Business Data Networks and Security, 9E Raymond R PankoJulia Panko Solution Manuals

Type:

Solution Manual

Resource:

Business Data Networks and Security

Edition:

9th Edition

Author(s):

Raymond R. Panko Julia L. Panko

Not for Distribution to Students

TEACHING THE CHAPTERS TEACHING THE BOOK IN GENERAL POWERPOINT PRESENTATIONS The chapter and module PowerPoint presentations are full lectures—not just “a few selected slides.”

In the book, nearly all concepts are illustrated in the figures, and the figures are the basis for the PowerPoint presentations. The figures are somewhat adjusted for the PowerPoint presentations. ➢ First, the font size is increased so that you can print six slides per page and still read them. ➢ Second, more complex figures are presented as a series of slides that build these figures in steps. ➢ Third, central concepts (CEPTs) that are critical for understanding networking are marked. You probably want to give them special emphasis. ➢ Fourth, material that is difficult for some students is also marked. You probably want to slow down for this material. Make sure that their eyes are open, get them off their phones, and so forth.

Central Concept (CEPT)

.

Difficult Material

Page 3

Not for Distribution to Students

PowerPoint presentations are divided into sections that are marked in a reasonably consistent way. (Chapter 3 used a different section organization built around the plan/protect/respond security management cycle, and the modules do not all use it.)

QUESTION-FOCUSED SUPPORT There are Test Your Understanding questions after subsections in each chapter. Students should read a section and then answer the questions before going on.

There are meaty End-of-Chapter questions that require students to think about what they have learned in the chapter.

The answer keys (not to be given to students) give the teacher answers for all questions in the chapter.

Importantly, in the test item files, (multiple choice/true-false), all questions are tied to specific questions in the chapter. So if you assign specific textbook questions students are responsible for, you can select exam questions to reflect them.

All multiple choice and true-false questions in the test item file (TIF) are tied to specific questions in the chapter. So if you assign specific textbook questions students are responsible for, you can select exam questions to reflect them.

TEACHING DIFFERENT KINDS OF COURSES As noted earlier, this book has 11 core chapters. These can form a complete course.

Junior and Senior Courses in Information Systems Programs With courses for juniors and seniors, covering the 11 core chapters (including “a” chapters that are case studies) will probably leave you with one or two semester weeks free. As noted earlier, this leaves time for hands-on activities (discussed earlier), additional TCP/IP material (or other material in the advanced modules), a term project, or whatever you wish to cover. However, the entire book should not be covered in a single term.

.

Page 4

Not for Distribution to Students

Community College Courses For freshman and sophomore courses in community colleges, it is good practice to stay with the 11 core chapters, going over chapter questions in class. If you want to do hands-on material, it is advisable to cut some material from the core chapters.

Graduate Courses Graduate courses tend to look a lot like junior and senior level courses, but with greater depth.

More focus can be placed on end-of-chapter questions and novel hands-on exercises, such as OPNET simulations. It is also typical to have a term project.

.

Page 5

Not for Distribution to Students

TEACHING CHAPTER 1: WELCOME TO THE CLOUD Role in the Book The growing complexity of networking requires four introductory chapters. The concepts introduced in this chapter will be reinforced throughout the book.

Chapter 1 covers general concepts and principles we will see throughout the book.

Chapter 2 covers standards concepts and architectures, Chapter 3 covers network security, and Chapter 4 covers network management.

After these four introductory chapters, we move up through the layers, applying concepts in the first four chapters to switched Ethernet networks, wireless LANs, internets, WANs, and applications.

Flow of the Material The chapter begins with examples of how people use applications “in the cloud” today.

It then introduces basic network terminology.

It next discusses circuit switching and packet switching. It presents packet switching historically, in the context of the ARPANET. Next comes the emergence of internetworking and the Internet.

The chapter closes with the components in a small home network to make the material in the chapter more concrete.

Changes from the Previous Edition The opening material has been changed to focus on cloud applications.

The final part has been shortened. There is no longer a discussion of LANs versus WANs. Students already know the basic distinction from earlier classes, and it seemed best to move this material to Chapter 5 (the start of LAN material) and Chapter 10 (the new chapter on WANs).

Central Concept In the definition of networking, a host is defined as any device connected to a network—servers, client PCs, smart phones, and so forth.

The chapter includes a discussion of the five layers of network operations and standards: physical, data link, internet, transport, and application.

.

Page 6

Not for Distribution to Students

Hard Parts Some students have a difficult time appreciating why packet switching is superior to circuit switching for bursty data.

Many students have a difficult time distinguishing between packets and frames, switches and routers, and data links and packets. The chapter shows how internetworking evolved historically out of single networks and that Cerf and Kahn had to define a second level of networking in which concepts were duplicated at both layers.

Teaching this Chapter If you can bring in any Internet memorabilia props, that’s kind of fun.

Also, it helps to bring in a big switch, a big router, UTP, and home networking equipment at appropriate times in the chapter.

I often start with a discussion asking whether networking means the same thing as the Internet, when was the Internet created, who pays for the Internet, and so forth. We then cover these questions in the chapter lecture.

I assign Chapter 1a as homework. I spend a good deal of time going over student answers. (If I don’t, students stop taking hands-on exercises seriously.)

Having students use Google docs or Microsoft Office Web Apps is a good way for them to appreciate cloud computing. Although cloud computing is not covered until Chapter 11, you might start the term having them work in group projects with these tools and use these tools throughout the term. In general, these tools are better for viewing documents than for creating them, so they should be able to work with existing personal productivity tools.

Chapter 1a: Hands-On Networking Tools Chapter 1a has a number of hands-on exercises to help students “burn internetworking concepts into mental ROM.” They learn how to convert 32-bit IP addresses to dotted decimal notation. Using web-based tools, they learn how to check their Internet connection speed.

Students go to the Windows command line to use ping, tracert, and nslookup for DNS. They also learn to look up RFCs—specifically, a joke RFC regarding using carrier pigeons to carry packets.

Students enjoy this chapter, and it makes the concepts in Chapter 1 more concrete.

.

Page 7

Not for Distribution to Students

TEACHING CHAPTER 2: NETWORK STANDARDS Role in the Book Standards are central to networking. This chapter looks at characteristics of standards, including message order, semantics, syntax, reliability, and connection orientation. In the process, students begin to learn about Ethernet, IP, TCP, UDP, and HTTP.

Flow of the Material The chapter recaps Chapter 1 concepts, especially layering.

It then discusses message ordering and reliability, comparing HTTP and TCP. Next comes a long section on syntax and the syntax of HTTP messages, TCP segments, UDP datagrams, and HTTP messages. Only a few key fields in these messages are discussed.

The next section discusses how application programs encode text, whole numbers, and alternatives into the bits that lower-layer processes require.

Vertical communication among the five-layer processes on the source host is discussed briefly.

This is really tough for students, but if they have at least a simple understanding, this is OK for an introductory course.

The chapter closes with a discussion of standards architectures and specifically the five-layer hybrid TCP/IP-OSI architecture that corporations actually use.

Changes from the Previous Edition The chapter now has a full discussion of port numbers. This was put off to a later chapter in a previous edition, but port and socket concepts are central to stateful inspection firewalls, which now dominate firewall filtering.

In encoding, voice encoding is included. It was previously left to alter chapters. This gives a better overview of encoding application messages into binary data streams.

The section on multiprotocol environments has been discontinued because it is now a tertiary concern in most firms.

Central Concepts Students have to read message syntax fluently. This chapter looks at different ways of representing message syntax and introduces the important concepts of reliability and connections.

The chapter introduces the concept of TCP and UDP ports, which are important in security and other subsequent chapters.

.

Page 8

Not for Distribution to Students

Most centrally, the chapter discusses the evolution and importance of the hybrid TCP/IP-OSI architecture that corporations actually use.

The chapter teaches the role of the Internet Engineering Task Force and Requests for Comment (RFCs).

A central piece of terminology is that an internet with a lowercase “i” is any network of networks connected by routers. It is also spelled in lowercase when referring to the internet layer (Layer 3). It is spelled with an uppercase “I” when referring to the global Internet.

Hard Parts This is a very conceptual chapter, and students find much of it difficult. Because students do not have an existing mental framework, it is easy to learn and forget. Students have to study this material multiple times.

Vertical communication among processes on a computer is very hard for some students. The key thing to emphasize is that one set of things—encapsulation and passing down—occurs repeatedly. It is not many different things. The discussion of encapsulation is kept short.

Students need the basic information. They tend to get too lost in the details.

The chapter discusses three different ways of representing message syntax. The first is field-byfield (Ethernet). The second is showing 32 bits on a line (IP, TCP, and UDP). The third is making each field a distinct line. Students need to understand each.

Teaching this Chapter This is a difficult chapter. I constantly orient the students by telling the students where we are in the chapter outline, and I frequently recap concepts. This material is unfamiliar to students and has many abstract and interrelated concepts. That makes it difficult for students to learn and retain the material.

This is a lecture chapter. However, I usually start by asking students what standards are. I then ask why they are important. I usually have students work in small buzz groups to come up with consensus answers.

Chapter 2a is a hands-on exercise in using Wireshark to capture and look at packets. Our students have their own notebooks. I have them read Chapter 2a and install Wireshark ahead of time. We then do some light packet captures and read individual packets associated with a connection-opening in TCP. We do this by turning on a capture, having them connect to a website, closing their browser, and then ending the capture.

I use Wireshark again after Chapter 8, when students have a more mature understanding of the fields in TCP, IP, and UDP. I have them do another webserver connection and disconnection, followed by captures for ARP. After Chapter 9, I have them do this for DNS, ping, and some other supervisory protocols.

.

Page 9

Not for Distribution to Students

TEACHING CHAPTER 3: NETWORK SECURITY Role in the Book Security was once a separate topic from networking, and traditional networking books left it out except in passing. Today, network security is one of the most important parts of the networking professional’s job. This edition has an introductory chapter on network security. Later, network security appears throughout the book in specific contexts.

Flow of the Material The chapter begins with the threat environment, discussing several types of attackers and their attacks. The rest of the book follows the plan-protect-respond cycle.

Central Concepts A key point in the threat environment today is that wizard hackers who hacked for the thrill of breaking in and the enhancement of their reputation have given way to career criminals.

Computer crime for traditional greed motives dominates the threat environment today.

The planning section has many important concepts. Arguably, the most important planning principle is risk analysis. You cannot stop all attacks, any more than society can stop all robbery.

The important thing is to spend money on protection only if there is a larger reduction in probable losses.

The students learn about various forms of authentication, such as reusable passwords and biometrics. They learn that reusable passwords offer weak security and are being phased out in many firms today.

Another key point is that digital certificate authentication is the strongest form of authentication.

Changes from the Previous Edition There is now a fuller discussion of firewall types. Static packet filtering is introduced as a way to pre-screen packets before a main firewall, and deep packet inspection firewalls that do both intrusion prevention and application-aware filtering are added.

Some parts are lightened to make room for this additional material.

Hard Parts The chapter discusses symmetric key encryption and public key encryption. These similar concepts confuse many students. A key concept to emphasize is that public key encryption is used primarily in authentication, but symmetric key encryption is used for confidentiality.

.

Page 10

Not for Distribution to Students

Teaching this Chapter This is a fun chapter to teach, especially if you can take an extra day so you don’t rush. I ask students first to list types of attackers in an open forum. I write these on the board, spreading them horizontally. I usually end up with the categories traditional hackers, malware writers, disgruntled employees and ex-employees, competitors, career criminals, terrorist groups, and nation states.

I then have students list and briefly describe the attacks each type of attackers will engage in. In some cases, I stop to discuss specific attacks in more depth.

Students like this exercise, in part because it gives some of them a chance to “show off” a little.

I then go through the PowerPoint presentation on this “threat environment” material more briefly, concentrating on things we did not cover in the opening discussion. I then cover the rest of the chapter.

Another enrichment option is to show them the Windows Firewall and how to configure it to allow some external connections. This also reinforces the concept of port numbers.

Unfortunately, Windows Firewall and security settings vary somewhat by Windows version. And, of course, many students now use Macintoshes and tablets.

.

Page 11

Not for Distribution to Students

TEACHING CHAPTER 4: NETWORK DESIGN AND MANAGEMENT Role in the Book With the bits and pieces of material in the first three chapters, we can now begin to look at network design and management. Network design is the focus of this chapter.

This is the final introductory chapter. By the end of it, students will have a good understanding of basic concepts. In subsequent chapters, they will apply these concepts to single switched networks, single wireless networks, internets, and applications.

Flow of the Material The chapter begins with some general concepts and emphasizes the importance of cost control and strategic network planning.

The chapter then notes that networks today must work well. It discusses various quality-ofservice (QoS) metrics.

There is a long section on network design, followed by a section on how to use multicriteria decision making to select among alternatives.

The chapter ends with the basic concerns of managing a network after it is in place—operations, administration, maintenance, and provisioning.

Changes from the Previous Edition The section on handling momentary traffic peaks was handled more heavily in the chapter on Ethernet networking (Chapter 6) in the previous edition. This material is moved here.

Central Concepts Students must learn that there always are alternatives in products and network design. They must be able to evaluate the pros and cons of alternatives. They cannot simply study alternatives individually. This is a major theme of the book.

The section on QoS emphasizes that just running wires and connecting them is far from enough today. Companies now depend on networks, and QoS performance metrics and service level agreements (SLAs) are crucial.

Hard Parts For SLA guarantees, some students have a difficult time realizing that guarantees specify worst cases or minimum acceptable performance levels. For instance, an SLA might specify that the network speed should not fall below 5 Gbps, not that the network should provide no more than 5 Gbps. They tend to think that speed is good, so the SLA should specify a lot of speed.

.

Page 12

Not for Distribution to Students

The section on using traffic analysis to decide how much capacity individual links will need is pretty tough. The book and PowerPoint presentation go through several examples. Students should also do several problems as homework. You might even make up some problems and have the students solve them in class.

Teaching this Chapter Chapter 4a shows students how to use Microsoft Office Visio. If your school has a site license, it is good to get students into Visio. They can create network diagrams for the rest of the term.

They will use it in other IT classes as well.

I also have my students go to Network World, select a review that uses multicriteria decision making, and write up a short report on what the criteria were. I then ask them what weights were used, what scores the products got on different criteria, and what dominant features of the products were rated most highly. I also have students think up a criterion that was not used in the analysis.

.

Page 13

Not for Distribution to Students

TEACHING CHAPTER 5: WIRED ETHERNET LANS Changes from the Previous Edition We begin with changes because they are rather massive. In Edition 8, there was one chapter on physical transmission media (Chapter 5) and another on switched networks (Chapter 6). With the growing importance of wireless communication and the maturation of Ethernet, less material needs to be covered in an introductory networking course.

The material on physical transmission media is shortened, the material on Ethernet somewhat less so. Aspects of physical transmission media and WAN switched networking have been moved from these chapters to the new chapter on Wide Area Networks, Chapter 10.

Role in the Book The first four chapters taught students core introductory concepts. In the rest of the book, they will apply these concepts to concrete situations.

First, they apply the concepts to single switched Ethernet LANs in Chapter 5. They learn about wired transmission media to connect hosts and switches—UTP and optical fiber. And yes, optical fiber really is used heavily in corporations today and is growing rapidly in importance. They also learn how Ethernet organizes its frames and makes switching decisions, as well as some advanced aspects of Ethernet switching and network design.

Flow of the Material The chapter begins with general ideas about signal transmission and propagation effects.

It then discusses 4-pair unshielded twisted pair (UTP) wiring, including RJ-45 connectors and plugs. It discusses propagation effects—attenuation, noise, and crosstalk interference—and simple installation rules to control them.

The chapter next discusses optical fiber, with a focus on the type of fiber used in most LANs— multimode fiber with 850 nm light. They also learn the relative roles of UTP and fiber in switched LANs. This is the chapter in which they learn more about propagation effects in physical media. In the next chapter, they will learn about wireless propagation effects. This chapter’s discussion eases them into propagation effects.

They learn the differences between serial and parallel transmission and the concept of full duplex operation.

They also learn the basic characteristics of waves, including amplitude, frequency, and wavelength. In this chapter, they focus on wavelengths.

They learn about Ethernet network design based upon physical layer standards.

.

Page 14

Not for Distribution to Students

They go into some detail on Ethernet frame fields and on Ethernet switch operation.

Beyond this, they learn about such advanced operational issues as the Rapid Spanning Tree Protocol, virtual LANs, manageability, and power over Ethernet.

They also learn about Ethernet port security.

Central Concepts Both LANs and WANs are governed by Layer 1 and Layer 2 standards. Therefore, they are OSI standards because OSI dominates physical and data link layer standards.

Propagation effects are central in this chapter.

So is the relationship between UTP and optical fiber, with UTP being used almost exclusively to connect stations to switches with wires and with optical fiber being used to connect core switches.

Quality is measured differently in UTP (categories of wire) and multimode optical fiber (modal bandwidth).

Ethernet uses a hierarchical topology, which leads to both efficiency and central points of failure.

There is a box at the end of the chapter that discusses the 802.3ba standards for 40 Gbps and 100 Gbps Ethernet. It introduces the concepts of virtual lanes and media lanes. In the most common standard for 100 Gbps Ethernet, the two switches are connected by 12 fiber optic cords as media lanes.

Hard Parts UTP noise and attenuation are controlled by limiting 4-pair UTP transmission distance to 100 meters, and terminal crosstalk interference is controlled by limiting the untwisting of wires at the end less than a half inch. This is pretty simple, but some students just have a hard time with concepts that have multiple parts.

Students learn the details of Cat 5e, Cat 6, and other categories of UTP cords. However, some lose sight of the fact that category is a measure of quality for 4-pair UTP. Similarly, they need to see that modal bandwidth is a measure of quality for optical fiber—but only for the multimode fiber used in LANs. The tag fields in the Internet frame are difficult to grasp because they are present only at certain conditions—when priority or VLANs are used—and have an odd design.

Teaching the Chapter This is a good chapter to cover simply through lecture.

To make things more concrete, I bring 4-pair UTP and optical fiber into classes and pass them around. My short fiber patch cord has ST connectors at one end and SC connectors at the other end. .

Page 15

Not for Distribution to Students

I also pass around a small switch and have students plug in and unplug an RJ-45 connector.

Pretty basic, but it emphasizes that there is nothing conceptual to the physical connection of UTP in networks. I also bring in a 24-port switch.

I also have them do the wire cutting and connectorizing exercise in Chapter 5a. This is a tad expensive, but they really like it. I usually start the class going over questions from Chapter 5.

There is then sufficient time to have them connectorize both ends of an 18-inch UTP cord and test the connections. Undergrads love it. MBAs find it a waste of time.

Chapter 6a is a relatively short exercise (about 30 minutes) that allows groups of students to work together to set up a small Ethernet wired network. After they set it up, they plug two computers into end notes and confirm that both get service. You then introduce a loop by connecting two switches in the hierarchy. Of course, for the breakdown to occur, the switches must not have RSTP capabilities. Fortunately, cheap switches do not. Four-port switches are more than enough.

.

Page 16

Not for Distribution to Students

CHAPTER 6: WIRELESS LANS I Role in the Book In Chapter 5, we looked at single wired switched Ethernet networks. In Chapters 6 and 7, we will look at single wireless networks. All single networks are governed by physical and data link layer standards, which means that they are OSI standards.

Chapters 8 and 9 will take us to internets at Layers 3 and 4.

Chapter 10 will bring us to wide area networks, which operate at Layers 1 and 2 or at 3 and 4.

Flow of the Material This chapter focuses on 802.11 and its standards. Chapter 7 discusses 802.11 management, 802.11 security, and other local wireless technologies.

Wireless propagation is unreliable compared to wired propagation. This section covers the main wireless propagation problem.

802.11 Wireless LANs (WLANs) standards dominate wireless local area networking. 802.11 standards are created by the 802.11 Working Group of the 802 LAN/MAN Standards Committee.

The relationship between channel bandwidth and transmission speed is central. Higher bandwidth means faster possible transmission speeds.

It is important to understand the difference between licensed and unlicensed radio bands and between the 2.4 and 5 GHz unlicensed bands, and normal versus spread spectrum transmission.

There are many 802.11 standards, but the two most important are the widely used 802.11g standard and the new and rapidly selling 802.11n standard, including channel bandwidth and MIMO. The chapter also introduces the even faster 802.11ac and 802.11ad standards whose products (based on draft standards) are now entering the market.

The chapter ends with some promising directions in wireless mesh networking, beamforming, multiuser MIMO, and Wi-Fi Direct.

Changes from the Last Edition Adopters asked for a specific discussion of BSSs, ESSs, SSIDs, and how these concepts relate to handoffs and roaming. This material has been added.

The advanced material on beamforming, multiuser MIMO, why speed varies so much, Wi-Fi direct, and mesh networking have been rewritten, with many things added or expanded.

Central Concepts Wireless transmission is difficult. Understanding propagation problems is central to understanding wireless local area networking. .

Page 17

Not for Distribution to Students

Today, WLANs are primarily ways to give wireless clients access to the wired network, which has the firm’s servers and Internet access routers. Complete wireless LANs are possible but are not common.

The relationship between channel bandwidth and possible transmission speed is critical.

Unlicensed operation affects how organizations manage their networks because it gives them flexibility but can create problems with neighboring organizations.

Spread spectrum transmission is wasteful of bandwidth but gives more reliability. In 802.11 WLANs, spread spectrum transmission does not give security.

Medium access control is necessary because the wireless access points and the wireless clients it serves transmit in the same channel, so they must take turns.

802.11g and 802.11n are the dominant WLAN standards today.

Hard Parts There are several different propagation effects. Students sometimes get overloaded and have a hard time keeping them apart. Only one is difficult—inverse square law attenuation. Students should work out several examples. They also need to understand the two propagation effects that increase with frequency so that they can understand differences between the 2.4 GHz band and the 5 GHz band.

Shannon’s equation is very simple when studied piece by piece. The signal-to-noise ratio is almost irrelevant because it is difficult to increase signal power and because there is only logarithmic growth with increasing signal strength. There is a direct relationship between signal speed and channel bandwidth. If you double the bandwidth, you double the possible transmission speed.

Spread spectrum transmission also is simple if taken step-by-step. Its several implications, however, must be clearly understood.

MIMO is one of those ah-ha things. It is strange at first, and there is a tendency to gloss over it.

However, when it is understood, it is really neat.

Teaching this Chapter Students are motivated to learn things in this chapter. I cover it with lecture, but I bring in an access point and wireless NICs to show things. I also ask the class where the nearest access point is. If possible, I get the model number and have them find its price. They often are surprised how expensive it is because organizations use higher-quality access points.

Security is not covered in this chapter, but a war driving exercise is still attractive so that students can see what information they can find about wireless networks with their computer’s basic software versus war driving software.

To help students get the material more deeply, there is a new “a” chapter on using the Xirrus Wi-Fi inspector. They can walk around and get a lot of information about nearby Wi-Fi access points. Security is not covered in this chapter, but a war driving exercise is still attractive so that .

Page 18

Not for Distribution to Students

students can see what information they can find about wireless networks with their computer’s basic software versus war driving software.

.

Page 19

Not for Distribution to Students

CHAPTER 7: WIRELESS LANS II Role in the Book Chapter 6 introduced 802.11 wireless LANs. This chapter continues to look at 802.11 WLANs, focusing on security and WLAN management. It then looks at other local area wireless networking technologies, including Bluetooth. The chapter then looks at wireless metropolitan area networking in the form of cellular data service, which is dominant in metropolitan area wireless networking.

Chapter 7 concludes the discussion of single wired and wireless networks, which operate at Layers 1 and 2. Chapters 8 and 9 move up to internets, which are governed by standards at Layers 3 and 4.

Flow of the Material 802.11 security is a critical topic in corporations today. There is a strong focus in the chapter on core security standards, especially 802.11i and WPA. 802.11 WLAN management is also important. Wireless propagation makes the management of WLANs difficult.

802.11i is not the only local wireless technology. The chapter also covers Bluetooth and other local wireless networking technologies.

Changes from the Previous Edition The security section is beefed up, including brief discussions of WPS and denial-of-service attacks.

At the request of adopters, the Bluetooth section is considerably beefed up.

The sections on Wireless WANs, including cellular data service have been moved to Chapter 10.

Central Concepts 802.11 users face major security threats. Only some of these are solved by using the WPA and 802.11i core security protocols, In particular, evil twin access points can only be thwarted by VPNs with pre-shared keys. Wireless Protected Setup can only be secured by turning it off at the access point, if this is even possible. Denial-of-service attacks are especially difficult to stop.

Students should develop a good understanding of the role of short-range Bluetooth and moderate-range 802.11i, and they should understand how Bluetooth is reducing the range and speed differences between the two.

.

Page 20

Not for Distribution to Students

Hard Parts Students often have confusion caused by the fact that both WPA and 802.11i have two modes of operation—802.1X and Pre-Shared Key modes. It is important for students to be able to compare and contrast them. By the way, the reason that WPA has both modes is that it is based on an early draft of 802.11i.

The idea that WPA and 802.11i do not solve all security problems—particularly evil twin threats—is difficult for some students. The final essay is useful for them to organize their thoughts on the mater.

In Chapter 5, we learned that in Ethernet 802.1X security, the workgroup switch is the authenticator. In 802.11i, however, the access point is the authenticator.

Roughly speaking, 802.11i = 802.1X + an extended form of EAP to protect authentication.

WEP uses a shared initial key. This is bad because shared keys are almost impossible to change in large organizations and employees often give them out freely because they do not seem secret. PSK mode uses initial pre-shared keys, but it is only for homes and very small businesses with a single access point. In these environments, giving out the key is limited. In addition, immediately after login, each host gets a unique session key that is not shared. Consequently, not enough traffic is encrypted with the initial pre-shared key for cryptanalysts to crack the key.

Teaching this Chapter Having students set up a connection to an access point is attractive, but different PCs set up connections differently because the software often is WNIC-specific.

A war driving exercise is attractive and fun, but make sure to distinguish between war driving and wireless hacking, which is illegal. This exercise would use the Xirrus Wi-Fi Inspector program.

.

Page 21

Not for Distribution to Students

CHAPTER 8: TCP/IP INTERNETWORKING I Role in the Book Chapters 5 through 7 dealt with single networks governed by Layer 1 and Layer 2 standards.

Chapters 8 and 9 move to the level of internets, which are governed by standards at Layers 3 and 4.

Flow of the Material In Chapter 1, students learned that IP addresses are 32 bits long. In this chapter, students learn that IP addresses have three parts—a network part, a subnet part, and a host part.

The chapter discusses the three steps that routers take when they forward packets.

Most of the book talks about IPv4, but IPv6 is the future of the Internet Protocol. Students learn about IPv6 in general, and they specifically learn to work with IPv6 addresses, which are written for humans with an entirely different notation that uses hexadecimal encoding and several techniques to shorten the display of addresses.

This chapter looks at TCP and UDP in more depth than the book did in Chapter 2.

IP, TCP, and UDP deal with delivery. There also are many supervisory protocols that network professionals must master.

Changes from the Previous Edition IPv6 and its address representation for humans are discussed in detail.

To make room for this discussion of IPv6, Multiprotocol Label Switching is moved to the following chapter.

The port number material has been moved to Chapter 2 so that it can be used in Chapter 3’s discussion of stateful inspection firewalls.

Central Concepts Physical and data link layer standards come almost exclusively from OSI. Internetworking standards are predominantly TCP/IP standards, which the Internet Engineering Task Force (IETF) creates.

TCP/IP has both user applications and supervisory applications. The supervisory applications keep large internets running.

Hierarchical IP addresses are central to TCP/IP internetworking. Companies need to consider subnetting to manage their IP addresses, as we will see in the next chapter.

.

Page 22

Not for Distribution to Students

We saw well-known port numbers for servers in Chapter 2. This chapter looks at ephemeral port numbers on clients and how the two types of port numbers are used.

At the internet layer, IP delivers packets, whereas ICMP handles nearly all supervisory tasks.

Hard Parts In router operation, masking and comparing are crucial. Students need to see several examples and do homework exercises. Eventually, they nearly all get it.

The process by which a router routes arriving IP packets is fairly long. In looking at the three steps in router operation, it is important to recap each step after covering it, and to emphasize what step is involved at each point. With a few examples, students nearly always get it.

There are two boxes. One deals with the Address Resolution Protocol, which students find difficult because it mixes Layer 2 and Layer 3 concepts. The other deals with applying masks when the number of initial 1s in a mask does not break at an 8-bit boundary. Both are difficult and time-consuming.

Dynamic routing protocols are difficult for students because they involve multiple protocols serving different purposes. It is important to go over this material in a way that focuses on similarities and differences.

Teaching this Chapter By this time in the course, students have forgotten a lot from Chapters 1 and 2. I do recap—even more than the chapter has at its beginning.

Now that students know more about TCP/IP protocols, they will see more if they do Wireshark captures. Students can also drop down to the command line to do pings and to see their ARP cache with the ARP command in Windows.

.

Page 23

Not for Distribution to Students

CHAPTER 9: TCP/IP INTERNETWORKING II Role in the Book Chapter 8 focused on how routers make forwarding decisions and on TCP, UDP, and IP, including IPv6. Chapter 9 continues with the management of internets, including supervisory standards, and Internet security.

Changes from the Previous Edition The chapter now ends with a new discussion of IPv6 management.

Flow of the Material The chapter begins with IP subnet planning. Companies must make strategic decisions about how to divide their allocated IP address space between subnet bits and host bits. Poor designs can lead to management problems. This discussion focuses on IPv4 subnetting.

TCP/IP supervisory standards are discussed, including network address translation, the domain name system, DHCP, and the Simple Network Management Protocol. All were discussed in earlier chapters. They are discussed here in more depth.

There is a section on Multiprotocol Label Switching, which makes routing far more efficient and disciplined.

Next comes a discussion of IPsec VPN security for protecting traffic traveling through the Internet.

The final section deals with IPv6 management issues, which many firms are just beginning to understand. This section covers IPv6 subnetting, new options for IPv6 configuration, and other important IPv6 standards.

Central Concepts Simple Ethernet networks can be set up and then ignored for long periods of time. This is not true of TCP/IP internets. These internets must be well-planned and then managed on an ongoing basis.

The Internet Engineering Task Force requires each RFC to have a security section. However, the IETF is focusing most of its security attention on IPsec, which transparently protects all transport and application layer content in IP packets.

Hard Parts In the section on SNMP, there is an important distinction between managed devices and objects. Managed devices are physical devices such as routers and switches. Objects are types of information, such as the length of time the TCP process will wait before sending another copy of .

Page 24

Not for Distribution to Students

an unacknowledged TCP segments. The term object comes from the fact that SNMP management information bases are object oriented.

The section on IPsec discusses the distinction between transport and tunnel modes of IPsec operation. They have strong relative strengths and weaknesses, and some students have some difficulty keeping things straight.

Teaching this Chapter This is a lecture chapter. Getting the information across clearly is important.

For subnetting, have students do some calculations in class. The PowerPoint presentations have a few examples. You can also give students worksheets.

.

Page 25

Not for Distribution to Students

CHAPTER 10: WIDE AREA NETWORKS Role in the Book Chapters 5, 6, and 7 discussed local area networks, which operate at Layers 1 and 2. Chapters 8 and 9 discussed internetworking, which operates at Layers 3 and 4. Now, we will look at wide area networks, which operate at Layers 1 through 4.

Changes from the Previous Edition Most fundamentally, there was no WAN chapter in the 8th edition. LAN and WAN material were mixed together in Chapters 5, 6, 7, and even 8 and 9. Making WANs a separate chapter is useful to emphasize how different it is to design and manage LANs than it is to design and manage WANs. In addition, companies must build their WANs from a group of optional technologies.

Putting all of this material together highlights that need. Plus, adopters told me to create a separate WAN chapter.

Flow of the Material The chapter repeats the definitions of LANs and WANs (and MANs). It emphasizes why WAN speeds are faster than LAN speeds and therefore why WAN efficiency is more critical than LAN efficiency.

Telephone access lines are used by both residential and business users to get access to WAN carriers. The chapter discusses telephone company access lines. It also discusses DSL and cable modem services for access to the customer premises, including business-oriented DSL lines, which are symmetric and offer quality of service guarantees.

The chapter discusses leased line WANs that companies create for themselves, linking sites together with leased lines and using routers at the sites to route transmissions.

The chapter then discusses public switched data networks (PSDNs), in which a carrier provides switching and overall management, and in which the customer needs only a leased line from each site to the nearest carrier point of presence (POP). There is a box on virtual circuits in PSDNs. A big trend is using the Internet for wide area networking instead of traditional technologies.

The chapter discusses how to address the Internet’s two biggest issues—relatively low quality of service without guarantees and security.

The chapter closes with the use of cellular telephony to carry data, including technology, standards, the characteristics of various generations of cellular service, and reasons why cellular throughput varies so much. There is a discussion about how Wi-Fi and cellular technology are converging.

.

Page 26

Not for Distribution to Students

The chapter finishes with a brief discussion of virtual WANs, which integrate multiple WAN technologies into a single effective corporate WAN.

Central Concepts The chapter discusses why WAN speeds are faster than LAN speeds and therefore why WAN efficiency is more critical than LAN efficiency.

Carriers price services for competitive reasons. Sometimes, they drop prices on one technology to encourage purchasing. Competitive price changes are difficult to predict because they are not based primarily on cost and can be very rapid. Carrier pricing makes WAN planning difficult.

While switched LANs are dominated by Ethernet and WLANs are dominated by 802.11, companies continue to use multiple technologies for WANs. Corporate WAN services tend to incorporate multiple technologies at any given moment.

Hard Parts It is important to be able to articulate why WAN speeds are faster than LAN speeds and therefore why WAN efficiency is more critical than LAN efficiency.

Some students have a hard time absorbing the fact that using 1-pair voice-grade UTP that is already pulled to the customer premises is the defining characteristic of DSLs.

Teaching this Chapter This is another lecture chapter.

Student discussions about their experiences with mobile phone, DSL, and cable modem speeds can be fun and instructive.

I keep a list of WAN technologies on the blackboard while teaching this chapter. It lists access technologies, then core network technologies. This helps students stay oriented when learning the large number of WAN technologies.

.

Page 27

Not for Distribution to Students

CHAPTER 11: NETWORKED APPLICATIONS Role in the Book After four introductory chapters, we moved up through the layers. Now we reach the highest layer, the application layer (Layer 5).

Near the beginning of this book, we noted that this is the only layer that users care about.

We focus on application standards more than management and security. Students should learn how HTTP, e-mail, and other standards operate.

Another theme is application architecture—where the application processing is done.

Increasingly, applications work by operating on multiple computers simultaneously.

Client/server processing began this trend. Now, peer-to-peer and service-oriented architectures are more radically distributing application processing.

Changes from the Previous Edition The broad chapter structure from the previous edition is preserved. There are, however, some changes in detail, particularly in service-oriented architectures. In addition, mobile clients are, of course, of exploding importance.

Flow of the Material There are more application layer standards than there are standards at any other layer.

Consequently, we can look only at a few of the most important standards. To organize the chapter, we look at application architectures—what machine or machines involved in the interaction do the processing.

For e-mail, we discuss traditional e-mail, which uses SMTP, IMAP, and POP for message transfer and RFC 822/2822, HTML, and UNICODE for message bodies. We also discuss web-based e-mail, in which the browser is the client and all interactions between the client PC and its mail server take place via HTTP. Voice over IP is an important new application. We look at the signaling and transport standards that govern VoIP transmission and codecs on the user device.

The World Wide Web has two major standards, HTTP for message transfer and HTML for the message body. We look at both in overview depth.

One could argue that cloud computing is nothing more than outsourced client/server computing. Although this may be true, cloud computing is the “big thing” today, and students must understand what it is, how it works, and the management issues it raises.

.

Page 28

Not for Distribution to Students

In service-oriented architectures (SOAs), many programs on many different computers can interact, providing services to one another, in order to satisfy a client command. This is another important trend today.

In peer-to-peer (P2P) applications, client PCs provide services to one another. P2P computing has a somewhat bad name in corporations because of its early use in illegal file sharing.

However, it has many potential legitimate corporate uses. It may be able to reduce the number of additional servers companies have to buy by exploiting underused client PC capacity.

