
- submitting a form to a data handling process

Front 73

HTTP cmd:
PUT (think files)

Back 73

rqsts enclosed item to be stored under ID'd svr resource

Front 74

GET data field:
Request start line

Back 74

contains rqst method, desired URL and HTTP version

Front 75

GET data field:
ACCEPT

Back 75

specifies certain media types that are acceptable for response

Front 76

GET data field:
ACCEPT CHARSET

Back 76

ID's which character sets are acceptable
if * is here, all are accepted

Front 77

GET data field:
ACCEPT ENCODING

Back 77

ID's encoding method client will accept

Front 78

GET data field:
ACCEPT-LANGUAGE

Back 78

ID's language client will accept

Front 79

GET data field:
COOKIE

Back 79

used to ID user to a svr

Front 80

GET data field:
USER-AGENT

Back 80

ID's browser app used by client

Front 81

GET data field:
HOST

Back 81

ID's URL client is rqsting

Front 82

Wireshark filter:
Show all HTTP error msgs

Back 82

http.response.code>399
others:
1XX-info
2XX-success
3XX-redirect
4XX-client error
5XX-svr error

Front 83

HTTPS

Back 83

uses port 443
same comm rules and syntax as HTTP
usually uses HTTPSURL prefix
ID's a secure connex w/padlock symbol

Front 84

SSL

Back 84

client can verify ID of svr
provides authentication, integrity, and confidentiality
x.509

Front 85

DNS

Back 85

client rqsts IP addr for a known FQDN
or
FQDN for a known IP addr

Front 86

DNS header

Back 86

Transaction ID (2B) matches rqsts/response packets
Flags (2B) type (0000-7FFF=query, 8000-FFFF=response)
Questions (2B) # of question records in rqst
Answer Records (2B) # of answer records in response

Front 87

DNS query:
Iterative

Back 87

svr to svr query when 1st svr does not know answer

Front 88

DNS query:
Recursive

Back 88

client to DNS and back to client query

Front 89

DNS reply

Back 89

responds to query
all smae fields as query, also includesanswer field at end of packet

Front 90

DNS record type:
A

Back 90

Mapping

Front 91

DNS record type:
CNAME

Back 91

canonical name (mapping) alias

Front 92

DNS record type:
MX

Back 92

mail records

Front 93

DNS record type:
AXFR

Back 93

zone tranfer

Front 94

DNS record type:
PTR

Back 94

pointer record
reverse lookup

Front 95

DNS zone transfer

Back 95

used between DNS svrs to keep DNS tables up to date
- when starting DNS service on secondary
- when refresh time expires
- when changes are saved to primary zone file
secondary svrs initiate zone transfers, primaries answer

Front 96

If in-addr.arpa is in ASCII portion of Wireshark, then...

Back 96

DNS is active in that packet

Front 97

LDAP

Back 97

port 389
x.500