Unique by CatheyMc

Network Structure

OSI Model

Home Networking

ASCII Character Chart

Registry Settings

IPv6

CD Media

Colors

comLinks

UNIX Basic Commands

links

     PAGE TOPICS:

TCP/IP   
TCP and UDP Port Numbers
CLASS A NETWORK ADDRESS 
CLASS B NETWORK ADDRESS 
CLASS C NETWORK ADDRESS 
CLASS C & D NETWORK ADDRESS
RESERVED ADDRESS 
LOCAL LOOPBACK 
CLASS C SUBNETTING 
 

DNS 
GATEWAY 
WINS and ScopeID 
HOSTS file
IPv6
TCP/IP PROTOCOLS 
TCP/IP UTILITIES
PBXes: CO Switches & IP

    SECURITY: Carnegie Melon OCTAVE   SANS policy  CERT tech tips      CERT Knowledgebase   CERT Securing Browser 

 Ralph's IP Addressing Article    VPN org

address pool

ARP

Address Resolution Protocol see  #PROTOCOLS

BOOTP

Bootstrap Protocol  A layer 3 or TCP/IP Internet layer protocol designed to permit diskless workstations to obtain network access and an operating system image across the network as they begin booting. Developed in the 1970s, it is seldom used anymore for workstations, however is used for JetDirect. - replaced by DHCP. Interoperability  reference: RFC 1534.

IP CLASS ADDRESS RANGE

RESERVED ADDRESS:
127.x.x.x addresses are reserved

127.0.0.1 is the local loopback address for the NIC used to troubleshoot TCP/IP bindings




all-hosts multicast address:
224.0.0.1


subnet mask: 225.0.0.0
 

When the node section is set to all "1"s, it specifies a broadcast that is sent to all hosts on the network.
What two addresses are “deducted” from the total number of IP addresses that may be calculated?
Answer: The Network address and the Broadcast address.¹

NOTE:  in binary numbering: Everywhere there is a 1 in the subnet mask, you are looking at part of the network ID. Everywhere there is a zero, you are looking at part of the host ID, see Class C Subnetting

Private IP addresses  RFC1918   *private IP addresses are not routable on the internet
10.0.0.0 network        -  10.255.255.255    (10/8 prefix)
172.16.0.0 network    -   172.31.255.255    (172.16/12 prefix)
192.168.0.0 network  -    192.168.255.255  (192.168/16 prefix)

all routers multicast address: 224.0.0.1  or 224.0.0.2

CLASS A   (1-126)
NETWORK ADDRESS
( 001.x.x.x through 126.x.x.x)
(No more available)
 

IP ADDRESS:     (the first four octets are the Network portion of the address)  You can’t use all zeros or all ones in an IP address
A 32-bit binary number broken into four 8-bit binary numbers separated by dotted decimals
Of the first set of numbers, if the first bit is set to 0,  and it has a subnet mask of 255.0.0.0,  the remaining 7 bits identify the network address ( 001.x.x.x through 126.x.x.x)
The remaining 24-bits are used for host address space ( x. 0.0.1 through x.255.255.254)

Subnetting a network address allows it to be broken into more subnet networks with fewer hosts per network, see Class C Subnetting

NETWORK ADDRESS:
First bit is set to 0
Network has subnet mask of 255.0.0.0
The 7-bit network address space can accommodate 126 network addresses
Acceptable range is 001.x.x.x through 126.x.x.x
HOST ADDRESS:
After the network address space, the remaining 24-bit host address space can accommodate up to 16,777,214 hosts per network
Acceptable range  is x.0.0.1 through x.255.255.254
 

NETWORK IDENTIFIER is the left part of the address. HOST IDENTIFIER is the right part of the address.

NOTE:  in binary numbering: Everywhere there is a 1 in the subnet mask, you are looking at part of the network ID. Everywhere there is a zero, you are looking at part of the host ID, see Class C Subnetting

CLASS B  (128-151)
NETWORK ADDRESS
(128.0.x.x through 191.255.x.x)
(No more available)

IP ADDRESS:                (the first eight octets are the Network portion of the address) You can’t use all zeros or all ones in an IP address
A 32-bit binary number broken into four 8-bit binary numbers separated by dotted decimals
If the first 2 bits are set to 10 it has a subnet mask of 255.255.0.0, the remaining 14 bits identify the network address (128.0.x.x through 191.255.x.x)
The remaining 14 bits are used for host address space  (x.x.0.1 through x.x.255.254).

