Computer Networking: Exam Review and Concepts

Welcome to your ultimate Computer Networking: Exam Review and Concepts guide! Whether you're a high school student preparing for a certification or a university student solidifying your knowledge, this article will break down essential networking topics, from OSPF routing to network security and modern network architectures. We'll cover key definitions, best practices, and troubleshooting tips to help you ace your exams and build a strong foundation in computer networking. Let's dive into the core concepts you need to master.

Core Networking Concepts: OSPF and Routing Essentials

Understanding how data travels across networks is fundamental. Open Shortest Path First (OSPF) is a crucial link-state routing protocol. OSPF-enabled routers use Hello packets to discover neighbors and establish neighbor adjacencies, transitioning from a Down state to an Init state upon receiving a Hello packet. This initial discovery is vital for building a robust network.

The Link-State Routing Process

Link-state routing involves several key steps to ensure efficient data forwarding:

1. Establishing Neighbor Adjacencies: Routers send Hello packets out all OSPF-enabled interfaces to find neighbors.
2. Exchanging Link-State Advertisements (LSAs): Routers flood link-state and cost information about each directly connected link to their neighbors.
3. Building the Topology Table (Link-State Database - LSDB): Based on received LSAs, routers construct a comprehensive map of the entire network area. All converged routers within the same OSPF area will have an identical LSDB, which can be viewed with the show ip ospf database command.
4. Executing the SPF Algorithm: Routers run Dijkstra's Shortest Path First (SPF) algorithm against the LSDB to calculate the best paths to each destination.
5. Choosing the Best Route: The router identifies the shortest paths and offers them to the IP routing table, unless a better administrative distance route already exists.

OSPF Tables and Adjacencies

Each OSPF router maintains three primary tables:

• Neighbor Table (Adjacency Database): A unique list of all neighboring routers with established bidirectional communication, viewed with show ip ospf neighbor.
• Topology Table (Link-State Database - LSDB): Lists all other routers and links within the OSPF area, and is identical on all converged routers within that area.
• Routing Table (Forwarding Database): Contains the best paths to each destination, unique to each router.

OSPF Router ID and DR/BDR Election

The OSPF router ID is a crucial identifier. If not manually configured, a Cisco router selects the highest IPv4 address of any configured loopback interfaces. If no loopback interfaces exist, it chooses the highest active IPv4 address of its physical interfaces.

On multiaccess networks (like Ethernet LANs), a Designated Router (DR) and Backup Designated Router (BDR) are elected during the Two-Way state. The election process prioritizes:

1. Highest OSPF priority (0-255, where 0 means never a DR).
2. Highest router ID.
3. Highest IP address of a loopback or active physical interface.

The DR and BDR serve as central collection and distribution points for LSAs, reducing the number of required adjacencies. A DROTHER router (not a DR or BDR) forms a full adjacency with the DR and BDR, sending its LSAs to them using the multicast address 224.0.0.6.

Configuring OSPF

To advertise networks in OSPF, you use the network command with a wildcard mask. This mask is calculated by subtracting the subnet mask from 255.255.255.255. For example, a 255.255.255.192 subnet mask yields a 0.0.0.63 wildcard mask. All interfaces participating in the OSPF process within a specific area must be explicitly defined. If an interface is passive-interface, it will not send Hello packets, preventing adjacency formation. To advertise a default route to OSPF neighbors, the edge router (ASBR) needs a static default route and the default-information originate command.

OSPF Timers

OSPF relies on timers to maintain neighbor relationships. The Hello interval defines how often Hello packets are sent. By default, the Dead interval is four times the Hello interval. If the Hello timer is set to 20 seconds, the Dead interval automatically becomes 80 seconds. These timers must match between neighboring routers for adjacency to form.

Network Security: Protecting Your Digital Assets

Network security is paramount. A failure domain is the area of a network impacted when a critical device fails. Implementing a building switch block approach (deploying routers or multilayer switches in pairs) limits the size of a failure domain, offering better reliability than redundant power supplies or a collapsed core design.

Penetration Testing Tools and Techniques

Network security firms employ various tools for penetration tests to identify vulnerabilities:

• Hacking Operating Systems: Specially designed OSs (e.g., Kali Linux) preloaded with hacking tools.
• Network Scanning Tools: Applications like Nmap, SuperScan, and Angry IP Scanner probe devices for open TCP/UDP ports and active IP addresses.
• Packet Sniffers: Tools like Wireshark capture and analyze network data exchanges to identify security gaps.
• Fuzzers: Discover vulnerabilities by providing large amounts of random data as input to systems, like Skipfish, Wapiti, and W3af.
• Password Crackers: Applications such as John the Ripper and THC Hydra make repeated guesses to crack passwords.
• Debuggers: Used to reverse engineer binary files for exploit writing or malware analysis.
• Forensic Tools: Detect evidence of hacks or malware within a computer or network (e.g., Sleuth Kit, Helix).