Central Concepts The chapter is organized around the concept of application architectures—which determine where the processing is done.

Growing client capacity accounts for most of the evolution of application architectures. In some ways, P2P processing completes the processing revolution from its start in terminal-host computing.

Cloud computing is a hot topic. This chapter only gives the user an overview of cloud computing, but this is a reasonable foundation for reading the trade press to learn more.

Service-oriented architectures (SOAs) will potentially revolutionize how applications are written.

However, this is a complex topic, and students must work to master it.

SOA may be important in the future, but P2P computing will certainly be important. Students need to break through the idea that P2P is about illegal file sharing.

Hard Parts E-mail causes problems because it has quite a few standards that serve different purposes. This is material to go through slowly, recap, and then be sure that you can put standards into a taxonomy. The figures are a good way to study and review these standards.

Service-oriented architectures are confusing because terminology is sloppy and because there is a hierarchical pattern in SOAs consisting of general SOAs, Web services, and SOAP-based Web services. Figure 11-19 helps organize these concepts.

RTP causes problems in VoIP. Students must understand what it does and where it is in the packet. Nothing is conceptually difficult, but students tend to gloss over it.

P2P requires students to keep popping back to what P2P architectures are designed to do and the categories of P2P applications so that they can understand difficult topics.

Teaching this Chapter You might begin by recapping the idea of networked applications—applications that require a network to operate. You can then have students come up with a list of applications they use or have heard about. You can then organize them into categories, such as the categories in this chapter.

.

Page 29

Not for Distribution to Students

Having students use Google docs or Microsoft live office products is a good way for them to appreciate cloud computing. You might even start the term having them work in group projects with these tools throughout the term.

.

Page 30

Not for Distribution to Students

MODULE A: MORE ON TCP Role in the Book The book discusses TCP/IP in Chapters 1, 2, 8, 9, and other places. This module contains additional information on TCP sequence numbers and flow control.

It can be studied after Chapter 2, but most teachers would keep it until after Chapter 8, if they use it at all.

Changes from the Previous Edition Based on adopter feedback, we found that most of the material in this module in previous editions was never used. However, knowledge of TCP sequence numbers is quite useful for security. Flow control is useful because by increasing error rates modestly, an attack can use TCP’s natural tendency to drop back to low delivery speeds in the face of errors to create a brownout.

Flow of the Material The module then looks at the details of TCP operation, focusing on sequence and acknowledgement numbers, and TCP flow control.

Hard Parts TCP sequence and acknowledgement numbers are difficult to learn, but nearly every student learns them successfully.

Flow control is more difficult for students. You might just talk at a high level about how TCP starts with a small window size to limit transmission rates, then gradually increases the window size when transmission is successful for a while, but then drops back to a small window size when it encounters errors believing that congestion is occurring.

Teaching the Module This is a lecture module. Working lots of examples is important.

.

Page 31

Not for Distribution to Students

CHAPTER B: MODULATION Role in the Book Modulation is a low-level concern that working networking professionals rarely get involved in.

Therefore it is covered in a module for adopters who do want to cover it.

However, some adopters have noted that information on modulation methods is often included in material on 802.11 operation and so it is useful to help students understand that.

Changes from the Previous Edition No form of modulation is discussed in detail in the text. All are now discussed in this module.

Flow of the Material The module covers amplitude, frequency, and phase modulation.

Phase modulation is further divided into BPSK and QPSK. Finally, the module discusses how to combine modulation types QAM.

The Hard Parts QAM is a bit harder than the other parts, but nothing is very hard.

Teaching the Chapter This is a straight lecture chapter. For QAM, some examples should be worked.

.

Page 32

Not for Distribution to Students

MODULE C: TELECOMMUNICATIONS The book looks at networking from the viewpoint of user corporations. It does not go into depth on material of primary interest to carriers. In addition, the book focuses on data transmission.

However, telecommunications also is concerned with voice and video. This module goes into more depth on these topics. The module can be covered front-to-back like a chapter; or, selected material can be discussed in various chapters.

For carriers, there is the important distinction between transport—carrying customer signals from one customer to another—and signaling—which is the name given to circuit setup, circuit shut-down, and other administrative transmissions. The module discusses the C7 signaling system used by telephone carriers. C7 is packet-switched instead of circuit-switched like PSTN transport.

Chapters 7 and 8 did not discuss microwave and satellite transmission systems, because these are carrier concerns rather than customer concerns. This module discusses microwave transmission, types of communication satellite orbits, and very-small dish satellite systems.

Ethernet UTP transmission uses 4-pair UTP. This medium was long used in building telephone wiring before Ethernet was created and was long considered unsuitable for data traffic.

However, improved categories of UTP wiring made this transmission medium suitable for both voice and data traffic. The module discusses some details of planning and installing UTP transmission plants in buildings.

Companies have their own private telephone switches, which handle internal telephone switching and connect the firm to the PSTN. These are private branch exchanges (PBXs). This module discusses PBXs technology, PBXs and VoIP, and user, attendant, and management services.

Large companies can get bulk discounts on telephone service, but understanding telephone pricing for corporations is rather complex. This module discusses some of these complexities.

Telephone service was once a monopoly. In the 1960s and afterward, telephone service was heavily deregulated. This brought competition, lower prices, and chaos. The module ends with a discussion of how today’s deregulation came to be. Many teachers skip this section because the most important changes in deregulation came before most students were born. However, it is interesting to see how carriers in a local area in the United States connect at points of presence (POPs).

.

Page 33

Not for Distribution to Students

MODULE D: DIRECTORY SERVERS This small module has three parts: Directory Servers Microsoft’s Active Directory Directory Servers’ Roles in Authentication

.

Page 34

Not for Distribution to Students

PREFACE FOR TEACHERS FIVE QUESTIONS Teachers who are considering this book typically have five questions.

•

Is this book right for a networking core course?

•

What’s new in this edition?

•

Why select this book? There are three reasons: •

Up-to-date, job-relevant information

•

Strong teacher support

•

A book design focused on student learning

•

How is the book organized?

•

How can I teach with it?

This preface walks through these questions.

IS IT RIGHT FOR A NETWORKING CORE COURSE? Absolutely. The name Business Data Networks and Security simply reflects the fact that the networking job has evolved greatly in recent years. Security permeates everything in networking today, from design through operation. When I talk to network professionals about their work, security is usually the main topic of conversation. This does not mean that traditional networking concerns have gone away or even gotten easier. It is just that security is pervasive and needs to be understood very well. The days of designing a network without thinking about security at every step are long gone.

In fact, security coverage has been growing in this book for several editions. The title for this edition simply reflects this increased focus. This is not simply a marketing gimmick. This edition has even more security than previous editions, and security is more tightly interwoven with traditional networking concepts. Just as every Internet Engineering Task Force RFC has a security section, this book explores security issues for nearly every concept in the book.

This increased focus on security should help students find good jobs. Networking and security have both been high-growth areas in IT employment for several years. Knowledge of both is very attractive to companies that hire our graduates. Many programs do not have full security courses in their core. Covering security in networks can help reduce this weakness. Of course, this is not a full security book. If you have a full security course and have networking as a prerequisite, a heavy focus on security in networking gives students momentum for the security course. .

Page 35

Not for Distribution to Students

WHAT’S DIFFERENT IN THIS EDITION? Updated Information It is important for authors in networking to weed out dead issues so that they have room to teach the newer concepts students need to know.

•

Security—Obviously, this edition has a good deal more security than previous editions.

•

Wireless—This edition also has an even stronger focus on wireless, including the revolutionary 802.11ac and 802.11ad standards whose products are beginning to come to market. There is also more information on WLAN handoffs, Bluetooth profiles, cellular data service, and other wireless topics.

•

Cloud Computing and BYOD—Of course, there is more emphasis on cloud computing and the BYOD (Bring Your Own Device) revolution.

•

IPv6—The TCP/IP chapters have a good deal more on IPv6, an area in which interest has recently spiked among networking professionals. Chapter 8 goes into more detail on the IPv6 header, the next header architecture of the packet, and the complex addressing scheme introduced with IPv6. Chapter 9 adds entirely new information on introducing IPv6 in an IPv4 world and the other “v6” standards that help companies manage IPv6.

Chapter 9 also discusses the complex options for getting IPv4 and IPv6 to work together.

Chapter Flow Changes

.

•

The major chapter redesign in this book is to have a chapter specifically on wide area networks (Chapter 10). In the previous edition, LAN concepts and WAN concepts were taught together to emphasize similarities. This approach seems cleaner and easier for students to learn.

•

Creating a WAN chapter allowed wired physical layer transmission and Ethernet to be combined into a single chapter (Chapter 5). This means slightly less emphasis on physical layer wired transmission, but that is reasonable in terms of what networking professionals need to know today.

•

The book still begins with four introductory chapters dealing with networking in general, network standards, network security, network design, and other network management matters.

•

After these four chapters, the student is able to apply these concepts to a series of progressively more complex types of networks. The remaining chapters take the students “up through the layers,” with three chapters on wired and wireless LANs, two chapters on TCP/IP internetworking, a WAN chapter that includes Internet transmission for traditional WAN purposes, and an applications chapter.

•

Pedagogically, this flow from LANs to TCP/IP and WANs introduces principles in familiar network settings such as wired and wireless LANs, so that when students get into the less familiar worlds of TCP/IP and WANs, they have the core concepts they need to

Page 36

Not for Distribution to Students

master less familiar types of networking. It also means that they learn more about TCP/IP because they are well prepared when they study it in depth.

WHY SELECT THIS BOOK? Up-to-Date, Job-Relevant Information in the Right Depth Up-to-Date Content In designing this and every previous edition, the first author talked extensively with working networking professionals and managers. He also examined extensive market data on the technologies that corporations actually use. Many textbooks seem to be surprisingly market blind, spending time on technologies that never were adopted by the market and on technologies that have not been sold since the previous century. Loaded down with unimportant information, they are not covering important new developments such as 802.11ac, 802.11ad, and the exploding importance of IPv6 knowledge.

All parts of the book have been updated. In this edition, special attention has been given to the following topics: •

Wireless Networking—Wireless is the “big thing” in networking today. Wireless LAN content is concentrated in two chapters, and these chapters occur after students already have a stronger grounding in security and network design than they did in the last edition. Cellular is moved to the new WAN chapter to allow more room for wireless LANs in Chapters 6 and 7.

•

Security—Security is pervasive throughout this book. As noted earlier, this has been the case in previous editions, but in this edition, security is even more integrated.

•

TCP/IP Internetworking—The need for TCP/IP knowledge continues to grow in networking. This edition gets much more deeply into IPv6 in Chapters 8 and 9.

•

More attention is given to both cloud computing and the BYOD revolution.

Job-Relevant Detail In the past, job interviewers often asked students to name the OSI layers and stopped at that.

Today, even interviewers for non-networking jobs grill job applicants on networking. The days of feel-good “network appreciation” textbooks with far too little detail for job applicants should be over.

For example, in the Ethernet chapter (Chapter 5), the book goes well beyond basic topology and switch operation to look at VLANs, link aggregation, the Rapid Spanning Tree Protocol, and switch purchasing considerations. Detail has been beefed up in other areas as well. The TCP/IP chapter (Chapter 8) takes a detailed look at how routers operate, whereas some other books cover this critical topic superficially or even incorrectly. IPv6 is heavily expanded for the same reason.

.

Page 37

Not for Distribution to Students

Strong Teacher Support Teaching networking is very difficult, so textbooks must provide strong teacher support.

ASK THE AUTHOR I’m Ray@Panko.com. If you have questions about the text, the material, or

networking in general, please do not hesitate to contact me. Also, if you have suggestions for the next edition, please let me know. This book is on a two-year cycle, it is always changing, and adopters have suggested most of these innovations.

DETAILED POWERPOINT LECTURES The book has full PowerPoint lectures. They are not just “a few

selected slides” from the book. The PowerPoint lectures cover all major concepts and include builds for more complex figures. They may also contain information added since the book went to press. Students can download the lectures in full PowerPoint format on the Companion Website, accessible through http://www.pearsonhighered.com/panko. Adopters get annotated versions of the PowerPoint presentations to help them prepare and present lectures.

The PowerPoint slides are directly related to figures in the book. Almost all important points in the book are covered in figures, including “study figures” that summarize key points. In addition, the text in figures is enlarged to be legible in PowerPoint presentations. (The figures were designed to be readable both in print and in PowerPoint presentations with only minor adjustments.)

WEBSITE The book’s Instructor Resource Center, accessible through

http://www.pearsonhighered.com/panko, is rich in teacher resources. This is where teachers can download answer keys, test item file questions, and the latest versions of the PowerPoint lectures (which are updated once or twice a year). There are also study hints for students and an Instructor’s Manual that gives teaching suggestions for individual chapters.

FLEXIBILITY: HAVE IT YOUR WAY This book is not designed to be covered in its entirety, including

all advanced modules. Rather, it is designed to give teachers options without having to look for other material.

.

•

An 11-Chapter Core: A Complete Networking Cours—The book has 11 core chapters.

Each can be covered in about one semester week. In a three-credit, one-semester course, this leaves one to two weeks for other material. However, many teachers prefer to limit their courses to the 11 core chapters, which form a complete networking course.

This allows them to go through the material at a more deliberate pace. In addition, staying with the 11 core chapters may be a good strategy for teachers working with the book for the first time or teaching a networking course for the first time. Most teachers doing that need a bit more time to cover concepts.

•

Boxed Material within Chapters—Within chapters, some technical details are placed in boxes. Many teachers skip all boxed material. Others use them selectively.

•

Hands-On Chapters—Students like to do hands-on exercises. These exercises can make the abstract concepts covered in the chapters more concrete. Several chapters have brief hands-on chapters that follow them. Generally, a hands-on chapter takes 30 to 45 minutes to cover in class.

Page 38

Not for Distribution to Students

•

Advanced Online Modules—There are four advanced modules. Module A covers TCP sequence numbers, acknowledgment numbers, and flow control. Module B covers modulation. Module C is for courses that focus on telecommunications. Chapter 10 looks at telecommunications from the viewpoint of corporate information systems (IS) staffs. Module C focuses on telecommunications more from the carrier’s point of view.

Finally, Module D covers directory servers. In the last edition, the modules were printed in the textbook itself. In this edition, they have been moved online to the Companion Website.

CHAPTER QUESTIONS ARE TIED TO ANSWER KEYS AND TEST ITEM FILE QUESTIONS Each multiple-

choice test question refers to a specific chapter test-your-understanding or end-of-chapter question. This allows you to select specific questions for students to master and then develop tests that reflect those selected questions.

Strong Pedagogy for Student Learning Learning networking is difficult. Many students find that networking is the most conceptually difficult course in IS programs. There are many TLAs and FLAs (three-letter acronyms and fourletter acronyms), and there are many abstract and interrelated concepts. Networking books need to have very strong pedagogy.

CLEAR WRITING Past editions of this book have received praise for clear writing, especially for

their ability to teach difficult and complex topics. Every chapter is classroom-tested.

HANDS-ON OPPORTUNITIES If students do hands-on activities, they can develop a more concrete

understanding of the concepts they have covered in the text.

CHAPTER QUESTIONS As noted earlier, the book gives the student many opportunities to check

his or her knowledge.

•

Frequent Test-Your-Understanding Questions—After each section, there are test-yourunderstanding questions to help students see whether they have understood the material they just read.

•

Meaty End-of-Chapter Questions—End-of-chapter questions help the student integrate the material in the chapter. Thought questions challenge the student to think more deeply about the material. Troubleshooting and design questions help students develop important skills that are critical in networking.

UP THROUGH THE LAYERS/FAMILIAR TO THE UNFAMILIAR In general, the book flows from the

familiar to the unfamiliar. Students learn broad concepts first and then look at familiar Ethernet and wireless LANs. They get to the complexity of TCP/IP standards and the unfamiliarity of WANs only after they have a solid grounding in simpler network concepts.

SYNOPSIS SECTIONS IN EVERY CHAPTER Each chapter ends in a synopsis section that summarizes

key points. In classroom testing of the edition’s chapters, these synopsis sections were very popular with students.

.

Page 39

Not for Distribution to Students

STUDY FIGURES Nearly every concept is covered in the chapter figures. A good way to study for

exams is to try to explain each figure. “Study figures” are summaries of concepts that are not covered in line drawing figures.

DEFINITIONS In many cases, important definitions or concepts are repeated in delimited

sentences or paragraphs such as the following. Students should pay particular attention to these.

A camel is a horse designed by a committee.

HOW DO I TEACH WITH THIS BOOK? As noted earlier, this book has 11 core chapters. These form a complete course.

Junior and Senior Courses in Information Systems With courses for juniors and seniors, as noted earlier, covering the 11 core chapters will probably leave you with one or two semester weeks “free”. As noted earlier, this leaves time for hands-on activities, additional material in the advanced modules, a term project, or other material you wish to cover. However, the entire book should not be covered in its entirety in a single term.

Community College Courses For freshman and sophomore courses in community colleges, it is good practice to stay with the 11 core chapters, going over chapter questions in class. It is probably good to cut out all boxed material in the classes. If you want to do hands-on material, it is advisable to cut some material from the core chapters.

Graduate Courses Graduate MSIS courses tend to look a lot like junior- and senior-level courses, but with greater depth. More focus can be placed on end-of-chapter questions. It is also typical to have a term project.

How I Teach the Course In general, I cover a chapter in one week. After finishing a chapter, the students are required to hand in selected test-your-understanding and all end-of-chapter questions the next class period.

We spend about a half hour going over their homework. For test-your-understanding questions, I give them 15 to 20 minutes to ask about specific questions they had a hard time with. I then spend 10 to 15 minutes going over all end-of-chapter questions. This is a bit tight. I usually schedule a free day for every three chapters in case we need a little wiggle room. I usually spend half of the free day going over questions; I do a hands-on exercise with the other half day.

.

Page 40

Not for Distribution to Students

HOW IS THE BOOK ORGANIZED? Introductory Chapters In networking today, it has become impossible to talk about specific network or internet technology without considerable background in standards in general, security, and network design. Consequently, the book begins with four initial chapters that introduce core concepts, ground the student firmly in layered network standards, go over core concepts in security, and cover network management, focusing on design. In the rest of the book, students apply these concepts to wired and wireless LANs, TCP/IP internets, WANs, and applications. Chapters 1 and 2 have “a” chapters that give students hands-on experiences to help them assimilate conceptual material in chapters.

Up Through the Layers After the introductory chapters, the book begins moving up through the layers, from the physical layer to the application layer. This book does not discuss the layers individually, because that is not how they appear in technology. Rather, the book shows how Layers 1 and 2 collectively govern single switched and wireless networks and then how Layers 3 and 4 collectively govern internetworking. Looking at network layers one at a time does not show their interrelationship as well.

WHY UP THROUGH THE LAYERS? In addition to moving up through the layers, students move from

situations that are more familiar to less familiar. All students have worked on wired LANs and wireless LANs. In these familiar environments, students learn the basic concepts they will need to move on to internets. Although students all use the Internet, IP, TCP, UDP, and supervisory protocols are much more complex than Layer 1 and Layer 2 protocols. Students learn a good deal about TCP/IP standards in early chapters, but they need more background before taking a comprehensive look at TCP/IP internetworking.

WIRED SWITCHED NETWORKS Chapter 5 covers switched Ethernet wired networks, which operate

at Layers 1 and 2. The chapter first introduces physical layer concepts and standards for wired transmission media (4-pair UTP and short-range optical fiber in LANs). The focus then shifts to the data link layer and management. Ethernet is no longer a simple plug-and-play technology.

The chapter covers VLANs, Power over Ethernet, 802.1X Port-Based Access Control, and other advanced topics. Most of the material in this chapter came from Chapters 5 and 6 in the previous edition. However, the material has been streamlined, with marginal topics dropped.

Chapters 5a and 5b give optional hands-on exercises in UTP connectorization and switched network setup. The latter shows how easy it is to physically set up an Ethernet network but illustrates what happens if you accidentally introduce a loop.

WIRELESS NETWORKS Chapters 6 and 7 cover wireless LANs, which also operate at Layers 1 and 2.

These chapters focus most heavily on 802.11 wireless LANs (WLANs), which are a major preoccupation of networking professionals today. Chapter 6 covers wireless transmission (which is more complex and far less predictable than wired transmission) and then discusses the technology of 802.11 WLANs. Chapter 7 covers 802.11 network security and management. An .

Page 41

Not for Distribution to Students

important lesson of Chapter 7 is that core security protocols such as 802.11i address only some of the important WLAN security threats. Chapter 7 moves into other local wireless standards, such as Bluetooth and near-field communication (NFC). (Wi-Fi Direct is covered in Chapter 6.)

Both 802.11 and Bluetooth information are expanded considerably compared to the previous edition.

TCP/IP Internetworking Chapters 8 and 9 cover internetworking with TCP/IP. This material is

difficult, but having learned core networking concepts in earlier chapters, including core TCP/IP concepts, students should not have difficulty with these chapters. Chapter 8 focuses most heavily on the Internet Protocol, how routers work, and advanced aspects of TCP and UDP. Chapter 9 focuses on the management of TCP/IP networks and TCP/IP network security. Given the exploding importance of IP Version 6, material on this standard has expanded considerably in the two chapters. There is no “a” chapter for this material, but I have my students revisit Wireshark, this time looking into most or all of the fields of IP, TCP, UDP, and ARP messages.

WIDE AREA NETWORKING Chapter 10 covers wide area networking, a topic that was spread

through other chapters in the previous edition. WANs vary in their layers of operation, including Layer 1 for leased lines, Layers 1 and 2 for public switched data networks, and Layers 3 and 4 when companies use the Internet for WAN transmission. The chapter discusses the importance of efficiency in WAN operation, where the cost per bit transmitted is high.

APPLICATIONS Chapter 11, as in the previous edition, covers application layer standards. Many

teachers skip this chapter because they cover applications in other courses. However, this chapter focuses on application standards much more than functionality, which is the main topic of most other courses. Application standards approaches are becoming much more complex, with different approaches needed for cloud computing, service-oriented architectures, peer-topeer applications, and other advances.

PREFACE FOR STUDENTS PERSPECTIVE In the past, information systems (IS) graduates had a single career track: programmer–analyst– database administrator–manager. Today, however, many IS graduates find themselves on the networking/security career track. Both networking and security employment are growing rapidly, and they are exciting to work in. This course is an introduction to the networking/security track.

Even programmers today need a strong understanding of networking. In the past, programmers wrote stand-alone programs that ran on a single computer. Today, however, most programmers write networked applications that work cooperatively with other programs on other computers.

Whichever IT career path you choose, learn as much as you can from each course. Employers do not just look at transcripts. If you make it past initial job interviews, expect to be grilled for hours in subsequent interviews to see what you really know. Employers do not expect

.

Page 42

Not for Distribution to Students

perfection, but they demand a high level of knowledge and the retention of that knowledge.

Study for mastery and retention.

How to Learn Networking NETWORKING AND SECURITY ARE DIFFERENT FROM PROGRAMMING Programming is an exciting

topic. However, intellectually it is very different from networking and security. In programming, the focus is on creating and running programs. In networking, the critical skills are design, product selection, troubleshooting, and security. These rather abstract skills require a broad and deep knowledge of many concepts. Many IS students have a difficult time adjusting to these cerebral skill requirements. Security is especially a “head game” because we are pitted against intelligent adversaries, not simply difficult choices in complex situations.

HOW TO STUDY THE BOOK There are several keys to studying this book:

.

•

Reading chapters once will not be enough. You will need to really study the chapters. In the earliest chapters, you will just be developing a mental framework for placing new information into the broader picture. This really hurts retention. You will have to go over things several times to really understand them and to develop the mental framework you will need to absorb additional networking knowledge efficiently.

•

Slow down for the hard parts. Some sections will be easy, others difficult. We all have a tendency to go at the same speed through all sections. Also, if you don’t get it the first time, work at it. You may be able to get Bs and Cs not knowing the hard stuff, but you won’t have the knowledge you need in the workforce.

•

When you finish reading a section, immediately do the Test Your Understanding questions. If you don’t get one of the questions, go back over the text. The understanding of networking is strongly cumulative, and if you skim over one section, you will have increasing difficulties with later material. Multiple-choice questions in the test item file are taken entirely from the test-your-understanding questions and the end-of-chapter questions.

•

If you can, get together with other students to go over your answers to the Test Your Understanding questions to see if everybody agrees.

•

Study the figures. Nearly every key point in each chapter is in the figures. If there is something in a figure you don’t understand, you need to study the corresponding section in the chapter. Pretend you are trying to explain the figure to someone else.

Also, study the “study figures” that summarize information.

•

Key terms are printed in boldface when they are first introduced. Pay special attention.

Pay even more attention to material set off with top and bottom borders.

•

Network design is about selecting among alternatives. If several concepts are presented in a section or chapter, do not just study them individually. You need to know which one to use in a particular situation, and that requires compare/contrast knowledge. Study the figures that compare concepts, and make your own figures and lists or charts of features if the book does not provide them. Comparing different technologies in order to select the best one for corporate needs is a critical skill for all IT professionals.

Page 43

Not for Distribution to Students

•

Study the synopsis section at the end of each chapter. The synopsis summarizes key concepts in the chapter. Be very sure that you understand the synopsis very well. You might even study them before beginning the chapter, to get a broad understanding of the material.

•

One way to make networking less abstract to you is to do as many hands-on activities as possible.

A NETWORKING/SECURITY CAREER If you like the networking course and think you want a networking or security career, an important thing to keep in mind is that both change constantly. This means constant learning and new skills development. On the negative side, this means doing a lot of reading. However, do not underestimate the importance of job variety in your career. Doing the same thing or very similar things every day does not make for a very satisfying career. Networking and security are very satisfying careers.

If you do want to prepare for a networking or security career, there are a number of steps you should take before graduation, even if your school does not have advanced networking or security courses.

.

•

Most importantly, do a networking or security internship. Employers really want workers with job experience, often preferring it to an unwarranted degree over academic preparation.

•

Read networkworld.com regularly. In fact, read it during this course. You won’t understand everything, especially at first, but as your understanding grows, you will find that you can read the professional material in the field. That means that you have a strong background.

•

Consider getting one or more industry certifications. In networking, the low-level CompTIA Network+ certification should be obtainable with just a bit more study after you take your core networking course. However, this certification is not highly valued.

Cisco’s more valuable CCNA (Cisco Certified Network Associate) certification, which focuses on switching and routing, will require substantially more study. You also have to learn hands-on commands. This will require you to take a class or buy a network simulation program designed for this certification. Microsoft server certification is also valuable, but it focuses more on clients and servers. Employers like certifications, but they know that certifications are no substitutes for job experience. Similarly, the CompTIA Security+ is a relatively low-level certification, whereas the CISSP is a more impressive certification. Certifications increasingly require several years of work in the field. However, it may be possible to pass the exam to show that you have mastered concepts in the field before you begin working in the field.

Page 44

Not for Distribution to Students

CHAPTER 1: WELCOME TO THE CLOUD Note: Page numbers are indicated by square brackets [ ].

TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Why do you think wireless is such a big concern today in networking and security? (In this book, “do you think” questions require you to go beyond what is in the text. You may not be able to answer them perfectly, but try hard because they are good learning opportunities.) [1–4] Some talking points: Most network implementations today are wireless.

Wireless transmission is more risky because adversaries can easily intercept signals.

Wireless propagation is less predictable than wired transmission Wireless standards and products are maturing rapidly. b) Distinguish between cloud data storage and synchronization on the one hand and cloud software service on the other. [2–4] Some talking points: Cloud data storage and synchronization is concerned only with data handling.

Cloud software service makes applications available to users. c) What do you think are the advantages of each? [2–4] Some talking points: Data service is simpler and therefore more manageable.

Providing applications is a good way to increase value. d) What do you think are their disadvantages? [2–4] Some talking points: They represent major security risks.

Services are immature and therefore difficult and costly to use from the labor viewpoint. e) Why do you think the bring your own device (BYOD) revolution has made networking more difficult? List several issues. [1–4] Some talking points: There is great device diversity and no standardization of devices.

Security on BYOD devices is immature to nonexistent.

Employees typically own their devices, so control over them is difficult.

Employees typically mix personal and business data and applications.

Employees do not understand security issues well.

There is limited management application software for managing BYOD devices.

There is no consensus on how to manage BYOD devices.

.

Page 45

Not for Distribution to Students

2.

Go to YouTube and watch “A Day Made of Glass” by the Corning Corporation. List new ways of displaying information shown in the video. [No Page Numbers] Walls and mirrors Table tops Devices such as refrigerators and stoves Traffic kiosks In-store displays Images can be moved among these devices

3.

a) What information could Claire learn about individual access points? [5–6] Names (SSIDs) Signal strengths Ethernet address (BSSIDs) Security standards in use b) Distinguish between SSIDs and BSSIDs. [5] The SSID is the name of the access point and network (FBP).

The BSSID is the access point’s (Ethernet) address. c) What is a rogue access point? [6] An access point set up by an individual employee or department without authorization. d) Why do you think rogue access points are dangerous? [6] Some talking points: They may have poor security, allowing attackers to get in without going through the site’s firewall.

They may interfere with the operation of legitimate access points.

e) Why is centralized wireless management highly desirable compared to “management by walking around” as Claire does today? [6] She will not have to walk around to find transmission problems.

It will identify rogue access points and access points outside the building automatically.

She can remotely diagnose problems and make changes.

She can dynamically adjust access point power to special conditions.

4.

a) List major wireless LAN security issues. [7–9] The need to create security policies for mobile devices Maturity of security on devices is improving, but new problems constantly appear Diversity of device software Pace of change in technology Physical loss of mobile devices Rogue access points are a problem

b) Why is BYOD security so difficult today? [7]

.

Page 46

Not for Distribution to Students

Immaturity of product security High diversity among products Rapid pace of change 5.

Why does this book combine networking and security? [7–8] The two are inseparable today at every stage of the network life cycle.

Networking people constantly run into security issues.

Security people find that many of their problems are concerned with networks.

6.

a) Give the book’s definition of network. [8] As a working definition, a network is a system that permits applications on different hosts to work together.

b) What is a networked application? [9] Networked applications are applications that require networks to work. c) What are Web 2.0 applications? [9] In Web 2.0 applications, users supply the content. d) What are social media applications? [9] These are applications that facilitate the creation and maintenance of group relationships. e) What is a host? [10] A host is any device attached to a network. f) Is your laptop PC or desktop PC a host? [9–10] Yes, if it is connected to a network. g) Is a smartphone a host? [9–10] Yes h) Why is the network core shown as a cloud? [10] To emphasize that the user does not have to look inside the cloud to see how it works. i) Why may the user need to know more about his or her access link than about the network cloud? [10–11] If the user needs to take any action regarding the network, it is likely to be regarding the access link.

Users may have to plug in access link technology, configure it, and troubleshoot simple problems.

7.

a) Are network speeds usually measured in bits per second or bytes per second? [13] Bits per second b) How many bits per second (without a metric prefix) is 20 kbps? Use commas. [13] 20,000 bps c) How many bits per second (without a metric prefix) is 7 Mbps? Use commas. [13]

.

Page 47

Not for Distribution to Students

7,000,000 bps d) How many bits per second (without a metric prefix) is 320 kbps? Use commas. [13] 320,000 bps e) Is the metric prefix for kilo k or K? [13] k f) Express 27,560 bps with a metric prefix. [13] 27.56 kbps 8.

a) Why is paying for a transmission line by the minute not too bad for voice conversations? [15] One person or the other is talking most of the time, so there is not a huge amount of unused bandwidth being wasted. b) For what two reasons is paying for a transmission line by the minute bad for data transmissions? [15] Data transmission is bursty, with short bursts of traffic separated by long silences. A great deal of paid-for bandwidth is wasted.

9.

a) In packet switching, what does the source host do? [16–17] In packet switching, the source host fragments the application message into many smaller pieces called packets. It submits these packets to the network. b) About how long is a packet? [16] About 100 bytes long c) Why is fragmentation done? [17] Packet switching saves money by multiplexing multiple conversations over expensive circuits. d) Where is reassembly done? [16] On the destination host e) What are the two benefits of multiplexing? [17] It reduces costs.

If there is an error in a packet, only that packet has to be resent—not the entire application message. f) When a packet switch receives a packet, what decision does it make? [17] It makes a forwarding decision—deciding which port to send the packet back out. g) Do packet switches know a packet’s entire path through a network? [18] No h) In Figure 1-14, if Packet Switch A receives a packet addressed to Destination Host W, where will it send the packet?

Packet Switch C

.

Page 48

Not for Distribution to Students

10.

a) In Figure 1-15, how many physical links are there between the source host and the destination host along the indicated data link? [20] 5 b) How many data links are there between the source host and the destination host? [20] 1 (by definition) c) If a packet passes through eight switches between the source and destination hosts, how many physical links will there be? (Careful!) [19-20] 9 (Draw the picture. There is always one more link than switches.) d) How many data links will there be? [19-20] 1 (by definition)

11.

a) On the ARPANET, explain the functions of IMPs. [20] They fragment application messages and act as packet switches. b) How is this like what packet switches do today? [20] They forward packets. c) How is it more than packet switches do today? [20] They also fragment application messages. This is done by hosts today, rather than packet switches.

12.

a) What organization sets Internet standards today? [22] The Internet Engineering Task Force (IETF) b) What does the IETF call its standards? [21] Requests for comments (RFCs)

13.

a) How did Ray Tomlinson extend e-mail? [22] Previously, e-mail was sent only between users on the same server host.

Tomlinson extended e-mail to be sent between users on different server hosts. b) How did he change e-mail addresses? [22] Previously, e-mail addresses had been user account names on the host.

He also needed to add the host on which the account resided to the address.

His final address was the account name, an @ sign, and the hostname.

14.

What problem did Bob Kahn face? [23] He was supporting several networks, and users on one network could not communicate with hosts on other networks.

15.

a) What device connects different networks into an internet? [23] A router b) What is the old name for this device? [23] Gateway

.

Page 49

Not for Distribution to Students

16.

a) Distinguish between internet with a lowercase i and Internet with an uppercase I. [25] Lowercase: an internet and the internet layer (except at the beginning of a sentence) Uppercase: the global Internet b) Why are many networking concepts duplicated in switched networks and internets? [25] Individual networks already existed. They had different technologies and addressing schemes. The only way to connect their users was to add a second level of networking, including messages, forwarding devices, and end-to-end paths. c) What are the two levels of addresses? [25] Single network addresses (at the data link layer) Internet addresses (IP addresses) at the internet layer d) How long are IP addresses? [25-26] Initially, in IPv4, 32 bits Later, in IPv6, 128 bits e) How are IPv4 addresses usually expressed for humans? [25-26] IPv4 addresses are expressed in dotted decimal notation for human reading. f) Distinguish between packets and frames. [26] Packets at the data link layer are called frames, and packets at the internet layer are called packets. g) A host transmits a packet that travels through 47 networks. How many packets will be there along the route? [26] One h) How many frames will be there along the route? [26] 47 i) Are frames carried inside packets? [26] No, packets are carried inside frames. j) Distinguish between switches and routers. [27] Switches are forwarding devices for frames at the data link layer.

Routers are forwarding devices for packets at the internet layer. k) Distinguish between physical links, data links, and routes. [27] A physical link connects adjacent devices in a single network.

A data link is the path a frame takes through a single network.

A route is the path a frame takes through an internet. l) Distinguish between what happens at the internet and transport layers. [27-28] The internet layer forwards a packet across routers from the source host to the destination host. The internet layer also governs packet organization.

.

Page 50

Not for Distribution to Students

The transport layer fragments and defragments application messages. It also checks for errors. m) Do IPv4, IPv6, or both use dotted decimal notation for human reading? [25-26] No n) Why are application layer standards needed? [28] So that application programs can work together. o) List the numbers and names of the five layers. [29]

17.

5

Application

4.

Transport

3.

Internet

2.

Data Link

1.

Physical

a) What are the roles of the Internet Protocol? [30] The Internet Protocol deals with addresses and functionality for routers to move packets across an internet. b) What are the roles of the Transmission Control Protocol? [30] It places packets in order, corrects errors, and reduces the likelihood of congestion.

It also does fragmentation and defragmentation. c) What are the limitations of the User Datagram Protocol? [30] It cannot do error handling.