Subnetting a network address allows it to be broken into more subnet networks with fewer hosts per network, see Class C Subnetting

NETWORK ADDRESS:
Network has subnet address 255.255.0.0
The 14-bit network address space can accommodate 16,382 network addresses
Acceptable range is 128.0.x.x through 191.255.x.x

HOST ADDRESS:
After the network address space, the remaining 14-bit host address space can accommodate up to 65,534 hosts per network
Acceptable range of host addresses is x.x.0.1 through x.x.255.254
 

NETWORK IDENTIFIER is the left part of the address. HOST IDENTIFIER is the right part of the address. You can’t use all zeros or all ones in an IP address

NOTE:  in binary numbering: Everywhere there is a 1 in the subnet mask, you are looking at part of the network ID. Everywhere there is a zero, you are looking at part of the host ID, see Class C Subnetting

CLASS C  (192-223)
NETWORK ADDRESS
(192.0.0.x through 223.255.255.x

IP ADDRESS:                 (the first twelve octets are the Network portion of the address)
A 32-bit binary number broken into four 8-bit binary numbers separated by dotted decimals
If the first 3 bits are set to 110 and it has a subnet mask of 255.255.255.0, the remaining 21 bits define the network address (192.0.0.x through 223.255.255.x)
The remaining 8 bits are used for host address space (x.x.x.1 through x.x.x.254 )

Subnetting a network address allows it to be broken into more subnet networks with fewer hosts per network, see Class C Subnetting

NETWORK ADDRESS:
Network has subnet address 255.255.255.0
The 21-bit network address space can accommodate 2,097,150 network addresses
The acceptable range is 192.0.0.x through 332.255.255.x

HOST ADDRESS:
After the network address space, the remaining 8-bit host address space can accommodate 254 hosts per network
The acceptable range is x.x.x.1 through x.x.x.254

In this class of network are you most likely to supernet.  Class C networks are smaller and more plentiful than Class A and B networks.  Therefore, they are more available to be use, and, because of their size, often need to be combined in order to support larger networks.

NETWORK IDENTIFIER is the left part of the address
HOST IDENTIFIER is the right part of the address

CLASS C SUBNETTING:   You can’t use all zeros or all ones in an IP address
 Everywhere there is a 1 in the subnet mask, you are looking at part of the network ID. Everywhere there is a zero, you are looking at part of the host ID

SUBNET MASK

BINARY VALUE OF LAST BYTE

SUBNETS AVAILABLE

HOSTS PER SUBNET

255.255.255.254

11111111.11111110

128

0

255.255.255.252

11111111.11111100

64

2

255.255.255.248

11111111.11111000

32

6

255.255.255.240

11111111.11110000

16

14

255.255.255.224

11111111.11100000

8

30

255.255.255.192

11111111.11000000

4

62

255.255.255.128

11111111.10000000

2

126

255.255.255.0

11111111.00000000

1

254

CLASS D  (224-239)
NETWORK ADDRESS

known as “multicast” addresses, are often used by routers to transmit changes in routing tables to other routers using a single message - voice over IP

CLASS E  (240-254)
NETWORK ADDRESS

exclusively reserved for Internet experimentation (currently not going on)

CIDR

Classless Inter-Domain Routing  A form of subnet masking that does away with placing network and host address portions precisely on octet boundaries, but instead uses the /n prefix notation, where n indicates the number of bits in the network portion of whatever address is presented.

A.    Class Licenses

1.      Class A

                                                                                 i.            Default netmask is 255.0.0.0

                                                                               ii.            Binary always starts with 0

                                                                              iii.            CIDR is /8

                                                                             iv.            IP address first octet range is 1-126

2.      Class B

                                                                                 i.            Default netmask is 255.255.0.0

                                                                               ii.            Binary always starts with “10”

                                                                              iii.            CIDR is /16

                                                                             iv.            IP address first octet range is 128-191

3.      Class C

                                                                                 i.            Default netmask is 255.255.255.0

                                                                               ii.            Binary always starts with 11

                                                                              iii.            CIDR is /24

                                                                             iv.            IP address first octet range is 192-223

Classless Subnetting
see Subnetting

Make subnets that aren’t Class A, B or C by defining the subnet mask at some point other than /8, /16, or /242.   Classless subnetting is simple in concept but complex in practice.  To make classless subnets, we must extend the original subnet mask to the right (in binary)

