GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Network Layer Protocol Headers

jeriel.juarbe2031 Protocol Analysis college English 85 cards

Cards in this deck (85)

  1. 1What is ARP?Address Resolution Protocol
    Meaning..
    I have your IP...what is the MAC for this IP?
  2. 2ARP header is variable length but we are concerned with the first ______ Bytes?28
  3. 3In the ARP Header What are the possible OPCODES in hex and what do they mean?00 01 = request
    00 02 = reply
    00 03 = RARP
  4. 4For ARP Header what are the 9 fields in order?H/W type; Protocol Type; H/W Size; Protocol type; opcode; SMAC; SIP; TMAC; TIP
  5. 5What happens after the DORA process?3 gratuitous ARP's
  6. 6What is the syntax when filtering ARP in wireshark to show all ARP requests?arp.opcode == 1
    (1, 2, 3)
  7. 7The following Exploitation methods and vulnerabilities pertain to which header? cache poisoning man-in-the-middle (MITM) exploitsARP
  8. 8What is the variable length of the IPV4 Header?20 - 60 Bytes
  9. 9T or F: Total IP Lenth AKA TIPL is the length of the datagram which includes the IPV4 header.True
  10. 10What is the min - max datagram size....... IPV4 Total IP Lengthmin of 20 Bytes, Max of 65,535
  11. 11T or F: the Identification field of the IPV4 header aids in assembling fragments of a datagramTrue
  12. 12What doe the IP Flags represent in the IPV4 Header?Identify whether the datagram can be fragmented and if the receiving host should expect more fragmented packets for this datagram.
  13. 13What does the Fragment Offset Field do? (13 bits)it indicates where in the datagram this fragment belongs.
  14. 140 000 =?May
  15. 150 > 000 =?Last
  16. 162 000 =?First
  17. 172 > 000 =?middle
    (more coming)
  18. 184 000 = ?Don't
  19. 198 000 =?reserved
  20. 20t or F: TTL or Time to live indicates the max # of hops a datagram can make before being discarded. (max TTL 255)True
  21. 21IPV4 header next protocol field hex value = what ? 01ICMP (layer 3)
  22. 22IPV4 header next protocol field hex value = what ? 02IGMP
  23. 23IPV4 header next protocol field hex value = what ? 06TCP
  24. 24IPV4 header next protocol field hex value = what ? 08EGP
  25. 25IPV4 header next protocol field hex value = what ? 11UDP
  26. 26IPV4 header next protocol field hex value = what ? 58IGRP
  27. 27IPV4 header next protocol field hex value = what ? 59OSPF
  28. 28When filtering IPV4 header in wireshark, what is the syntax to show all TCP packets?ip.proto == 6
  29. 29When filtering IPV4 header in wireshark, what is the syntax to show all packets from specified IP Address?ip.src ==
  30. 30When filtering IPV4 header in wireshark, what is the syntax to show all packets to or from specified IP Address?ip.addr ==
  31. 31What are the 14 fields in the IPV4 Header in order?version; Header Length; Type of Service TOS; Total IP Length TIPL; Identification; IP Flags; Fragment Offset; TTL time-to-live; Next Protocol; Check Sum; SIP; TIP; Options; Padding
  32. 3244 1 2 2 3 313 1 1 2 4 4 opt padIPV4 header by the numbers
  33. 330 000 1 fff =?may Frag
  34. 342 000 3 ffff = ?More Frag
  35. 354 000 =?Don't Frag
  36. 368 000 =?Reserved
  37. 37What is the fixed size of the IPV6 Header?40 Bytes
  38. 38How many Bytes does an IPV6 address have?16
  39. 39What does the IPV6 header use as verbage instead of the TTL field compared to IPV4?Hop Limit
  40. 40What are the 8 fields in an IPV6 header in order?IP version; Traffic Class; Flow Label; Payload Length; Next Header; Hop Limit; Source Address; Destination Address
  41. 41ARP by the Numbers = ?2 2 1 1 2 6 4 6 4
  42. 42IPV4 by the numbers = ?44 1 2 2 313 1 1 2 4 4 options padding
  43. 43IPV6 by the numbers = ?4820 2 1 1 16 16
  44. 44In the IPV6 Header, in the next header field, what does 0x3a mean/signify as the next header?ICMPv6
  45. 45T or F: in IPV6 the payload length does not include the length of the IPV6 header (in contrast to the IPV4 total length)True
  46. 46In regards to IPV6, What is the calculation to determine the Total IP Length?40 + Payload Length = TIPL
  47. 47What is the syntax in wireshark to show all IPV6 packets that contain TCP headers?ipv6.nxt == 06
  48. 48T or F: IP datagrams can be broken down into smaller fragments to allow proper encapsulation of IP traffic within various MTU-sized Data Link Layer Protocols.True
  49. 49T or F: Fragments are reassembled at the distant host once all fragments are received.True
  50. 50What are the Steps in regards to Fragmentation to get the Flag Offset (F.0.)?Step 1: Convert TIPL and IPHL to DEC
    Step 2: TIPL – IPHL = x [x = payload in Decimal]
    Step 3: x / 8 = y [divide the payload by 8]
    Step 4: Convert Y (DEC) to HEX
    Y = Fragment Offset (F.O)
  51. 51Once you have your Fragment Offset, How do you find out what fragment you are on?Step 1: Flag w/offset – 2000 = x [get the current frag hex number & subtract by the starting Frag]
    Step 2: convert x (HEX) to DEC
    Step 3: x / F.O. (DEC) = y
    Step 4: y +1 = z [ Z being the Fragment you’re on]
  52. 52What are the Steps when asked “what is the next fragment”?Step 1: Solve for the F.O.
    Step 2: Current Frag (HEX) + F.O. (HEX) = xxx
    Step 3: Answer will be 2 things… last frag and more frag. Example 0 1A4 and 2 1A4