Types of Cyberattacks

Attackers use various methods to compromise networks:

• Reconnaissance Attacks: Gathering information about the network and scanning for accessibility.
• Denial of Service (DoS) Attacks: Sending extreme quantities of data to render a system inoperable.
• Access Attacks: Attempting to retrieve/modify data or escalate access privileges.
• Malware: Programs designed to cause harm:
• Virus: Requires end-user activation (e.g., opening a file) and can infect other files.
• Worm: Replicates itself by independently exploiting network vulnerabilities.
• Trojan Horse: Carries out malicious operations disguised as a legitimate program.
• Botnet: A network of infected computers ("zombie network") controlled by a hacker.
• Spyware: Gathers sensitive data like passwords.
• Buffer Overflow Attacks: Sending too much information to a memory block, causing additional memory areas to be affected.
• Password Attacks: Using electronic dictionaries to obtain passwords.
• DHCP Spoofing: An attacker configures a fake DHCP server to redirect clients to a false default gateway.
• DNS Open Resolver Attacks: Types include amplification and reflection, DNS cache poisoning (redirecting users to malicious sites), and resource utilization attacks.

Access Control Lists (ACLs): Filtering Network Traffic

Access Control Lists (ACLs) are ordered sets of rules that filter network traffic. They are essential for network security and traffic management.

Standard IPv4 ACLs

• Filter traffic based on source IP addresses only.
• Best practice: Place standard ACLs close to the destination IP address of the traffic. This prevents inadvertently blocking traffic to other legitimate destinations.
• Can be identified by a number (1-99, 1300-1999) or a name.
• Example commands: access-list 95 deny 172.16.0.0 0.0.255.255 and access-list 95 permit any.

Extended IPv4 ACLs

• Filter traffic based on source IP address, destination IP address, protocol type, and source/destination TCP or UDP ports.
• Best practice: Place extended ACLs close to the source IP address of the traffic to filter unwanted traffic before it consumes network resources.
• Can be identified by a number (100-199, 2000-2699) or a name.
• Example: An ACL to allow web traffic but deny Telnet from 192.168.10.0/24 to a web server at 172.17.80.1 would involve access-list 103 permit tcp 192.168.10.0 0.0.0.255 host 172.17.80.1 eq 80 and access-list 103 deny tcp 192.168.10.0 0.0.0.255 any eq telnet.

ACL Logic and Placement

• Implicit Deny: Every ACL has an implicit deny any statement at the end, meaning if a packet doesn't match any permit entry, it's denied.
• Order of ACEs: The router processes Access Control Entries (ACEs) from lowest sequence number to highest. New ACEs are appended to the end by default unless a sequence number is specified.
• Filtering unwanted traffic before it travels onto a low-bandwidth link is a best practice.
• A single router interface can support one inbound and one outbound ACL per protocol (e.g., one inbound IPv4, one outbound IPv4).

ACL Application to VTY Lines

The access-class in command is used on VTY (virtual terminal) ports, which support Telnet and/or SSH traffic. It filters access attempts to the router's command-line interface.

Network Address Translation (NAT) and Virtualization

NAT Fundamentals

Network Address Translation (NAT) is crucial for allowing devices with private IP addresses to access the internet. It conserves registered public IP addresses and hides private LAN addressing from outside devices.

• Inside Local Address: The IP address of an internal host as seen from inside the network (private).
• Inside Global Address: The IP address of an internal host as seen from the outside network (publicly routable). Example: In ip nat inside source static 192.168.0.100 209.165.20.25, 209.165.20.25 is the inside global address.
• NAT Configuration: Involves identifying inside local addresses (often with a standard ACL), defining inside/outside NAT interfaces, and specifying the translation type (static or dynamic).

Virtualization and Cloud Services

Virtualization is a networking trend that allows a single physical server to host multiple operating systems on a single CPU, providing separate servers for different customers without allocating discrete hardware. This improves resource utilization.

Cloud services offer off-premise, on-demand access to shared pools of computing resources (storage, compute). Benefits include:

• Access to organizational data anywhere, anytime.
• Streamlined IT operations by subscribing only to needed services.
• Elimination or reduction of onsite IT equipment, maintenance, and management.
• Support for telecommuting and reducing environmental footprint.

Wide Area Networks (WANs) and VPNs

A WAN (Wide Area Network) is a network infrastructure that provides access to other networks over a large geographic area. Organizations can connect via private WAN (e.g., leased line, Ethernet WAN) or public WAN (e.g., DSL, cable, municipal Wi-Fi).

Virtual Private Networks (VPNs)

A VPN (Virtual Private Network) uses virtual connections to create a private network through a public network (like the internet). VPNs provide secure communication between remote users or sites without dedicated physical connections.

• Remote Access VPNs: Connect individual users to a company network via VPN client software on their device. Examples include mobile sales agents or employees working from home. If the Cisco AnyConnect client isn't preinstalled, the user can initiate a clientless SSL VPN connection via a web browser to download it.
• Site-to-Site VPNs: