Review for quiz 2

• network layers
  • OSI model
    • physical.
    • link.
    • transport.
  • encapsulation.
  • IP
    • TCP.
    • UDP.
• network addressing
  • ifconfig.
  • subnet masks.
  • subnet addressing.
  • ports and services.
• network naming
  • /etc/hosts
  • configuring named.
  • forward and reverse lookups.
  • using nslookup.
  • editing resolv.conf.
• network debugging
  • using ping
  • using traceroute
• routing
  • routing tables.
  • RIP.
• filtering
  • addresses and address masks.
  • ports and connections.

Coverage:

• Lectures 6-9, 15-16, and 21-24 with emphasis on networking topics.
• Frisch chapter 13, Hunt chapters 1-4,6-9.

Review problems

1. You're on a machine that has the routing table;

    subnet                gateway         interface
    130.64/16             10.1.1.30       eth0
    192.168.1/24          10.1.1.20       eth0
    192.168.2/24          10.1.1.10       eth0
    192.168.2/24          10.1.1.10       eth0
    10.1.1/24             10.1.1.3        eth0
    default               10.2.1.50       eth1
   

   1. From this information, what's your IP address?
   2. What's your best guess for the subnet mask for your interface eth0? Why?
   3. If your host sends a packet to the host numbered 130.64.12.15, which gateway is the packet's next hop?

• answer:
  1. Since all gateways to 130.64, 192.168 are on 10.1.1/24, we infer that 10.1.1.3, the gateway to 10.1.1/24, is OUR ip address! netstat is nicer and tells you it's local. I erased that.
  2. It's pretty obvious that it's probably 255.255.255.0.
  3. 130.64.12.15 matches 130.64/16 with gateway 10.1.1.30.

1. You can't talk to an adjacent machine on your own network. List the problems that can cause this and their solution.

• answer:
  1. your interface isn't configured. Check /etc/sysconfig/network.
  2. other machine interface isn't configured. Check its configuration.
  3. your routing table is wrong. Check netstat -rn.
  4. its routing table is corrupted. Same annotation.
  5. your arp table is corrupted. Check arp -a.
  6. its arp table is corrupted. Same annotation.
  7. /etc/hosts is corrupt on your side.
  8. /etc/resolv.conf is incorrect on your side.
  9. name server broken.

1. Describe exactly how to utilize traceroute to find a broken router.

• answer: call traceroute on hostname, watch for *'s in output. Either the router before the *'s or the router that is the next hop after the listed one has a problem.

1. You're trying to talk through a firewall choke. You find that you can ping 10.2.5.1 and 10.2.5.15 but not 10.2.5.16 or 10.2.5.30. Give a firewall address and mask that would match the addresses you can ping without matching the addresses you can't ping.

• answer

   00001010 00000010 00000101 00000001   10.2.5.1
   00001010 00000010 00000101 00001111   10.2.5.15
   00001010 00000010 00000101 00010000   10.2.5.16
   00001010 00000010 00000101 00011110   10.2.5.30
  

  so you can utilize

   11111111 11111111 11111111 11110000   255.255.255.240
  

  or

   11111111 11111111 11111111 00000001   255.255.255.1
  

  So the answer is 10.2.5.0/28 or 10.2.5.0/255.255.255.240

1. Give the procedure for checking the reverse lookup for the address 130.64.25.13 using nslookup.

• answer:

   % nslookup
   > set type=ptr
   > 13.25.64.130.in-addr.arpa.
  

1. If the reverse lookup comes up with the wrong name, what to do?

• answer:
  • identify name server.
  • check configuration files named.conf, databases it indicates.

1. Give the ifconfig command that configures eth0 as 10.2.5.1, broadcast 10.2.5.255, subnet mask 255.255.255.0

• answer: (what a joke!)

   ifconfig eth0 address 10.2.5.1 mask 255.255.255.0 broadcast 10.2.5.255
  

1. Suppose we have the following filters set up via ipchains:

    from 0.0.0.0/0 to 10.2.45/24 deny
    from 0.0.0.0/0 to 10.2.46/24 allow
    from 10.2/16   to 10.2.50/16 allow
    from 0.0.0.0/0 to 10.2.40/24 deny
   

   Which of the following packets get through?
   1. from 130.64.9.2 to 10.2.45.30
   2. from 130.64.9.2 to 10.2.50.33
   3. from 10.2.30.55 to 10.2.50.53
   4. from 10.2.30.55 to 10.2.40.30

• answer:
  1. from 130.64.9.2 to 10.2.45.30 is denied by first filter.
  2. from 130.64.9.2 to 10.2.50.33 can't be determined. Depends upon default policy.
  3. from 10.2.30.55 to 10.2.50.53 is allowed by third rule.
  4. from 10.2.30.55 to 10.2.40.30 is denied by fourth rule.

1. Suppose you have the following IPchains setup.

    from 0.0.0.0/0 to 10.2.50.33 port 22 masq 
   

   What happens to a packet sent to 10.2.50.33:22? By what mechanism are responses sent back to the calling host?

• Answer: masquerading rewrites the source address to be the address of the firewall, so the packet sent to 10.2.50.33:22 gets readdressed as coming from the firewall. Destination address stays the same. When a response comes back to the firewall, the DESTINATION address of the response is rewritten to your address.