CLSM

 Constant-Length Subnet Masks, see subnetting

COMMON SUBNET MASKS

Number of bits

Class A
NNN.nnn.nnn.nnn

Class B
NNN.NNN.nnn.nnn

Class C
NNN.NNN.NNN.nnn

0
( default mask)

255.0.0.0
(default mask)

255.255.0.0
(default mask)

255.255.255.0
(default mask)

1

255.128.0.0
(default +1)

255.255.128.0
(default +1)

255.255.255.128
(default +1)

2

255.192.0.0
(default +2)

255.255.192.0
(default +2)

255.255.255.192
(default +2)

3

255.224.0.0
(default +3)

255.255.224.0
(default +3)

255.255.255.224
(default +3)

4

255.240.0.0
(default +4)

255.255.240.0
(default +4)

255.255.255.240
(default +4)

5

255.248.0.0
(default +5)

255.255.248.0
(default +5)

255.255.255.248
(default +5)

6

255.252.0.0
(default +6)

255.255.252.0
(default +6)

255.255.255.252
(default +6)

7

255.254.0.0
(default +7)

255.255.254.0
(default +7)

255.255.255.254
(default +7)

8

255.255.0.0
(default +8)

255.255.255.0
(default +8)

255.255.255.255*
(default +8)
*reserved for Broadcasts

DHCP

·        Dynamic Host Control Protocol  allows the administrator to set up zones, or ranges, of IP addresses to be distributed dynamically to the network clients upon boot. UsingDHCP centralizes IP administration;  is easier to maintain than static IP addresses. It eliminates the tedious labor involved in manually managing IP addresses. DHCP also allows the administrator to establish static IP addresses.

DHCP CLIENT The software component on a TCP/IP client, usually implemented as part of the protocol stack software, that issues address requests, lease renewals and other DHCP messages to a DHCP server.

DHCP DISCOVERY  The four-packet process ;used to obtain an IP address, lease time and configuration parameters.  The four-packet process includes the Discover, Offer, Request and Acknowledgement packets.

DHCP  OPTIONS  Parameter and configuration information that defines what the DHCP client is looking for.  Two special options --):Pad  and 255:END--are used for housekeeping.  Pad simply ensures that the DHCP fields end on an acceptable boundary, and End denotes that there are no more options listed in the packet.

DHCP RELAY AGENT  A special purpose piece of software built to recognize and redirect DHCP Discovery packets to known DHCP servers.  When any cable segment or broadcast domain has no DHCP server directly attached, but includes DHCP clients that will need address management services and configuration data, it is necessary to install a DHCP relay agent on that cable segment or broadcast domain (or to enable routers to forward BOOTP packets to segments where DHCP servers are available.)

DHCP REPLY  a DHCP message that contains a reply from a server to a client's DHCP request message.

DHCP REQUEST  a DHCP message from a client to a server, requesting some kind of service; such messages occur only after a client receives an IP address and can use unicast packets (not broadcasts) to communicate with a specific DHCP server.

DHCP SERVER  The software component that runs on a network server, responsible for managing TCP/IP address pools or scopes and for interacting with clients to provide them with IP addresses and related TCP/IP configuration data on demand.

DHCP relay agent

DNS
Domain Name System

                             DNS is the standard protocol across all releases of TCP/IP  see BIND
A hierarchical routing structure that links domain names to IP addresses.  DNS servers convert domain names to IP addresses

1.      Uses name resolution to resolve a hostname or URL to an ip address

2.      On older systems, DNS uses a special file called a HOSTS file

3.  DNS is not a dynamic environment, so all address updates must be entered manually.

·        The Domain Name Service (DNS) is used to resolve a URL or computer name to a known IP address. For example, when you type in the URL www.myplace.com ,  that web site name is resolved by DNS to the IP address 216.109.118.70. DNS is used because it is much easier to remember a web site URL than it is an IP address. It is the default naming resolution of the Internet.
DNS Country Codes   TLDs

DNS RRs
(databases)

DNS  Resource Records - the DNS resource records database is divided into four classes. (RFC 1035).  The nine most commonly used RR types, of interest to most users are:

SOA - start of Authority record:  SOA identifies the name server that is authoritative for a specific DNS database segment; it identifies the master DNS server for a specific domain or subdomain. The first entry in any DNS file must be the SOA record. (p318)
NS - name server record: used to identify all DNS servers in a domain, this field must be in the zone file.