Application messages must fit into a single UDP datagram. d) Why is UDP used sometimes? [30] Requires less processing burden on the hosts Creates less traffic burden on the network e) What is TCP/IP? [31] TCP/IP is a family of standards including IP, TCP, UDP, and many other standards.

18.

a) In what sense is January 1, 1983, the birthday of the Internet? [31] On that day, NCP was ended and all hosts had to follow TCP/IP. b) In what sense is it not? [31] Most systems were already using TCP/IP anyway.

19.

a) What was the Acceptable Use Policy in place on the Internet before 1995? [31] The NSF ran the backbone. It forbade the use of commercial activities through the AUP. b) Why did commercial activities on the Internet become acceptable in 1995? [31] The government stopped paying for Internet transmission, so its restrictions on the Internet’s use ceased to exist. The Acceptable Use Policy was gone.

.

Page 51

Not for Distribution to Students

c) What do we call the carriers that provide Internet service? [31] Internet service providers [ISPs] d) Why do they need to be interconnected? [31] Two hosts that need to communicate over the Internet may be on different ISPs. The ISPs need to be interconnected to carry such traffic. e) At what locations do ISPs interconnect? [31] Network access points (NAPs) 20.

a) Why do servers need static IP addresses? [33] So that client hosts can know how to find them. b) What protocol provides a client PC with its dynamic IP address? [33] The Dynamic Host Configuration Protocol (DHCP) c) What other configuration information does this protocol provide? [33] Configuration information also includes the IP addresses of local Domain Name System (DNS) servers, which we will see next. It includes other information such as a subnet address mask, which we will see later in this book. d) Why should PCs get their configuration information dynamically instead of manually? [34] With DHCP, every client PC automatically gets hot fresh information every time it boots up. If configuration information changes, all client PCs will be updated automatically.

With manual configuration, every change in basic configuration information would require manual changes on each client. This would be very expensive.

21.

a) To send packets to a target host, what must the source host know? [34] The IP address of the target host. b) If the source host knows the host name of the target host, how can it get the target host’s IP address? [34] It sends a DNS request message to a DNS server. This message contains the host name of the target host and requests the IP address of the target host.

The DNS server sends back a DNS response message containing the IP address of the target host (or an error message explaining why it failed to find the requested IP address).

22.

Both DHCP servers and DNS servers send a host an IP address. These are the IP addresses of what hosts?

This is an important question that helps students distinguish between these two types of servers.

DHCP servers give a client an IP address for the client to use as its own.

DNS servers give a client the IP address of a target host, to which the client host wishes to send packets.

23.

a) List the hardware elements in the small home network described in this section. [35–37] Broadband modem

.

Page 52

Not for Distribution to Students

Wireless access router Client PCs (and other client devices) Printer 4-Pair UTP wiring b) For wired connections, what transmission medium is used? [36] 4-pair UTP. c) What is its connector standard? [36] RJ-45 d) What is the standard for wireless PCs and printers to connect to a wireless access point? [36] 802.11 e) What are the five hardware functions in a wireless access router? [37] Router Ethernet switch Wireless access point (if included) DHCP server Network Address Translation (NAT) f) Why is the DHCP function necessary? [37] So that hosts on the home networks can have individual IP addresses. The ISP gives only a single ISP address to the access router. g) Why is NAT necessary? [37] So that transmissions to and from the Internet by different internal devices can be sent from and to the correct device. h) What three services does this network provide to the desktop PC and the wireless tablet? [3738] Shared Internet access File sharing Printer sharing i) Which devices need to be configured? (List them.) [38] Each client PC The printer The remote access router

END-OF-CHAPTER QUESTIONS Thought Questions 1.

.

a) In Figure 1-15, when Host X transmits a packet along the data link shown, how many physical links are there along the data link shown?

Page 53

Not for Distribution to Students

5 b) How many data links? [20] 1 2.

a) In Figure 1-20, how many physical links, data links, and routes are there along the way when Host A sends a packet to Host B? Physical links: 7 Data links: 3 Routes: 1 b) When Host E sends to Host C? (Assume that hops will be minimized across switches and routers.)

Physical links: 8 Data links: 3 Routes: 1 c) When Host D sends to Host E? Physical links: 3 Data links: 1 Routes: 1

3.

In a certain network, there are nine routers between Host R and Host S. a) How many data links will there be along the way when Host R transmits a packet to Host S? (Hint: Draw a picture.)

10 b) How many routes?

1 c) How many frames?

10

4.

Why does it make sense to make only the transport layer reliable? This is not a simple question.

First, error correction has to be done only on the source and destination hosts—not on each router along the way.

Second, it is directly beneath the application layer, so wherever errors occur, the application program gets clean data.

5.

a) What does it mean that data transmission is bursty?

There are brief transmission bursts separated by long silences. b) Why is burstiness bad if you pay for a transmission line by the minute?

You will be paying for capacity you are not using.

6.

.

What layer fragments application messages so that each fragment can fit inside an individual packet?

Page 54

Not for Distribution to Students

The transport layer

Case Study 1.

A friend of yours wishes to open a small business. She will sell microwave slow cookers. She wishes to operate out of her house in a nice residential area. She is thinking of using a wireless LAN to connect her four PCs. What problems is she likely to run into? Explain each as well as you can. Your explanation should be directed to her, not to your teacher. This is not a trivial problem.

Student answers will vary. The goal of this question is not to get specific answers but to help students think through the matter.

She will need to purchase cable modem service or DSL service with sufficient speed.

She will need to have a wireless access router.

She will have to configure the router and the individual PCs. <She should turn on security.>

.

Page 55

Not for Distribution to Students

CHAPTER 1A: HANDS-ON: TEST YOUR UNDERSTANDING QUESTIONS 1.

a) What is 11001010 in decimal? [43–44] 202 b) Express the following IP address in binary: 128.171.17.13. (Hint: 128 is 10000000. Put spaces between each group of 8 bits.) [43-44] 10000000 10101011 00010001 00001101 c) Convert the following address in binary to dotted decimal notation: 11110000 10101010 00001111 11100011. (Spaces are added between bytes to make reading easier.) (Hint: 11110000 is 240 in decimal.) [43-44] 240.170.15.227

2.

a) What kind of connection do you have (telephone modem, cable modem, LAN, etc.)? [44] Student answers will vary. b) What site did you use for your first test? [44] Student answers will vary. c) What did you learn? [44] Student answers will vary. d) What site did you use for your second test? [44] Student answers will vary. e) Did you get different results? [44] Student answers will vary.

3.

Go to the command line. Clear the screen. [45] There is no answer to this part.

4.

Use ipconfig/all or winipconfig. a) What is your computer’s IP address? [45] Student answers will vary. b) What is its Ethernet address? [45] Student answers will vary. c) What is your default router (gateway)? [45] Student answers will vary. d) What are the IP addresses of your DNS hosts? [45]

.

Page 56

Not for Distribution to Students

Student answers will vary. e) What is the IP address of your DHCP server? [45] Student answers will vary. f) When you get a dynamic IP address, you are given a lease specifying how long you may use it.

What is the starting time of your lease and the ending time? [45] Student answers will vary.

5.

Ping a host whose name you know and that you use frequently. What is the latency? If this process does not work because the host is behind a firewall, try pinging other hosts until you succeed. [45] Student answers will vary.

6.

Ping 127.0.0.1. Did it succeed?

It should succeed, or the student has no Internet connection.

7.

Do a tracert on a host whose name you know and that you use frequently. You can stop the tracert process by hitting Control-C. [45] a) What is the latency to the destination host? [45] Student answers will vary. b) How many routers are there between you and the destination host? If this does not work because the host is behind a firewall, try reaching other hosts until you succeed. [45] Student answers will vary.

8.

Distinguish between the information that ping provides and the data that tracert provides. [45] Ping determines if another host is reachable and provides latency to a destination host.

Tracert does this too; in addition, it identifies each router along the way and gives the latency to each router.

9.

Find the IP address for Microsoft.com and Apple.com. [46] These vary over time. In addition, each has multiple webservers, so different students will get different answers.

10.

a) Look up RFC 1149. [46] There is no answer to this part. b) In layperson’s terms, what does this RFC specify? [46] RFC1149 is the standard for the transmission of IP datagrams on Avian Carriers—in other words, using carrier pigeons to carry packets. c) What are its sections? (This is a serious question. You should learn how RFCs are structured.)

[46] Title RFC Number, Date Status of this Memo Overview and Rational

.

Page 57

Not for Distribution to Students

Frame Format Security Considerations Author's Address d) On what day was it created?

RFC1149 was created on April Fool’s Day in 1990, and its latest edition was created nine years later on the same day (1 April 1999).

.

Page 58

Not for Distribution to Students

CHAPTER 2: NETWORK STANDARDS TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Give the definition of network standards that this chapter introduced. [48] Network standards are rules of operation that govern the exchange of messages between two hardware or software processes. This includes message semantics, syntax, message order, reliability, and connection orientation. b) In this book, do standards and protocols mean the same thing? [47] Yes

2.

a) What three aspects of message exchanges did we see in this section? [51-52] Message order, semantics, and syntax b) Give an example not involving networking in which the order in which you do things can make a big difference. [No page number] Student answers will vary.

Example: Installing a printer on a computer (when to power it on, etc.). c) Distinguish between syntax and semantics. [51-52] Syntax governs the organization of messages.

Semantics defines the meaning of messages.

3.

a) Describe the simple message ordering in HTTP. [53] The client sends an HTTP request.

The server sends an HTTP response. b) In HTTP, can the server transmit if it has not received a request message from the client? [53] No. c) Describe the three-step handshake in TCP connection openings. [53-55] The initiating host sends a SYN segment indicating that it wants a connection.

The other host sends a SYN/ACK segment to acknowledge the SYN and to indicate that it is willing to open a connection.

The initiating host sends an ACK segment to acknowledge the SYN/ACK. The connection is now open. d) What kind of message does the destination host send if it does not receive a segment during a TCP connection? [54-55] None e) What kind of message does the destination host send if it receives a segment that has an error during a TCP connection? [54-55]

.

Page 59

Not for Distribution to Students

None (It simply drops the segment.) f) Under what conditions will a source host TCP process retransmit a segment? [55] If it has not received an acknowledgement after a preset delay g) Describe the four-step handshake in TCP connection closes. [56] The side initiating the close sends a TCP FIN segment.

The other side transmits a TCP ACK segment to acknowledge the FIN segment.

Immediately or later, the other side sends a FIN. The side that initiated the close sends back an ACK. The connection is now closed. h) After a side initiates the close of a connection by sending a FIN segment, will it send any more segments? Explain. [56] Yes, it will send ACK segments if the other side transmits segments. i) In Figure 2-7, suppose Host A had already sent A6 before it realized that it would need to resend A5. When it then resent A5, A6 would arrive before A5. How would Host B be able to put the information in the two segments back in order? [55-56] It would put them in order by sequence number.

4.

a) What are the three general parts of messages? [57–58] The three general parts of messages are the header, the data field, and the trailer. b) What does the data field contain? [58] The data field contains the content being delivered by the message. c) What is the definition of a header? [58] The header is everything that comes before the data field. d) Is there always a data field in a message? [58] No, there is not always a data field in a message. e) What is the definition of a trailer? [58] The trailer is everything that comes after the data field. f) Are trailers common? [58] No. g) Distinguish between headers and header fields. [58] The header is everything that comes before the data field.

A header field is a subdivision of the header. h) Distinguish between octets and bytes. [58] The two terms mean the same thing.

5.

a) How long are Ethernet MAC addresses? [60] 48 bits long

.

Page 60

Not for Distribution to Students

b) What devices read Ethernet destination MAC addresses? [59] Switches. (Also the destination host, to see if the frame is addressed to it.) c) If the receiver detects an error on the basis of the value in the Frame Check Sequence field, what does it do? [60] It discards the frame. There is no retransmission. d) Ethernet does error detection but not error correction. Is Ethernet a reliable protocol? Explain.

[60] No, to be a reliable protocol, a protocol must correct errors, not simply detect them.

6.

a) How many octets long is an IPv4 header if there are no options? (Look at Figure 2-10.) [60-61] If there are no options, the IP header will be 20 octets. b) List the first bit number on each IPv4 header row in Figure 2-10, not including options.

Remember that the first bit in Row 1 is Bit 0. [61] 0, 32, 64, 96, and 128. c) What is the bit number of the first bit in the destination address field in IPv4? (Remember that the first bit in binary counting is Bit 0.) [61] 128 (The first bit on each line is 0, 32, 64, 96, and 128.) d) How long are IPv4 addresses? [61] IP addresses are 32 bits long. e) What device in an internet besides the destination host reads the destination IP address? [60] Each router along the way reads the destination IP address. f) What is this device’s purpose in doing so? [60] The router reads the IP address in order to learn how to forward the IP packet to the next router or to the destination host itself. g) Is IP reliable or unreliable? Explain. [60] IP is unreliable. It does error detection and discarding; it does not do error correction.

7.

a) Why was TCP designed to be complex? [61] The Transmission Control Protocol (TCP) is complex because it is meant to handle complex internetworking management tasks that the simply designed IP cannot handle. b) Why is it important for networking professionals to understand TCP? [61] It is important for networking professionals to understand TCP because they will have to use TCP to deal with more complex internetworking management tasks. c) What are TCP messages called? [61] TCP messages are called TCP segments.

8.

a) Why are sequence numbers good? [62] Sequence numbers are good because they allow the receiving transport process to put arriving TCP segments in order if IP delivers them out of order.

.

Page 61

Not for Distribution to Students

b) What are 1-bit fields called? [61] Flag fields. c) If someone says that a flag field is set, what does this mean? [61] Its value is 1 d) If the ACK bit is set, what other field must have a value? [61, 63] The acknowledgement number field. e) What is the purpose of the acknowledgment number field? [61, 63] To indicate which segment that was sent earlier the segment containing the acknowledgement number field is acknowledging.

9.

a) What are the four fields in a UDP header? [43] The four fields in a UDP header are the two port number fields, the length field, and the header checksum field. b) Describe the third. [43] The length field gives the length of the UDP datagram. c) Describe the fourth. [43] The header checksum field allows the receiver to check for errors. If an error is found, the UDP datagram is discarded. d) Is UDP reliable? Explain. [43] No, it does error detection but not error correction.

10.

a) What type of port numbers do servers use for common server programs? [64] Well-known port numbers. b) What type of port numbers do clients use when they communicate with server programs? [64] Ephemeral port numbers. c) What is the range of port numbers for each type of port? [64] Well known: 0 through 1023 Ephemeral in Windows: 1024 to Port 4999 d) How are ephemeral port numbers generated? [64] The client generates them. It generates an ephemeral port number for every connection to an application on a host. e) Why are they called ephemeral? [64] They are discarded after the connection ends.

11.

a) What is the syntax of a socket? [65] A socket is written as an IP address, a colon, and a port number, for instance, 128.171.17.13:80.

.

Page 62

Not for Distribution to Students

b) In Figure 2-13, when the client transmits to the webserver host, what is the source port number? [65] 2707 c) What is the destination port number? [65] 80 d) What is the source socket? [65] 60.171.18.22:2707 e) What is the destination socket? [65] 1.33.17.3:80 f) When the SMTP server transmits to the client host, what is the source port number? [65] 25 g) What is the destination port number? [65] 4400 h) What is the source socket? [65] 123.30.17.120:25 i) What is the destination socket? [65] 60.171.18.22 12.

a) Is the application layer standard always HTTP? [65–66] No b) Which layer has the most standards? [65] Application. c) At which layer would you find standards for voice over IP? (The answer is not explicitly in this section.) [65-66] Application layer (it is an application). d) Are all application layer standards simple like HTTP? [67] No, many are much more complex. e) In HTTP response headers, what is the syntax of most lines (which are header fields)? [67] They consist of a keyword, a colon, and the value for the keyword. f) In HTTP request and response message, how is the end of a field indicated? [67] With a carriage return/line feed, which starts a new line. g) Do HTTP request messages have headers, data fields, and trailers?

No, they just have headers. They do not have data fields or trailers. h) Do HTTP response messages that deliver files have headers, data fields, and trailers? [67] No, they just have headers and data fields.

.

Page 63

Not for Distribution to Students

They do not have trailers.

13.

a) What is encoding? [68] Converting application message content into bits. b) At what layer is encoding done? [68] The application layer

14.

a) Explain how many bytes it will take to transmit “Hello World!” without the quotation marks.

(The correct total is 12.) [68] Component

Length

Hello

5

Space

1

World

5

!

1

Total

12

b) If you go to a search engine, you can easily find converters to represent characters in ASCII. What are the 7-bit ASCII codes for “Hello world” without the quotation marks? (Hint: H is 1001000.) [68]

15.

H

1001000

e

1100101

l

1101100

l

1101100

o

1101111

<sp>

0100000

W

1010111

o

1101111

r

1110010

l

1101100

d

1100100

a) Does binary counting usually begin at 0 or 1? [69] 0 (usually) b) Give the binary representations for 13, 14, 15, 16, and 17 by adding one to successive numbers (12 is 1100). [69] 13: 1101 14: 1110 15: 1111 16: 10000 17: 10001

16.

.

a) If a field is N bits long, how many alternatives can it represent? [70-71]

Page 64

Not for Distribution to Students

2N b) How many alternatives can you represent with a 4-bit field? [70-71] 24 = 16 c) For each bit you add to an alternatives field, how many additional alternatives can you represent? [70-71] Twice as many d) How many alternatives can you represent with a 10-bit field? (With 8 bits, you can represent 256 alternatives). [70-71] 28 = 256 and 29=512, so 210=1,024. e) If you need to represent 128 alternatives in a field, how many bits long must the field be?

7 (27=128) [70-71] f) If you need to represent 18 alternatives in a field, how many bits long must the field be? [7071] 4 bits can only encode 16 alternatives, so 4 bits is not enough.

5 bits can represent 32 alternatives; this is sufficient. g) Come up with three examples of things that can be encoded with 3 bits. [70–71] With three bits, there can be 8 possibilities. Student answers will vary. Examples include: Points on a six-sided star, five to eight priority levels, the names of the seven continents, and the days of the week.

17.

a) Why is the electrical signal generated by a microphone called an analog signal? [72] They are similar to (analogous to) the voice input signal. b) What two things does a codec do? [72] Encode voice signals into binary signals.

Compress the binary signal. c) Is there a single codec standard? [72] No, there are many. They have different compression, quality, and other characteristics.

18.

a) What is encapsulation? [72] Encapsulation is placing a message in the data field of another message. b) Why is encapsulation necessary for there to be communication between processes operating at the same layer but on different hosts, routers, or switches? [72] The fact that two processes other than physical layer processes cannot communicate directly requires the use of encapsulation. c) After the internet layer process in Figure 2-19 receives the TCP segment from the transport layer process, what two things does it do? [72-73] The internet layer process encapsulates the TCP segment in the data field of an IP packet and passes the IP packet down to the data link layer process.

.

Page 65

Not for Distribution to Students

d) After the data link layer process in Figure 2-19 receives the IP packet from the internet layer process, what two things does it do? [72-73] The data link layer process encapsulates the IP packet in the data field of a frame and passes the IP packet down to the physical layer process. e) After the physical layer process receives a frame from the data link layer process, what does the physical layer process do? [72–73] It does not do encapsulation. It turns the bits of the frame into signals. f) If encapsulation occurs on the source host, what analogous process do you think will occur on the destination host? (The answer is not in the text.) [72–73] Decapsulation 19.

a) What does a network standards architecture do? [75] Network standards architectures break the standards functionality needed for communication into layers and define the functions of each layer. b) c) What are the two dominant network standards architectures? [75] The two dominant network standards architectures are OSI and TCP/IP. d) What is the dominant network standards architecture in most real firms today? [75] The hybrid TCP/IP–OSI architecture. e) Are the two network standards architectures competitors? [75] No, although OSI and TCP/IP sometimes are viewed as competitors, they actually work together in most corporate networks.

20.

a) What standards agencies are responsible for the OSI standards architecture? Just give the acronyms. [76] ISO and ITU-T b) At which layers do OSI standards dominate usage? [76] Physical and data link (1 and 2)

21.

a) Which of the following is an architecture: TCP/IP, TCP, or IP? [78] TCP/IP b) Which of the following are standards: TCP/IP, TCP, or IP? [78] TCP and IP c) What is the standards agency for TCP/IP? [78] Internet Engineering Task Force (IETF) d) Why have this agency’s standards been so successful? [78] IETF TCP/IP standards have been successful because they tend to be simple standards that can be implemented quickly and inexpensively. (Not primarily because of the use of these standards on the Internet.)

.

Page 66

Not for Distribution to Students

e) What are most of this agency’s documents called? [78] Most of this agency’s documents are called requests for comment (RFCs). f) At which layers is TCP/IP dominant? [79] Internet and transport layers 22.

a) Is any standards architecture dominant at the application layer? [79] No, standards architecture is dominant at the application layer, although IETF protocols are widely used. b) Do almost all applications, regardless of what standards architecture they come from, run over TCP/IP standards at the internet and transport layers? [79] Yes

23.

a) Which layers of the hybrid TCP/IP–OSI standards architecture use OSI standards? [80] Physical and data link. b) Which layers use TCP/IP standards? [80] Internet and transport. c) Do wireless LAN standards come from OSI or TCP/IP? Explain. (The answer is not explicitly in this section.) [80] OSI; LANs are single networks, and single network standards at Layer 1 and Layer 2 come from OSI. d) Do switched WAN standards come from OSI or TCP/IP? Explain. (Again, the answer is not explicitly in this section.) [80] OSI. LANs are single networks, and single network standards at Layer 1 and Layer 2 come from OSI.

*24.

a) At which layers do OSI standards dominate usage? [80] 1 and 2 (physical and data link) b) Name and describe the functions of OSI Layer 5. [82] OSI Layer 5 is the OSI session layer. It initiates and maintains a connection between application programs on different computers. It is especially good for database applications. If communication fails during a transaction, the entire transaction does not have to be done over—only the work since the last rollback point. c) Name and describe the intended use of OSI Layer 6. [81] OSI Layer 6 is the OSI presentation layer. It is designed to handle data formatting differences between two computers, as well as compression and encryption. d) How is the OSI presentation layer actually used? [81] The OSI presentation layer is actually used as a category for data file formats. e) Beginning with the physical layer (Layer 1), give the name and number of the OSI layers. [80– 81] 1.

.

Physical Page 67

Not for Distribution to Students

2.

Data link

3.

Network

4.

Transport

5.

Session

6.

Presentation

7.

Application

END-OF-CHAPTER QUESTIONS Thought Questions 1.

How do you think TCP would handle the problem if an acknowledgment were lost, so that the sender retransmitted the unacknowledged TCP segment, therefore causing the receiving transport process to receive the same segment twice? [54–55] Both segments would have the same sequence number. The receiving transport process would realize this and drop the duplicate.

2.

a) In Figure 2-13, what will be the value in the destination port number field if a packet arrives for the e-mail application? [65] 25 b) When the HTTP program sends an HTTP response message to a client PC, in what field of what message will it place the value 80? [65] It will place the value 80 in the source port number field of the TCP segment contained in the transmitted packet.

3.

4.

Binary for 47 is 101111. Give the binary for 48, 49, and 50. [69] 48:

110000

49:

110001

50:

110010

You need to represent 1,026 different city names. How many bits will this take if you give each city a different binary number? [70–71] 10 bits can represent 1,024 cities.

11 bits can represent 2,048 cities.

10 bits is not enough. We must use 11 bits.

Brainteaser Questions 1.

How can you make a connectionless protocol reliable? (You may not be able to answer this question, but try.)

You do not have sequence and acknowledgement numbers.

So you have to send one message, then stop and wait for an acknowledgement before sending the next messages.

.

Page 68

Not for Distribution to Students

This is very slow compared with being able to send many messages before getting acknowledgements, as TCP can do.

2.

Spacecraft exploring the outer planets need reliable data transmission. However, the acknowledgments would take hours to arrive. This makes an ACK-based reliability approach unattractive. Can you think of another way to provide reliable data transmission to spacecraft?

(You may not be able to answer this question, but try.)

Spacecraft transmission uses forward error correction, in which messages are sent with redundant bits. There is enough redundancy in messages to allow the receiver to correct most errors during transmission.

(FEC also is used in wireless LAN transmission because of the high error rates in wireless transmission.)

.

Page 69

Not for Distribution to Students

CHAPTER 3: NETWORK SECURITY TEST YOUR UNDERSTANDING QUESTIONS 1.

a) How did the attacker get the credentials for the company’s bank account? [91] The attacker sent a fake invoice. When an accountant opened the invoice, this loaded a keystroke logger on the accountant’s computer. The keystroke logger intercepted the accountant’s login credentials and sent these to the attacker. b) Why were money mules used? [91-92] Banks are suspicious about sending money to other countries. Money mules in the same country as the banks received the payments, then passed on most of the payments to the foreign attacker. c) List indications that this was a sophisticated attack. [91-92] The keystroke logger was sophisticated.

The attacker sent the fake invoice to a person who would have the needed credentials.

Money mules were used. d) How might the company have been able to avoid this compromise? [91-92] Student answers will vary. The company could have had better filtering on its incoming e-mail.

The company could have trained people who have high access not to open attachments.

E-mail and web surfing could have been done on a separate computer. e) What motivated the attacker? [91-92] The theft of money. This was not done “for fun.” f) What would you say to executives in small companies who believe that they are too little to be attacked? [91–92] If companies have attractive assets, there are enough attackers who will want to steal the assets.

Also, smaller companies may be preferred victims because they are not sophisticated in their defenses. Attackers go after “low-hanging fruit.”

2.

a) What are the two elements of the threat environment? [92] Attackers and attacks b) Briefly explain each of the three stages in the plan–protect–respond cycle. [92-93] Plan: Devise a plan to respond to the threat environment.

Protect: Implement protections.

Respond: Respond according to plan when protections break down. c) Which of these three stages consumes the most corporate effort? [93]

.

Page 70

Not for Distribution to Students

Protect d) Give three names for successful attack. [93] Compromise, incident and breach. e) What is the main thing that separates security from other aspects of IT? [93] The risk does not come from technology but from intelligent adversaries who are constantly getting better at what they do and who learn to defeat defenses.

3.

What is malware? [95] It is a name for any evil software.

4.

a) What is a vulnerability? [95] A vulnerability is a flaw in a program that permits a specific attack or set of attacks against this program. b) How can users eliminate a vulnerability in one of their programs? [95] They can download a patch. c) What name do we give to attacks that occur before a patch is available? [95] A zero-day attack. d) What type of malware does not require a vulnerability? [95] Universal malware.

5.

a) What is a propagation vector? [96] A method for malware to move to a victim computer. b) How do viruses propagate within computers? [96] When an infected program executes, the virus code infects other programs on the computer. c) How do viruses propagate between computers? [96] Most viruses today spread by e-mail. <Many viruses send messages that have infected attachments to addresses in the infected computer’s e-mail directories.> Another popular propagation method today is visiting websites.

USB RAM sticks and P2P file transfer are growing rapidly as ways to spread viruses and worms.

There are many other propagation vectors, such as downloading free games. d) In what two ways can viruses be stopped? [96] To stop viruses, the company must protect its computers with antivirus programs that scan each arriving e-mail message or floppy disk for patterns that identify viruses.

It must also apply patches promptly. e) Do firewalls usually stop viruses? [96] No, not normally.

6. .

a) How do viruses and worms differ? [97] Page 71

Not for Distribution to Students

Viruses attach themselves to other programs. Worms are full programs. b) Distinguish how directly-propagating worms and e-mail worms spread. [97] Worms are often spread via e-mail, as viruses are.

However, some worms are directly-propagating worms, which can jump directly from one machine to another. These exploit a vulnerability in a program on the victim computer. c) Which can spread faster—viruses or directly propagating worms? Explain. [97] Directly-propagating worms can spread much more rapidly than viruses can because they require no human action, which is very slow. d) How can directly-propagating worms be stopped? [97] Directly-propagating worms can be stopped by patching the specific vulnerabilities that these worms target. Firewalls may also stop directly-propagating worms. e) Can antivirus programs usually stop directly-propagating worms? [97] No 7.

a) What is a script? [98] A script is a group of commands in a simplified programming language that are executed when the webpage is loaded. b) Are scripts normally bad? [98] No c) Under what circumstances are scripts likely to be dangerous? [98] Scripts are likely to be dangerous if a computer has a vulnerability. d) Why are scripts on webpages called mobile code? [98] They are called mobile code because they move from the webserver to the client on a webpage.

8.

a) What are payloads?

Payloads are pieces of code that are executed after the virus or worm has spread.

Payloads can completely erase hard disks and do other significant damage. [98] b) What are Trojan horses? [98] Trojan horses are programs that look like ordinary system files but that exploit the user. c) How do Trojan horses propagate to computers? [98] Trojan horses cannot propagate by themselves. They have to be spread by worms, viruses, hackers, or gullible users. d) What is spyware? [98] Spyware is software that, when installed on a user’s PC, collects sensitive information about the user and sends this information to the attacker. e) What is a keystroke logger? [98]

.

Page 72

Not for Distribution to Students

A keystroke logger is a program which collects information that the user types and sends this information to the attacker. It is a form of spyware. f) What does data mining software do? [99] Data mining software is a Trojan horse that sorts through files on the victim’s computer to look for useable information. It sends this information to the attacker.

9.

a) What is social engineering? [99] Social engineering is tricking users into doing something against their interests. b) What is fraud? [99] Fraud is lying to get victims to do something against their financial self interest. c) What is the definition of spam? [99] Unsolicited commercial e-mail. d) How can spam be used to harm people who open spam messages? [99] Fraud—getting the user to send money for goods that will not be delivered or for false investment opportunities.

Getting the user to go to harmful websites that will download malware. e) What is phishing? [100-101] Phishing is a sophisticated social engineering attack in which an authentic-looking e-mail or website entices the user to enter his or her username, password, or other sensitive information. f) Distinguish between credit card number theft and identity theft. [101] In credit number card theft, the thief steals credit number card numbers and uses them to make unauthorized purchases.

In identity theft, the thief impersonates an individual in large financial transactions and other matters. g) What are carders? [101] Carders are credit card number thieves. h) Which tends to produce more damage—credit card theft or identity theft? Explain your answer. [101] Identity theft is more damaging. This is because it can involve large monetary losses and because restoring the victim’s credit rating can take months. Some victims have even been arrested for crimes committed by the identity thief.

10.

a) List the three main phases in human break-ins (hacks). [101–104] Scanning to collect data about IP addresses and applications The break-in (exploit) Doing damage after the break-in b) What is hacking? [101]

.

Page 73

Not for Distribution to Students

Hacking is intentionally accessing a computer without authorization or in excess of authorization. c) What are the two purposes of probe packets? [101-102] To identify IP address with live hosts.

To identify responding port numbers, which indicate active programs of specific types. d) What is an exploit? [103] A tailored attack method used to break in. Also, the act of breaking in. e) What steps does a hacker usually take immediately after a break-in? [103-104] Download a hacker tool kit.

Delete log files.

Create a backdoor.

Download Trojan horses for ongoing damage. f) What software does the hacker download to help him or her do work after compromising a system? [103] A hacker toolkit. g) After breaking in, what does a hacker do to avoid being caught? [104] The hacker deletes log files. h) What is a backdoor? [104] A backdoor is a way back into a system that an attacker can use to get into the compromised computer later, even if the vulnerability that was exploited is repaired. i) What are the two types of backdoors? [104] New accounts and Trojan horses 11.

a) What is the purpose of a denial-of-service attack? [104] The purpose of a denial-of-service (DoS) attack is to make a computer (or network) unavailable to its users. b) What are bots? [105] Bots are programs that attackers install on victim computers. Bots can be remotely controlled by the attacker after installation and can even be updated remotely. c) What gives bots flexibility? [105] They can be upgraded after they are installed. d) How do distributed DoS attacks work? [105] The hacker installs bot programs on many computers. He or she sends the bots an attack command, and they all flood the victim with packets.

12.

a) Are most attackers today driven by curiosity and a sense of power? [107] No b) Is it generally illegal to write malware? [107]

.

Page 74

Not for Distribution to Students

No. c) For what four reasons are employees dangerous? [107] Employees are dangerous because they often have extensive access to and knowledge of systems. They also know how to avoid detection. They are trusted. d) What are the most dangerous types of employees? [107] IT staff members and IT security staff members. e) What type of attacker are most attackers today? [107] Career criminal attackers. f) What are cyberterror and cyberwar attacks? [107-108] Cyberterror attacks are IT attacks by terrorists, and cyberwar attacks are IT attacks by national governments. g) Why are cyberwar and cyberterror serious security concerns? [107–108] The amount of damage that governments and terrorists can do is very large compared to traditional and current types of attackers.

13.

Why is security primarily a management issue, not a technology issue? [108] Security is primarily a management issue, not a technology issue, because unless a firm does excellent planning, implementation, and day-to-day execution, the best security technology will be wasted.

14.

a) List the four major planning principles. [108–111] The four major planning principles are risk analysis, comprehensive security, defense in depth, and access control with minimum permissions. b) What is risk analysis? [109] Risk analysis is the process of balancing threats and protection costs for individual assets. c) Repeat the risk analysis described in this section, this time with Countermeasure B that does not affect damage severity but that reduces the likelihood of an attack by 75 percent. The annual cost of Countermeasure B is $175,000. Show the full table. [109–110]

Countermeasure Damage per successful attack Annual probability of a successful attack Annual probable damage Annual cost of countermeasure Net annual probable outlay

.

None

B

$1,000,000

$1,000,000

20%

5%

$200,000

$50,000

$0

$175,000

$200,000

$225,000

Page 75

Not for Distribution to Students

Annual value of countermeasure

0

($25,000)

d) Comment on the statement, “The goal of security is to eliminate risk.”

Risk can never be eliminated. It can only be reduced, and then only to the extent that makes sense economically. e) What is comprehensive security? [110] Closing off all avenues of attack. f) Why is comprehensive security important? [110] Comprehensive security is important because if a company misses even one vector of attack, and if the attacker finds it, the attacker will succeed. g) What is defense in depth? [110] Defense in depth is having successive lines of defense. h) Why is defense in depth necessary? [110] Defense in depth is necessary because every protection will break down occasionally. If attackers have to break through only one line of defense, they will succeed during these vulnerable periods. However, if an attacker has to break through two, three, or more lines of defense, a single breakdown will not be enough to allow the attacker to succeed. i) What is access control? [111] Access control is limiting who may access each resource and limiting their permissions to use the resource. j) What are permissions? [111] Permissions are the actions that a person given access to a resource is allowed to take. k) Why should people get minimum permissions? [111] So they cannot do things they should not be allowed to do.

Also, if you give everyone all permissions, this may be easy to do, but it creates risk.

15.

a) What is a policy? [112] A policy is a broad statement of what should be accomplished. b) Distinguish between policy and implementation. [112] The policy specifies what should be done.

Implementation specifies how to do it. c) Why is it important to separate policies from implementation? [112] The policy makers know the overall picture, but implementers have the specific knowledge needed to determine the best way to implement a policy. d) Why is oversight important? [112–113] Oversight helps ensure that the implementation faithfully implements the policy.

.

Page 76

Not for Distribution to Students

e) Compare the specificity of policies, implementation guidance, and implementation. [113] Implementation is the most specific. Policies are the least specific. Implementation guidance is in the middle. f) Distinguish between standards and guidelines. [113] Standards must be followed, whereas guidelines do not have to be followed if there is good reason not to. g) Must guidelines be considered? [113] Yes. h) List the three types of oversight listed in the text. [114] Audits, reading log files, and vulnerability testing. i) What is vulnerability testing, and why is it done? [114] Vulnerability testing is attacking your own systems. The goal is to find (and fix) weaknesses before attackers exploit them. j) Why is it important for policy to drive both implementation and oversight? [114] To identify inconsistencies 16.

a) What is authentication? [115] Authentication is requiring someone requesting to use a resource to prove his or her identity. b) Distinguish between the supplicant and the verifier. [115] The supplicant is the user trying to prove his or her identity.

The verifier is the party requiring the supplicant to prove his or her identity. c) What are credentials? [115] Credentials are proofs of identity that the supplicant provides to the verifier. d) Why must authentication be appropriate for risks to an asset? [115] If authentication is too weak for a threat, this makes no sense economically. If authentication is excessively strong for a threat, this is a waste of limited security money.

17.

a) Distinguish between usernames and reusable passwords. [115] A username is an account.

A reusable password is a string of characters that a user types to gain access to the resources associated with a certain username. b) Why are passwords widely used? [116] Passwords are widely used because they are easy to use and add no additional cost, as operating systems and many applications have built-in password authentication. c) What types of passwords are susceptible to dictionary attacks? [116] Dictionary words and names are susceptible to dictionary attacks.

.

Page 77

Not for Distribution to Students

d) What types of passwords are susceptible to dictionary attacks in hybrid mode? [117] Common variations of dictionary words and names, such as capitalizing the first letter and adding a number at the end. e) Can a password that can be broken by a dictionary attack or a dictionary attack in hybrid mode be adequately strong if it is very long? [117] No. f) What is a brute force attack? [117] A brute force attack is one in which the attacker tries all possible combinations of letters, numbers, and other keyboard characters. g) What types of passwords can be broken only by brute force attacks? [117] Complex passwords. (Passwords that use uppercase and lowercase letters, the digits from 0 to 9, and other keyboard symbols, such as & and #.) h) Why is password length important? [117] Password length is important because if the password is complex, each additional character increases the time needed for a brute force attack by a factor of about 70 if case is considered. i) How long should passwords be? [117] At least 8 characters long 18.

Critique each of the following passwords. First, describe the type of attack that would be used to crack it, justifying your answer. Second, say whether or not it is of adequate strength, justifying your answer. a) velociraptor [117] Dictionary attack Inadequate; any password that can be cracked by a dictionary attack is inadequate. b) Viper1 [117] Word followed by a single digit at end of word; only first letter capitalized; no special characters: Dictionary attack in hybrid mode Inadequate; any password that can be cracked by a dictionary attack is inadequate. c) NeVeR [117] Upper and lower case are mixed. It requires brute force cracking characters.

Inadequate; changes case, but no numbers or special characters, and it is only five characters in length. d) R7%t& [117] Complex with all types of keyboard characters; only a brute force attack will work.

Inadequate; good randomization but too short (6 characters).

19.

a) What security problem do access cards have? [118] They can be lost.

.

Page 78

Not for Distribution to Students

b) What is biometrics? [118] Biometrics is the use of body measurements to authenticate you. c) By what three criteria should biometric methods be judged? [118] Cost, precision, and susceptibility to deception by someone wishing to impersonate a legitimate user. d) Why may fingerprint scanning be used to authenticate access to a laptop? [118] Most laptops do not carry critical information. They do not need strong authentication and so can use fingerprint scanning.

In addition, fingerprint scanners do not have the problem of lost passwords. e) Why is iris scanning desirable? [120] It is extremely precise and not susceptible to deception. f) Why is face recognition controversial? [120] It can be done surreptitiously—without the subject’s knowledge. This can be viewed as a privacy violation.

20.

a) In digital certificate authentication, what does the supplicant do? [120] The supplicant does a calculation with its own private key. b) What does the verifier do? [120] The verifier does a calculation on the supplicant’s results with the public key of the true party. c) Does the verifier use the true party’s public key or the supplicant’s public key? [120] The true party’s public key. d) How does the verifier get the public key? [120] From a digital certificate. e) From what type of organization does the verifier get the digital certificate? [120] A certificate authority

21.

a) Why is two-factor authentication desirable? [120] It adds strength to authentication by providing defense in depth. b) Will two-factor authentication still be strong if the attacker controls the supplicant’s computer? [121] No. c) Will two-factor authentication still be strong if the attacker can intercept all authentication communication? [121] No

22.

.

a) What does a firewall do when a packet arrives? [122]

Page 79

Not for Distribution to Students

When a packet arrives, the firewall will examine the packet. If the firewall identifies the packet as an attack packet, the firewall discards the packet and copies information about the discarded packet into a log file. b) Does a firewall drop a packet if it probably is an attack packet? [122] No. c) Why is it important to read firewall logs daily? [122] It is important to read firewall logs daily in order to understand the types of attacks coming into the resource that the firewall is protecting. d) Distinguish between ingress and egress filtering. [122] Ingress filtering is filtering on packets arriving from the outside.

Egress filtering is filtering on packets going out to the outside.

23.

a) What is the limitation of static packet filtering? [123] There are different needs for security filtering in different communication states. b) Why is static packet filtering still done despite its weakness, and how is it used? [124] To prescreen traffic before it goes into the main border firewall. It can do so very cost effectively.

24.

a) Why are states important? [124] There are different needs for security filtering in different communication states. b) Why are ACLs needed for stateful firewalls? [125] To determine what to do with arriving packets that attempt to open a connection. c) When a packet that is part of an ongoing connection arrives at a stateful inspection firewall, what does the firewall usually do? [125-126] It usually passes the packet, usually without further filtering. d) When a packet that is not part of an ongoing connection and that does not attempt to open a connection arrives at a stateful inspection firewall, what does the firewall do? [126] It drops the packet. e) Why are stateful firewalls attractive? [126] Stateful firewalls are attractive because their very simple operation allows them to filter large volumes of traffic inexpensively and because they have strong security. f) What type of firewalls do most corporations use for their main border firewalls? [126] Most corporations use stateful packet inspection for their main border firewall.

25.

a) How will an SPI firewall handle a packet containing a TCP segment which is an acknowledgement? [125–126] This is not an attempt to open a connection. The firewall will check if the connection has been approved. If not, it will drop the packet. If so, it generally permits it to go effectively.

.

Page 80

Not for Distribution to Students

b) How will an SPI firewall handle a packet containing a TCP SYN segment? [125-126] This is an attempt to open a connection. It will be passed through the ACL. c) How will an SPI firewall handle a packet containing a TCP FIN segment? [125-126] This is not an attempt to open a connection. The firewall will check if the connection has been approved. If not, it will drop the packet. If so, it generally permits it to go effectively. d) How will the access control list (ACL) in Figure 3-19 handle a packet that attempts to open a connection to an FTP server? Explain. [125] The first two rules do not apply, so the third rule is reached.

This denies all connections.

Therefore, the connection is destroyed.

26.

a) What two things do deep inspection firewalls do that SPI firewalls do not? [127–128] It looks at streams of packets for patterns, not just individual packets.

It looks at content in the internet, transport, and application layers. b) Why is the first useful? [127-128] It can catch attacks that static packet filtering and even stateful filtering that look at individual packets cannot catch. c) Why is the second useful? [127-128] It can filter based on the application traffic. d) What is an application-aware firewall, and how it useful? [128] It is a firewall that can determine the application that created the packet. It can apply filtering rules based on the application. e) For what type of devices was deep inspection first used? [128] Intrusion detection systems. f) What is the main problem with deep inspection firewalls? [128] It takes a great deal of processing power. g) What technology is overcoming this problem, and how is it doing so? [128] Application-Specific Integrated Circuits (ASICs) do processing in hardware instead of software; this is much faster.

27.

a) What is a cipher? [128–129] A cipher is an encryption method. b) What protection does confidentiality provide? [128] An attacker cannot read your messages even if he or she intercepts them. c) In two-way dialogues, how many keys are used in symmetric key encryption? [129] One key is used. d) What is the minimum size for symmetric keys to be considered strong? [129]

.

Page 81

Not for Distribution to Students

Symmetric keys must be at least 100 bits long to be considered strong.

28.

What two protections do electronic signatures provide? [129–130] Message-by-message authentication and message integrity

29.

a) What is the definition of response? [130] Response is reacting to a security incident according to plan. b) What are the two benefits of a well-rehearsed response plan? [130] Response is faster.

Response is more effective. c) What are the four response phases when attacks occur? [130-131] Detecting the attack.

Stopping the attack.

Repairing the damage.

Punishing the attacker. d) What is the purpose of forensic tools? [131] The purpose is to capture and safeguard data in ways that fit rules of evidence in court proceedings. e) Why are CSIRTs necessary? [132] Computer security incident response teams (CSIRTs) are necessary because the on-duty security staff cannot handle major incidents. f) Should the CSIRT be limited to security staff personnel? [132] The CSIRT should not be limited to security staff personnel; it should also include members of the IT staff, senior managers, members of functional departments, and the firm’s legal and public relations departments. g) Distinguish between disaster recovery and business continuity recovery. [132] Disaster recovery is the reestablishment of information technology operations after a disaster.

Business continuity is getting the whole firm back in operation. h) Explain how firms use backup sites in disaster recovery. [132] In disaster recovery, firms have backup sites that can be put into operation very quickly, after data and employees have been moved to the backup site.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

a) Suppose that an attack would do $100,000 in damage and has a 15 percent annual probability of success. Spending $9,000 per year on “Measure A” would cut the annual probability of success by 75 percent. Do a risk analysis comparing benefits and costs. Show your work clearly. [110]

.

Page 82

Not for Distribution to Students

Damage per successful attack

$100,000

Annual probability of a successful attack

15%

Annual probable loss

$15,000

Measure A Effectiveness in reducing threat

75%

Threat reduction

$11,250

Cost of Measure A

$9,000

Net probable benefit

$2,250

Decision: The protection is justified

b) Should the company spend the money? Explain. [110] Yes, the company should spend the money because the net probable benefit is positive. c) Do another risk analysis if Measure A costs $20,000 per year. Again, show your work. [110] Damage per successful attack

$100,000

Annual probability of a successful attack

15%

Annual probable loss

$15,000

Measure A Effectiveness in reducing threat

75%

Threat reduction

$11,250

Cost of Measure A

$20,000

Net probable benefit

($8,750)

d) Should the company spend the money? Explain. [110] No, the company should not spend $20,000 per year on Measure A because the net benefit would be negative.

2.

a) What form of authentication would you recommend for relatively unimportant resources?

Justify your answer. [115-121] Password is an appropriate form of authentication for relatively unimportant resources because it is weak but very user-friendly. b) What form of authentication would you recommend for your most sensitive resources? [115– 121] Digital certificate authentication is appropriate for sensitive resources because it is very strong.

.

Page 83

Not for Distribution to Students

Some students may suggest iris scanning. This would also be OK if iris scanning could be used for the particular resource.

3.

For each of the following passwords, first state the kind of attack that would be necessary to crack it. Justify your answer. Then say whether or not it is an adequate password, again giving specific reasons. a) swordfish [116-118] Common word, so dictionary attack Inadequate; dictionary attacks succeed very quickly. b) Processing1 [116–118] Variation of common word; dictionary attack with hybrid dictionary attack Inadequate; hybrid-mode dictionary attacks are fast. c) SeAtTLe [116-118] Complex, so would require a brute force attack. A dictionary attack would not work because of changes in capitalization.

Not adequate; no non-alphabetic characters and too short (7 characters). d) 3R%t [116-118] Complex, so brute force attack Inadequate; good randomization but too short (4 characters). e) 4h*6tU9$^l [116-118] Complex, so brute force attack Adequate; good randomization and long enough (10 characters) (But will the user remember it, or will he or she write it down?)

4.

Keys and passwords must be long. Yet most personal identification numbers (PINs) that you type when you use a debit card are only four or six characters long. Yet this is safe. Why? [No page numbers] PINs have to be entered manually, which is a slow process. Even with only four-number PINs, it would take an attacker a prohibitive amount of time to try enough combinations to succeed.

In addition, most PIN key pads are in public places, so trying many PINs would probably be observed.

5.

.

Revise the ACL in Figure 3-19 to permit access to an FTP server with IP address 10.32.67.112.

[125]

Rule

Destination IP Address or Range

Service

Action

1

ALL

25

Allow connection

2

10.47.122.79

80

Allow connection

3

10.32.67.112

20 or 21

Allow connection

Page 84

Not for Distribution to Students

4

ALL

ALL

Do not allow connection

Note: the student may create two rules—one for Port 20 and one for Port 21. This would also be correct.

6.

In digital certificate authentication, the supplicant could impersonate the true party by doing the calculation with the true party’s private key. What prevents impostors from doing this? [No page number] Private keys are kept secret. Therefore, the impostor cannot get the true party’s private key.

Of course, if the impostor steals the true party’s private key, it can authenticate itself as the true party.

Online Exercise 1.

Go to http://www.cybercrime.gov. Go to the section on computer crimes. Select one of the cases randomly. Describe the type of attacker and the type of attack(s). [No page number] Student answers will vary.

Case Study: Patco In 2009, the Patco Construction Company had $588,000 drained from its bank accounts at Ocean Bank. The theft involved six withdrawals on May 8, May 11, May 12, May 13, May 14, and May 15. The money in each withdrawal was sent to a group of money mules.

After thieves stole all of the company’s cash, they continued to make withdrawals. Patco’s bank continued to allow withdrawals, covering them with over $200,000 from Patco’s line of credit.

Although the bank was able to recover or block $243,406 in transfers, Patco was still out $345,400. In addition, the bank began charging Patco for interest on the money that had been withdrawn using Patco’s line of credit.

Although the transactions were far larger than Patco normally made, Ocean Bank did not inform Patco of any problems until one of the account numbers entered by the thieves was invalid. It sent a notification by mail, and it did not arrive at Patco until several days later. Patco notified the bank of problems the next morning. However, the bank had already sent out $111,963 that day, some of which was recovered.

The bank used account numbers and passwords. For transactions over $1,000, Patco employees had to answer two challenge questions. Most withdrawals were over $1,000, so employees had to answer these same challenge questions many times. Patco believes that these challenge messages were too easy. The State of Maine has stringent banking laws. The Federal Financial Institutions Examination Council in 2005 required banks to use at least two-factor authentication and specifically noted that usernames and passwords were not enough. Patco sued People’s United Bank for its losses, claiming that the challenge questions were nothing more than a second set of passwords and that the bank should have required much stronger credentials. Patco also claimed that Ocean Bank should have been suspicious when such large unprecedented withdrawals were made and when they were sent to 30 different accounts.

Normally, Patco only withdrew money for payrolls on Fridays. Its previous largest single day .

Page 85

Not for Distribution to Students

withdrawal had been under $37,000. Patco’s complaint stated that based on belief and information from the bank, Patco assumed that antifraud monitoring was being done by the bank. Ocean Bank did not comment on the case, but most banks in a similar situation use the defense that they were not negligent. A bank can be found negligent only if it has lower protections than are the norm in the industry.

Caution: The information in this case is based only on Patco’s complaint. Consequently, the statements made in the case have not been validated and may be disputed by Ocean Bank as being nonfactual. Analyze the case based on Patco’s allegations, but do not draw firm conclusions against the bank.

1. a) According to the information in the case, do you think the bank satisfied the requirement to use twofactor authentication? [136–137] The challenge question was a second form of authentication.

The challenge message is effectively a reusable password, even if it is phrased as an answer to a question.

Repetition of the same two pieces of information is asking for trouble. b) According to the information in the case, do you think the bank was doing antifraud monitoring? [136–137] No, or if it was, it was doing so ineffectively. It did not notice a very unusual pattern. c) According to the information in the case, do you think Ocean Bank was negligent? [136–137] Quite likely; it did not notice a very different pattern than normal. However, negligence is very difficult to prove in court. d) According to the information in the case, if you were the head of Ocean Bank, what would you do to prevent the reoccurrence of this problem? [136–137] Put in antifraud monitoring.

Come up with a better form of second-factor authentication than frequently repeated challenge questions with fixed answers.

Case Study: Walmart In 2005, Hurricane Katrina slammed into Louisiana and Mississippi, devastating New Orleans and many other cities along the U.S. Gulf Coast. Shortly afterward, the fourth most intense Atlantic hurricane in history, Rita, added enormously to the destruction. The Federal Emergency Management Agency (FEMA) became notorious for its handling of the crisis, responding belatedly and acting ineptly when it did respond.

Many businesses collapsed because they were poorly prepared for the hurricanes. One company that did respond effectively was Walmart. In its Brookhaven, Mississippi, distribution center, the company had 45 trucks loaded and ready for delivery even before Katrina made landfall. The company soon supplied $20 million in cash donations, 100,000 free meals, and 1,900 truckloads full of diapers, toothbrushes, and other emergency supplies to relief centers.

The company also supplied flashlights, batteries, ammunition, protective gear, and meals to police and relief workers. .

Page 86

Not for Distribution to Students

Although the relief effort was impressive, it was merely the visible tip of Walmart’s disaster recovery program. Two days before Katrina hit, Walmart activated its business continuity center. Soon, 50 managers and experts in specific areas such as trucking were hard at work. Just before the storm knocked out the company’s computer network, the center ordered the Mississippi distribution center to send out recovery merchandise such as bleach and mops to its stores. The company also sent 40 generators to its stores so that stores that lost power could open to serve their customers. It also sent out many security employees to protect stores.

After computer networks failed, the company relied on the telephone to contact its stores and other key constituencies. Most stores came back immediately, and almost all stores were able to serve their customers within a few days. Lines of customers were long, and Walmart engaged local law enforcement to help maintain order.

Walmart was successful because of intensive preparation. The company has a full-time director of business continuity. It also has detailed business continuity plans and clear lines of responsibility. In fact, while the company was still responding to Katrina and Rita, it was monitoring a hurricane off Japan, preparing to take action there if necessary.

1.

a) Why was Walmart able to respond quickly? [137–138] It had a good management structure in place for disasters, and its plan was wellrehearsed. b) List at least three actions that Walmart took that you might not have thought of. [137–138] Student answers will vary.

.

Page 87

Not for Distribution to Students

CHAPTER 4: NETWORK MANAGEMENT TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Why must networking professionals be concerned with the SLC rather than the SDLC? [139] A great deal of networking work is done after the network is in place. b) Why is a focus on information systems insufficient in networking? [140] It is insufficient because one must look at the total business system, not just the information system.

2.

a) Compare trends in network demand and network budgets. [140] Whereas network demand is growing very rapidly, network budgets generally are growing slowly if at all. b) What are the implications of these trends? [140] The main implication of these trends is a cost squeeze that governs every aspect of network management thinking. Network managers need to limit what they do and purchase only what they need. Overspending on one project will leave managers unable to do another project.

3.

a) What is what-is analysis? [141] What-is analysis is an in-depth inventory of the current state of the company’s network, including the network’s components and their interrelationships. b) List the four driving forces for change. [142] The normal continuing growth of application traffic demand.

The introduction of disruptive applications, which may create major surges in demand far beyond traditional patterns. Voice over IP is an obvious example. However, if video applications begin to grow, capacity planning will become extremely difficult.

Changes in other elements of the IT technological infrastructure can also require extensive network changes. One long-term trend has been the consolidation of data centers from many to few.

Organizational change can be a major driving force. If a company is adding a site, not only will the site have to be served but communication among different parts of the firm will change, depending on what units are moved there. In fact, all corporate reorganizations are likely to impact network planning. At the extreme are nightmare scenarios that exist if the company is bought out or buys out another firm. c) For each, give an example not listed in the text. [142] Student answers will vary. d) What is gaps analysis? [142]

.

Page 88

Not for Distribution to Students

Gaps analysis is the analysis that should occur after what-is analysis identifies gaps between what the firm will need and what the current network can provide. These gaps must be identified, characterized, and documented. e) Why is it necessary to create a project portfolio? [142] Due to budget constraints, it is necessary to create project portfolios in order to keep track of factors considered when making strategic decisions. f) What are legacy decisions, and why must projects that involve legacy decisions be judged with great care? [142] In light of networking, legacy decisions are decisions that lock an organization into a specific vendor or technology option for several years.

4.

a) What are QoS metrics? (Do not just spell out the acronym.) [143] Quality-of-service (QoS) metrics are quantitative measures of network performance. b) How are QoS metrics used? [143] QoS metrics are used to quantify companies’ quality of service so that they can set targets and determine if they have met those targets.

5.

a) In what units is transmission speed normally measured? [143] Bits per second

b) Is speed normally measured in bits per second or bytes per second? [143] Bits per second. c) Give the names and abbreviations for speeds in increasing factors of 1,000. [144] In increasing factors of 1,000, speeds come in bits per second (bps), kilobits per second (kbps), megabits per second (Mbps), gigabits per second (Gbps), and terabits per second (Tbps). d) What is 55,000,000,000 bps with a metric prefix? [144] 55 Gbps. e) Write out 100 kbps in bits per second (without a metric prefix). [144] 100,000 bps. f) Write the following speeds properly: 0.067 Mbps, 23,000 kbps, and 48.62Gbps. [144] 67 kbps 23 Mbps 48.62 Gbps (OK as is) 6.

a) Distinguish between rated speed and throughput. [146] Rated speed is the speed that the network should provide. Throughput is the data transmission speed a network actually provides to users. b) Distinguish between individual and aggregate throughput. [146] Individual and aggregate throughput refer to networks where the speed is shared by many users. In these cases, aggregate throughput is the total throughput that the

.

Page 89

Not for Distribution to Students

network provides to all users who share it. Individual throughput is the throughput that single users receive as their share of the aggregate throughput.

7.

a) What is availability? [146] Availability is the percentage of time that a network is available for use. b) What is downtime? [146] Downtown is the percentage of time a network is not available. c) What are the “five nines”? [147] The “five nines” are the availability target of the Public Switched Telephone Network— to be available 99.999 percent of the time. d) Does corporate network availability usually meet the five-nines expectation of the telephone network? [147] No, data networks generally have lower availability. e) What are packets? [148] Packets are small messages in which hosts send data. f) Distinguish between the packet error rate and the bit error rate. [148] The packet error rate is the percentage of packets that are lost or damaged during delivery.

The bit error rate is the percentage of bits that are lost or damaged during delivery. g) When should error rates be measured? Why? [148] Error rates should be measured when traffic levels are high. This is because when the network is overloaded, error rates can soar because the network has to drop the packets it cannot handle. If a company measures error rates when traffic levels are low, it will not have a good understanding of error rate risks. h) What is latency? [148] Latency is the amount of delay packets experience when they move through a network. i) In what units is latency measured? [148] In milliseconds (ms). j) What is jitter? [148] Jitter is variability in latency. k) For what applications is jitter a problem? [148] For VoIP and streaming media. l) How does application response time differ from latency? [149] Latency includes only network delays. Application response time involves delays in the hosts and applications as well.

(Not in the text: Latency tends to be measured for transmission in a single direction. By definition, application response time measures delay for both the request and the response.)

.

Page 90

Not for Distribution to Students

m) Why is application response time difficult to improve? [149] It requires knowledge of hosts, applications, and networking. Usually this knowledge is spread across different departments.

8.

a) What are service level agreements? [150] Service level agreements are contracts that guarantee levels of performance for various QoS metrics. b) Does an SLA measure the best case or the worst case? [150] The worst case. c) Would an SLA specify highest latency or lowest latency? [150] Highest latency. d) Would an SLA specify a lowest availability or a highest availability? [150] Lowest availability. e) What happens if a carrier does not meet its SLA guarantee? [150] It must pay a fee. f) If carrier speed falls below its guaranteed speed in an SLA, under what circumstances will the carrier not have to pay a penalty to the customers? [150] If speed has fallen below the guaranteed level more than the guaranteed maximum percent of time.

9.

Do a three-site traffic analysis. Site X attaches to Site Y, which attaches to Site Z. Site X is 130 meters east of Site Y. Site Z is 180 meters west of Site Y. Site X needs to be able to communicate with Site Y at 3 Gbps. Site Y needs to be able to communicate with Site Z at 1 Gbps. Site X needs to be able to communicate with Site Z at 700 Mbps. Supply your picture giving the analysis. You may want to do this in Office Visio or Windows Draw and then paste it into your homework.

Site Z---------180 m---------Site Y------130 m------Site X ---------1 Gbps--------→ ------3 Gbps----→ ----------------------700 Mbps-------------------→ a) What traffic capacity will you need between Sites X and Y? [151-152] The transmission line between Site Y and Site X requires 3.7 Gbps of capacity. b) Between Y and Z? [151–152] The transmission line between Site Z and Site Y requires 1.7 Gbps of capacity.

10.

a) What is the purpose of redundancy in transmission lines? [151–152] The purpose of redundancy in transmission lines is to facilitate continuity of networking operations. If a transmission line fails, there should be other means of transmitting information in place as back-up. b) If the line between R and S fails in Figure 4-11, how much capacity will the line between Q and S need? [151–152]

.

Page 91

Not for Distribution to Students

2.3 Gbps. c) What about the line between Q and R? [151-152] 2.045 Gbps in order to satisfy redundancy requirements.

11.

a) What is a network topology? [153] A network topology is the physical arrangement of a network’s computers, switches, routers, and transmission lines. b) At what layer do we find topologies? [153] We find topologies at the physical layer. c) In what topology are there only two nodes? [153] Point-to-point. d) In what topologies is there only a single path between any two end nodes? [153] Point-to point, simple star, and extended star (hierarchy) topologies. e) In what topology are there usually many paths between any two end nodes? [153] Mesh topology. f) In what topology is broadcasting used? [153] In a bus topology. g) What topologies can be used in complex networks? [154] Any type

12.

a) What is the advantage of a full-mesh leased line network? [155] The advantage of a full-mesh leased line network is that it provides many redundant paths so that if one site or leased line fails, communication will continue unimpeded. b) What is the disadvantage? [155] The disadvantage is that as the number of sites in the mesh increases, the cost of a full mesh grows exponentially. c) What is the advantage of a pure hub-and-spoke leased line network? [155] The advantage of a pure hub-and-spoke leased line network is that it dramatically reduces the number of leased lines required to connect all sites compared to a full mesh and so minimizes cost.

.

Page 92

Not for Distribution to Students

d) What is the disadvantage? [155] The disadvantage is that it offers no redundant links, so that any link failure will cause a service outage. e) Do most leased line networks use a full-mesh or a pure hub-and-spoke topology? Explain.

[155] No, most leased line networks do not use either a full-mesh or a pure hub-and-spoke topology; they use a mix of the two.

13.

A company has three sites: Micah, Mallory, and William. Micah and Mallory need 100 Mbps of transmission capacity between them. Mallory and William need 200 Mbps of transmission capacity between them. Micah and William need 300 Mbps of transmission capacity between them. a) Create a hub-and-spoke network with Micah as the hub. What links will there be, and how fast will they need to be? Explain your reasoning. [155] --------100 Mbps------Micah------300 Mbps------→ Mallory ------------------------[NO LINK]--------------------- William Without concern for redundancy, the link between Mallory and Micah will be 100 Mbps because that is what is required. Under the same assumptions, the link between Micah and William will be 300 Mbps because that is what is required. There will be no link between Mallory and William because they are only linked to Micah, the hub.

b) For the same situation, create a full-mesh network. What speeds will the links need to have if you are not concerned with redundancy in case of line failure? Explain your reasoning. [155] --------100 Mbps------Micah------300 Mbps------→ Mallory------------------------200 Mbps-----------------------→William Without concern for redundancy, the link between Mallory and Micah will be 100 Mbps because that is what is required. Under the same assumptions, the link between Micah and William will be 300 Mbps because that is what is required. The link between Mallory and William will be 200 Mbps because that is what is required. c) Building on the last part of this question, add redundancy so that a failure of the line between Mallory and William will not bring down the network. (Hint: DTP.) [155] --------300 Mbps------Micah------500 Mbps------→ Mallory---------------------------[FAIL]------------------------→William Adding concern for redundancy, the link between Micah and Mallory will be 300 Mbps, and the link between Micah and William will be 500 Mbps. This is sufficient so that if the line between Mallory and William fails, each line will still have enough capacity to carry all the traffic of the network.

14.

.

a) How long are momentary traffic peaks? [157]

Page 93

Not for Distribution to Students

Momentary traffic peaks are very brief, lasting only a fraction of a second to a few seconds. b) Distinguish between overprovisioning and priority. [157-158] Overprovisioning is adding much more switching and transmission line capacity than will be needed most of the time.

Priority is assigning high priority to latency-intolerant applications, such as voice, while giving low priority to latency-tolerant applications, such as e-mail.

Overprovisioning is wasteful of capacity but inexpensive and does not require ongoing management. Priority requires management, but it does allow the company to work with lower capacity. c) Distinguish between priority and QoS guarantees. [158] Priority gives preference to certain traffic but does not guarantee a certain amount of capacity. QoS reservations do reserve capacity for certain traffic. d) What problem can QoS create? [158] Because QoS guarantees must be satisfied, certain types of traffic are given priority of reserved capacity. Not only does this mean that extremely active management is required, it also means that non-QoS traffic gets the leftovers. e) How is traffic shaping different from traditional approaches to handling momentary traffic overloads? [158] Traffic shaping is different from traditional approaches to handling traffic overloads in that it manipulates capacity at access points (before traffic enters the network), whereas traditional approaches target traffic that has already entered the network. f) In what two ways can traffic shaping reduce traffic? [158-159] Traffic shaping can reduce traffic by filtering out unwanted traffic at access switches or by assigning percentages of capacity to designated applications that arrive at access switches.

15.

a) Why is traffic shaping a more general tool than just being a way to handle momentary traffic peaks? [159] Traffic shaping is more of a general tool because, by eliminating some types of traffic entirely and by limiting other types of traffic to small percentages of total network traffic, traffic shaping can substantially reduce the overall traffic a network must handle at all times. b) Why can compression help in traffic management? [159] Compression can help in traffic management because it minimizes the bit size of data by recoding redundant data into fewer bits, which ultimately results in fewer bits that are transmitted over the network. c) What makes compression possible? [159] Compression is made possible by compression devices. The downside is that two ends of a network must have compatible compression equipment, and because competitive vendors require clients to use compression equipment that only works for their

.

Page 94

Not for Distribution to Students

respective products, clients often are locked into having to use only one vendor’s products.

16.

Why was the design in Figure 4-17 selected? [161] The design in Figure 4-17 was selected because of the building’s layout. The most natural network design for this office building is to have Ethernet workgroup switches on each floor that provide data links to hosts on their respective floors by connecting to the core switch located in the basement. The basement core switch is the control point that functions as the gateway to the outside world.

17.

a) Should products that fail to meet minimum requirements be dropped from consideration?

[161] Yes b) In what two ways can solutions fail to be scalable? [162–163] Solutions can fail to be scalable when they are not cost-advantageous (expensive) as traffic grows and when they cannot handle higher future traffic volumes.

18.

a) What is the make-versus-buy decision? [163] The make-versus-buy decision is the decision of whether the programming staff should create the software itself or whether the company should purchase the software. b) For routers and switches, do firms usually make or buy? [163] They buy. c) We are considering products A, B, and C. Our criteria are price, performance, and reliability with weights of 20 percent, 40 percent, and 40 percent, respectively. Product A’s evaluation scores on these three criteria are 8, 6, and 6, respectively. For B, the values are 6, 8, and 8, respectively. For C, they are 7, 7, and 7, respectively. Present a multicriteria analysis of the decision problem in tabular form and showing all work. Interpret the table. [163–164]

Product A Criterion

Product B

Product C

Weight

Rating

Score

Rating

Score

Rating

Score

Price

20%

8

1.6

6

1.2

7

1.4

Performance

40%

6

2.4

8

3.2

7

2.8

Reliability

40%

6

2.4

8

3.2

7

2.8

Total Score

6.4

7.6

7

Product B appears to be clearly superior to Product C and much superior to Product A. Compared to Product C, Product B is superior in performance and reliability, which are the most important criteria based on their weights.

.

Page 95

Not for Distribution to Students

Product A is superior in price but substantially lacking in performance and reliability.

19.

a) What period of a network’s life does the SDLC cover? [165] The SDLC covers the network’s life during development. b) Why are hardware and software base prices often misleading? [165] There usually are many optional items that can make the purchase prices substantially higher than the base price. c) List the four categories of SDLC costs. [165] Hardware costs, software costs, labor costs in development, and outsourcing development costs. d) Why must user costs in development be considered? [165] User costs must be considered because the time that users spend on the system’s development during requirements definition and later development states is substantial and is not free to the company any more than network staff time is free.

20.

a) Distinguish between the systems development life cycle and the systems life cycle. [165] The systems development life cycle (SDLC) covers only the period of development. The system life cycle spans the entire life of a system. b) What is the total cost of ownership (TCO)? [165] The total cost of ownership (TCO) is the cost of a system over its entire life cycle. c) Why should operating and management costs be considered in addition to hardware, software, and transmission costs in purchasing decisions? [165] They must be considered because they can have a very large impact on the TCO, sometimes exceeding hardware, software, and transmission costs. d) What additional cost factor comes into SLC costs, compared to SDLC costs? [166] Carrier costs.

21.

a) For what is OAM&P an abbreviation in ongoing management? [167] Operations, administration, maintenance, and provisioning. b) Distinguish between operations and maintenance. [167] Operations manages the network on a second-by-second basis. Maintenance is called in when there are problems or to do preventative maintenance to avoid problems. c) What is provisioning? [167] Provisioning is setting up service. d) When may reprovisioning be necessary? [167] When a user’s authorizations change, or when a user changes jobs within the firm or joins project teams, or when contractors or other outside organizations change the way they work. e) When may deprovisioning be necessary? [167]

.

Page 96

Not for Distribution to Students

When a user leaves a project team or leaves the company entirely, or when contractors or other outside organizations stop working with a company. f) Into which of the four categories would you classify the task of comparing the inventory of parts with the inventory list on the computer? [168] Administration 22.

a) List the main elements in SNMP. [168–169] The main elements are the network management program (the manager), managed devices, network management agents (agents), objects on the managed device, and management information bases (MIBs). b) Does the manager communicate directly with the managed device? Explain. [168-169] No, the manager does not communicate directly with the managed device; rather, the manager communicates with the device’s agent. c) Distinguish between Get and Set commands. [168-169] Get commands ask agents for information about the managed device.

Set commands tell the agent to change how the managed device operates. d) Where does the manager store the information it receives from Get commands? [168-169] In its management information base (MIB). e) What kinds of messages can agents initiate? [168–169] An agent can initiate trap commands if the agent senses a problem.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

Assume that an average SNMP response message is 100 bytes long. Assume that a manager sends 40 SNMP Get commands each second. a) What percentage of a 100 Mbps LAN link’s capacity would the resulting response traffic represent? [168–169] Capacity is 100 Mbps.

SNMP traffic = 100 bytes per message times 40 SNMP messages per second = 4,000 bytes per second. This is 32,000 bps.

0.032 percent b) What percentage of a 128 kbps WAN link would the response messages represent? [168-169] 32,000 bps divided by 128,000 bps = .25 (25 percent) c) What can you conclude from your answers to this question? [168–169] You must limit SNMP scanning on WAN links. This will restrict the information you have.

2.

The telephone network has long boasted that it has the “five nines” (99.999 percent availability).

.

Page 97

Not for Distribution to Students

a) How much downtime is this per year? Express downtime in days, hours, minutes, and so on as appropriate. [147]

0.001 Days per year

365

0.37

Hours per year

8,760

8.76

Minutes per year

525,600

525.60

Seconds per year

31,536,000

31,536.00

b) How much downtime is there per year with 99 percent availability? [147]

1%

.

Days per year

365

3.65

Hours per year

8,760

87.60

Minutes per year

525,600

5,256.00

Second per year

31,536,000

315,360.00

Page 98

Not for Distribution to Students

CHAPTER 5: WIRED ETHERNET LANS TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Distinguish between LANs and WANs. [175] LANs operate within the customer premises; customers can build any type of LAN they wish.

WANs carry signals through public areas, between customer premises. b) What are rights of way? [176] Government permission to lay transmission wires in public locations. c) What are carriers? [176] Companies that receive rights of way to lay wire in public areas. d) Why do you have more flexibility with LAN service than with WAN service? [176] You can decide what you want to do on your own premises. e) What is the advantage of using carriers? [177] They handle the labor of operating the transmission network.

2.

Why are typical WAN speeds slower than typical LAN speeds? Give a clear and complete argument. [177] The cost per bit to transmit over longer distances is more expensive than to transmit over a LAN. Consequently, the price per bit is higher on WANs than LANs. When prices rise, people use less of something.

This includes reducing the number of bits per second on WANs.

3.

a) Distinguish between the two types of Ethernet switches in terms of what they connect. [177– 178] Workgroup switches connect hosts to the network.

Core switches connect switches to other switches. b) Distinguish between the two types of Ethernet transmission link technologies in terms of what they connect. [177-178] UTP cords connect hosts to workgroup switches.

Optical fiber is often used to connect switches to other switches. c) Why must core switches have more processing power than workgroup switches? [179] They carry the traffic of many conversations between hosts.

4.

.

a) What is a MAN? (Don’t just spell out the acronym.) [179]

Page 99

Not for Distribution to Students

A metropolitan area networks—a WAN that only covers a metropolitan area—a city and its suburbs. b) What standards association creates most LAN standards? [179] IEEE Standards Association c) What is the name of its committee for developing LAN standards? [179] 802 LAN/MAN Standards Committee d) What 802 working group creates Ethernet standards? [180] The 802.3 Working Group e) What working group is likely to develop security standards to be used by multiple LAN/ WAN technologies? [180] 802.1 Working Group f) When do vendors begin to develop products based on new 802.3 standards? [180] After the 802.3 WG completes its work.

(Sometimes they develop products based on draft standards.)

5.

a) At what layers do single networks require standards? [181] Physical and data link. b) Is Ethernet processing executed in hardware or software? [181] In hardware. c) What circuit implements both of the physical and data link layer processes in Ethernet? [181] Network interface card

6.

What three things do physical layer standards govern? [181] Connectors, transmission media, signaling

7.

a) What must a sender do to send the bits of a frame over a transmission medium? [181] It must convert it into a signal. b) Distinguish between binary and digital signaling. [181] Binary transmission has exactly two states.

Digital signaling has a few states. c) What is a state? [181] A condition on a line that the receiver can understand. d) Why is binary transmission error-resistant? [182] There can be considerable attenuation without making the signal unreadable. e) In Figure 5-7, how much could the signal attenuate before it became unreadable? [182] 12 v to 3 v; This is 75 percent attenuation. f) Why is digital transmission error-resistant? [183]

.

Page 100

Not for Distribution to Students

There can be considerable attenuation without making the signal unreadable. g) How does error resistance differ in binary and digital signaling? [183] The distance between states is smaller in digital signaling than in analog signaling.

Therefore, smaller amounts of attenuation can be tolerated before errors occur. h) Why are clock cycles necessary? [183] If the sender wishes to send 1111, it will transmit two highest signals in a row. The receiver can tell that this is two signals instead of a single longer signal because the transmission will be two clock cycles long. i) If the binary transmission rate is 50 Mbps, how long will a clock cycle be? [183] 1/50,000,000 second: 0.000,000,02 8.

a) What type of copper wiring is widely used in Ethernet? [184] 4-pair UTP b) How many wires are there in a UTP cord? [184] 8 wires c) How many pairs? [184] 4 pairs d) What type of connectors and jacks does 4-pair UTP use? [185] RJ-45 e) What is the advantage of parallel transmission compared to serial transmission? [185] Higher throughput

9.

a) List the three main propagation effects that can impair a signal travelling through UTP wire.

[186] Attenuation Noise Terminal crosstalk interference b) List the two ways in which these effects are controlled. [186] Limiting propagation distances Not untwisting wires too much at the ends. c) Which types of propagation effects are controlled by which control method? [186] Limiting propagation distance: attenuation and noise.

Limiting untwisting: terminal crosstalk interference d) Why is terminal crosstalk interference the main type of interference problem? [186] Except at the ends, the wires are twisted, limiting interference problems. At the end, there is no such protection.

10.

.

a) Of what wire characteristic is category a measure? [187]

Page 101

Not for Distribution to Students

UTP wire quality. b) What types of UTP wiring can carry signals 100 meters at 1 Gbps? [187] Categories 5 and 6. c) What types of UTP wiring can carry signals in 10GBASE-T? [187] Cat 6 and 6A d) Which can carry 10Gbps Ethernet 100 meters? [188] Cat 6A 11.

a) Does the signal travel through the optical fiber core, cladding, or both? [188] The core. b) Why can signals travel very far through optical fiber? [188] There is very little attenuation with distance. c) Why does an optical fiber cord have two strands? [188] For two-way transmission (one in each direction) d) What is the ability to transmit in both directions simultaneously called? [188] Full duplex transmission. e) Why does modal dispersion happen? [189] Signal modes traveling straight through a fiber cords arrive more quickly than modes that enter at high angles and reflect from the walls multiple times, thus traveling farther.

If the light from successive clock cycles overlaps in time, the signal will tend to be unreadable. f) When will modal dispersion be a problem? [189] For multimode fiber. g) What is the measure of multimode optical fiber quality? [190] Modal bandwidth. h) In what units is modal bandwidth expressed? [190] MHz-km i) If you use 1000BASE-SX fiber, what modal bandwidth do you need to transmit a signal 250 meters? [190] 62.5 microns, 200 MHz-km j) Will light travel farther in 50 micron fiber or 62.5 micron fiber? [190] 50 micron fiber. k) What does wavelength measure? [190] The distance between successive wave heights, troughs, starts, stops, and so forth is called the wavelength.

.

Page 102

Not for Distribution to Students

12.

a) Comparing LAN and WAN fiber, what are distance limits? [192] LANs: 200 to 300 miles WAN: several kilometers. b) What light wavelengths are used? [192] LANs: 850 nm.

WAN: 1,310 and 1,550 c) What are the two diameters for multimode fiber? [192] 50 microns or 62.5 microns d) What is the diameter of single-mode fiber? [192] 8.5 microns. e) What are the principle distance limiting factors for LAN and carrier fiber? [192] LAN fiber: modal bandwidth.

WAN fiber: attenuation. f) Is modal bandwidth a quality measure for LAN fiber, carrier fiber, or both? [192] LAN fiber

13.

a) What is link aggregation? [192] Link aggregation (trunking or bonding) is the use of two or more trunk lines between a pair of switches. b) What is it also called? [192] Bonding. c) If you need to connect two 1000BASE-SX switches at 2.5 Gbps, what are your options? [193] Link aggregation with three links.

Going up to 10 Gbps Ethernet. d) Why may link aggregation be more desirable than installing a single faster link? [193] Link aggregation allows you to increase trunk speed incrementally instead of by a factor of 10. This is less expensive than increasing speed by a factor of 10. In fact, you probably can use ports on your existing speeds if they are not in use. e) Why may link aggregation not be desirable if you will need several aggregated links to meet capacity requirements? [193] It may not be desirable if you will need several aggregated links to meet capacity requirements because after two or three aggregated links, the company should compare the cost of link aggregation with the cost of a ten-fold increase in capacity that would be achieved by moving up to the next Ethernet trunk line speed. Going to a single faster trunk line will also give more room for growth.

14.

.

a) What steps would you go through to use the information in Figure 5-12 and Figure 5-15 in network design? [194]

Page 103

Not for Distribution to Students

You can use the data in the figures to figure out which type of transmission link would be best suited to your network design on the basis of the speed you require and the distance you need to span. b) If more than one type of Ethernet standard shown in Figure 5-12 and Figure 5-15 can span the distance you need, what would determine which one you choose? [194] If more than one type of Ethernet standard shown in the figures can span the distance you need, cost would probably determine which one you would choose. In general, always choose the least expensive option that will do the job. c) In Figure 5-12 and Figure 5-15, is the maximum distance the maximum distance for a single physical link or for the data link between two hosts across multiple switches? [194] Distance shown is the maximum for a single physical link. d) At what layer or layers is the 802.3 100BASE-TX standard defined—physical, data link, or internet? [194] Physical layer. e) How does regeneration allow a firm to create LANs that span very long distances? [194] Regeneration allows a firm to create LANs that span very long distances. If the signals were not regenerated, they would attenuate too much to be readable over very long distances. As a solution, each switch along the path of a pair of devices can regenerate the signal. If the signal begins as a 1, for example, it is likely to be distorted before it reaches the first switch. The first switch recognizes it as a 1 and generates a new 1 signal to send to the second switch. The second switch regenerates the 1 as well. This allows frames to be delivered over very long distances. f) If you need to span 300 meters by using 1000BASE-SX, what options do you have? (Include the possibility of using an intermediate switch.) [194] You have the options of 50/125-micron multimode operating at 850 nm with either 400 or 500 MHz-km in modal bandwidth.

Using an intermediate switch, you could also use 62.5/125-micron multimode at 850 nm, with either 160 or 200 MHz-km in modal bandwidth. g) How would you decide which option to choose? [194] You would have to cost out the alternatives to decide.

15.

a) What is the purpose of the preamble and start of frame delimiter fields? [195] The purpose of the preamble and start of frame delimiter fields is to synchronize the receiver’s clock with the sender’s clock. These fields have a strong rhythm of alternating 1s and 0s. The last bit in the sequence is a 1 instead of the expected 0, to signal that the synchronization is ended. b) Why are Ethernet addresses called MAC addresses or physical addresses? [196] They are called MAC addresses because they are addresses at the media access control layer.

.

Page 104

Not for Distribution to Students

They are called physical addresses because Ethernet is implemented by physical network interface cards. (However, these are addresses at the MAC layer (part of the data link layer), not physical layer addresses.> c) What are the steps in converting 48-bit MAC addresses into hex notation? [196] First, the 48 bits are divided into twelve 6-bit units, which computer scientists call nibbles.

Second, each nibble is converted into a hexadecimal symbol.

Third, the symbols are written as six pairs with a dash between each pair—for instance B2-CC-66-0D-5E-BA. (Each pair represents one octet.) d) Convert 11000010 to hex. [196] 1100 is C. 0010 is 2. So the answer is C2. e) Convert 7F hex to binary. [196] 7 is 0111 and F is 1111, so the answer is 01111111. f) The length field gives the length of what? [197] The length field gives the length of the data field g) If the length field is 1020, what is the length of the packet in the data field? [197] Length: 1020. LLC subheader: 8. Packet = 1020 – 8 = 1012 h) What are the two components of the Ethernet data field? [197] The LLC subheader and the packet that the frame is carrying. i) What is the purpose of the LLC subheader? [197] The purpose of the LLC subheader is to describe the type of packet contained in the data field. j) What type of packet is usually carried in the data field? [197] Usually, the data field carries an IP packet. k) What is the maximum length of the data field? [197] The maximum is 1,500 octets. l) Who adds the PAD field—the sender or the receiver? [198] The sender adds the PAD field. m) Is there a minimum length for the data field? [198] There is no minimum length for the data field. n) If the data field is 40 octets long, how long a PAD field must the sender add? [198] If the data field is 40 octets long, a PAD field of six octets must be added. o) If the data field is 400 octets long, how long a PAD field must the sender add? [198] If the data field is 400 octets long, no PAD field needs to be added. p) What is the purpose of the Frame Check Sequence Field? [198] .

Page 105

Not for Distribution to Students

The purpose of the frame check sequence field is to permit error detection. [198] q) What happens if the receiver detects an error in a frame? [198] If the receiver detects an error in a frame, the receiver simply discards the frame.

16.

a) Do switches know the entire data link between the source and destination host? [199] No. b) What does a switch know? [199] It knows a port number for each MAC address. If a frame comes in with a certain destination MAC address, the switch knows what port to send it back out. c) In Figure 5-22, trace everything that will happen when Host E5 sends a frame to D4. [199] E5 will send a frame addressed to D4 to Switch 3.

Switch 3 will send the frame out port 2 to D4. d) Trace everything that will happen when Host E5 sends a frame to B2. [199] E5 will send a frame addressed to D4 to Switch 3.

Switch 3 will send the frame out Port 4, to Switch 2.

Switch 2 will send the frame out Port 3, to Switch 1.

Switch 1 will send the frame out Port 7 to B2.

17.

a) How are switches in an Ethernet LAN organized? [200] Switches in an Ethernet LAN are organized in a hierarchy, in which each switch has only one parent switch above it. b) Because of this organization, how many possible paths can there be between any two hosts?

[200] Because of this organization, there can be only one possible path between any two hosts. c) In Figure 5-23, what is the single possible path between Client PC 1 and Server Y? [200] The only path is from Client PC 1 to Switch D to Switch B to Switch A to Switch C to Switch F to Server Y. d) Between Client PC 1 and Server X? [200] The only path is from Client PC 1 to Switch D to Switch B to Switch E to Server X.

18.

a) What is the benefit of having a single possible path? Explain in detail. [201] The benefit of having a single possible path is that it allows a simple table lookup operation, because in every switch along the path, the destination address in a frame will appear only once in the switching table—for the specific outgoing port needed to send the frame on its way. This simple table lookup operation is very fast and therefore costs little per frame handled, making Ethernet switches inexpensive. b) Why has Ethernet become the dominant LAN technology? [201] Ethernet has become the dominant LAN technology because of its simple switching operation and resultant low cost.

.

Page 106

Not for Distribution to Students

c) Why are routers expensive for the traffic volume they handle? [201] They are connected in a mesh, so there are many alternative routes for every packet. A router must consider the best possible way to send a packet out, not simply the single possible way an Ethernet can use to send a frame out.

19.

a) What is a single point of failure? [202] Having a single possible path between any two hosts in an Ethernet network is dangerous because it makes Ethernet vulnerable to single points of failure. b) Why is having a single possible path between any two hosts in an Ethernet network dangerous? [202] A single point of failure exists if a single failure can cause widespread disruption. This occurs in hierarchical topologies, where there is only a single possible path between any two hosts. c) What is the traditional way to address this problem? How does it bring redundancy? How does it improve reliability? [202] To add a backup link.

It provides an alternative path if the original path fails.

If there is a failure, the signal will still get through. d) What standard allows backup links for redundancy in Ethernet networks? [203] The standard that permits Ethernet network redundancy is the Rapid Spanning Tree Protocol (RSTP). e) Is it easy or difficult to create backup links effectively with RSTP? [203] It is difficult and time-consuming.

20.

a) What is a VLAN? [204] A VLAN is a virtual LAN, a group of hosts in a LAN that can communicate only with one another. Hosts in different VLANs cannot communicate with one another. b) What two benefits do VLANs bring? [204] Virtual LANs (VLANs) address the problem of congestion, which is produced in a large switched Ethernet LAN with many servers if there is broadcasting.

They also address the need for security. c) How do VLANs bring security? [205] VLANs bring security by grouping hosts into closed collections of servers and the clients they serve (i.e., grouping them into virtual LANs). A server can only be reached by clients on its VLAN. d) When VLANs or priority are used, what two fields does the 802.1Q standard add to Ethernet frames? [205] The Tag Protocol ID and Tag Control Information fields e) When VLANs are used, what does the Tag Protocol ID field tell a receiving switch or NIC? [205] The Tag Protocol ID field says that the frame is tagged.

.

Page 107

Not for Distribution to Students

f) What information does the tag control information field tell the switch or receiver? [205] It specifies the frame’s 12-bit VLAN ID. g) In Figure 5-27, what server or servers can Host A communicate with? [205] B and E. h) In Figure 5-27, what server or servers can Host C communicate with? [205] D and F. 21.

How many priority levels are possible for Ethernet switches? [206] 23 = 8 b) Why does a momentary traffic overload cause delay? Be specific. c) How does priority reduce delay? d) What determines what level of priority a frame will be given? e) What priority would you give to streaming video? Defend your decision. f) What priority would you give to database queries? Defend your decision. g) What is the trade-off between implementing priority and overprovisioning?

22.

a) What are managed switches? [207] Managed switches are switches that have enough intelligence that they can be managed from a central computer. b) What benefits do they bring? [207] They can collect information for problem diagnosis, collect information for performance summaries, and even fix a switch remotely. c) Do managed switches increase or decrease total costs? [207] They decrease total costs. d) Why does a company’s security level determine whether it can use the Set command? [208] If it has poor security, it will not implement Set because an attacker may take it over and use it to attack the firm. e) What are the implications of not being able to use the Set command? [208] The cost benefits of making remote changes must be foregone.

23.

a) What is POE? [208] POE (power over Ethernet) is a standard that permits a switch to send electrical power to attached devices over the ordinary UTP cord that hosts already use to connect to the switch. b) Why is POE attractive to corporations? [208] It avoids the need to provide external electrical power during the installation of wireless access points, voice over IP telephones, surveillance cameras, and other networked devices. c) What maximum standard power does the POE standard specify? [209] 25 watts. d) For what types of devices is POE sufficient? [209]

.

Page 108

Not for Distribution to Students

VoIP telephones, advanced access points, and motorized surveillance cameras. e) Is POE sufficient for desktop computers and most notebook computers? [209] No 24.

a) What threat does 802.1X address? [210] 802.1X addresses the threat of attackers being able to plug their notebook PCs into any Ethernet wall jack and have unfettered access to the network. b) How does the standard address the threat? [210] I addresses the threat by requiring any device that attaches to the port to send authentication credentials to prove its identity and to prove its permission to use the network. c) In 802.1X, what device is the authenticator? [210] The workgroup switch is the authenticator. d) What are the benefits of using a central authentication server instead of having the individual authenticators do all authentication work? [210–211] First, it minimizes the processing power needed in the workgroup switch. This can produce a major cost saving, compared with having the workgroup switches do the authentication.

Second, having all credentials on the authentication server gives consistency in authentication; there is no danger in having different workgroup switches with incompatible authentication databases.

Third, management cost is reduced because credentials need to be changed on the central authentication server only when user authentication information is changed whenever a user joins the firm, leaves the firm, or needs other credential changes.

Fourth, the credentials of individuals who are fired or suspended can be invalidated in seconds.

25.

a) What is likely to be the main standard for 100 gigabit per second Ethernet? [211] 802.3ba. b) At what speed does 100GBASE-SR10 operate? [211] 100 Gbps. c) What is the speed of the 100GBASE-SR10 virtual lane? [211] 100 Gbps. d) What is the speed of an individual 100GBASE-SR10 media lane? [211] 10 Gbps. e) How many optical fiber cords does 100GBASE-SR10 require? [211] 24. f) How many connectors does 100GBASE-SR10 require at each device? [211] 24.

.

Page 109

Not for Distribution to Students

g) Why is 100GBASE-SR10 better than simply trunking ten 10GBASE-SX connectors on each device? (Explain your answer.) [212] By requiring only a single port at each end and by automatically handling the virtual lane’s multiple media lanes, 100GBASE-SR10 is attractive economically. 100GBASE-SR10 should also reduce power requirements. This will save money both directly in each device and indirectly by lowering air conditional costs for equipment rooms. h) How are 100 Gbps standards likely to change for LANs as technology matures? [212] Fewer media lanes may be needed.

Distance may be increased.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

With power over Ethernet, what is the potential danger to users in having powered switch ports?

How do you think this danger might be avoided? [208–209] Power might do damage to a device connected to the outlet if it is not designed for POE. The POE source checks to see if the device is compatible before turning on the power.

2.

When would the optional Tag fields in the Ethernet frame be added? [205] If priority or a VLAN was being used

3.

The Length field is 22. a) How long is the combined data field and PAD? [197-198] 46 octets b) How long is the PAD? [197–198] 46 – 22 = 24

Design Questions 1.

Design an Ethernet network to connect a single client PC to a single server. The two devices are 410 feet apart. They need to communicate at 800 Mbps. Your design will specify the locations of switches and the transmission line between the switches.

Student designs will vary.

2.

Add to your design in the previous question. Add another client next to the first client. This client will also communicate with the server and will also need 800 Mbps in transmission speed. Again, your design will specify the locations of switches and the transmission line between the switches.

Student designs will vary.

Troubleshooting Question 1.

You are connecting two switches in a large Ethernet switch with 32 switches. You are using 4-pair UTP. Suddenly, transmissions cannot travel over the network. What do you think might have

.

Page 110

Not for Distribution to Students

happened? If you cannot come up with a good solution, reread the synopsis and see which points might apply.

Student answers will vary.

.

Page 111

Not for Distribution to Students

CHAPTER 6: WIRELESS LANS I TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Which terms in this case were unfamiliar to you? [223] Student answers will vary. b) What do you think Christopher should do? Justify your conclusion. [223] The student does not really have the information to say definitively at this point, but they should be able to think about it.

(In reality, Christopher bought the dual-band N router, and Claire used it in the uncrowded 5 GHz band. It made Claire’s download speed very fast. In the 2.4 GHz band, the new router made no difference.)

2.

a) At what layers do wireless networks operate? [224] Layers 1 and 2 (physical and data link). b) Are wireless network standards OSI standards or TCP/IP standards? Explain. [224] OSI standards dominate at Layers 1 and 2, so wireless network standards are OSI standards.

3.

a) What 802 working group creates 802.11 standards? [225] The 802.11 Working Group. b) Why do wireless clients need access to the wired Ethernet LAN? [225] To reach servers and Internet access routers on the wired LAN. c) How can firms provide WLAN coverage throughout a large building? [225] By locating many access points around a building

4.

a) Is wireless radio transmission usually expressed in terms of wavelength or frequency? [226] Frequency. b) What is a hertz? [226] Hertz is a measure of frequency. One Hz is one cycle per second. c) Convert 3.4 MHz to a number without a metric prefix. [226] 3,400,000 Hz. d) At what range of frequencies do most wireless systems operate? [226] About 500 megahertz (MHz) to 10 gigahertz (GHz)

5.

a) Distinguish between omnidirectional and dish antennas in terms of operation. [227] Omnidirectional antennas transmit and receive equally strongly in all directions.

Dish antennas transmit and receive most strongly in one direction.

.

Page 112

Not for Distribution to Students

b) Under what circumstances would you use an omnidirectional antenna? [227] If the other party is near, if you do not know where the other party is, or both. c) Under what circumstances would you use a dish antenna? [227] If you need to communicate over longer distances and if you know where the other party is. d) What type of antenna normally is used in WLANs? Why? [227] Omnidirectional antennas; because the user does not know where the access point or other device is. Also, carrying around a dish would really be cumbersome.

6.

a) Which offers more reliable transmission characteristics—UTP or radio transmission? [228] UTP b) Which attenuates more rapidly with distance—signals sent through wired media or radio signals? [228] Signals sent over radio. c) If the signal strength from an omnidirectional radio source is 8 mW at 30 meters, how strong will it be at 120 meters, ignoring absorptive attenuation? Show your work. [228] r1/r2 = 30/120 = ¼ (r1/r2)2 = (¼)2 = 1/16 S1 * (r1/r2)2 = 8/16 = 0.5 mW d) How are shadow zones (dead spots) created? [229] There is an dense object between the sender and receiver. e) Why is multipath interference very sensitive to location? [229] Additive and destructive interference can vary greatly over a very short distance. f) What is the most serious propagation problem in WLANs? [229] Multipath interference. g) List some sources of EMI[229] Other wireless devices.

Microwave ovens. h) What propagation problems become worse as frequency increases? [230] Absorptive attenuation (not inverse square law attenuation) and shadow zones

7.

a) Distinguish among the frequency spectrum, service bands, and channels. [230] The frequency spectrum is all frequencies between zero Hz and infinity.

A service band is a region of the frequency spectrum dedicated to a particular purpose, such as broadcast VHS television.

A channel is a subdivision of a service band; it carries a single signal. b) In radio, how can you send multiple signals without the signals interfering with one another?

[230]

.

Page 113

Not for Distribution to Students

You can send them in different individual channels.

8.

a) Does a signal usually travel at a single frequency, or does it spread over a range of frequencies? [231] It spreads over a range of frequencies. b) What is channel bandwidth? [231] The difference between the highest frequency and the lowest frequency in a channel c) If the lowest frequency in a channel is 1.22 MHz and the highest frequency is 1.25 MHz, what is the channel bandwidth? (Use proper metric notation.) [231] 1.25 – 1.22 = 0.03 MHz = 30 MHz. d) Why is large channel bandwidth desirable? [231] If channel bandwidth is large, you can transmit more rapidly. e) What do we call a system whose channels have large bandwidth? [233] A broadband system. f) What other types of system do we call broadband? [233] We frequently use the name for any system that is fast, regardless of whether it transmits in channels.

9.

a) Write the Shannon Equation. List what each letter is in the equation. [231] C = B [Log2 (1 + S/N)] C = the maximum possible speed of a channel B = the bandwidth in Hz S/N = the signal to noise ratio b) What information does C give you? [231] The maximum possible transmission speed of a channel. c) What happens to the maximum possible propagation speed in a channel if the bandwidth is tripled while the signal-to-noise ratio remains the same? [231] The maximum possible speed is tripled. d) Given their relative bandwidths, about how many times as much data is sent per second in television than in AM radio? (The information to answer this question is in the text.) [231] TV bandwidth is 6 MHz. AM radio bandwidth is 10 kHz. Bandwidth ratio = 6,000,000 Hz / 10,000 Hz = 600.

TV can carry 600 times as much information. e) Telephone channels have a bandwidth of about 3.1 kHz. Do the following in Excel. Cut and paste your analyses into your homework. f) If a telephone channel’s signal-to-noise ratio is 1,000 (the signal strength is 1,000 times larger than the noise strength), how fast can a telephone channel carry data? (Check figure: Telephone modems operate at about 30 kbps, so your answer should be roughly this speed.) These questions are asked at the end of the chapter.

.

Page 114

Not for Distribution to Students

10.

a) What is the golden zone in commercial mobile radio transmission? [234] 500 MHz to 10 GHz. b) Why is the golden zone important? [234] It is the range of frequencies normally used for commercial radio transmission. c) What is a clear line-of-sight limitation? [234] It is when there is nothing between the sender and receiver to stop the signal.

11.

a) Do WLANs today use licensed or unlicensed bands? [235] Unlicensed radio bands. b) What is the advantage of using unlicensed bands? [235] You do not need a license to have or move a station. c) What is the disadvantage? [235] You cannot prevent others from installing transmitters that interfere with yours.

12.

a) In what two unlicensed bands does 802.11 operate? [235-237] The 2.4 GHz and 5 GHz bands. b) How wide are 802.11 channels usually? [235–237] 20 MHz c) Which licensed band is defined the same way in most countries around the world? [235-237] The 2.4 GHz band. d) Does the 2.4 GHz band or the 5 GHz band allow longer propagation distances for a given level of power? Justify your answer. [235-237] The 2.4 GHz band. The 5 GHz band has higher attenuation because higher frequencies have more absorptive attenuation. e) How many non-overlapping channels does the 2.4 GHz band support? [235-237] Three. f) Why is the number of non-overlapping channels that can be used important? [235–237] If you do not have enough nonoverlapping channels, you cannot have different nearby access points operate at different frequencies. If you cannot, they will interfere with one another. g) How many non-overlapping channels does the 5 GHz band support? [235-237] Between 11 and 24.

13.

a) In unlicensed bands, what type of transmission method is required by regulators [238] Spread spectrum transmission. b) What is the benefit of spread spectrum transmission for business communication? [238] More reliable propagation

.

Page 115

Not for Distribution to Students

c) Is spread spectrum transmission done for security reasons in commercial WLANs? [239] No, commercial WLAN spread spectrum transmission does not provide security.

14.

a) In normal radio operation, how does channel bandwidth usually relate to the bandwidth required to transmit a data stream of a given speed? [239] Usually, only enough bandwidth is allocated for the required transmission speed. b) How does this change in spread spectrum transmission? [239] In spread spectrum transmission, the bandwidth is much wider than the required transmission speed requires.

15.

a) What spread spectrum transmission method is used for the most recent 802.11 standards?

[240] Orthogonal Frequency Division Multiplexing (OFDM) b) Describe it. [240] The channel is divided into many subcarriers. Part of the signal is sent in each subcarrier.

The information is sent redundantly so that if some subcarriers are impaired, all of the information will still get through.

16.

a) List the elements in a typical 802.11 LAN today. [241] Client hosts with wireless capabilities Wireless access points. b) Why is a wired LAN usually still needed if you have a wireless LAN? [241] To connect wireless clients to servers and the Internet access router on the firm’s main wired LAN. c) In the figure, what is the distribution system? [241] 802.11 wireless networks and Ethernet LANs have different frame syntaxes. So the access point cannot simply pass the frame on from one network to another.

17.

a) Why must the access point remove an arriving packet from the frame in which the packet arrives and place the packet in a different frame when it sends the packet back out? [242] 802.11 wireless networks and Ethernet LANs have different frame syntaxes. So the access point cannot simply pass the frame on from one network to another. b) Besides moving packets between wireless clients and the Ethernet network, what other control functions do access points have? [242] To control the wireless hosts.

18.

a) What is a BSS? (Do not just spell out the acronym.) [242] A basic service set (BSS) consists of an access point and the set of hosts it serves b) What is an SSID? (Do not just spell out the acronym.) [243] The access point in a BSS has an identifier called the service set identifier (SSID). c) Does the access point have an SSID? [243]

.

Page 116

Not for Distribution to Students

Yes. d) Why must wireless devices know the access point’s SSID? [243] Wireless devices must know an access point’s SSID to connect to it.

19.

a) What is a handoff in 802.11? [243] A client host moving from one access point to another. b) What is the relationship between handoffs and roaming in WLANs? [243] They mean the same thing. c) What is an ESS? (Do not just spell out the abbreviations.) [243] An extended service set (ESS) is a group of BSSs that are 1) connected to the same distribution system (network) and 2) have the same SSID d) What feature do all access points in an ESS share? [243] All have the same SSID. e) How can access points communicate with each other? [243] Via the distribution system. f) What is the purpose of the 802.11r standard? [243] For communicating roaming information between access points

21.

a) What is a collision? [244] When two devices in the same channel transmit at the same time. b) Why is it bad? [244] Their signals will be unintelligible. c) What is the purpose of media access control? [244] To prevent two stations from transmitting at the same time. d) Does media access control limit the actions of wireless hosts, the access point, or both? [244] Both

*22.

a) Describe CSMA/CA+ACK. Do not go into detail about how long a host must wait to transmit if there is no traffic. [245–246] If there is current traffic, a wireless device must wait.

If there has been no traffic for a “long time,” it may transmit immediately.

If there has been traffic recently, the device waits a random amount of time and then goes through these three rules again. <The purpose of the third rule is collision avoidance (CA).> b) Is CSMA/CA+ACK transmission reliable or unreliable? Explain. [245-246]

Each transmission is immediately acknowledged (without delay). This makes CSMA/CA+ACK reliable. c) Why is CSMA/CA+ACK inefficient? [245–246]

.

Page 117

Not for Distribution to Students

There is a good deal of waiting because of the third rule.

The acknowledgement also takes time. *23.

a) Describe RTS/CTS. [246–247] A wireless host transmits a request-to-send message indicating that it wishes to transmit.

The wireless access point transmits a clear-to-send message. If the access point chooses, it may send a clear-to-send message. This message allows the host that sent the CTS to transmit for a period of time. Other hosts receiving the CTS message must wait. b) Is CSMA/CA+ACK required or optional? [246-247] Required. c) Is RTS/CTS required or optional? [246-247] Optional. d) Which is more efficient, RTS/CTS or CSMA/CA+ACK? [246-247] CSMA/CA+ACK. e) When does RTS/CTS make sense to use? [246–247] When two client hosts cannot hear each other and so may transmit at the same time

24.

a) Of the four 802.11 transmission standards summarized in this section, which are full standards, and which are only draft standards? [247–249] Full:

802.11g and 802.11n are full standards

Draft:

802.11ac and 802.11ad

b) What is the maximum rated speed for each standard? [247–249] 802.11g:

54 Mbps

802.11n:

600 Mbps

802.11ac:

6.9 Gbps

802.11ad:

7 Gbps

c) Compare maximum speeds for 802.11g and 802.11n and the maximum distances at which each standard can provide these speeds. [247-249] 802.11g:

30 m

802.11n:

70 m

d) Which can bring gigabit speeds to clients? [247-249] 802.11ac and 802.11ad. e) What business application will gigabit transmission speed make feasible to do wirelessly?

Wireless data backup and synchronization 25.

What spread spectrum method do all four standards use as their main method?

OFDM

26. .

a) Why is wider channel bandwidth good? [250] Page 118

Not for Distribution to Students

You can transmit data faster in a wider channel.

What is the downside of wider channel bandwidth? [250] Service bands have limited sizes, so wider channels means fewer channels. b) What frequency band or bands do 802.11g, 802.11n single band, 802.11n dual band, 802.11ac, and 802.11 ad use? [250] 802.11g:

2.4 GHz

802.11n single band:

2.4 GHz

802.11n dual band

2.4 GHz, 5 GHz

802.11ac

5 GHz

802.11 ad

60 GHz

c) For each, compare channel bandwidth and the number of possible channels. [250] 802.11g:

2.4 GHz

20 MHz

3

802.11n single band:

2.4 GHz

40 MHz

1

802.11n dual band

2.4 GHz, 5 GHz

20 MHz

3 (2.4 GHz)

40 MHz

6 (USA)

80 MHz

6

160 MHz

3

2.1 GHz

3 (USA), 4 Europe

802.11ac 802.11 ad

5 GHz 60 GHz

d) What are the benefits and problems of transmission in the 60 GHz band? [250] Benefit: Very high channel bandwidth, so very high speed Problem: High attenuation at 60 GHz, so very short distance 27.

a) How does MIMO work? [251] A station transmits multiple spatial streams (signals) in a single channel. It sends each spatial stream from a different antenna.

These spatial streams arrive at slightly different times at the different antennas of the receiver. With this difference, the receiver can understand both spatial streams. b) What is the main benefit of MIMO? What is its other benefit? [251] Greater speed.

Greater distance. c) Compare the range of rated speeds possible 802.11g with 40 MHz channels and 802.11ac.

[251] 802.11g: 54 Mbps 802.11n with 2 spatial streams: 300 Mbps; with 4 spatial streams: 600 Mbps 802.11ac with 8 streams, 160 MHz channels: 6.93 Gbps

28.

a) What is beamforming? [252] With multiple antenna, an access point can direct its energy and sensitivity to a particular wireless client.

.

Page 119

Not for Distribution to Students

b) What two benefits can it bring? [252] More power to the client Multiuser MIMO c) Distinguish between MIMO and multiuser MIMO. [252] MIMO: using spatial streams to transmit more rapidly to a client.

Multiuser MIMO: using spatial streams and beamforming to communicate with multiple wireless devices simultaneously in the same channel. d) What is another name for beamforming? [252] Having smart antennas 29.

a) Distinguish between rated speed, aggregate throughput, and individual throughput. [253] Rated speed: advertised speed of transmission Aggregate throughput: actual throughput provided for all wireless devices Individual throughput: actual throughput provided for a single wireless device. b) What factors influence individual throughput, given a certain level of aggregate throughput?

[253] How many other stations are being served at the same time.

The presence of a distant station.

An 802.11b device associating with an access point. c) Why does transmission speed drop as a computer moves farther from an access point? [253] With a given modulation scheme, errors increase with distance because of attenuation.

To keep up quality, the access point and station switch to a lower-speed modulation scheme, which will have lower error rates but also lower speed. d) How does the presence of a distant station harm all users of an access point? [253] If one station is very far away, its slower transmission speed will require more transmission time per message. This time is taken from other stations.

30.

a) What is backward compatibility? [254] When a device designed for a new standard retains the ability to communicate via older standards with other devices. b) Why do you think it is important? [254] Devices supporting a new standard can be moved in gradually without disrupting operations. c) When a device designed to use a newer standard must work with a device that only uses an older standard, what standard do they use to communicate? [254] The older standard

31.

a) What is white space, and why is using it attractive? [255] White space is unused channel bandwidth in television and other services.

It is attractive because it can potentially be used for other purposes.

.

Page 120

Not for Distribution to Students

b) Why may spectrum scarcity be a problem?

Demand is growing explosively.

Unless new spectrum is opened soon (or if we learn to use existing spectrum better), we will have the equivalent of overcrowded California freeways. c) If spectrum scarcity becomes a problem, how will that affect users? [255] Everyone’s throughput will drop.

Prices will increase.

32.

a) How does Wi-Fi Direct differ from the traditional way in which two wireless hosts communicate?[255] The two hosts communicate directly instead of through an access point. b) Can a large Wi-Fi network operate without an Ethernet switched backbone? [256] The access points, talking among themselves, can serve as the distribution system. c) What technology allows this? [256] Wireless mesh networking. d) What is the current 802.11 standard for this technology? [256] 802.11s e) What devices forward frames in a mesh network? [256] Access points and hosts f) What three issues must be overcome to make mesh networking acceptable to corporations?

[256] Meshes must be self-organizing.

Meshes must not overload some devices.

Meshes must have good security.

33.

a) Why can two products that comply with the same standard have different performance? [257] Most standards have options, and not all vendors will implement all options.

Not implementing certain options can reduce performance. b) What is the advantage of having three antennas rather than two on an access point? [257] Even if wireless devices have only two antennas, there will be a typical speed gain of 67.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

Reread the Christopher Lorek case. Are any terms still unfamiliar to you? Would you give the same advice? Why or why not? [223] Student answers will vary.

.

Page 121

Not for Distribution to Students

2.

The first letter part in this question was previously asked as a test your understanding question.

Telephone channels have a bandwidth of about 3.1 kHz. Do the following in Excel. Cut and paste your analyses into your homework. a) If a telephone channel’s signal-to-noise ratio is 1,000 (the signal strength is 1,000 times larger than the noise strength), how fast can a telephone channel carry data? (Check figure: Telephone modems operate at about 30 kbps, so your answer should be roughly this speed.) [231]

Question part

a)

b)

c)

Bandwidth

3,100

3,100

4,000

SNR

1,000

10,000

1,000

1 + SNR

1,001

10,001

1,001

10

13

10

30,898

41,192

39,869

Log2(1+SNR) B*Log2(1+SNR)

30,898 bps b) How fast could a telephone channel carry data if the SNR were increased massively, from 1,000 to 10,000? (This would not be realistic in practice.) [231] 41,192 c) With an SNR of 1,000, how fast could a telephone channel carry data if the bandwidth were increased to 4 kHz? Show your work or no credit. [231] 39,869 d) What did you learn from these three analyses?

Increasing bandwidth is the easiest way to increase transmission speed.

3.

A building has four sides that are each 100 meters long. The building is 100 meters tall. Draw a picture. [No page numbers] a) If access points have a service radius of 25 meters, how many access points would you need?

Three access points can cover a linear distance of 100 meters.

This must be done in three dimensions, so the number of access points will be 3 cubed or 9.

(This will still not quite enough for corners.) b) If access points have a range of 33 meters, how many access points would you need.

Two access points can cover a linear distance of 100 meters.

This must be done in three dimensions, so the number of access points will be 2 cubed or 4.

.

Page 122

Not for Distribution to Students

(This will still not quite be right for corners.) c) What did you learn from your answers?

Extending an access point’s service range can considerably decrease the number of access points needed.

4.

The following matters were not addressed specifically in the text. However, if you understand the concepts of Layer 1 and Layer 2 standards, in each case, give your answer and explain your reasoning. [No page numbers] a) Is multipath interference a Layer 1 or Layer 2 concern?

Propagation is a Layer 1 concern, so multipath interference is a Layer 1 concern. b) Is media access control a Layer 1 or Layer 2 concern?

It is a data link layer concern because it manages frame transmission. c) Is MIMO a Layer 1 or Layer 2 concern?

Propagation is a Layer 1 concern, so MIMO is a Layer 1 concern. d) Are wireless propagation problems Layer 1 or Layer 2 concerns?

Propagation is a Layer 1 concern, so propagation problems are Layer 1 concerns.

Design Question 1.

Consider a one-story building that is a square. It will have an access point in each corner and one in the center of the square. All access points can hear one another. a) Assign access point channels to the five access points if you are using 802.11g. Try not to have any access points that can hear each other use the same channel. Available channels are 1, 6, and 11.

The key thing to note is that all access points can hear one another.

Under these conditions, you can only place one in the middle and place the others in opposite corners. b) Were you able to eliminate interference between access points?

No because they can all hear one another and therefore will interfere with others on the same channel. c) Repeat the first two parts of the question, this time using 802.11a. Available channels are 36, 40, 44, 48, 53, 56, 60, 64, 149, 153, 157, and 161, but many NICs and access points only support channels below 100.

Simply choose a different channel for each access point.

There will be no interference between any of the access points.

Troubleshooting Question 1.

.

When you set up an 802.11g wireless access point in your small business, your aggregate throughput is only about 6 Mbps. a) List at least two possible reasons for this low throughput.

[No page numbers]

Page 123

Not for Distribution to Students

There may be interference from nearby access points.

This may be realistic throughput if distances are considerable.

There may be distant and therefore slow wireless hosts. b) Describe how you would test each. [No page numbers] There may be interference from nearby access points: Do a wireless survey of access point channels.

This may be realistic throughput if distances are considerable: Check if others in a similar condition are getting different throughput.

There may be distant and therefore slow wireless hosts: Check the distances of wireless hosts. c) Describe what you would do if each proved to be the problem. [No page numbers] There may be interference from nearby access points: Change the channel on your access point.

This may be realistic throughput if distances are considerable: Live with it or have multiple access points.

There may be distant and therefore slow wireless hosts: Add another access point for them.

.

Page 124

Not for Distribution to Students

CHAPTER 7: WIRELESS LANS II TEST YOUR UNDERSTANDING QUESTIONS 1.

a) What did the attackers do first to break into TJX and other companies? [270] They broke into retail store networks using the weak security of WEP. b) Why do you think TJX failed to upgrade to stronger security than WEP? (There may be more than one consideration.) [270] The company is a low-cost operator. By not upgrading, they could save money. They did not consider break-ins likely. c) How was the TJX break-in an international crime? [271] The hackers used accomplices in other countries to sell stolen credentials.

2.

a) Distinguish between war drivers and drive-by hackers. [272] War drivers merely locate unprotected access points. Drive-by hackers actually break into the firm’s WLAN. b) What is a rogue access point? [272] An unauthorized internal access point

3.

a) When 802.11 was created, what security protocol did it offer? [273] Wired equivalent privacy (WEP) b) How long does it take to crack WEP today? [274] About ten minutes

4.

a) Who created WPA? [275] The Wi-Fi Alliance b) What is WPA’s disadvantage compared with 802.11i? [275] WPA offers weaker security than 802.11i.

5.

a) What is the strongest security protocol for 802.11 today? [275] 802.11i (WPA2). b) What does the Wi-Fi Alliance call 802.11i? [275] WPA2. c) What encryption method does 802.11i use? [275] AES-CCMP. d) What is deterring companies from converting from WPA to 802.11i? [275] The cost of reconfiguring all access points and wireless hosts to 802.11i

.

Page 125

Not for Distribution to Students

e) Why is WPA no longer viewed as a safe solution? [275] WPA was partially cracked in 2009.

6.

a) In what mode of 802.11i and WPA operation is a central authentication server used? [276] 802.1X mode. b) What does the Wi-Fi Alliance call 802.1X mode? [276] Enterprise mode. c) Why does 802.1X not need security between the authenticator and the computer in Ethernet?

[276] It is difficult to tap the UTP connection between the computer and the Ethernet workgroup switch network access server. d) Why does 802.1X need security between the authenticator and the computer in 802.11 wireless access? [276] It is easy for an attacker to intercept or otherwise interfere with communication between the access point and the wireless host.

This can allow it intercept enough information to compromise security. e) Why is extra EAP security necessary in 802.11 networks using 802.1X? [276] repeats previous part. f) What is the most popular standard for extended 802.1X security? [276] The Protected Extensible Authentication Protocol (PEAP)

7.

a) How does PSK mode differ from 802.1X mode? [277] The 802.1X mode uses a central authentication server. PSK mode uses the access point to manage keys on the basis of a pre-shared key that all devices can use. b) What is a potential weakness of PSK mode? [278] Creating a weak shared key by using a weak pass phrase. c) How long should pass phrases be with PSK? [278] At least twenty characters

8.

a) What is an evil twin access point? [278] An evil twin access point is a notebook computer configured to act like a real access point. It entices internal hosts to associate with it by operating at very high power. b) A company uses 802.11i for its core security protocol. How many 802.11i connections will the evil twin access point set up? [279] Two. c) What does the evil twin do when the client transmits to the legitimate access point? [279] It intercepts the transmission, decrypts it, reads it, reencrypts it, and sends it on. d) Distinguish between evil twin access points and rogue access points. [279] Evil twin access points are set up outside the firm by a drive-by hacker.

.

Page 126

Not for Distribution to Students

Rogue access points are unauthorized access points set up within the firm by individuals or departments. e) How can VPNs defeat evil twin attacks?

VPNs provide end-to-end protection between a client and a server using a pre-shared secret. Because this secret is never transmitted, the evil twin access point cannot intercept it and so decrypt communication. f) Why must the VPN secret be pre-shared to thwart a VPN attack? [279–280] If it was transmitted, it could be intercepted. If it is pre-shared, it does not need to be transmitted.

9.

a) What does WPS do? [281] It makes it easy to add new stations to a basic service set. b) For what 802.11i mode is it applicable? [281] Preshared key mode. c) Why is it desirable? [281] It reduces setup labor in preshared key mode access points. This is important because PSK mode is used in homes and small businesses, where networking expertise may be very limited. d) Why is it dangerous? [281] It has a security flaw that an attacker can exploit to associate with the access point as a legitimate user. e) What can be done to reduce the danger of the WPS security weakness? [281] Turning off WPS in the access point.

This may not even be possible.

10.

a) What damage is done by a denial-of-service attack? [281] Wireless devices will lose service. b) What are the two types of wireless denial-of-service attacks? [281] Getting a wireless client to disassociate from the access point, thus losing service Flooding the access point with traffic

11.

a) Describe the process by which access point locations are selected. [282] A radius is selected for access point ranges.

Circles with this radius are laid out over blueprints.

This planning must be done in three dimensions in multistory building.

The plans must be modified for thick walls and other obstacles. b) After access points are installed provisionally, what must be done next? [282] A site survey must be done to find spots with poor signal strengths.

Access point placement and power levels are adjusted until signal strengths are good.

.

Page 127

Not for Distribution to Students

Later, site surveys must continue to be done periodically so that changes can be made in response to changing conditions.

12.

a) Why is centralized access point management desirable? [282] It is desirable because it reduces the labor cost of managing the many access points in larger firms. b) What are the two technologies for remote access point management? [282] Smart access points that can be managed directly.

WLAN switches that manage dumb access points. c) What functions should remote access point management systems provide? [282] Notify the WLAN administrators of failures immediately.

Provide continuous transmission quality monitoring.

Provide indications of security problems.

Support remote access point adjustment.

Allow software updates to be pushed out to all access points or WLAN switches.

Work automatically whenever possible.

*13.

a) Using a spreadsheet program, compute the decibel value for a ratio of 17:1.

12.30448921 b) For 1/33.

-15.1851394 c) Estimate, without using Excel, the decibels for a ratio of 8/1.

9 (3x3) d) For 1/20.

1/10 = -10 ½ = -3 ~ -13 e) For 1/8.

-9 (2x2x2) = -3 + -3 + -3 f) For 16/1 12 = 3+3+3+3 g) Estimate, without using Excel, the decibels for a ratio of 80/1.

10 = 10 8=9 80 = 10 h) For 1:40.

.

/10

-10

/4

-6 Page 128

Not for Distribution to Students

Total

-16

i) For 1/800 /100

-20

/8

-9

/800

-29

j) For 16,000/1 1000

30

16

12

1600

42

k) Estimate, without using Excel, the dBm value for 2 mW. 2 mW 1 mW X2 3 dBm l) For a radio with 16 mW 16 mW 1 mW X16 12 dBm m) For a radio with 2 W. 2,000 mW 1 mW X2000 33 n) For a radio with 0.2 W. 200 mW 1 mW X200 23 *14.

.

a) Estimate the final dBm value for a radio if the radio has .1 Watt of power, if there is a 4:1 amplifier before transmission, and if there is attenuation to 1/8 the original signal strength between the sender and receiver.

Beginning

0.1 Watt

Base

0.001 Watts

Initial dBm

100

Amplifier

+6 dB

Attenuation

-9 dB Page 129

Not for Distribution to Students

Final dBm

97 dBm

b) Estimate the final dBm value for a radio if the radio has .4 Watt of power, if there is a 10:1 amplifier before transmission, and if there is attenuation to 1/1,000 the original signal strength between the sender and the receiver, and if the receiver’s antenna loses half of the signal strength before delivering the signal to the receiver.

*15.

Beginning

0.4 Watt

Base

0.001 Watts

Initial dBm

400

Amplifier

+10 dB

Attenuation

-30 dB

Final dBm

380 dBm

a) What power ratio does -30 dB represent?

1/1000 b) What power ratio does –21 dB represent?

-20 = 1/100 -1 = 1.26 .126 c) What absolute power does 78 dBm represent?

Ratio: 70,000,000 Base = 1/1000 Watt dBm = 70,000

16.

a) What is a PAN? (Do not just spell it out.) [290] A personal area network (PAN) is a small network that is meant to be used by a single person. b) What organization creates Bluetooth standards? [291] Bluetooth Special Interest Group (SIG) c) Compare the speeds, distances, and duty cycles of classic Bluetooth, high-speed Bluetooth, and low-energy Bluetooth. [291] Type

Speed

Distance

Duty cycle

Classic Bluetooth

3 Mbps

10 m

Low to high

High-Speed Bluetooth

24 Mbps

30 m

Low to high

Low-Energy Bluetooth

200 kbps

15 m

Very low

d) What do these characteristics mean for battery life? [291] Low-energy Bluetooth has a long battery life. e) What is the other benefit of low-energy Bluetooth? [291] Rapid setup time

.

Page 130

Not for Distribution to Students

f) Would two devices typically use high-speed Bluetooth during their total communication time?

Explain. [291] No, only for high-volume transactions.

17.

a) What does it mean that Bluetooth uses one-to-one operation? [292] One device talks to another, without an access point. b) Is this even true if a master communicates with four slaves? [292] Yes c) What does master–slave operation mean? [292] One device is in control. The other obeys command. d) When you connect a computer to a Bluetooth keyboard and mouse, which devices are masters and slaves?

The keyboard and mouse are slaves. e) At the beginning of a telephone call placed through a Bluetooth headset with the Hands-Free Profile, which device is initially the master? [293] When placing a call, the Bluetooth is the master and the mobile phone is the slave.

Afterward, the mobile phone my become the master. f) What is a piconet, and how many devices may it have? [293] A piconet is a network with a very small diameter.

8 (1 master and up to 7 slaves) g) Distinguish between peering and bonding. [294-295] Peering is done when two devices first communicate. There may be authentication and other formalities.

Once peering is finished, the two devices are bonded. They can begin communication again without going through peering. h) If two devices communicate frequently, do they peer each time? [295] No, only the first time. i) Name and describe the profile that two devices use to begin peering. [295] The Service Discovery Profile: each device will send a service discovery profile request, including information about itself and the profiles it offers.

18.

a) Why did the Bluetooth SIG have to develop Bluetooth profiles? [293–294] To define how specific services, such as a hands-free telephone headset, will work.

This creates interoperability among vendors. b) What profile would a Bluetooth-enabled notebook use to print to a nearby printer? [293] Basic printing profile. c) What profile would a tablet use with a Bluetooth keyboard? [293] Human interface device profile

.

Page 131

Not for Distribution to Students

d) What two profiles might a mobile phone use to communicate with a headset? [293] Hands-free profile Bluetooth headset profile e) Which is a better profile to use and why? Be specific. [293] The hands-free profile has more functionality, such as call waiting and voice dialing.

19.

a) What service band does Bluetooth use? [295] 2.4 GHz service band. b) Describe the type of spread spectrum transmission classic Bluetooth uses. [295] Frequency hopping spread spectrum: the frequency hops about every 1/1600 second to another frequency. So that only some frames are lost if there is a bad frequency. c) What other major local wireless technology uses this service band? [295] 802.11 d) What does Bluetooth do to minimize interference with other wireless technologies in this band? [295] Bluetooth avoids channels where 802.11 (or other services) is active.

20.

a) What is the distance limit for near field communication?

4 cm / 2 in b) What three factors give NFC low transmission power requirements? [297] Short distance.

Slow transfer speeds.

13.56 kHz band, which uses less power than transmission at higher frequencies. c) In what transmission band does NFC operate? [297] 13.56 kHz band d) At what speeds does NFC operate? [297] 106 kbps, 212 kbps, or 424 kbps e) Passive RFID chips have no batteries. How can they transmit when queried? [298] The signal querying the RFID chip provides power to send the response. <Some RFID tags do have batteries, but they are more expensive.> f) How can attackers eavesdrop on NFC transmissions? [298] By using extremely sensitive readers which can read transmissions over distances far larger than the standard supports.

21.

a) How does UWB achieve high data rates? [299] It uses ultra-wide bandwidth—cutting across many service bands. b) How does UWB avoid interfering with other transmissions within its channel bandwidth? ?

[299]

.

Page 132

Not for Distribution to Students

Its power per Hertz is very low compared to normal signals in its channel bandwidth. c) What is UWB’s major limitation? [299] Very short distances 22.

a) What threats do new wireless transmission technologies face? [299–300] Eavesdropping, data modification, impersonation, denial-of-service attacks. b) Describe the state of cryptographic security for new transmission standards. [299-300] Cryptographic protections usually are not provided or may be immature. c) Why is device theft or loss a serious danger? [299–300] Most users either use no lock passwords or use very simple ones. These devices are frequently lost.

END-OF-CHAPTER QUESTION Essay 1.

A friend is interested in installing a wireless LAN in her small business. She has about a dozen employees. She is concerned about security. Write a two-page letter to explain what security threats she is facing and how she can reduce these threats. Remember that you are writing for a friend, not for a teacher. Do not hand in disorganized notes. Double spacing is good.

Student answers will differ. Here are some things to look for.

There should be some discussion of threats. Yes, it is asked for explicitly, but many students ignore it. Drive-by hacking and evil twins are essential things to include under threats. Also, the types of attacks that drive-by attackers and evil twins can engage in (eavesdropping, making attacks on the network while bypassing the corporate firewall, searching for information on the client PC, installing malware, etc.).

There should be a discussion of core security protocols, including what they do, why 802.11i should be used, and whether to use PSK (which may be viable in a small business) or 802.1X mode.

Rogue access points are not likely, but it would not be technically wrong to include them.

There must be a discussion of evil twin access points, including what they are, the fact that they can defeat core security protocols, and the need to use a VPN with a preshared secret.

.

Page 133

Not for Distribution to Students

CHAPTER 8: TCP/IP INTERNETWORKING I TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Compare TCP and IP along the dimensions in Figure 8-2. [304] TCP is connection-oriented and reliable, whereas IP is connectionless and unreliable.

TCP operates at the transport layer, whereas IP operates at the internet layer. b) Compare TCP and UDP along the dimensions in Figure 8-2. [304] TCP is connection-oriented and reliable, whereas UDP is connectionless and unreliable.

Both operate at the transport layer.

2.

a) What is routing? [305] Routing is a process by which a router forwards an incoming packet out another port (interface) to get the packet closer to the destination.

(Later in the chapter, a second definition of routing is introduced—the protocols by which routers share routing table information. The equivocality is unfortunate, but it is established in use.> b) What are the three parts of an IP address? [305-306] The three parts of an IP address are the network part, the subnet part, and the host part. c) How long is each part? [305-306] Part lengths vary. d) What is the total length of an IP address? [305-306] The total length always is 32 bits. e) In the IP address, 10.11.13.13, what is the network part? [307] We cannot say because part lengths very. It is wrong to think that the answer is 10.11 simply because the network part was 16 bits long in the example used to illustrate the parts of an IP address.

3.

a) Connecting different networks is the main job of what type of router? [307] A border router’s main job is to connect different networks. b) What type of router only connects different subnets? [307] An internal router only connects only different subnets within a firm.

4.

a) How many bits are there in a mask? [308] There are 32 bits in a mask. b) What do the 1s in a network mask correspond to in IP addresses? [308]

.

Page 134

Not for Distribution to Students

The network part. c) What do the 1s in a subnet mask correspond to in IP addresses? [308] The network plus subnet parts. d) When a network mask is applied to any IP address on the network, what is the result? [308] Suppose there are N initial ones.

The first N bits of the IP address followed by 0s.

5.

a) A mask has eight 1s, followed by 0s. Express this mask in dotted decimal notation. [308] 255.0.0.0 b) Express this mask in prefix notation. [308] /8 c) In prefix notation, a mask is /16. Express this mask in dotted decimal notation. [308] 255.255.0.0 d) Express the mask /18 in dotted decimal notation. [308] 255.255.X.0 X is 11000000 X is 128 + 64 = 192 255.255.192.0

6.

Do routers know the difference between network and subnet masks? Who does have to know the difference, and why do they need to know it? [308] No, they do not. They simply apply the mask.

Host computers must know the difference so that they can create addresses.

7.

Why are routing tables more complex than Ethernet switching tables? Be articulate. [310] Routing tables are more complex than switching tables because routers are organized in meshes, which allow many possible alternative routes between end points. Routers must therefore deal with these multiple alternative paths when designing their routing tables.

Also, in an Ethernet switching table, there is only one matching row per Ethernet MAC address, so using a switching table is fast. In contrast, in a routing table, multiple rows will match most destination IP addresses. Every row will have to be searched to find a match and the best match will have to be selected. This is very time consuming and, therefore, expensive.

8.

a) In a routing table, what does a row represent? [313] In a routing table, a row represents a route for all IP addresses within a range of IP addresses—typically to a network or subnet. b) Do Ethernet switches have a row for each individual Ethernet address? [313] Yes

.

Page 135

Not for Distribution to Students

c) Do routers have a row for each individual IP address? [313] No. d) What is the advantage of the answer to the previous subpart of this question? [313] For a given number of addresses, routers need fewer rows and so fewer processing cycles than they would if they had a separate row for each IP address.

9.

a) In Row 3 of Figure 8-8, how will a router test if the row matches the IP address 60.168.6.7?

Show the calculations in the format given in the text. Is the row a match? [314–315] First, the router will apply the mask 255.255.255.0 to IP address 60.168.6.7. The result is 60.168.6.0.

Next, the router compares the masking result, 60.168.6.0, to the destination value in the row, 60.168.6.0. The two are identical. Therefore, the row is a match. b) Why is the last row called the default row? [314–315] The row is the default—the one that will be used if no other row provides a match. A default is something you get if you do not specify something else. c) Why must a router look at all rows in a routing table? [314-315] A router must look at all rows in a routing table because router networks have many alternative routes. Consequently, a router cannot stop the first time it finds a row match for each arriving packet because there may be a better match further on. d) What rows match 172.30.17.6? [314-315] Only the default row is a match. e) Which rows match 60.168.7.32? Show your calculations for rows that match. [314-315] Only the default row and row 12 are matches. For row 12, applying the mask 255.255.0.0 to 60.168.7.32 gives the result 60.168.0.0. This matches the row’s destination network or subnet value (60.168.0.0). f) Which rows in Figure 8-8 match 128.171.17.13? (Don’t forget the default row.) Show your calculations for rows that match. [314–315] Row 13 (the default row) is a match.

Row 1 is a match. Applying the mask 255.255.0.0 to 128.171.17.13 gives the result 128.171.0.0. This matches the row (128.171.0.0).

Row 7 is a match. Applying the mask 255.255.255.0 to 128.171.17.13 gives the result 128.171.17.0. This matches the row (128.171.17.0).

10.

a) Distinguish between Step 1 and Step 2 in the routing process. [315–316] In Step 1, the router finds all row matches. In Step 2, the router selects the best-match row. b) If any row other than the default row matches an IP address, why will the router never choose the default row? [315–316]

.

Page 136

Not for Distribution to Students

The default router has a match length of 0 bits. Any other matching row would have a longer length of match and so would be selected rather than the default row. c) Which rows in Figure 8-8 match 128.171.17.13? (Don’t forget the default row.) Show your calculations. [315-316] The default row matches, as do rows 1 and 7. d) Which of these is the best-match row? Justify your answer. [315-316] Row 7 is the best-match row because it is the longest match (24 bits instead of 16 bits). e) What rows match 172.40.17.6? Show your work. [315-316] Only the default row is a match. f) Which of these is the best-match row? Justify your answer. [315-316] The default row is the best-match row because there are no other matches. g) Which rows match 172.30.12.47? Show your work. [315-316] Rows 10, 11, and 13. h) Which of these is the best-match row? Justify your answer. [315–316] Rows 10 and 11 are tied by longest length of match (24 bits).

The metric value must be used to break the tie.

The metric is cost, and Row 11 has the lowest cost (3 instead of 9).

So Row 11 is the best match. i) How would your previous answer change if the metric had been reliability? [315–316] Higher reliability is better than lower reliability, so Row 10 would be selected as the best-match row instead of 12 (9 instead of 3).

11.

a) Distinguish between Step 2 and Step 3 in routing. [316–317] In Step 2, the router selects the best-match row. In Step 3, the router sends the packet back out. b) What are router ports called? [316-317] Router ports are called interfaces. c) If the router selects Row 13 as the best-match row, what interface will the router send the interface out? [316-317] Interface 3. d) To what device? [316-317] Next-hop router H. e) Why is this router called the default router? (The answer is not in the text.) [316–317] Because if no other rule matches the IP address, the packet will be sent to this router. f) If the router selects Row 2 as the best-match row for packet 172.30.33.6, what interface will the router send the interface out? [316–317]

.

Page 137

Not for Distribution to Students

Interface 1 g) To what device? (Don’t say, “the local device.”) [316–317] The destination host (172.30.33.6) 12.

a) What should a router do if it receives several packets going to the same destination IP address? [317] If a router receives several packets going to the same destination IP address, it should go through the entire routing process again. b) How would decision caching speed the routing decision for packets after the first one? [317] Decision caching would speed the routing decision for packets after the first one by allowing the router to cache (remember) the decision it made for a particular destination IP address. It will then use this decision for successive IP packets going to the same destination. c) Why is decision caching dangerous? [317] Decision caching is dangerous because the Internet changes constantly, and, as routers come and go, links between routers change frequently. Consequently, a cached decision that is used too long will result in non-optimal routing or even routes that will not work and that will effectively send packets into a black hole.

*13.

An arriving packet has the destination IP address 128.171.180.13. Row 86 has the destination value 128.171.160.0. The mask is 255.255.224.0. Does this row match the destination IP address?

Show your work. You can use the Windows Calculator if you have a Windows PC. In Windows Vista and earlier versions of Windows, choose scientific when you open the calculator. In the Windows 7 calculator, choose programmer mode. [318]

Segment

1

2

3

4

IP Address

128

171

180

13

Mask

255

255

224

0

Result

128

171

160

0

Destination

128

171

160

0

The result does match the destination column value, so the row is a match. *14.

A router wishes to send an IP packet to a host on its subnet. It knows the host’s IP address. a) What else must it know? [318-320] It must know the destination host’s data link layer address. b) Why must it know it? [318–320] It must know the data link layer address so that it can place the packet to be delivered in a frame that it can send to the destination host.

.

Page 138

Not for Distribution to Students

c) What message will it broadcast? [318-320] It will broadcast an ARP request message. d) What device will respond to this broadcast message? [318-320] The destination host will respond. e) Does a router have to go through the ARP process each time it needs to send a packet to a destination host or to a next-hop router? Explain. [320] No, it places the IP address and destination data link layer address pair in an ARP cache. f) Is ARP used to find the destination data link layer destination addresses of destination hosts, routers, or both? [320] Both. g) At what layer does the ARP protocol operate? [318-320] The internet layer. h) Why must client PCs use ARP to transmit packets? The answer is not in the text. [318–320] Because they need to locate the data link layer address of a router to which to send the packet.

15.

a) What is the main version of the Internet Protocol in use today? [320] The main version of Internet Protocol in use today is the IP version 4 (IPv4). b) What does a router do if it receives a packet with a TTL value of 1? [321] If a router decrements a time to live (TTL) value to 0, it will discard the packet, although it may send back an ICMP error advisement message to the source host. c) What does the protocol field value tell the destination host? [321] The protocol value tells the destination host the content of the IP packet’s data field. If the protocol field value is 1, the IP packet carries an ICMP message in its data field. TCP and UDP have protocol values 6 and 17, respectively. d) Under what circumstances would the identification, flags, and fragment offset fields be used in IP? [321] The identification, flags, and fragment offset fields would be used if a router wished to forward a packet to a particular network and the network’s maximum packet size was too small for the packet. The router would then fragment the packet, using the identification, fragment offset, and more fragments bit to tell the receiving host how to defragment the packet. e) Why is IP fragmentation suspicious? [321] Fragmentation is suspicious because it is often used by attackers. f) How can a source host avoid fragmentation? [321] By setting the do not fragment flag in the IP header. g) Why are IP options suspicious? [322]

.

Page 139

Not for Distribution to Students

Options are suspicious because they are often used by attackers. h) What security standard uses IPv4 options? [322] IPsec. i) What is the purpose of the Diff-Serv field? [322] Its purpose is to label IP packets for priority and other service parameters.

16.

a) What is the main problem with IPv4 that IPv6 addresses? [322] We have essentially run out of IPv4 addresses.

IPv6 will give us an almost inexhaustible supply of IPv6 addresses. b) What factors combined to cause the exhaustion of IPv4 addresses? [322] IPv4 addresses were given out in blocks, many of the addresses never being used.

The explosion in Internet users, especially those with mobile devices.

17.

a) What is the designation of the newest version of the Internet Protocol? [323] IP version 6 (IPv6) b) What is its biggest improvement over IPv4? [323] More available addresses by extending the IP address from 32 bits to 128 bits. c) Is the conversion from IPv4 to IPv6 relatively inexpensive? [323] Yes

18.

a) Are IPv6 addresses written in uppercase or lowercase letters? [324] Lowercase b) Are IPv6 addresses written in decimal or hexadecimal symbols? [324] Hexadecimal c) How many symbols are there in a field, and how are fields delimited? [324] Four hex symbols (16 address bits) They are separated by colons.

19.

a) List the rules for simplifying IPv6 addresses. [324] Change the binary representation to hexadecimal.

Write hex symbols in lowercase.

Organize the hex symbols of groups of four and separate the groups with colons.

Delete initial zeros in each group.

If several groups of four zeros in a row are deleted, replace multiple groups by a single ::.

If there are multiple groups like this, select the longest.

If there are multiple groups like this that have the same length, select the fist. b) Simplify the following IP address: 2001:0ed2:056b:00d3.000c:abcd:0bcd:0fe. [324] 2001:ed2:56b:d3::bed:fe

.

Page 140

Not for Distribution to Students

c) Simplify the following IP address: 2001:0002:0000:0000:0000:abcd:0bcd:0fe. [324] 2001:2::abcd:bcd:fe. d) Simplify the following IP address: 2001:0000:0000:00fe:0000:0000:0000:cdef. [324] 2001:::00fe::cdef e) What is the advantage of simplifying IPv6 addresses according to strict rules? [324] String searchers can find the addresses in documentation and other text files.

20.

a) How do the version number fields in IPv4 and IPv6 differ? [325] IPv4: 0100 (4) IPv6: 0110 (6) b) In IPv6, how can the receiver tell the length of packet? [327] The length of the header (40 octets) plus the number of octets indicated in the payload length field. c) Does the payload length field include the lengths of any all extension headers in the packet?

[327] Yes. All of them. d) What is the maximum possible lengths for ordinary IPv6 payloads? [327] 65,536 octets e) What are jumbo packets, and why are they desirable? [327] They are larger than 65,536 octets. f) What is the maximum MTU size? [327] The largest packet that can be sent along the entire route without fragmentation. g) How is it determined in IPv6? [327] Through an MTU discovery protocol,the most recent is RFC 4821. h) If a source host does not do MTU discovery, what is the longest packet it can safely send?

[327] 1,280 octets

21.

a) Compare fragmentation in IPv4 and IPv6. [327] IPv6 does not do fragmentation at all.

IPv4, of course, rarely does fragmentation. b) How is the hop limit field used? [327] It specifies the maximum number of hops an IPv6 packet may take before it is dropped.

It operates like the time to live field in IPv4. c) Does IPv6 have a header checksum field? [328] No d) What are the implications of this? [328]

.

Page 141

Not for Distribution to Students

A packet with a garbled IP header might cause problems among routers during its forwarding.

However, this danger is extremely slight and not worth the heavy cost of doing error detection on each packet. e) What is the general purpose of the traffic class field? [325-326] To address quality-of-service parameters for this packet. f) Of the flow label field? [325–326] To designate that the packet is part of a particular flow, whose packets should be handled according to the same rules.

22.

a) Why is handling options the way that IPv4 does undesirable? [328] Routers must check each packet for options. This is time consuming and so expensive. b) Why is the approach of using optional extension headers desirable? [328] It makes the handling of extension headers very straightforward and therefore fast. c) Distinguish between protections provided by the authentication header and the encapsulating security payload. [328] Authentication only gives assurance about the identity of the sender.

The encapsulating security protocol gives confidentiality and authentication. d) Are these two security extension headers available in IPv6, IPv4, or both? [328] Both. e) What does it mean that the Routing Header Type 0 has been deprecated? [330] That it is not to be used. f) What is usually the only extension header that routers normally have to consider? [330] Hop-by-hop options (0) g) What is another they might have to consider? [330] Encapsulating security protocol (51) h) How does the last extension header before a UDP datagram indicate that the UDP datagram comes next? (You must infer the answer from the text.) [329] It has the next-header field value 17 i) If you see 51 in the next header field of a header, what will follow this header? [329] Encapsulating security protocol. j) If you see 59 in the next header field of a header, what will follow this header? [329] No next header

23.

a) Why is TCP complex? [330] IP could not assume much in terms of underlying data link functionality, so IP was made very simple. TCP had to add all of the functionality left out of IP.

.

Page 142

Not for Distribution to Students

(Not in the text: Initially, there was only going to be a single standard, TCP, which would have the functionality we now associate with IP and TCP combined. It was decided to split the functionality in order to get flexibility.> b) Why is it important for networking professionals to understand TCP? [330] They will have to deal with it a lot. c) What are TCP messages called? [330] TCP segments 24.

a) Why are sequence numbers good? [330–332] They allow the destination host to place TCP segments in the right order. b) What are 1-bit fields called? [330-332] Flag fields. c) If someone says that a flag field is set, what does this mean? [332] Its value is 1. d) If the ACK bit is set, what other field must have a value? [332] The acknowledgement number field. e) What is a FIN segment? [332] A segment that announces a close. The FIN bit is set. f) Distinguish between four-way closes and abrupt resets. [332] In four way closes: The closing initiator sends a FIN segment.

The other side immediately sends back an ACK. Later, the other side may send data, which the initiator will acknowledge.

At some point, the other side sends a FIN segment.

The initiator sends an ACK segment.

The connection is closed.

In abrupt closes: One side sends an RST segment—one with the RST bit set. It then closes the connection from its end.

The other side closes the connection. No ACK is sent. g) Why is a reset segment not acknowledged? [332] The side that initiated the reset has already closed the connection and is not listening.

The other side realizes that there is no point in sending more information.

(Humans should be more like this.)

25.

a) Why can TCP handle extremely long application messages? [333] TCP can fragment long application messages, send the segments in multiple packets, and reassemble the segments at the destination host.

.

Page 143

Not for Distribution to Students

b) Can UDP handle extremely long application messages? [333] No, because it does not do fragmentation. c) What is the maximum application message size if UDP is used at the transport layer. [333] 65,536 26.

a) What is the purpose of dynamic routing protocols? [334] The purpose of dynamic routing protocols is to allow routers to transmit routing tables to one another. b) In what two ways does TCP/IP use the term routing? [334] TCP/IP uses the term routing to mean the process of forwarding arriving packets and the process of exchanging information for building routing tables. c) What is an autonomous system? [335] An autonomous system is an internal internet controlled by an organization. d) Within an autonomous system, can the organization choose its interior dynamic routing protocol? [335] Yes. e) What are the two TCP/IP interior dynamic routing protocols? [335] RIP and OSPF. f) Which IETF dynamic routing protocol is good for small internets that do not have high security requirements? [335] RIP g) Which IETF dynamic routing protocol is good for large internal internets that have high security requirements? [335] OSPF. h) What is the main benefit of EIGRP compared to OSPF as an internal dynamic routing protocol?

[335] EIGRP is not limited to IP routing. It can also route IPX/SPX and other protocols. i) When might you use EIGRP as your interior dynamic routing protocol? [336] If you have all Cisco routers and have some non-TCP/IP packets to handle. j) May a company select the routing protocol its border router uses to communicate with the outside world? [336] No, it is determined by the other autonomous systems the firm will connect to. k) What is the almost universal exterior dynamic routing protocol? [336] EIGRP

27.

