What is an IP address? What is a subnet mask?

A subnet mask allows you to identify which part of an IPaddress is reserved for the network, and which part isavailable for host use. If you look at the IP addressalone, especially now with classless inter-domainrouting,you can't tell which part of the address is which. Addingthe subnet mask, or netmask, gives you all theinformationyou need to calculate network and host portions of theaddress with ease. In summary, knowing the subnet maskcanallow you to easily calculate whether IP addresses are onthe same subnet, or not. What is ARP? Short for Address Resolution Protocol, a network layer protocol used to convert an IP address into a physical address (called a DLC address), such as an Ethernet address. A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. The host on the network that has the IP address in the request then replies with its physical hardware address. There is also Reverse ARP (RARP) which can be used by a host to discover its IP address. In this case, the host broadcasts its physical address and a RARP server replies with the host's IP address. The Address Resolution Protocol uses a simple message format that contains one address resolution request or response. The size of the ARP message depends on the upper layer and lower layer address sizes, which are given by the type of networking protocol (usually IPv4) in use and the type of hardware or virtual link layer that the upper layer protocol is running on. The message header specifies these types, as well as the size of addresses of each. The message header is completed with the operation code for request (1) and reply (2). The payload of the packet consists of four addresses, the hardware and protocol address of the sender and receiver hosts. What is ARP Cache Poisoning? ARP stands for Address Resolution Protocol. Every computer in a LAN has 2 identifiers: IP and MAC address. IP is either entered by the user or dynamically allocated by a server. But the MAC address is unique for any Ethernet card. For example, if you have 2 ethernet cards, one for wired and the other for WiFi, you have 2 MAC addresses on your machine. The MAC address is a hardware code for your ethernet card.

The communications between computers is done on the IP level. Means that if you want to send a file to a computer, you need to know the other computer IP. Now, ARP is the protocol that matches every IP with a certain MAC address in ARP table that is saved on your switch in your LAN. ARP cache poisoning is changing this ARP table on the switch.

For Normal case, when a machine tries to connect to another machine. The first machine goes to the ARP table with the other machine IP, the ARP table provide the MAC address for the other machine and the communication starts. But if someone plays with the table, the first machine goes with the IP and the ARP table will provide a faulty MAC address to a 3rd machine who wants to intrude through your communication. This Kind of attach is known as "Man in the Middle".

What is the ANDing process? When a source host attempts to communicate with a destination host, the source host uses its subnet mask to determine whether the destination host is on the local network or a remote network. This is known as theANDing process. The AND function has the following properties: If the two compared values are both 1, the result is 1. If one of the values is 0 and the other is 1, the result is 0. If both of the compared values are 0, the result is 0. What is a default gateway? What happens if I don't have one? A Default gateway is a node (a router) on a TCP/IP Network that serves as an access point to another network. A default gateway is used by a host when the ip's packet destination address belongs to someplace outside the local subnet. Without a default gateway you will not be able to route packets out of your LAN Can a workstation computer be configured to browse the Internet and yet NOT have a default gateway? If we are using public ip address, we can browse the internet. If it is having an intranet address a gateway is needed as a router or firewall to communicate with internet.

What is a subnet? What is APIPA? What is an RFC? Name a few if possible (not necessarily the numbers, just the ideas behind them) A Request For Comments (RFC) document defines a protocol or policy used on the Internet. An RFC can be submitted by anyone. Eventually, if it gains enough interest, it may evolve into an Internet Standard Each RFC is designated by an RFC number. Once published, an RFC never changes. Modifications to an original RFC are assigned a new RFC number. A Request For Comments (RFC) document defines a protocol or policy used on the Internet. An RFC can be submitted by anyone. Eventually, if it gains enough interest, it may evolve into an Internet Standard . Each RFC is designated by an RFC number. Once published, an

RFC never changes. 821 - Simple Mail Transfer Protocol 822 - Standard for the format of ARPA Internet text messages 974 - Mail routing and the domain system 1035 - Domain names - implementation and specification 1123 - Requirements for Internet hosts - application and support 1321 - The MD5 Message-Digest Algorithm What is RFC 1918? RFC 1918 is Address Allocation for Private Internets. What is CIDR? You have the following Network ID: 192.115.103.64/27. What is the IP range for your network? You have the following Network ID: 131.112.0.0. You need at least 500 hosts per network. How many networks can you create? What subnet mask will you use? You need to view at network traffic. What will you use? Name a few tools How do I know the path that a packet takes to the destination? What does the ping 192.168.0.1 -l 1000 -n 100 command do? What is DHCP? What are the benefits and drawbacks of using it? Describe the steps taken by the client and DHCP server in order to obtain an IP address. What is the DHCPNACK and when do I get one? Name 2 scenarios. What ports are used by DHCP and the DHCP clients? Describe the process of installing a DHCP server in an AD infrastructure. What is DHCPINFORM? Describe the integration between DHCP and DNS. What options in DHCP do you regularly use for an MS network? What are User Classes and Vendor Classes in DHCP? How do I configure a client machine to use a specific User Class? What is the BOOTP protocol used for, where might you find it in Windows network infrastructure? DNS zones describe the differences between the 4 types. DNS record types describe the most important ones. Describe the process of working with an external domain name Describe the importance of DNS to AD. Describe a few methods of finding an MX record for a remote domain on the Internet. What does "Disable Recursion" in DNS mean? What could cause the Forwarders and Root Hints to be grayed out? What is a "Single Label domain name" and what sort of issues can it cause? What is the "in-addr.arpa" zone used for?

What are the requirements from DNS to support AD? How do you manually create SRV records in DNS? Name 3 benefits of using AD-integrated zones. What are the benefits of using Windows 2003 DNS when using ADintegrated zones? You installed a new AD domain and the new (and first) DC has not registered its SRV records in DNS. Name a few possible causes. What are the benefits and scenarios of using Stub zones? What are the benefits and scenarios of using Conditional Forwarding? What are the differences between Windows Clustering, Network Load Balancing and Round Robin, and scenarios for each use? How do I work with the Host name cache on a client computer? How do I clear the DNS cache on the DNS server? What is the 224.0.1.24 address used for? What is WINS and when do we use it? Can you have a Microsoft-based network without any WINS server on it? What are the "considerations" regarding not using WINS? Describe the differences between WINS push and pull replications. What is the difference between tombstoning a WINS record and simply deleting it? Name the NetBIOS names you might expect from a Windows 2003 DC that is registered in WINS. Describe the role of the routing table on a host and on a router. What are routing protocols? Why do we need them? Name a few. What are router interfaces? What types can they be? In Windows 2003 routing, what are the interface filters? What is NAT? What is the real difference between NAT and PAT? How do you configure NAT on Windows 2003? How do you allow inbound traffic for specific hosts on Windows 2003 NAT? What is VPN? What types of VPN does Windows 2000 and beyond work with natively? What is IAS? In what scenarios do we use it? What's the difference between Mixed mode and Native mode in AD when dealing with RRAS? What is the "RAS and IAS" group in AD? What are Conditions and Profile in RRAS Policies? What types or authentication can a Windows 2003 based RRAS work with? How does SSL work? How does IPSec work? How do I deploy IPSec for a large number of computers? What types of authentication can IPSec use?

What is PFS (Perfect Forward Secrecy) in IPSec? How do I monitor IPSec? Looking at IPSec-encrypted traffic with a sniffer. What packet types do I see? What can you do with NETSH? How do I look at the open ports on my machine?

Question and Answers