  53. 53T or F: ICMP provides error reporting, Flow control, and first hop gateway redirection.True
  54. 54What are the 2 categories of ICMP Messages?Informational and Error
  55. 55What are the Types we care about in this MOD in the ICMP Header field?0=Echo Reply
    3= Destination Unreachable
    5=Redirect
    8=Echo Request
    11=TTL Exceeded
  56. 56RFC states that in an error message, the data portion must contain what?must contain the original (offending) IP header including all options plus at least 8 bytes of additional data.
  57. 57What are the ICMP type 3 codes we care about in the Code Field?0 = Network Unreachable
    1 = Host Unreachable
    2 = Protocol Unreachable
    3 = Port Unreachable
  58. 58T or F: You will only get a code in the code field of ICMP header if there an error occurs.True
  59. 59When using Wireshark how do you filter to show all ICMP packets with a destination unreachable/port unreachable error condition?icmp.type == 3 and imcp.code == 3
  60. 60icmp.type == 8 and ! (icmp.code == 0)FYI for Wireshark
  61. 61What are the ICMP exploitation Methods and Vulnerabilities?1) DoS Exploits
    2) Netmask request for enumeration
    3) ICMP redirect exploit for MITM
    4) Payload can be used to transmit through firewalls
    5 ) Some DDoS attacks such as trinoo
    read page 40
  62. 62T or F: 00 is the default for many ICMP messages, type 3 and its associated codes can be used in enumeration efforts.True
  63. 63What is used in TCP to maintain order and assure receipt?Sequence #'s and Acknowledge #'s
  64. 64What are the 11 fields in the TCP Header?SPORT, TPORT, Sequence #, Acknowledge #, Data Offset, Reserved, Control Flags, Window Size (MTU), checksum, Urgent Pointer, Options
  65. 65What does the Sequence number in the TCP header represent?currents block's position in the overall message.
  66. 66T or F: The sequence number, when started off, is a random high port.True
  67. 67What does the Acknowledge Number represent in the TCP Header?the next sequence number expected from the other end.
  68. 68T or F: the acknowledgement Number is 00 00 00 00 for the syn portion of the 3-way handshake.True
  69. 69What happens to the seq and ack #'s when looking at a packet in the syn-ack portion of a 3- way handshake?the sequence is set (random) and the ack # is copied from the syn portion of the 3-way handshake and incremented by 1 and then becomes the ack # in the syn-ack packet
  70. 70T or F: once the session has been established in the TCP connection, the sequence and ack # will vary in increment as determined by the size (payload) of the data being transmitted.True
  71. 71This field in the TCP Header... represents the number of 32-bit words that are in the TCP Header.Data Offset
  72. 72In the Control Flags field of the TCP header, what are bit possibilities?C E U A P R S F
    University of Alabama Plays really shitty football
    Cwr Ecn-echo Urg Ack Psh Rst Syn Fin
  73. 73If on, push data to up the stack as soin as possible for applications such as Telnet or FTPPSH
    push bit (8)
  74. 74What TCP header field is being described below? If greater than zero and the urgent flag i set, then this field points to how far into the data stream urgent data extends.Urgent Pointer
  75. 75T or F: The only time you ever increment the seq# by one is during a 3-Way handshake and a 4-way tear down.True
  76. 76T or F: There is zero data being transmitted during a 3-Way handshake and 4-way tear downTrue
  77. 77When looking at packets during a TCP connection, the sequence # always increments by the TCP payload.True
  78. 78What determines when the seq# and ack # flip during the TCP connection?when the communication changes directions...Meaning look at the TIP and SIP SPORT and TPORT to notice when communication is changing.
  79. 79What is the steps for calculating the next sequence & ack number in the TCP Header using IPV4?1) TIPL - IPHL - Data Offset = TCP Payload
    2) TCP Payload + sequence # = next seq or ack #
    3) determine if comm change directions
  80. 80What is the steps for calculating the next sequence & ack number in the TCP Header using IPV6?1) Payload Length - Data Offset = TCP Payload
    2) TCP Payload + sequence # = next seq or ack #
    3) determine if comm change directions
  81. 81These are referring to which Header? -OS enumeration by ISN -TCP session Hacking -Service enumeration through responding TCP ports - custom flags to bypass ACL'sTCP
    Read page 52 for more shit
  82. 82This header /protocol provides for a connection-less unreliable transport mechanism. The upper layers protocols assume the responsibilities of ensuring delivery and accuracyUser Datagram Protocol (UDP) Header
  83. 83What are the Fields in the UDP Header?SPORT, TPORT, Message Length, checksum
    2 2 2 2
  84. 84T or F: The UDP Message length field in the UDP Header represents the entire UDP header and data length.True
  85. 85What are the vulnerabilities/exploit methods to the UDP Header?-exploit poor router ACL's
    -security left to the upper layer protocols

Information

Description
college Protocol Analysis (Network Layer Protocol Headers) Flashcards on Network Layer Protocol Headers, created by jeriel.juarbe2031 on 24/09/2014.
Views
25
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?