A  - Address record: provide name-to-address mapping data; stores domian name-to-IP address translation data (uses FQDN)
CNAME - canonical name record: used to create aliases for hosts in your zone
HINFO - host information record:  stores descriptive information about a specific internet host
MX - mail exchange record: used to route SMTP based email on the Internet and identify the IP address for a domain's master email server
PTR - pointer record:  provide address-to-name mapping data; stores IP address-to-domain name translation data and supports the operation known as a reverse DNS lookup (uses FQDN)
TXT - Text record: may be used to add arbitrary text information to a DNS database, usually for documentation
WKS - Well-known services record: lists the IP-based services, such as Telnet, FTP, HTTP, that an Internet host can supply

DNS Servers

There are three kinds of DNS servers.  DHCP SERVER  The software component that runs on a network server, responsible for managing TCP/IP address pools or scopes and for interacting with clients to provide them with IP addresses and related TCP/IP configuration data on demand. Most current DHCP servers can handle multiple address pools. There are three types of servers as follows:

PRIMARY, aka, master server: is where the primary DNS database files for the domain(s) or subdomain(s) for which that server is authoritative reside. The server loads into memory an ASCII snapshot of the DNS database.  The file is sometimes called a zone file, or zone data file.  For any DNS zone, there can be only one primary master name server.  It's good practice to point clients at a caching-only server where one is available, and by definition, such a server can never be a primary DNS server.  Often primary servers for specific zones also function as slave DNS servers for other nearby zones.

SECONDARY, aka, slave server or secondary master: gets its data for the zone from a master server.  It checks its SOA file, comparing it to the value in the master server's database to make sure the data is current.  The zone data on a secondary server always originates from a primary server.  Multiple secondary servers may exist, but only one primary.

CACHING : store recently accessed DNS records from other domains to avoid incurring the performance overhead involved in making a remote query each time a resource outside the local domain is accessed.

Obtain Root Server Data file for a DNS server: ftp.ns.internic.net look in the /domain subdirectory for file:  named.root ; copy file  and rename it cache.dns to save it to %SystemRoot%System32\DNS directory;

REVERSE LOOKUP:  The file structure of reverse DNS lookups is classful.  Filesnames that map host names for reverse lookups are usually called:   addr.in-addr.arpa.dns (in which addr is the network number for the domain in reverse order, without the trailing 0s). e.g,, lanu.com, IP 206.224.65.0,  filename would be 65.224.206.in-addr.arpa.dns. Such files are also called in--addr.arpa files in the label that appears at the end of each reversed address in the files' PTR records. Note that other DNS implementations , primarily BIND, use a different naming convention, but all DNS require these files to operate no matter how they are named.

FTP

The protocol used when you transfer a file from one computer to another

FQDN

Fully Qualified Domain Name - consists of all elements of a domain name, in which each name on the directory tree is followed by a period, the final period stands for the root of the DNS hierarchy itself. Each node in that directory tree forms the root of a new subtree in the overall hierarchy, in which each such subtree represents a database segment.  You must use FQDNs in DNS A and PTR resource records.

GATEWAY

The gateway is the default route for all TCP/IP packets that are not destined for the local subnet.
1.  When an IP address is specified that is not part of the subnet of the workstation, the workstation must forward those packets to the default gateway or gateway router.
2. The gateway then determines whether the IP subnet is located on any of its ports.
3. If the packet is not destined for a local subnet connected to the gateway, it will forward the packet to its default gateway.

The router connecting a local network must know how to address packets for other systems that are not part of its local network We call this router the default gateway, gateway router, or sometimes just gateway. A gateway might be a router or it might be a PC that runs routing software Gateways are used by traffic destined for a remote system.

·        The default gateway address should be that of a forwarding router. The default gateway has one sole responsibility: to forward packets destined for a subnet other than the local subnet (a remote subnet).

HOSTS file

You can use the HOSTS file to assign static IP addresses to domain names.  The more dynamic properties of DNS servers have replaced the static database HOSTS file.  It is still in used on some older systems, especially UNIX.
The windows HOSTS file is located in the winnt\system32\drivers\etc directory.  Syntax for assigning an address::  192.168.10.1coriolis_ws99 # (the pound sign # is for remarks)

ICMP
 

Internet Control Message Protocol  ICMP Router Discovery Messages RFC 1256
ICMP messages consists of single packet,   They are connectionless, They show how IP packets are doing between any two hosts

ICMP ECHO PROCESS  a process whereby a host sends an Echo packet to another host on an internetwork.  If the destination host is active and able, it echoes back the data that is contained in the ICMP echo packet.