.

a) For what general class of messages is ICMP used? [336]

Page 144

Not for Distribution to Students

The Internet Control Message Protocol (ICMP) is used for supervisory messages at the internet layer. b) Explain error advisement in ICMP. [337] ICMP has error advisement rather than error correction. If a router or the destination host finds an error, it discards the packet. Although there is no retransmission, the router or host that finds the error usually sends an ICMP error message to the source device to inform it that an error has occurred. It is then up to the source device to decide what to do. c) Explain the purpose of ICMP echo messages. [337] The purpose of ICMP echo messages is to see if a target host can be reached, which is a good diagnostic tool. d) Sending an ICMP echo message is called __________ the target host. [337] pinging

END-OF-CHAPTER QUESTIONS Thought Questions 1.

How do the postal services use hierarchical sorting? How does this simplify delivery decisions?

[No page number] When letters come into a post office, they are sorted by zip codes at a high level.

Bags to a particular region are sent directly to that region.

There is no need to do other things to determine how to send letters on to their destination.

2.

Give a non-network example of hierarchical addressing, and discuss how it reduces the amount of work needed in physical delivery. Do not use any example in the book, the postal service, or the telephone network. [No page number] Student answers will vary.

Aggregation is the key and bulk processing afterward is critical.

3.

A client PC has two simultaneous connections to the same webserver application program on a webserver. (Yes, this is possible, and in fact, it is rather common.) What will be different between the TCP segments that the client sends on the two connections? Moved earlier.

4.

A router that has the routing table in Figure 8-8 receives an incoming IPv4 packet. The source IP address is 10.55.72.234. The destination host is 10.4.6.7. The TTL value is 1. The Protocol field value is 6. What will the router do with this packet? [No page number] The TTL field is reduced to 0, and the router discards the packet.

Nothing else is done.

.

Page 145

Not for Distribution to Students

Harder Thought Questions 1.

For security reasons, many organizations do not allow error reply messages to leave their internal internets. How, specifically, could hackers use information in echo reply messages to learn about the firm’s internal hosts? (Hint: Notice that ICMP messages are carried in the data fields of IP packets.) [No page number] The echo reply message is carried in the packet sent by the target host.

The packet plus the reply message tells the sender that a host at that particular IP address is active.

This information is useful to the attacker, as discussed in Chapter 3.

Troubleshooting 1.

You suspect that the failure of a router or of a transmission line connecting routers has left some of your important servers unavailable to clients at your site. How could you narrow down the location of the problem using what you learned in this chapter? [No page number] Ping all devices and see which do not respond.

Note the locations of non-responsive devices.

The pattern will probably pinpoint the source of the difficulty.

.

Page 146

Not for Distribution to Students

CHAPTER 9: TCP/IP INTERNETWORKING II TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Why is IP subnet planning important? [341] IP subnet planning is important because the larger the subnet part is, the more subnets there will be. However, the larger the subnet part is made, the smaller the host part must be. This will mean fewer hosts per subnet. b) If you have a subnet part of 9 bits, how many subnets can you have? [342] If you have a subnet part of 9 bits, you can have 29-2 subnets. This is 512-2 or 510 subnets. c) Your firm has an 8-bit network part. If you need at least 250 subnets, what must your subnet size be? [342] With 8 bits, you can have 254 subnets. This will be sufficient but will leave no room for growth. d) How many hosts can you have per subnet? [342] With 8 bits for the network part and 8 bits for the subnet part, you have 16 bits for the host part. This allows 65,536 - 2 or 65,534 hosts per subnet. e) Your firm has a 20-bit network part. What subnet part would you select to give at least 10 subnets? [342] With 4 bits, you can have 14 subnets. Three bits would give only 6 subnets. So you need 4-bit subnet parts. f) How many hosts can you have per subnet? [342] With a 20-bit network part and a 4-bit subnet part, you have 8 bits left for the host part.

This allows 254 possible hosts per subnet.

2.

a) What is NAT? (Do not just spell it out.) [343] Network address translation (NAT) is the process of presenting external IP addresses that are different from internal IP addresses used within the firm. b) Describe NAT operation. [343] In NAT operation, an internal client host sends a packet to an external server host.

When the NAT firewall at the border receives the packet, it makes up a new row in its translation table. It places the internal IP address and port number in the table. It then generates a new external source IP address and external source port number. c) What are the two benefits of NAT? [343] Transparency and security. d) How does NAT enhance security? [343]

.

Page 147

Not for Distribution to Students

NAT enhances security by keeping sniffers from learning information about IP addresses and port numbers within a firm. With NAT, an eavesdropper learns only false (external) IP addresses and port numbers. e) How does NAT allow a firm to deal with a shortage of IP addresses given to it by its ISP? [345] NAT helps firms deal with this shortage by doing port address translation. With Microsoft Windows, there are almost 4,000 ephemeral port numbers. A firm can multiply its own limited number of IP addresses by 4,000. f) How are private IP address ranges used? [345] Private IP address ranges are only used within a firm. g) What are the three ranges of private IP addresses? [345] The three ranges of private IP addresses are 10.x.x.x, 192.168.x.x, and 172.16.x.x through 172.31.x.x. h) What problems may firms encounter when using NAT? [345] Some protocols present a problem because they cannot work across a NAT firewall or can work only with considerable difficulty.

3.

a) Is the Domain Name System only used to send back IP addresses for given host names?

Explain. [346] No, it is also a general naming system for the Internet. b) What is a domain? [346] A domain is any group of resources (routers, single networks, and hosts) under the control of an organization. c) Distinguish between the DNS root and first top-level domains. [347] The root has all domains.

Top-level domains are specialized, such as .com and .ie. d) What are the two types of top-level domains? [347] Generic top-level domains.

Country top-level domains. e) Which level of domain name do corporations most wish to have? [37] Second-level domain names. f) What are DNS root servers? [346] Root servers are the highest-level DNS servers. g) How many DNS root servers are there? [346] 13. h) How does a company or individual obtain a second-level domain name? [348] From an domain registrar. i) Why is getting a second-level domain name only the beginning? [348]

.

Page 148

Not for Distribution to Students

The firm must also get a DNS server to host the name.

It also needs a webserver if it wants to offer Web service through that name.

It needs an ISP to connect to the server.

4.

a) What hosts are given static IP addresses? [348] Servers b) Why do these hosts need static IP addresses? [348] So that client users can find them easily. c) What are dynamic IP addresses? [348] Dynamic IP addresses are non-permanent addresses. d) How do clients get dynamic IP addresses? [348] Clients get dynamic IP addresses from DHCP servers. When a client wakes up, it broadcasts a DHCP message to all nearby hosts, and only the DHCP servers respond.

The user sends an acceptance message to the DHCP server it selects, and the server responds with the configuration information. e) Can the client send a DHCP request information to multiple DHCP servers? [348] Yes. f) Do DHCP servers update the configuration information they store automatically? [349] No g) What are DHCP scopes? [349] DHCP scopes are configurable parameters that determine which subnets the DHCP server will serve.

5.

a) List the main elements in a network management system. [349] The main elements in a network management system are the network management program (the manager), managed devices, network management agents (agents), objects on the managed device, and the management information base (MIB). b) Does the manager communicate directly with the managed device? Explain. [349] No, the manager does not communicate directly with the managed device; rather, the manager communicates with the device’s agent. c) Explain the difference between managed devices and objects. [351] A managed device is simply a device that needs to be administered. Objects are properties of the managed device. d) Is the MIB a schema or the actual database? (This is a trick question.) [351] The management information base (MIB) can be either the schema or the actual database. e) Why must user interface functionality for the SNMP manager be considered carefully in selecting SNMP manager products? [353]

.

Page 149

Not for Distribution to Students

This functionality is not defined by the SNMP standard and varies widely among vendors. It is this functionality that makes SNMP useful, so vendor selection must consider this functionality to maximize the usefulness of the SNMP agent.

6.

List one object in each of the following areas: the system, IP, TCP, UDP, ICMP, and an interface.

[352] System Objects System name System description System contact person System uptime (since last reboot) IP Objects Forwarding (for routers) Subnet mask Default time to live Traffic statistics Number of discards because of resource limitations Number of discards because could not find route Number of rows in routing table Rows discarded because of lack of space Individual row data TCP Objects Maximum/minimum retransmission time Maximum number of TCP connections allowed Open/failed connections/resets Segments sent Segments retransmitted Errors in incoming segments No open port errors Data on individual connections (sockets, states) UDP Objects Error: no application on required port Traffic statistics ICMP Objects Number of errors of various types Interface Objects Type Status: up/down/testing Speed MTU (maximum transmission unit—the maximum packet size)

.

Page 150

Not for Distribution to Students

Traffic statistics: octets, unicast/broadcast/multicast packets Errors: discards, unknown protocols, and so on 7.

a) In SNMP, which device creates commands? [353] In SNMP, the manager creates commands. b) Responses? [353] The agent creates responses. c) Traps? [353] The agent creates traps. d) Explain the two types of commands. [351] Get commands tell the agent to retrieve certain information and return this information to the manager.

Set commands tell the agent to change a parameter on the managed device. e) What is a trap? [351] A trap is a message sent by an agent to let the manager know about a condition the agent has detected. f) Why are firms often reluctant to use Set commands? [353] Firms are often reluctant to use Set commands because of security dangers. If setting is permitted and attackers learn how to send Set commands to managed devices, the results could be catastrophic. g) Describe SNMPv1’s poor authentication method. [353] SNMPv1 had almost no authentication at all. The manager and all managed devices merely had to be configured with the same community name. With hundreds or thousands of devices sharing the same community name, attackers could easily learn the community name and use it to attack the managed devices. h) Describe SNMPv3’s good authentication method. [353] SNMPv3 has added passwords for each manager–agent pair, and these passwords are encrypted during transmission. In addition, each message is authenticated by the shared password.

8.

a) In MPLS, is selecting the best interface for each packet done when the packet enters the network or before? [354] Before the packet arrives; in fact, before any data packet arrives. b) What is the name of the path selected for a particular conversation? [354] Label-switched path. c) When a source host first transmits to a destination host, what will happen? [354] MPLS will determine the best path for packets going between the two hosts. d) Do label-switching routers along the MPLS path look at the packet’s IP address? Explain your reasoning. [355]

.

Page 151

Not for Distribution to Students

No. They look at its label number. e) Why is MPLS decision making fast compared to traditional routing? [355] Selecting the best route is done ahead of time, so that label switching takes little time. It is just a simple table lookup. f) On what does each label-switched router base routing decisions? [355] It will base decisions on the label number. g) Why is MPLS transparent to the source and destination hosts? [355] Neither knows that label switching is happening. The label is added after the source host sends the packet and removed before the destination host receives the packet. h) What is MPLS’s main attraction? [355] It reduces cost. i) What are its other attractions?

It can provide traffic engineering benefits such as load balancing. [355] j) What is traffic engineering? [355] Deciding how traffic will flow over a network. k) Can MPLS provide traffic load balancing? [355] Yes. l) Is it possible to implement MPLS on the entire Internet? [355] It requires tight agreement between ISPs, and there are many ISPs on the Internet.

9.

a) At what layer does IPsec operate? [357] The internet layer. (Note the “IP” in the name!) b) What layers does IPsec protect? [357] The internet layer and higher layers. c) Does IPsec protect these layers transparently? [357] Yes. d) Describe IPsec tunnel mode. [357-358] IPsec tunnel mode provides protection only between the two IPsec gateways. e) What is the main advantage of tunnel mode? [357-358] It is less expensive than transport mode because digital certificates and setup are not needed on individual hosts. f) What is the main disadvantage of tunnel mode? [357–358] It provides protection only between the IPsec gateway servers. g) Describe IPsec transport mode. [357-358] It provides host-to-host security.

.

Page 152

Not for Distribution to Students

h) What is the main advantage of transport mode? [357-358] It provides security over the internal networks. i) What is the main disadvantage of transport mode? [357-358] It is expensive because of setup on all of the hosts. j) In which IPsec mode are clients and servers required to have digital certificates? [357–358] IPsec transport mode k) Which IPsec mode does not require clients and servers to have digital certificates? [357-358] IPsec tunnel mode. l) Is IPsec used for remote-access VPNs, site-to-site VPNs, or both? [358] Both 10.

a) In IPsec, what are security associations (SAs)? [358] An agreement on what security options each side will use in IPsec. b) Must security associations be the same in the two directions? [358] No, they can be asymmetrical. c) Describe how IPsec gateways can be managed centrally to ensure that weak SAs are not permitted. [359] IPsec policy servers push lists of allowable security associations to devices that implement IPsec.

11.

a) For what application was SSL/TLS created? [360] Web service

b) Why is it attractive? [360] All browsers can work with it, without configuration.

This means that it is free to implement on the client side. c) Distinguish between SSL and TLS. [360] Netscape created early versions of the standard as Secure Sockets Layer security.

The IETF took over and created later versions under the name Transport Layer Security. d) What are its four limitations? [361] 12.

a) What does it mean for a host to have a dual stack for IP? [361–362] It means it can communicate via both IPv4 and IPv6. b) Why is it desirable to have a dual stack? [361-362] A client can communicate with any server host. c) Why is having only an IPv6 stack problematic? [361–362] A client can communicate only with IPv6 hosts directly.

.

Page 153

Not for Distribution to Students

13.

a) What field in an IPv6 global unicast address corresponds to the network part of a public IPv4 unicast address? [362] The routing prefix. b) What field in an IPv6 global unicast address corresponds to the subnet part of a public IPv4 unicast address? [362] The subnet ID. c) If the subnet ID is 16 bits long (as it often is), how long is the routing prefix? [364] 64 – 16 = 48 d) If you are a large company, do you want a large routing prefix or a small routing prefix? [364] A small routing prefix; this gives you a large subnet ID and therefore many possible subnets.

14.

a) What field in a global unicast IP address corresponds to the host part of a public unicast IPv4 address? [364] Interface ID. b) How long is this field? [364] 64 bits. c) What are these addresses called by the IEEE? [364] Extended Unique Identifiers (EUIs) d) Convert the following MAC address to an EUI-64 address: AA-00-00-FF-FF-00. [364–365] AA-00-00-FF-FF-00 aa-00-00

ff-fe-00

aa-00-00-fffe-ff-fe-00 aa00:00ff:feff:ff00 aa: 10101010 Invert: 10101000 = a8 a800:00ff:feff:ff00 e) Repeat for this MAC address: 9B-E5-33-21-FF-0D. [364–365] 9B-E5-33-21-FF-0D 9B-E5-33

21-FF-0D

9b-e5-33 fffe 21-ff-0d 9be5:33ff:fe21:ff0d 9b = 10011011 Invert 10011001 99e5:33ff:fe21:ff0d 15.

a) Can a client computer use DHCP to get IPv6 configuration information? Explain. [365] Yes

.

Page 154

Not for Distribution to Students

b) What other option is available for IPv6 client configuration? [365] Stateless autoconfiguration c) What are the two phases in IPv6 stateless autoconfiguration? [367] The first is to create a link-local IPv6 address.

The second is to create a global unicast IPv6 address. d) What is a link-local IP address? [367] An address that can only be used in a link (a single network) e) For a link-local address, what are the contents of the routing prefix, subnet ID, and interface ID? [367] Routing prefix and subnet ID: The first 10 bits are 1111 1110 10. The next 54 are 0s.

Interface ID: Extended Unique Identifier. f) Why must a client use the neighbor discovery protocol after creating a link-local IPv6 address?

[367] To ensure that no other client in the link has the same EUI g) For a global IP address, what are the contents of the routing prefix, subnet ID, and interface ID? [368] The router advertisement gives the client the routing prefix and subnet ID for the client’s subnet For the host ID, the client uses the EUI it created. h) In what ICMPv6 message are the routing prefix and subnet ID delivered? [368] Router advertisement message. i) May the router advertisement message forbid the use of stateless autoconfiguration for creating a global IPv6 address? [368] Yes 16.

a) At a minimum, what configuration information does a router advertisement message give a client? [368] b) Why is this sufficient for dual-stack clients? [368] The IPv4 stack can use DHCP to obtain configuration information. c) For single-stack IPv6 clients, what additional piece of configuration information is almost certainly needed? [368] The IP addresses of DNS hosts. d) How may this information be obtained? [368] As an option in an ICMP router advertisement message. e) Is the mechanism for giving the IPv6 addresses of DNS servers mandatory or optional? [368] Optional, unfortunately f) What are the known security weaknesses of IPv6? [369]

.

Page 155

Not for Distribution to Students

For instance, a host may decide not to create an EUI-64 based on its link-layer address, in order to be anonymous. It may even use an EUI-64 that would allow it to impersonate another client. In addition, several of the interactions in stateless autoconfiguration are susceptible to flooding denial-of-service attacks. Stateless autoconfiguration will have to mature to address these security issues. g) Can stateless autoconfiguration be used to change all routing prefixes and subnet IDs in a firm? [368–369] Yes 17.

a) Does ICMPv6 contain new ICMP message types? [369] Yes b) In the Domain Name System, distinguish between the information contained in the A and AAAA records for a host name. [369] The A record has the 32-bit IPv4 address for the host name.

The AAAA record has the 128-bit IPv6 address for the host name. c) What standard replaces the Address Resolution Protocol in IPv6? [369] Neighbor discovery protocol. d) What are the two types of messages in the neighbor discovery protocol? [370] Neighbor solicitation message Neighbor advertisement message e) What does each contain? [370] Neighbor solicitation message: Requests data link address for a particular IP address.

Neighbor advertisement message: The data link address.

18.

a) I type in the host name of an IPv6 host. What does my computer do?

Contacts a DNS server and requests the AAAA record. b) I know the IPv6 address of a particular host. How can I find its data link layer address so that I can send it frames?

Transmit a neighbor discovery message to all hosts on its link (single network).

END-OF-CHAPTER QUESTIONS Thought Questions 1.

Both DNS servers and DHCP servers send your client PC an IP address. Distinguish between these two addresses.

DHCP servers give a client the IP address for the client to use as its own.

DNS servers give a client the IP address of a host that the client wishes to send packets to.

2.

.

Assume that an average SNMP response message is 100 bytes long. Assume that a manager sends 40 SNMP Get commands each second.

Page 156

Not for Distribution to Students

a) What percentage of a 100 Mbps LAN link’s capacity would the resulting response traffic represent?

Capacity is 100 Mbps.

SNMP traffic = 100 bytes per message times 40 SNMP messages per second = 4,000 bytes per second. This is 32,000 bps.

0.032 percent b) What percentage of a 128 kbps WAN link would the response messages represent?

32,000 bps divided by 128,000 bps = .25 (25 percent) c) What can you conclude from your answers to these questions?

You must limit SNMP scanning on WAN links. This will restrict the information you have.

3.

A firm is assigned the network part 128.171. It selects an 8-bit subnet part. a) Draw the bits for the four octets of the IP address of the first host on the first subnet. (Hint: Use Windows Calculator.)

10000000 10101011 00000001 00000001 b) Convert this answer into dotted decimal notation.

128.171.1.1 c) Draw the bits for the second host on the third subnet. (In binary, 2 is 10, while 3 is 11.)

10000000 10101011 00000011 00000010 d) Convert this into dotted decimal notation.

128.171.3.2 e) Draw the bits for the last host on the third subnet.

10000000 10101011 00000011 11111110 f) Convert this answer into dotted decimal notation.

128.171.3.254

4.

A firm is assigned the network part 128.171. It selects a 10-bit subnet part. a) Draw the bits for the four octets of the IP address of the first host on the first subnet. (Hint: Use Windows Calculator.)

The network part is 16 bits long. So the first 16 bits are 128.171: 10000000 10101011 The subnet and host parts are 10 bits long and 6 bits long, respectively.

So the first host on the first subnet is: 10000000 10101011 00000000 01000001 b) Convert this answer into dotted decimal notation.

128.171.0.65 c) Draw the bits for the second host on the third subnet. (In binary, 2 is 10, whereas 3 is 11.)

10000000 10101011 00000000 11000010

.

Page 157

Not for Distribution to Students

d) Convert this into dotted decimal notation.

128.171.0.194 e) Draw the bits for the last host on the third subnet.

10000000 10101011 11111111 10111110 f) Convert this answer into dotted decimal notation.

128.171.255.190

Troubleshooting Question 1.

In your browser, you enter the URL of a website you use daily. After some delay, you receive a DNS error message that the host does not exist. a) What may have happened? Explain your reasoning. Again, do NOT just come up with one or two possible explanations.

You mistyped the URL. Your local DNS server may be down.

The target host may have crashed.

A remote DNS server that your local DNS server needs to find the IP address of the target host may be down.

The host may have relinquished its host name to change its name, because its firm went out of business, and so on. b) How would you logically disconfirm or test each possibility?

Most likely, you mistyped the URL. This is the first thing to check.

NOT: Your local DNS server may be down. If your local DNS server was down, you couldn’t get an error message for it!

NOT: The host may have crashed. This would not affect the DNS system.

A remote DNS server that your local DNS server needs to find the IP address of the target host may be down. This is very hard to test but is the most likely problem.

The host may have relinquished its host name to change its name, because its firm went out of business, and so on. But if you use it daily, this is unlikely.

.

Page 158

Not for Distribution to Students

CHAPTER 10: WIDE AREA NETWORKS TEST YOUR UNDERSTANDING QUESTIONS 1.

a) Distinguish between LANs and WANs. [373] A local area network exists within a company’s site whereas a wide area network connects different sites within an organization or between them. b) What are rights of way? [374] Permissions to lay wires through public areas. c) What are carriers? [374] Carriers are companies given rights of way by the government to lay wires in public areas and offer services to customers. d) Why do you have more flexibility with LAN service than with WAN service? Why? [374] LANs are on your premises, so you can use whatever technology you wish.

If you use a carrier, you can only have what they offer.

2.

a) Why are typical WAN speeds slower than typical LAN speeds? Give a clear and complete argument. [375] WANs cost more per bit to transmit than LANs because they must carry the signal farther.

As unit price goes up, unit demand usually goes down.

Therefore companies learn to live with lower WAN speeds. b) Why are future WAN prices difficult to predict? [375] Carriers change prices to move consumers between technologies on a strategic basis, not on the basis of costs. c) Compare the diversity of technologies in LANs and WANs. [375] Wired and wireless LANs have largely settled upon a single standard each. In WANs, there are still many competing technologies, making the understanding of WAN technologies difficult.

3.

a) Why do MANs have higher typical speeds than broader-scope WANs? [376] Distances are shorter, so costs (and prices) are less. b) Are LANs single networks or internets? {25, Chapter 1}[376] LANs can be either single networks or internets. c) Are WANs single networks or internets? [376] WANs can be either single networks or internets. d) Is the Internet a WAN? [376]

.

Page 159

Not for Distribution to Students

Yes 4.

a) List the three basic components of wide area networks. [376] Customer premises equipment Access links The network core. b) Are access links wired or wireless? [376] Either. c) What is CPE? (Do not just spell out the abbreviation.) [376] Customer premises equipment—equipment on the customer’s premises; owned by the customer instead of the carrier.

5.

a) What two technologies are used in business local loops? [377–379] Optical fiber 2-pair data-grade UTP b) What two technologies are used in residential local loops? [379] 1-pair data-grade UTP Optical fiber c) Compare the two local loop UTP technologies in terms of number of pairs and voice-grade versus data-grade wiring quality. [377–379] Business:

Pairs: 2

Quality: data grade

Residential:

Pairs: 1

Quality: voice grade

d) Compare the types of UTP used in corporate buildings and in low-speed PSTN leased lines.

[377–379] Buildings: 4-pair UTP Low-speed leased lines: 2-pair data grade e) Is all UTP wiring limited to 100 meters? Explain. [379] No, only 4-pair UTP 6.

a) Explain the difference between access lines and leased lines. [380] Access lines go from the customer premises to the first telephone company switch.

Leased lines go all the way from one customer premises to another. b) Compare dial- up connections with leased line connections along the dimensions shown in Figure 10-7. [380]

.

Characteristic

Dial-Up Connections

Leased Lines

Connectivity

Point-to-any-point

Point-to-point

Connection Period

Duration of a call

Duration of lease (always on)

Payment

By the minute for long distance calls

Flat rate plus per-use changers

Page 160

Not for Distribution to Students

Commitment

None (except for cellular plans)

Duration of the lease

Data Transmission Speed

Low to moderate

Moderate to high

ic Dial-Up Connections Leased Lines 7.

a) Below what speed are there different leased line standards in different parts of the world?

[381] The world uses different standards for leased lines below 50 Mbps. b) What is the exact speed of a T1 line? [381] The speed of a T1 line is 1.544 Mbps. c) What are the speeds of comparable leased lines in Europe? [381] Europe’s E1 line operates at 2.048 Mbps. d) What access link transmission media do T1 and E1 lines use? [381] 2-pair data-grade UTP e) What access link transmission medium do all higher-speed leased lines require? [381] Optical fiber f) Why are fractional T1 and E1 speeds desirable? [381] Fractional T1 and E1 speeds are desirable because they lie between the extreme speeds of 56 kbps and several Mbps. They provide intermediate speeds at intermediate prices. g) List common fractional T1 speeds. [381] Common fractional T1 speeds are 128 kbps, 256 kbps, 384 kbps, 512 kbps, and 768 kbps. h) What is T1/E1 bonding, and why is it attractive?

It allows you to have two, three, or more times the capacity of a T1/E1 without having to go all the way up to a T3 lines. i) What are the most widely used leased lines? [381] T1/E1, fractional T1/E1, bonded T1/E1

8.

a) What leased line standards are used above 50 Mbps? [382] Above 50 Mbps, the leased line standards used are SONET (Synchronous Optical Network) in North America and SDH (Synchronous Digital Hierarchy) in Europe. b) What is the lowest-speed SONET/SDH leased line? [382] 1.554 Mbps c) Why does 10 Gbps Ethernet use a speed of 9,953.28 Mbps on “10 Gbps” WAN links? [383] 9,953.28 Mbps is the closest SONET speeds.

9.

a) Why are DSL connections likely to be less expensive than traditional leased line connections?

[383] They use 1-pair data-grade UTP, which is already provisioned (in place), so there is no need to pull new lines to the home.

.

Page 161

Not for Distribution to Students

b) Are business DSL service speeds symmetric or asymmetric? Explain. [383] They are symmetric because most business transmission needs are symmetric. c) What are the downstream and upstream speeds of HDSL, HDSL2, and SHDSL? [384] Feature

HSDL

HSDL2

SHDSL

Name

High-Rate Symmetric DSL

High-Rate Symmetric DSL Version 2

Super-High Rate Symmetric DSL

Downstream Rated Speed

768 kbps

1.544 Mbps

192 kbps to 2.3 Mbps

Upstream Rated Speed

768 kbps

1.544 Mbps

192 kbps to 2.3 Mbps

d) Do business, residential, or both DSL services offer quality-of- service guarantees? [384] Businesses DSL only. e) What is the fastest DSL standard? [384] VDSL f) Why is VDSL difficult to compare to the other standards? [384] It is designed for multi-tenant buildings.

Although residential, it is often symmetric.

It can only be supported over very short distances.

10.

a) Why is asymmetric speed acceptable in residential DSL service? [385] Many services that require high speeds require faster downstream speeds than upstream speeds. b) What is the benefit of not providing quality-of-service guarantees to residential DSL customers? [385] Price is lower because rigorous engineering is unnecessary. c) Does residential DSL offer simultaneous voice and data service? [386] Yes. d) What equipment does the customer have to add to his or her home? [386] An ADSL modem. e) What is the purpose of the DSL access multiplexer? [386] To split customer signals between voice and data transmission and send each on to the appropriate part of the telephone network. f) Compare rated downstream speeds for ADSL initially and today. [386] 1.5 Mbps and 24 Mbps g) Compare rated upstream speeds for ADSL initially and today. [386] 0.5 Mbps and 3.3 Mbps

.

Page 162

Not for Distribution to Students

h) What three factors reduce actual user throughput? [386] There is a general large gap between rated speeds and actual throughput.

Quality of the residential wiring plant.

Distance from the carrier’s switching building. i) Why is fiber to the home attractive? [386] Fiber to the home can offer much faster speeds. j) Compare fiber to the home installation with pulling optical fiber to firms for high-speed leased lines. [386] For high-speed leased lines, fiber cords may have to be provisioned individually.

For fiber to the home, the fiber backbone is run to the entire neighborhood so that provisioning fiber to individual homes afterward will be relatively inexpensive.

11.

a) What transmission media do cable television companies use? [388] Coaxial cable. b) Why is coaxial cable called “coaxial”? [388] It is called “coaxial” because the two conductors are a wire running through the center of the cable and a wire mesh tube on the same axis. c) Distinguish between the coaxial trunk cable and drop cable. [388] The thick trunk cable carries signals from the head end past the subscriber’s house. The thin drop cable runs from the trunk cable into the home. d) What types of amplifiers are needed for cable data service? [388] Two-way amplifiers. e) What device do customers need for cable modem service? [388] A cable modem

12.

a) What two technologies are needed for leased line switched WANs? [390] Leased lines.

Router at each site. b) What are the cost elements in networks of leased lines? [390] Leased line charges Router charges Design labor Maintenance labor, which is much higher than for LAN switching

13.

a) List the physical components of PSDN technology. [391] There is a single leased line running from each site to a POP at the PSDN cloud.

The PSDN cloud is run by the Frame Relay carrier. b) Do customers need leased lines if they use PSDNs? [391] Customers need one leased line per site if they use PSDNs.

.

Page 163

Not for Distribution to Students

c) What is a POP? [391] Point of Presence—a location where you may connect physically to the PDN cloud. d) Why do you want a WAN with many POPs? (The answer is not in the text. It requires you to think about POPs.) [391] If there are many POPs, one is likely to be close to each site, minimizing the cost of the leased line from each site to the nearest POP. <Of course, to really determine this, you would have to look at actual site locations and nearest POPs for each.> e) If a company has seven sites, how many leased lines will it need if it uses a PSDN? [391] Seven. f) Why are PSDNs fairly inexpensive? [391] There are strong economies of scale in management, switching, and leased lines, so PSDNs have lower costs than corporations. g) Why is the PSDN transport core drawn as a cloud? [391] It is drawn as a cloud to symbolize the fact that although the PSDN has internal switches and trunk lines, the customer does not have to know how things work inside the PSDN cloud. The PSDN carrier handles almost all of the management work that customers have to do when running their own leased line networks. Customers merely have to send data to and receive data from the PSDN cloud, in the correct format.

14.

a) What is the speed range of Frame Relay? [392] 256 kbps to 40 Mbps. b) Why is this speed range attractive? [392] Most companies need WAN service in this speed range. c) Why has ATM not been popular? [392] It offers higher speeds than companies need, and it is very expensive. d) What is metro Ethernet? [392] Ethernet in a metropolitan area network. e) For what reasons is it attractive? [392] It is inexpensive.

It offers very high speeds.

Companies are familiar with Ethernet, so there is little learning to use metro Ethernet.

It can be rapidly reprovisioned. f) What PSDN service is growing? [392] Metro Ethernet

*15.

a) Why are virtual circuits used? [393] Virtual circuits are used to simplify switching, thus reducing switching costs. Selecting the best possible path for each frame through a PSDN mesh would be complex, and,

.

Page 164

Not for Distribution to Students

therefore, expensive. If the best possible path had to be computed for each frame at each switch along its path, PSDN switches would have to do so much work that they would be prohibitively expensive. Instead, PSDNs select the best possible path between two computers or sites before transmission begins. b) With virtual circuits, on what does a switch base its forwarding decision when a frame arrives?

[394] With virtual circuits, a switch bases its forwarding decision on the virtual circuit number in the arriving frame’s header. c) Do PSDN frames have destination addresses or virtual circuit numbers in their headers? [394] Each PSDN frame has a virtual circuit number in its header. d) What is the name of the Frame Relay virtual circuit number? [394] The Data Link Control Identifier (DLCI) is the name used. e) How long, typically, is a DLCI? [394] 10 bits. f) How many virtual circuits does this number of bits allow? (The answer is not specifically in the text.) [393–394] 210 or 1,024 16.

a) What are the two attractions of using the Internet as a WAN? [395] The cost per bit transmitted is very low. b) What are the two issues that companies must overcome to do so? [395] Service quality Security

17.

a) List the three protections that can be used to address the lack of security on the Internet.

[395] Have a border firewall.

Apply cryptographic security, preferably using IPsec.

Do antivirus filtering. b) Based on what you learned in the first chapter, how can the second approach make the first approach less effective? [395] Border firewalls cannot read cryptographically protected communications.

18.

a) How may connecting all of a company’s sites to a single ISP mitigate quality-of-service issues for traffic flowing over the Internet? [396] The ISP had strong control over traffic within its network. This control is lost when multiple ISPs work together through network access points. b) What technology do ISPs use to provide quality-of-service guarantees? [396] MPLS

.

Page 165

Not for Distribution to Students

c) Do these guarantees work for site-to-site traffic within a firm, for traffic with other firms, or both? [396] Only between sites in a single firm 19.

a) In cellular technology, what is a cell? [397] In cellular technology, a cell is a small geographical area, a subdivision of a metropolitan service area. b) What is a cellsite? [397] A cellsite is the site near the middle of each cell, containing a transceiver and supervising each mobile phone’s operation. c) What are the two functions of the MTSO? [398] The mobile telephone switching office (MTSO) connects cellular customers to one another and to wired telephone users. It also controls what happens at each of the cellsites, determining what to do when people move from one cell to another, including which cellsite should handle a caller when the caller wishes to place a call.

20.

a) Why does cellular telephony use cells? [398–399] Cellular telephony uses cells for channel reuse. The number of channels permitted by regulators is limited, and subscriber demand is heavy. Cellular telephony uses each channel multiple times, in different cells in the network. b) What is the benefit of channel reuse? [398-399] The benefit of channel reuse is that it multiplies the effective channel capacity, allowing more subscribers to be served with the limited number of channels available. c) In Figure 10-19, assume that channels cannot be reused in adjacent cells, and Channel 47 is being used in Cells A, D, and F. What other cells can it be used in? [399] K, M, and P d) Continuing, how many times is Channel 47 used? [399] Six times. e) If a city has a hundred cells, how many times can a channel be used without channel reuse?

[399] 100/7 = ~14 Round off. f) Repeat the last two parts if channel reuse is possible in adjacent cells. [399] 100 times, 100 times

21.

a) Distinguish between handoffs and roaming in cellular telephony. [400] A handoff is when a subscriber moves from one cell to another within a city and his or her call is transferred (handed off) from one cellsite to another.

Roaming is when a subscriber leaves a metropolitan cellular system and goes to another city or country. Roaming requires the destination cellular system to be technologically compatible with the subscriber’s mobile. It also requires administration permission from the destination cellular system.

.

Page 166

Not for Distribution to Students

b) Distinguish between handoffs and roaming in 802.11 wireless LANs. [400] These terms mean the same thing in 802.11 WLANs—moving from one access point to another.

22.

a) List the required download speeds for each of the four generations of service. [402] First: 10 kbps Second: 10 kbps Third: 2 Mbps to stationary customers, 384 kbps in moving vehicles. (Actually only 100 kbps to 500 kbps) Fourth: 1 Gbps to stationary customers, 200 Mbps to moving customers. b) With what generation did web surfing become attractive? [402] Third. c) Compare 3G required download speeds with initial 3G actual throughput. [402] 2 Mbps to stationary customers, 384 kbps in moving vehicles. (Actually only 100 kbps to 500 kbps) d) What throughput do the best 3G services provide today? [402] HSPA+: 7 Mbps down and 1 Mbps up in the best systems. e) What applications that are difficult or impossible to use with 3G will be easy to use in 4G? [403] Multiple HDTV signals simultaneously. f) What are the technical advances required in 4G systems? [402] Higher speed, of course.

Run over IP networks.

MIMO Scalable channel bandwidth. g) What 4G technology is likely to dominate in the future? [403] LTE Advanced

23.

a) What generation is HSPA+? [402–403] Third b) What generation is LTE in terms of current speed? [402-403] Third. c) What generation does the ITU allow LTE to be called? Why? [402-403] Fourth. It is a precursor to LTE Advanced. <And the ITU has no moral backbone.> d) What is the designation of the version of LTE that will fully meet 4G performance requirements? [402-403] LTE Advanced. e) Toward what standards are carriers converging? [402–403]

.

Page 167

Not for Distribution to Students

LTE Advanced 24.

a) List the general categories of conditions that may limit user throughput. [403–404] Options used in carrier technology for a particular standards.

Throughput is aggregate throughput shared by multiple customers. If too many customers are served by a cellsite, individual throughput will go down.

Individual throughput varies by time of day as more or fewer people use the network.

By location, if one is near a cellsite’s edge, service will be slower; also if you go into an area with too few cellsites, individual throughput will be lower.

The user’s smartphone may not be able to handle the carrier’s latest technology and options and so will revert to slower service. b) Which can the carrier do something about? [403-404] All except the user’s smartphone. c) What can the vendor do for each of these? [403-404] Have more cellsites. d) What category is beyond the vendor’s control? [403–404] The user’s smartphone

25.

a) Why is it attractive to a laptop user to have WLAN access? (This is a simple question.) [405] They can use the Internet when they are near an available access point. b) Why is it attractive for a laptop user to have cellular data access? [405] They can use the Internet even when there is no available access point. c) Why is it good for users that some smartphones can connect to WLAN access points? [405] WLAN access is faster than cellular access.

This saves the user’s cellular data minutes. d) Why is it good for carriers? [405] If customers pay a flat fee for Internet access, getting them to go through a WLAN reduces the cost to the carrier. e) Why is it attractive to users that some smartphones can act as access points? [405] Wi-Fi-only devices such as most tablets and notebook computers can get Internet access through it. f) Why is it attractive for a smartphone to act as an access point? [406] Wi-Fi-only devices such as most tablets and notebook computers can get Internet access through it. g) Why should it be more attractive in the future? [406] Wi-Fi-only devices such as most tablets and notebook computers can get Internet access through it. h) What is unattractive using a smartphone as an access point today? [406]

.

Page 168

Not for Distribution to Students

Carriers increase the monthly charge if the user uses the smartphone as an access point.

26.

a) What technical problem does virtual WAN technology address? [406–407] Companies have many separately managed WAN technologies. b) What must be added to create a corporate virtual WAN? [407] Virtual WAN software. c) What benefits can a virtual WAN system bring? [407] All components can be managed so that they are a complete system.

When technology changes are made, the VWAN software management remains the same.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

Why was this chapter so difficult?

There are so many concepts because there are many different WAN technologies and standards.

For wired networks, there was only Ethernet.

For wireless LANs, 802.11 dominated and only Bluetooth had a major niche.

Hands-On 1.

If you have a smartphone, download an app to tell your data transmission throughput. What did you find?

Student answers will vary.

.

Page 169

Not for Distribution to Students

CHAPTER 11: NETWORKED APPLICATIONS TEST YOUR UNDERSTANDING QUESTIONS 1.

a) What business problem did Papa Murphy’s face? [411] The problem was how best to create a centralized management system for the company’s many franchises. b) How did Papa Murphy’s resolve this problem? [411] Papa Murphy’s resolved this problem by outsourcing to Salesforce.com. Salesforce did the work of designing, implementing, and hosting the system. c) What benefits did Papa Murphy’s see as a result of its choice to use Salesforce to handle this work? [411] First, the system’s implementation was quick.

Second, employees can access the system remotely.

Third, Papa Murphy’s is freed from managing the system and the servers it runs on; these IT jobs are taken care of by Salesforce. d) Can you think of any risks that are involved in this business choice? [411] Student answers will vary. Some potential answers include: If Papa Murphy’s employees lose Internet access for any reason, they will be unable to access the management system.

Security problems might arise if Salesforce has access to sensitive data about Papa Murphy’s.

Security problems might arise if Salesforce fails to protect Papa Murphy’s sensitive data from hackers.

Papa Murphy’s might be locked into Salesforce’s system and thus be unable to stop using it if they become dissatisfied with the service.

2.

a) What is a networked application? [412] A networked application is an application that requires a network to operate. b) What is an application architecture? [412] An application architecture is the way in which application layer functions are spread among computers to deliver service to users. c) Why do users focus on the application layer? [413] Users focus on the application layer because it is the only layer whose functionality users see directly.

3.

.

Create a table. The first column should be client device (dumb terminal, PC, etc.). The second column should be the technical advance embodied in the client. The third should be networking

Page 170

Not for Distribution to Students

advances associated with the client. The fourth and last should be new networked applications made possible by the client and networking. [413–414]

Client Device

Technical Advance

Network Advance

New Networked Applications

Dumb Terminal

Desktop interaction with computers

Telephone modems

Not listed, but e-mail

Early Personal Computers

Desktop processing power

None. Still used telephone modems and terminal emulation.

Word processing, spreadsheets locally

Far more power, memory, etc.

Broadband Internet access

For laptops, portability

WLANs

Client/server applications such as web browsing

Later Desktop and Laptop PCs

No advance in networked applications

Eventually, peer-to-peer applications Small Mobile Devices

Radical portability Touch-screen interface

Large Stationary Devices 4.

Tables, walls, etc.

Dual WLAN and highspeed cellular access

Cloud applications

Very-high speed broadband

Applications that require a broad picture

What advance made the client/server application architecture possible? [414] Increased client processing power

5.

a) Why are hackers now focusing on taking over applications? [415–416] If they can take over an application, they receive its privileges on that machine. b) What are root privileges? [415] A program or user with root privileges can do anything. c) Why is the explosion of applications and small mobile devices a particular concern? [416] The explosion in mobile apps makes vetting applications very difficult.

6.

a) Distinguish among the major standards for e-mail bodies. [417–418] RFC 2822 (originally, RFC 822) is the standard for plain text messages—multiple lines of typewriter-like characters with no boldface, graphics, or other amenities.

HTML is the standard used for e-mail HTML bodies, with richly formatted text and even graphics.

The UNICODE standard allows characters of all languages to be represented, although most mail readers cannot yet display all UNICODE characters well. b) In traditional e-mail, when a station sends a message to its mail server what standard does it use? [418]

.

Page 171

Not for Distribution to Students

When a station sends a message to its mail server, it uses the Simple Mail Transfer Protocol (SMTP). c) When the sender’s mail server sends the message to the receiver’s mail server what standard does it use? [418] When the sender’s mail server sends the message to the receiver’s mail server, it uses SMTP. d) In traditional e-mail, when the receiver’s e-mail client downloads new mail from its mail server what standards are it likely to use? [419] Mail downloads normally use the Post Office Protocol (POP), but they sometimes use the Internet Message Application Protocol (IMAP). e) What is web-enabled e-mail? [419] Mail downloads normally use the Post Office Protocol (POP), but they sometimes use the Internet Message Application Protocol (IMAP). f) What do you think are the advantages of a web-enabled e-mail system? [419] Its advantage is that any computer with a browser in an Internet café, home, or office will allow the user to check his or her mail.

7.

a) What is the main tool of firms in fighting viruses and Trojan horses in e-mail attachments?

[419] The main tool of firms in fighting viruses and Trojan horses in e-mail attachments is antivirus software. b) Why does filtering on the user’s PC often not work? [419-420] Filtering on the user’s PC often does not work because many users either turn off their antivirus programs or keep the programs active but fail to update them regularly. c) What options do firms have for where antivirus filtering should be done? [420] Firms may do central filtering on individual user PCs, on corporate mail servers, or at outside security firms. d) According to the principle of defense in depth, how should firms do antivirus filtering? [420] According to the principle of defense in depth, antivirus filtering should be done in at least two locations—on the user PC, on the mail server, or at an external security company. It is also best if two different antivirus vendors are used. This increases the probability of successful detection because different antivirus programs often differ in which specific viruses, worms, and Trojan horses they catch.

8.

a) What is VoIP? [421] VoIP is the transmission of telephone signals over IP packet-switched internets instead of over circuit-switched networks. b) What is the promise of VoIP? [421] The promise of VoIP is to reduce telephone costs by switching from reserved capacity for each call to more efficient packet switching.

.

Page 172

Not for Distribution to Students

c) What two devices can be used by VoIP callers? [421] VoIP telephones and multimedia PCs. d) What is the purpose of a media gateway? [421] A media gateway connects a VoIP network to the public switched telephone network. e) Why is having a media gateway in a VoIP system important? [421] Without a media gateway, VoIP users could only talk to one another. f) Does the media gateway translate signaling transmissions or transport transmissions? [421] Both 9.

a) What are the two major protocols for VoIP signaling? [422] H.323 and the Session Initiation Protocol (SIP). b) Which of these protocols is growing rapidly? [422] SIP. c) Describe how SIP initiates a communication session. [422-423] One VoIP phone sends a SIP INVITE message to its own SIP proxy server.

The sender’s proxy gateway passes the SIP INVITE to the called party’s proxy server.

The called party’s proxy server passes the SIP INVITE to the called party.

10.

a) What is the purpose of a VoIP codec? [423] The purpose of a VoIP codec is to convert analog voice signals into digital voice data streams. b) Some codecs compress voice more. What do they give up in doing so? [423] Voice quality. c) In a VoIP transport packet, what is the application message? [423-424] A group of voice codec octets. d) Does a VoIP transport packet use UDP or TCP? Explain why. [424] UDP. There is no time to wait for TCP’s retransmissions of lost or damaged packets. e) What two problems with UDP does RTP fix? [424] First, UDP does not guarantee that packets will be delivered in order. RTP adds a sequence number so that the application layer can put packets in the proper sequence.

Second, VoIP is highly sensitive to jitter, which is variable latency in packet delivery.

Jitter literally makes the voice sound jittery. RTP contains a time stamp for when its package of octets should be played relative to the octets in the previous packet. This allows the receiver to provide smooth playback. f) List the headers and messages in a VoIP transport packet, beginning with the first packet header to arrive at the receiver. (Hint: See Figure 11-9.) [423] IP header—UDP header—RTP header—Group of voice codec octets

11. .

a) Distinguish between HTTP and HTML. [425] Page 173

Not for Distribution to Students

The Hypertext Transfer Protocol (HTTP) is the standard used for the transfer of requests and responses.

The Hypertext Markup Language (HTML) is the standard used for creating webpages. b) You are downloading a webpage that has six graphics and two sound clips. How many request–response cycles will be needed? [425-426] You need to download the HTML webpage, six graphics, and two sound clips, for a total of nine request–response cycles.

(Don’t forget the original HTML webpage.) c) What is the syntax of the first line in an HTTP request message? [426] The first line begins with a capitalized method (for example, GET), which specifies what the requestor wishes the webserver to do.

The method is followed by a space and then by the location of the file.

Next comes the version of HTTP that the client browser supports.

The line ends with a carriage return/line feed—a command to start a new line of text. d) What is the syntax of subsequent fields? [426] Each subsequent field begins with a keyword, a colon, a value for the keyword, and a carriage return/line feed. e) What is the syntax of the first line in an HTTP response message? [427] First, the webserver gives the version of HTTP it supports.

Then there is a space and a code. A 200 code is good; it indicates that the method was followed successfully. In contrast, codes in the 400 range are bad codes that indicate problems.

This code is followed by a text expression that states what the code says in humanly readable form.

A carriage return/line feed ends this first line. f) What do the MIME header fields tell the receiving process? [427] The MIME (Multipurpose Internet Mail Extensions) header fields tell the receiving process which version of MIME the webserver uses and what type of file is being delivered. g) Why is this information necessary? [427] This information is necessary so that the browser will know what to do with the attached file. h) How is the start of the attached file indicated? [427] The start of the attached file is indicated by a blank line (two CR/LFs in a row) after the message header lines.

12.

a) What is software as a service? [428] In SaaS, the user does not have to install the application software on his or her device permanently. The SaaS vendor provides the application storage. The user uses the application via the Internet.

.

Page 174

Not for Distribution to Students

b) Why is the word service in SaaS? [428] Instead of software being a product (purchased), it is a service (provided for a fee). c) What do you think are some advantages of storing files on Google Docs services? [429] Student answers will vary. Important points: Files backed up regularly Access from anywhere Access from any machine Sharing with others 13.

a) What is cloud computing? [429] In cloud computing, the company outsources some combination of servers, server applications, and client PC software to a cloud service provider (a company that provides cloud computing services). b) What is an organization that provides cloud services called? [429] A cloud service provider

14.

a) Describe how Software as a Service (SaaS) works. [430] In Software as a Service (SaaS), an application service provider supplies an application to customers on demand. SaaS software vendors may host the application on their own webservers or download the application to the consumer device, disabling it after use or after the on-demand contract expires. b) Describe how cloud SaaS works. [430] In cloud Software as a Service, the user accesses the software over the Internet, often (although not always) with a browser. As with traditional SaaS, the application may either be hosted on the ASP’s webservers or downloaded temporarily from the webservers to the consumer device. c) What are the four main attractions of cloud SaaS? [430-431] The first main attraction is that a company can use software on an as-needed basis, which may result in lowered costs and less risk.

Second, cloud SaaS allows the company to save on personnel resources.

A third attraction is mobility.

Finally, a fourth attraction is collaboration. d) What are the four issues that cloud SaaS raises? [431] The first issue is that a company using cloud SaaS might be unable to access the application if the cloud service provider is attacked or goes out of business.

Second, cloud SaaS entails a loss of control, which may result in companies being locked into proprietary software and rising costs.

The third issue is security. If a company’s sensitive data is stored in the SaaS application, it may be vulnerable to attackers or software vulnerabilities.

The fourth issue is that legal complications may arise.

.

Page 175

Not for Distribution to Students

15.

a) Is utility computing a new phenomenon? [431] No, utility computing was used as far back as the 1960s. b) Describe how utility computing works. [432] In utility computing, a company offloads server processing work to another company at a remote site. In the case of cloud utility computing (that is, utility computing done as a cloud computing model), the company that receives this processing job is a cloud service provider, and the data is sent over the Internet to be processed. c) Why was “utility computing” given this name? [432] Utility computing was given this name because it is usually offered as a pay-as-you-go service; “utility” refers to the fact that public utilities like electricity are typically offered as a metered service. d) What provisioning problems might a company face if it runs its own data center? [432] A company might face problems with both over- and under-provisioning.

16.

a) What are the four main attractions of cloud utility computing? [43–433] The first main attraction is that companies are saved the cost and risk of long-term investment in hardware and management.

Second, the company does not have to dedicate personnel resources to managing its data center.

Third, utility computing provides flexibility.

Fourth, utility computing is highly scalable. b) What are the issues facing cloud utility computing? [433] The issues facing utility computing are access, loss of control, security, and legal liability.

17.

a) What three major factors have contributed to the popularity of cloud computing? [433–434] The three major factors that have contributed to the popularity of cloud computing are the Internet, Web services, and virtualization. b) How has the Internet contributed to the popularity of cloud computing? [433] The Internet has contributed to the popularity of cloud computing by offering increased coverage, so that users can now access cloud computing resources from almost everywhere. Also, the speed and reliability of Internet service means that it is feasible for corporations to rely on the cloud to access and process their corporate data.

18.

Briefly explain how computers that use virtualization work. [434–435] In virtualization, the real computer’s capacity is divided among a number of virtual machines. Each virtual machine acts like a stand-alone computer to its users.

19.

What major issue must a company consider when deciding whether to use cloud computing?

[436] When deciding whether to use cloud computing, a company must consider security risk.

20.

.

a) What is a service-oriented architecture? [436]

Page 176

Not for Distribution to Students

An SOA is an application architecture in which there are many small service objects rather than a few large programs. b) What do service objects do? [436] They each provide services to one or more callers.

21.

a) What is the benefit of reuse? [437] The functionality does not have to be programmed again. This saves cost. b) Why do SOAs make reuse more likely? [437] Service objects can be called in a standardized way, so they can be reused just by calling them. c) What is language independence? [437] The ability to be written in any language. d) In what sense are SOAs language-independent? [437] They can be written in any language. e) Why is language independence good? [437] Service objects can be written in any language the developer wishes, so there is no barrier to new languages or people with specific language preferences.

22.

a) What are Web services? [438] Web services use service objects that provide services to customers using World Wide Web interaction standards. b) Distinguish between SOAs and Web services. [438] SOAs are large numbers of service objects providing services.

Web services are SOAs in which World Wide Web standards are used for communication. c) What is the function of SOAP? [438] Just as Web services are only one way to implement a service-oriented architecture, SOAP is only one way to implement Web services. d) Why are SOAP messages encoded in XML rather than HTML? [439] XML allows the creation of new tags for price, quantity demanded, and other specific information of interest to communicating parties. e) What is the function of WSDL? [440] A WSDL message allows a calling program to understand how to use the Web service object. f) What is the function of UDDI? [440] A UDDI interaction allows a calling program to locate a particular Web service object.

23.

How are service-oriented architectures, Web services, and SOAP related? [440] Service-oriented architecture is the broadest term.

.

Page 177

Not for Distribution to Students

A Web service is one way to implement an SOA. SOAP is one way to implement a Web service.

24.

a) What are peer-to-peer (P2P) applications? [441] Peer-to-peer (P2P) applications are applications in which most or all of the work is done by cooperating user computers, such as desktop PCs. If servers are present at all, they serve only facilitating roles and do not control the processing. b) How are P2P applications better than traditional server-centric client/server applications?

[441-442] P2P applications are better than traditional server-centric client/server applications in that P2P processing frees clients from central control and is less wasteful of user capacity. <Not mentioned in the text, it also creates low barriers to entry for content providers.> c) How are they not as good? [441–442] There are several ways in which P2P applications are not as good as traditional servercentric client/server applications. In P2P applications, user PCs have transient presence on the Internet, they have only transient IP addresses, and security tends to be poor without centralized filtering.

25.

a) Distinguish between client/server file retrieval and P2P file sharing. [443–444] In client/server file retrieval, you download a file from a server to work on it.

In P2P file sharing, you download a file from another client computer. b) What are the problems with each? [443-444] The problem with client/server file retrieval is that download speeds may be slow if the server is overloaded.

The problem with P2P file sharing is that you can unfairly overload the peer providing the file. Also, because upload speeds are traditionally slower than download speeds, the speed with which you can download the file is limited by the upload speed of the peer providing the file c) How does BitTorrent differ from the common P2P file sharing model? [444] In the common P2P file sharing model, you download an entire file from a single peer.

In BitTorrent, you download parts of the file simultaneously from multiple peers d) Explain the steps of BitTorrent operation. [444–446] First, the BitTorrent client program searches for the file it wants (typically by checking an index website).

Second, the BitTorrent client program contacts a tracker.

Third, the tracker examines all of the computers currently connected to its network to find out which have all or part of the file (i.e., to find out which computers make up the swarm).

Fourth, with the tracker’s assistance, the BitTorrent client program downloads different parts of the same file from multiple computers in the swarm.

.

Page 178

Not for Distribution to Students

Fifth, these individual pieces are reassembled on the original computer to form the complete file. e) In BitTorrent, what is an index website? [444] In BitTorrent, an index website is a site the BitTorrent client program goes to in order to get .torrent files. f) What are .torrent files? [444] .Torrent files are files that give information about specific files and where they are stored. g) In BitTorrent, what is a tracker? [444] In BitTorrent, a tracker is a server that coordinates the file transfer. h) In BitTorrent, what is a swarm? [444] In BitTorrent, a swarm is the group of all computers currently connected to the network that have all or part of the file that the client desires to download. i) What security concerns must firms address if they plan to use BitTorrent? [446] First, there is the concern that using BitTorrent requires opening TCP ports 6881 through 6889, which may leave computers at risk for attacks that exploit these ports.

Second, employees might use BitTorrent to download an infected file, which could then compromise the corporation’s computers.

Finally, if an employee uses BitTorrent to distribute illegal content, the firm might be held responsible. j) What is the main advantage of BitTorrent file sharing? [446] The main advantage is that BitTorrent file sharing allows the corporation to use clients (whose capacity is often underused) rather than expensive server processing power, which results in cost savings.

26.

a) What is Skype? [446] Skype is a P2P VoIP service that currently offers free calling among Skype customers over the Internet and reduced-cost calling to and from Public Switched Telephone Network customers. b) Do you have to pay a fee to make calls using Skype? Explain. [446] Only when calling to or from the Public Switched Telephone Network. Skype client-toSkype-client calling is free. c) What is the most popular P2P VoIP service? [446] Skype (at the time of the writing of this textbook) has the largest installed base, giving Skype users many people to call for free.

27.

a) List and define Skype’s three main elements. [447] Skype login server: a central server managed directly by Skype.

Host node: a Skype application that runs on a user’s computer.

.

Page 179

Not for Distribution to Students

Super node: a host node that takes on the work of signaling. Any regular host node may become a super node if it has enough memory, network bandwidth, and CPU. b) Explain how login works in Skype. [448] In Skype login, a user’s username and password are authenticated. The Skype server also notes the user’s IP address, which will be needed later, in the directory search. c) What is a directory search in Skype? [448] In Skype, a directory search is the process where a Skype application looks up the username and IP address of the party it wants to contact. d) Which element of the Skype network is in charge of signaling? [448] The super nodes. e) Which element of the Skype network is in charge of transport? [448] The host nodes. f) Which of Skype’s three steps is done P2P? [448] Signaling and transport are done P2P. g) Compare Skype and traditional voice over IP in terms of whether login, signaling, and transport are P2P or whether they use servers. [448] Login uses servers in both Skype and traditional VoIP. Signaling is P2P in Skype; it requires proxy servers in traditional VoIP. Transport is P2P in both Skype and traditional VoIP. 28.

a) Why is Skype’s use of proprietary software problematic?

Skype’s use of proprietary software is problematic because Skype uses proprietary software and protocols that have not been revealed to security personnel and that change frequently in any case. This causes security professionals to be concerned with the existence of vulnerabilities, backdoors, and other security threats. b) What problem is there with Skype’s encryption for confidentiality? [448] The problem with Skype’s encryption for confidentiality is that its detailed method is unknown. c) Does Skype control who can register a particular person’s name? [449] No, an attacker can use other people’s names and impersonate them. Skype initial registration is open and uncontrolled. d) Why do firewalls have a difficult time controlling Skype? [449] Firewalls have a difficult time controlling Skype because the Skype protocol is unknown and changes frequently to avoid analysis. Also, Skype helps users communicate through NAT firewalls. This is good for the user but bad for corporate security. e) Does Skype’s file transfer mechanism work with most antivirus programs? [449] No, not at the time of this writing. f) Overall, what is the big problem with Skype? [449]

.

Page 180

Not for Distribution to Students

Although Skype concerns are theoretical, the fact that Skype cannot be well-controlled by corporate security policies makes it unacceptable in many firms.

29.

How does SETI@home make use of idle capacity on home PCs? [449] When the computer is idle, the screen saver awakens, asks the SETI@home server for work to do, and then processes the data. Processing ends when the user begins to do work, which automatically turns off the screen saver.

30.

Explain how P2P applications may use facilitating servers yet still be called P2P applications. [450] We still call them peer-to-peer because the user computers do most of the work through peer interactions.

END-OF-CHAPTER QUESTIONS Thought Questions 1.

Do you think that pure P2P architectures will be popular in the future? Why or why not?

In most cases, pure P2P architectures without servers are created to avoid laws and corporate control. For business applications, however, some use of facilitating servers almost always makes sense.

2.

Come up with a list of roles that facilitating servers can play in P2P applications. This will require you to read through the section on P2P applications carefully. You should also try to think of an example not in the text.

Login server (Skype) Implement authentication and access Allocating tasks to be executed via processor sharing (SETI@home) Index website to find who has files

Troubleshooting Question 1.

You perform a BitTorrent search and get no responses. List several possible causes. Then describe how you would test each.

You may have mistyped your search request (the most likely situation). Try it again, typing it very carefully.

You may not have connected properly to the index website, although it is likely that you could not even begin a request if you have not.

You may not have a connection to the tracker server, although it is more likely that there is a problem with the tracker server.

You may be searching for a rare file that may not be available in the P2P network.

.

Page 181

Not for Distribution to Students

MODULE A: MORE ON TCP REVIEW QUESTIONS 1.

A TCP segment begins with octet 8,658 and ends with octet 12,783. [Module A] a) What number does the sending host put in the sequence number field? [Module A] 8,658. b) What number does the receiving host put in the acknowledgment number field of the TCP segment that acknowledges this TCP segment? [Module A] 12,784

2.

A TCP segment carries data octets 456 through 980. The following TCP segment is a supervisory segment carrying no data. What value is in the sequence number field of the latter TCP segment?

[Module A] 981 (Supervisory messages are treated as carrying a single octet of data.)

3.

Broadly describe flow control in TCP. [Module A] Each acknowledgement contains a window size field.

The receiver adds the window size value to the acknowledgement number in the acknowledgement field.

The receiver may transmit up to that computed octet without another acknowledgement. If the receiver wishes to send a TCP segment containing that computed octet, it must pause.

.

Page 182

Not for Distribution to Students

MODULE B: MODULATION REVIEW QUESTIONS 1.

Describe frequency modulation. [Module B] Frequency modulation uses two frequencies—one to represent a 1 and the other to represent a 0. To send a 1 or 0, the sender sends the appropriate frequency during a clock cycle.

2.

Describe amplitude modulation. [Module B] Amplitude modulation uses two amplitudes—one to represent a 1 and the other to represent a 0. To send a 1 or 0, the sender sends the appropriate amplitude during a clock cycle.

3.

a) Describe phase modulation. [Module B] Phase modulation uses waves of two different phases—one to represent a 1 and the other to represent a 0. To send a 1 or 0, the sender sends the appropriate phase during a clock cycle. b) Describe BPSK. [Module B] BPSK is phase modulation with two phases to represent one bit per clock cycle. c) Describe QPSK. [Module B] QPSK is phase modulation with four phases to represent two bits per clock cycle.

4.

a) What two forms of modulation does QAM use? [Module B] Amplitude modulation and phase modulation. b) In QAM, if you have four possible amplitudes, how many states do you have? [Module B] Each phase has 4 states, and 4x4=16 states. c) In QAM, if you have eight possible amplitudes, how many states do you have? [Module B] Each phase can have 8 possible amplitudes, so there are 64 possible states. d) How many bits can you send per clock cycle? [Module B] There are 64 states, and 26 = 64, so you can send 6 bits per clock cycle.

.

Page 183

Not for Distribution to Students

MODULE C: MORE ON TELECOMMUNICATIONS REVIEW QUESTIONS 1.

a) How many simultaneous voice calls can a T3 line multiplex?

672 b) Explain frames and slots in time division multiplexing (TDM).

In time division multiplexing (TDM), time is divided into brief time periods called frames, which are then divided into even briefer periods called slots. c) How is a circuit allocated capacity on a TDM line?

On a TDM line, a circuit is given the same slot in each frame. d) What is the advantage of TDM? The advantage of TDM is that it provides guaranteed capacity. e) What is the disadvantage?

The disadvantage of TDM is that it wastes unused capacity, which users must pay for whether or not they use it.

2.

a) What is the relationship between leased line circuits and trunk lines?

A leased line is an end-to-end circuit offered to customers. Trunk lines connect pairs of switches within the PSTN. A leased line circuit is likely to pass through multiple trunk lines. b) Below about what speed are trunk lines point-to-point lines?

50 Mbps. c) What topology are SONET/SDH lines designed to use?

The ring topology. d) What is the advantage of this topology?

High reliability.

It wraps the ring so that there continues to be an unbroken loop. e) What does a SONET/SDH network do when there is a break in a line between switches?

When there is a break in a line between switches, the ring is wrapped, and service continues.

3.

a) How is ATM different from previous trunk line technologies?

Unlike previous trunk line technologies, ATM is a packet-switched technology. b) Why is ATM good for voice?

.

Page 184

Not for Distribution to Students

ATM is good for voice because it was designed specifically to carry voice. ATM provides quality-of-service guarantees for voice. c) Why is ATM ideal for use in the transport core of telecommunications carriers?

ATM has very strong management functions. This requires a great deal of management labor. This labor-intensive ATM management is overkill for smaller networks but it is ideal for the worldwide telephone system.

In addition, ATM has strong quality-of-service guarantees for voice. This is necessary for good voice quality in the PSTN. 4.

a) What is the worldwide signaling system for telephony?

Signaling System 7. b) Distinguish between SS7 and C7.

SS7 is the variant used in the United States. C7 is the variant used in Europe. c) Does having two versions of the standard cause major problems?

No, they are almost identical, so a simple gateway can interconnect them easily.

5.

a) Why are microwave repeaters needed?

Because of the curvature of the earth, point-to-point wireless connections cannot travel very far. b) Does the uplink or the downlink use point-to-point transmission?

The uplink. c) What is the footprint?

The area on the ground over which the downstream signal spreads. d) Which of the following uses dish antennas: GEOs, LEOs, or MEOs? GEOs. e) Which of the following is good for mobile stations: GEOs, LEOs, or MEOs? LEOs and MEOs f) What are the rough heights of GEO, LEO, and MEO orbits?

GEOs: about 22,300 miles LEOs: a few hundred miles MEOs: a few thousand miles g) What is a VSAT satellite dish?

It is a very small aperture terminal, which has a small dish antenna. h) What is the attraction of VSAT technology?

Small dishes are inexpensive.

6.

a) What telephone equipment are you likely to find in a building’s equipment room?

Termination equipment and a PBX for voice.

.

Page 185

Not for Distribution to Students

b) In its telecommunications closets?

A cross-connect device. c) What is the purpose of a PBX? It is an internal telephone switch for all internal telephone communication. d) Compare and contrast vertical wiring distribution for telephony and data.

For data wiring, there is only one cord (4-pair UTP or fiber) to every floor.

For telephone wiring, there are eight wires to every telephone wire on every floor. e) Compare and contrast horizontal wiring distribution for telephony and data.

Horizontal wiring for data and voice are the same.

7.

A building has 10 floors, not counting the equipment room in the basement. Each of the 10 floors has 60 voice jacks and 40 data jacks. a) For telephony, how many wires will you run through the vertical riser space for each floor?

You will run 480 wires for each floor (60 voice jacks times 8 wires per cord). b) How many 25-pair cords will this require?

There are 25 pairs in each vertical distribution cord, so ten 25-pair cords (500 wires) would be needed. <Each 25-pair cord can only support six 4-pair UTP horizontal cords because eight does not divide into 25 evenly. This leaves one unused pair.>. c) For vertical data wiring if you use 4-pair UTP? Only one 4-pair UTP cord would be needed per floor—10 in all. d) For vertical data wiring if you use optical fiber?

Only one optical fiber cord would be needed per floor—10 in all. e) On each floor, how many wires will you run horizontally from the telecommunications closet to wall jacks?

100 wall jacks times 8 wires per jack means that you will need to run 800 wires. f) How many cords will this require?

It will be 100 UTP cords—one per wall jack.

8.

a) Where is plenum cabling required?

Plenum cabling is required any time cables run through airways (plenums), such as air conditioning ducts. b) Why is plenum cabling needed?

Plenum cabling is needed in air ducts in case there is ever a fire in the building. Ordinary sheaths on UTP and optical fiber cords are made of polyvinyl chloride (PVC), which gives off deadly toxins (PCBs) when it burns. If these toxins are released in airways, they will spread rapidly to office areas. Plenum, in contrast, gives off a lower amount of dangerous fumes when it burns.

9.

.

a) Into what three categories are PBX services divided?

Page 186

Not for Distribution to Students

Attendant services Management services User services b) List and briefly describe two services in each category.

Student answers will vary. Possible answers include: For Users: Speed dialing, Last number redial, Display of called number, Camp on, Call waiting, Hold, ANI, Conference, Call transfer, Call forwarding, Voice mail For Attendants: Operator, Automatic call distribution, Message center, Paging Operator, Nighttime call handling, Change requests For Management: Automatic route selection, Call restriction, Call detail 10.

Create a table to compare and contrast direct distance dialing, toll-free numbers, 900 numbers, and WATS, in terms of whether the caller or the called party pays and the cost compared with the cost of a directly dialed long-distance call.

Service

Who Pays?

Price Compared to Direct Distance Dialing

Direct distance dialing

Caller

Same

Toll-free numbers (800…)

Receiver

Lower

WATS

Caller

Lower

900 numbers

Caller

Higher

11.

Describe the two pricing options for local calls.

They can charge for duration of each call.

They can have a flat monthly charge for all local calling.

12.

a) What is the advantage of toll-free numbers for customers?

They do not have to pay to call you.

(So they are more likely to do so.) b) For companies that provide toll-free number service to their customers?

Customers are more likely to call you. This can increase sales.

13.

a) Name the four advanced telephone services listed in the text.

Caller ID Three-party calling Call waiting Voice mail b) Name and briefly describe two advanced services not listed in the text.

Student answers will vary.

14. .

a) Do all countries have PTTs? Explain.

Page 187

Not for Distribution to Students

No, the United States does not. b) What is a monopoly over domestic telephone service?

This is a monopoly over telephone service within a country. c) What are the purposes of PTTs and Ministries of Telecommunications?

The purpose of the Public Telephone and Telegraph authority (PTT) is to provide service.

The purpose of Ministries of Telecommunications is to counterbalance and regulate the power of PTTs. 15.

a) Distinguish between the traditional roles of AT&T and the RBOCs. After the breakup, AT&T handled long distance service and the RBOCs handled local service. b) Distinguish between the traditional roles of the FCC and PUCs in the United States.

The FCC manages telephony nationwide. PUCs oversee pricing and services within individual states.

16.

a) Distinguish between LATAs, ILECs, and CLECs. A local access and transport area (LATA) is one of the roughly 200 regions that the United States has been divided into for local telephone service.

The incumbent local exchange carrier (ILEC) is the traditional monopoly telephone company within each LATA. A competitive local exchange carrier (CLEC) is a competitor to the ILEC. b) What is the role of IXCs relative to LATAs? Interexchange carriers (IXCs) carry voice traffic between LATAs. c) What carriers handle long-distance calling in the United States?

Domestically, both LECs and IXCs handle long-distance calling. d) What is the role of ICCs? International common carriers (ICCs) provide international service. e) Why are POPs important?

They permit competiton by providing a way for carriers to connect their customers.

17.

a) What is deregulation?

The removal of monopoly protections in order to provide competition. b) When did deregulation begin?

The 1970s. c) How complete is deregulation for customer premises equipment?

Almost totally complete. d) For long-distance calling?

High

.

Page 188

Not for Distribution to Students

e) For local calling?

Relatively low.

The traditional monopoly wired telephone carrier has been able to stop direct wired competition.

Cellular is providing competition.

VoIP is beginning to provide competition. f) What issues are involved in the regulation of VoIP? Should VoIP vendors be taxed?

.

Page 189

Not for Distribution to Students

MODULE D: MODULATION REVIEW QUESTIONS 1.

a) What kinds of information are stored in a directory server?

Directory servers store centralized information about a firm. They store information about people, hardware devices, and anything else the firm may want to store information about. b) How is information in directory servers organized?

Information in directory servers is organized hierarchically. c) What is the purpose of LDAP? The purpose of the Lightweight Directory Access Protocol (LDAP) is to govern query commands. LDAP commands specify the path to a property. d) If Astronomy has a similar directory organization to Business (in Figure D-1), give the specification for the telephone extension of Claire Williams (username cwilliams), who is an Astronomy staff member.

GET Ext.cwilliams.faculty.astronomy.waikiki

2.

a) What is Active Directory?

Active Directory is Microsoft’s directory server product. b) What is an AD domain?

An AD domain is a group of resources managed by an Active Directory controller or controllers. c) What are domain controllers?

Domain controllers are servers that run Active Directory and maintain an AD database for the domain. d) Can a domain have more than one domain controller?

Yes. e) What are servers that do not run AD called?

Servers that do not run AD are called member servers. f) Describe replication among domain controllers in the same domain.

If there are multiple domain controllers within a domain, then the AD data is fully replicated between them. g) What is an Active Directory tree?

A group of Active Directory domains organized in a hierarchy. h) Describe replication among domain controllers at different levels.

.

Page 190

Not for Distribution to Students

There is partial replication between AD servers in parent and child domains (adjacent layers in the hierarchy). i) What is an AD forest?

A group of AD trees organized in a hierarchy.

3.

a) What device holds the authentication data—the authenticator or the back-end authentication server?

The back-end authentication server b) If a firm has many back-end authentication servers, where might authentication data be stored for central management?

The directory server

.

Page 191