ICMP ECHO REQUEST PACKET  a packet that is sent to a device to test connectivity.  If the receiving device is functional and can reply, it should echo back the data that is contained in the data portion of the Echo Request packet.

ICMP ERROR MESSAGE  Error messages sent using the ICMP protocol.  Destination Unreachable, Time Exceeded and Parameter Problem are examples of ICMP messages.

ICMP QUERY MESSAGES  messages that contain requets for configuration or other information.  ICMP Echo, Router Solicitation and Address Mask Request are examples of ICMP messages.

ICMP ROUTER DIRECTORY  a process in which hosts send ICMP Router Solicitation messages to the all-router multicast address (224.0.0.2).  Local routers that support the ICMP Router Discovery process reply with an ICMP Router Advertisement unicast to the host.  The advertisement contains the router's address and a Lifetime value for the router's information.

ICMP ROUTER SOLICITATION  the process that a host can perform to learn of local routers.  ICMP Router Solicitation messages are sent to the all routers multicast address of 224.0.0.2

IP ADDRESS FORMAT

A. IP Address Format
1.  32-bit number divided into four 8-bit octets
2. Octets are delimited by a period
3.  Value of Octets must be between 0 and 255
 

B.     Converting IP addresses

1.      Dotted decimal notation

                                                                                 i.     Divide the IP address into four pieces of eight bits

                                                                               ii.      A group of eight bits has a limited number of permutations of ones and zeros.    The exact number of permutations is 2⁸ or 256 different patterns of ones and zeros

2.      Can convert by hand or by using a calculator

3.      Use Windows command—IPCONFIG (Windows NT/2000/XP) and WINIPCFG (Windows 9x/ME) to obtain IP address.

IPv6

IPng

with dual stack nodes

IPng (Internet Protocol next generation)

NO MORE BROADCASTS! In IPv6, broadcast is replaced with a multicast.- thanks to new ScopeField. Nodes must announce that they wish to recieve multicast traffic bound for a particular broadcast address. p584
IPv^Multicast address format:

IPV6 May be viewed as a  string that uniquely identifies on single network interface on the global Internet.  Alternately, that address can understood as an address with  network and host portions. How much of the address belongs to either portion depends on who's looking at it, where they are located in relation to the host with that address.
Uses a colon as a separator, instead of the period

Has six groupings of numbers compared to four for IPv4 (128 bits long) (more than 20 orders of magnitude over IPv4)

Each grouping is an eight bit number

The eight bits are made up of two, four-bit “nibbles”

Each group is a hexadecimal number between 0000 and FFFF

Leading zeros can be dropped from a group, so 00CF becomes simply CF

Use a pair of colons (::) to represent a string of consecutive 16-bit groups with a value of zero

The unspecified address (all zeros) can never be used, nor can an address that contains all ones

IPv6 offers an immense amount of additional IP addresses

Example: 1234:5678:90AB:CDEF:5555:6666
·        IPv6 addresses consist of eight octets of 4 hexadecimal numbers. These numbers can have values ranging from 0000 to FFFF, and each set is delimited by a colon (:). Just like IPv4 addresses, no IPv6 address may contain all zeros or all F’s.

IPv^ includes important changes to security handling, auto configuration, efficiency of routing and handling of mobile users

Nodes that need to tunnel IPv6 packets through IPv4 routers use the IPv4-compatable address, called dual stack nodes.  They understand both IPc4 and IPv6. (IPv6 nodes that need to communicate with IPv4 nodes that do not understand IPv6, all use the IPv4-mapped address)

SCOPE IDENTIFIER:  Multicast addresses  use a 4-bit scope identifier, which is a 4-bit field that limits the valid range for a multicast address to define the portion of the Internet over which the multicast group is valid. p581-2

INTERFACE IDENTIFIERS (RFC 3041): Follow the EUI-64  format.  p581 following table Global/local and individual/group bits in IPv6

HP MIB list

MSS

Maximum Segment Size  is the amount of data that can fit in a packet after the TCP header.  Each TCP peer shares the MSS during the handshake process.

MTU

MTU is the amount of data that can fit inside a MAC header.

multicast address

address used to transmit information to multiple network hosts ,but using only ONE address.   All-hosts multicast address: 224.0.0.1
 

Network ID

A number that identifies the network on which a device or machine exists; this is true in both IP and IPX protocol suites

PORTS - Common Well Known TCP and UDP port numbers:
for Security, Ports in Red Should be ASSIGNED OR blocked   Trojan Horse Port Numbers
 see: IANA Assigned Port Numbers

Windows port support file located at \system32\drivers\etc\services\NETWORKS

Well Known Port Numbers (0 - 123)

Well known port numbers are assigned to the key, or core services that systems offer.

Registered Port Numbers (1025 - 49151)

Registered port numbers are assigned to industry applications and processes.

NOTE:  Some TCP-IP systems use between 1024 and 5000 for temporary numbers, although IANA includes that range as part of its dynamic port numbers range.

Dynamic Port Numbers (49152 - 65535)

Dynamic ports (also referred to as ephemeral ports) are used a temporary ports for specific communications.

Port Number

Used by

Identifier

Description

7

UDP

UDP

Echo process can be used to determine if a router is active. should not be used on client/server for security reasons

7

TCP

TCP echo

RFC 862

15

UDP

NETSTAT

Network Status

20, 21

TCP;UDP

FTP

File Transfer Protocol data/control

23

TCP;UDP

TELNET

Telnet

Novell and Win NT do not support port 23 connections for terminal emulation

25

TCP;UDP

SMTP

Simple Mail Transport Protocol

53

TCP

DOMAIN

Domain Name System (DNS zone file transfers)

65

UDP

TFTP

Trivial File Transfer Protocol

67

UDP

DHCP

(DHCP server) Client to Server  Bootstrap Protocol

68

UDP

DHCP

 (DHCP client) Server to Client  Bootstrap Protocol

69

UDP

TFTP

Trivial File Transfer Protocol  tftpd

80

TCP;UDP

HTTP

World Wide Web HTTP/Web applications

110

TCP;UDP

POP3

Post Office Protocol 3

119

TCP;UDP

NNTP

Network News Transfer Protocol

137

UDP; TCP

NetBIOS Name Services

router ports 137 138,139

used by UDP at Internet routers; TCP

ports 137, 138 and 139 should be blocked at the Internet router  to close off external traffic. NetBIOS related port

143

TCP/IP

IMAP

161

TCP/IP;UDP

SNMP

Simple Network Management Protocol

162

UDP

SNMP Trap

SNMP Trap -system management messages

smux

SNMP Unix Multiplexer

220

TCP;UDP

IMAP3

Interactive Mail Access Protocol 3

443

TCP/IP

HTTPS

secure Web applications

512

513

514

520

UDP

RIP

Routing Information Protocol

520

TCP

EFS

Extended Rile Name Server process.

540

1433

UDP

SQL

Assigned to MS SQL process

1993

2049 & 111

MSS (Maximum Segment Size).

registry settings

see Windows Registry settings  the settings are used to manage TCP/IP protocols on a WIN based operating system

resolver

or name resolver - the piece of software that accesses DNS name servers on behalf of the network client.  These requests for service are called name queries or address requests.  Also known as an inverse DNS query.  In most cases the name resolve is built right into the TCP/IP stack for whatever operating system is in use.

reverse lookup

RIP
v1 RFC1058
v2 RFC2453

RMON

router
see: ICMP  SNMP
pathping

a system that forwards IP datagrams.   Routers  support groups of separate, interconnected networks.  Routers direct network traffic. Routers read the IP addresses in each incoming packet. Routers use that information to then send the packet out on its way toward the intended recipient. The creators of the TCP/IP protocol suite invented the concept of routers.
all-router multicast address:  224.0.0.1 SPF MULTICAST ADDRESS: 224.0.0.5  DR multicast address: 224.0.0.6 (p470)

Network troubleshooting often use ICMP Destination Unreachable packets which can indicate a configuration service fault somewhere on the network. (ping)  The destination Unreachable packet must return the IP header and eight bytes of the original datagram that triggered this response. E.g., A DNA query to a host that does not support DNS.   ICMP Router Discovery Messages RFC 1256

subnetting

Using bits borrowed from the host section of an IP address to extend and subdivide the address space that falls beneath the network portion of a range of IP addresses Enables a system to distinguish between local and remote IP addresses. Uses networks IDs.

Whenever you see an IP address that ends with zeros, it is a network ID.
The Internet Assigned Numbers Authority (IANA) is the ultimate source of all network IDs.
 

1.      Every TCP/IP computer uses the subnet mask to compare network IDs

2.      Every network has a subnet mask

                                                                                 i.            Determined by the length of its network ID

                                                                               ii.            Everywhere there is a 1 in the subnet mask, you are looking at part of the network ID

                                                                              iii.            Everywhere there is a zero, you are looking at part of the host ID

3.      By placing a subnet mask on top of an IP address, a computer can tell which part of the IP address is the network ID and which part is the host ID

                                                                                 i.            Can determine which IP address is local

                                                                               ii.            Can determine which IP address is remote

4.      Subnet masks are represented in dotted decimal just like IP addresses

Subnetting secrets

Start with the given subnet mask and move it to the right until you have the number of subnets you need

Never try to subnet without first converting to binary.  Forget the dots.

You can’t use all zeros or all ones in an IP address

CLSM: (Constant-length subnet masks)  In CLSM, all the networks created will support only the same number of hosts.  The more common name, in a production environment, is “subnet”

VLSM: (variable-length subnet mask) for subnetting across a class boundary, it’s subnetting a subnet.  The protocol used by routers in these network environments must support extended network prefix information
Yu would use VLSM if your subnets needed to support different numbers of network hosts.

supernet

It is the C class of network that you are most likely to supernet.  Class C networks are smaller and more plentiful than Class A and B networks.  Therefore, they are more available to be use, and, because of their size, often need to be combined in order to support larger networks.

supernet

 see Class C Network Address

SYN attack

SYN Flood Attack  an attack that sends multiple handshake establishment request packets (SYN) in an attempt to fill the connection que and force the victim to refuse future valid requests.

TCP
[SOCKET - PORT - SMTP]
IP

TCP  Transmission Control Protocol   is a Transport layer component
TCP is  a connection-oriented protocol that guarantees delivery of the data. It is at  the Transport layer of the TCP/IP protocol suite.  It establishes a virtual network between two computers by setting up end-to-end connections, across all routers in the affected network.   To make a connection between two computers, the sender makes a connection request, which the receiver grants.  It waits for authorization to send data and then checks to make sure that it was delivered in its entirety.  TCP uses IP as the transport mechanism between the host computers
TCP Separates functions of its individual application programs by port number.  One computer’s NIC can keep track of several applications at once

TCP/IP is not a protocol in and unto itself. It is actually a stack of protocols that are designed to operate a particular service such as email, web browsing and file transfers. Each service with this protocol stack has a corresponding port number that is used between systems to establish the appropriate session(s) for that service.
 

  SOCKET  Each computer in a communications session creates a socket, each of which has an address (a port number).
  PORTS  The client and server work together to set up a temporary connection using  ports to transport data.  The ports form an end-to-end connection using TCP or the UDP (User Datagram Protocol)
        SMTP:  When a process, such as a  SMTP (Simple Mail Transport Protocol) gateway, is installed on a host computer, it monitors port 25 and retrieves any data sent to that port.
        UDP:  (User Datagram Protocol)  is a connectionless-oriented protocol that does not guarantee data delivery.

IP   (Internet Protocol)  see IPv6
IP is the transport protocol.  TCP uses IP to deliver the datagram  across the network. to the appropriate computer.

TCP/IP PROTOCOLS

SEE

TCP UTILITIES

NOTE:  Protocols in Green cells are  some of the primary protocols. All TCP/IP services such as SMTP, FTP, Telnet or HTTP use ports to transfer data between host computers.  The TCP/IP hosts create a virtual session and these sessions use the port numbers to pass the data between them.  TCP OPTION NUMBERS

Transport Driver Interface  The Windows Transport Data interface (TDI) is sometimes referred to as the "native" Windows NT networking interface. It is a kernel-mode interface between two types of device drivers

TLD

Top Level Domain name - new TLDs  DNS Country Codes

TCP/IP UTILITIES

arp    command line|  arp -a used to view ARP table contents on Windows based computers.

IPCONFIG  and IPCONFIG /All  ipconfig /release   ipconfig /renew
IPCONFIG displays the TCP/IP settings of a WIN NT computer.  IPCONFIG/ALL displays the IP address, subnet mask, default gateway, WINS and DNS configurations.  You can also release an IP address from a DHCP server using this command.

winipconfig
A graphical representation os all the TCP/IP configurations in a Windows 95/98/ME workstation.  For troubleshooting TCP/IP problems to include DHCP, WINS and DNS problems.

nbstat
Powerful for troubleshooting NetBIOS problems.  Command removes or corrects preloaded BetBIOS entries

nbtstat
returns statistics on NetBIOS, using NetBT if TCP/IP is installed on the machine from which it is run  -n  = list of all local NetBIOS names;  -s  = list of names resolved by broadcast and WINS and includes a summary count of name resolutions/registrations;  -s  = NetBIOS sessions table, showing open sessions with their destination IP address.  The "S" does the same, but attempts to resolve the remote host name using the HOSTS file.
 

nslookup Used to query a Domain Name Service server. Usually access is privileged for sequrity reasons.   nslookup domainname [nameserver]  (In Win, the configuration is located in the TCP/IP properties window, available through Start, Control Panel, Network Connections)

PING  Packet Internet Groper
PING is a utility that sends an ICMP echo request message to a host on a TCP/IP network to test network connectivity.  It waits for a response from the remote host and registers the time it takes to respond.  To stop a looping ping use either ctrl+c or delete command.
                                                          ICMP Internet Control Message Protocol
pathping  - (post Win 2k) utility that uses ICMP Echo packets to test router and link latency, including packet loss along a path to a host. pathping uses a combination of tracert and ping to first determine the path to a specified host, and then test the round trip to the host.  It tests  packet loss to the destination and each router along the way.

ping localhost

telnet  port 23
1.  Telnet provides a terminal emulation window through which you can access remote routers and Unix systems on a TCP/IP network.
2.  Telnet is used to modify router commands and run host applications in Unix systems.
3.  Windows NT and Novell do not support Telnet port 23 connections for terminal emulation.  Telnet connection on port 23 is used to connect to a host machine and run an application on the connected host once the security subsystem has authenticated the user.
4.  The Telnet utility can be set up to connect to a host with a port number other than 23 to troubleshoot problems.  With Telnet, using port 25 and entering SMTP commands individually you can record the results from the SMTP server and determine if there are any errors.
5.  Telnet is one of the mail utilities used to connect to ports on host computers to determine whether the port is working properly.

tracert [-d (do not resolve addresses to hostname [-h max number of hops to search for target] [ -j    -w ]  (invoked as tracert in the Windows environment - traceroute in others)
This utility traces the route of a packet between two locations and displays the router hops taken to get there.  It is a good tool to determine where a packet is stopping on its way to the TCP/IP destination.  You can also use it to determine which route is taken on a dual port router.  Tracert is a great utility to map the route that a packet takes through an intranet or the internet. Trace Route is used primarily to trace a route from a local computer to any other computer on the Internet. In other words, it determines how many hops there are between the local and target machine, and displays response time, name, and IP address of each intermediate hop

traceroute
traces the end-to end path through an internetwork. Traceroute alters the TTL value to find routers (not commonly used for security reasons) (p201).  tracert is used in the Windows environment.

VLSM:

 Variable Length Subnet Mask, see subnetting

watchdog process

Netware uses  the watchdog process to maintain a connection between a NetWare host and server.  If the application cannot maintain a connection, the TCP keep alive procerss may be responsible for maintain the connection.  If implemented, only the server process initiates TCP keep-alives.

windows clustering

WINS  p548
Windows Internet Name Service

Scope ID

In essence, WINS is Microsoft's imitation of DNS, repurposed for the NetBIOS namespace.
A LAN service.  WINS is a database that correlates IP addresses to NetBIOS computer names in a Windows-only networking environment.  A non-routable protocol that is best used on small LANs of less than 50 people.
The WINS address is a TCP/IP address that points to a WINS server that has the WINS database installed on it.  It is a configuration tab associated with the TCP/IP protocol.
WINS resolution is not required if the network is not using NetBios names.
     Scope ID:   is a WINS option that provides a way to isolate a group of computers that are permitted communication only with one another.  The Scope ID is a case-sensitive string value that is appended to the NetBIOS name and is used for all NetBIOS over TCP/IP communications from that computer.
The maximum requirements for setting up WINS on  a Window 9x workstation are: Enable WINS resolution and then enter a primary WINS server.  If you have a secondary WINS server, enter it also.

command line tools to configure WINS:    netsh> wins  Enter ? to display Help.