VA+ (Vulnerability Assessment Plus) Supporting Notes.

Networking

There are a significant number of networking questions in the multiple-choice examination and you are expected to be able to configure and troubleshoot networking from both the terminal and from a GUI. You are expected to be familiar with the following terms and concepts.

Addressing

• IP addresses, classes of networks, subnet masks, broadcast addresses default gateway, DNS server, CIDR notation, RFC 1918 private addresses, Network Address Translation (NAT) techniques.
• Decimal Dotted Octets, e.g., 192.168.14.1 & binary equivalent 11000000.10101000.00001110.00000001 and how to convert between decimal, binary (& hexadecimal where appropriate).
• You should be able to identify a valid routable IP address from either an invalid address or one that is not intended to be routed across the Internet. So 259.121.1.1 being invalid and 172.16.2.1 being part of RFC 1918 and should be classed as non-routable (you can obviously do as you choose internally).
• You should know what MAC addresses are, what layer MAC is in the OSI and TCP models (Data Link in the OSI and Network Access layer in the TCP\IP model) and how they are organised and represented.
• [OUI|ID] For example, in the MAC address 98-8b-5d-93-c9-23, which part is the OUI (Organisational Unique Identifier)? What does the MAC broadcast address look like? The first 24 bits or 6 hex digits (shown in bold above) represent the OUI and FF-FF-FF-FF-FF-FF is the broadcast MAC address.

An excellent networking primer can be found here. It takes the form of a TCP\IP Tutorial and Technical Overview, and covers IP addressing and almost every other protocol you will need to know about.

If you are unsure about number conversions, have a look here or at this simple example here. This covers decimal to binary and vice versa.

Network Configuration

• You should be able to use basic networking tools to configure and test an IP address and a route to a host. Examples of tools include ip a, ip r, ifconfig, route, ping, traceroute, arp.

Network Devices, Routing & Media

• Switches provide connectivity for LANs and provide micro segmentation. Switches are layer 2 devices (data link in OSI, Network Access in TCP\IP) and their Protocol Data Units (PDUs) are ‘frames’. Switches work with MAC addresses and can only determine addresses locally. If a frame is leaving a LAN, it will invariably do so via the default gateway.
• Routers are responsible for determining the path to and end system. Routers operate at layer 3 (network layer in the OSI and in TCP\IP). Routers work with packets (or datagrams) as their PDU. Routers tend to use dynamic routing protocols, such as RIP, EIGRP, OSPF, IS-IS BGP, EGP, etc to maintain routing information about the networks they are attached to. It is possible to configure static routing, however most routers will be using some form of dynamic routing protocol as previously discussed.
• Some routing protocols are known as Distance Vector (DV) routing protocols , whilst others are known as Link State (LS) routing protocols. A DV routing protocol tends to use less metrics than a LS and a router will normally only know about routes offered by its directly connected neighbours, whilst a LS will hold information about all of the routes within an administrative domain and has more complex metrics. Obviously there can be finer grained choices made when you have more metrics, so a LS routing protocol will generally perform significantly better than a DV routing protocol, however, there are instances where a DV may perform just as well or at least not so poorly as to be ignored as a choice.
• It is an advantage to know the difference between and Interior Gateway Protocol (IGP) and an Exterior Gateway Protocol (EGP). IGPs tend to be used within the administrative control of a network, whilst EGPs tend to be used when systems under different autonomous control are being connected.
• WLAN access points provide connectivity to wireless networks for hosts and in terms of their operation act more like hubs than switches. An access point will use the CSMA\CA (Carrier Sense Multiple Access with Collision Avoidance) protocol for media access and likely some form of WPA for security.
• You should have a basic understanding of types of media such as wire, fibre, wireless etc. Each media has its advantages and disadvantages.
• Wire tends to be Ethernet (UTP or STP, Unshielded Twisted Pair and Shielded Twisted Pair respectively) and the current specifications range from 1Gb to approx 40Gb. There are many in-between and beyond. However, installations will often specify the network as a cable type, for example Cat 6e, which is actually a cable specification. Wire has the advantage that it can bend relatively easily and in terms of connection points is relatively easy to work with. It does have distance limitations, so is limited to runs of 100m after which the signal must be amplified in some way. However, wire does suffer from noise and can be significantly diminished by EMI (Electromagnetic Interference), consideration must be taken during installation.
• Fibre has some significant advantages as it does not suffer from EMI and can have extended runs many times that of wire and significantly increased bandwidth. In fact some under sea cables have runs of up to 240km. However, making connections and splicing fibre is much more difficult. Fibre optics also have only a limited capacity for bending, so are more difficult to install where significant cable bending is required. Fibre optic is also significantly more expensive than its wired counterparts are. However, costs continue to fall and fibre is often used for site-to-site links and for horizontal backbone cabling
• Wireless transmissions have the advantage of not requiring a ‘physical’ connection to the network, however this does mean that the signals are ‘seen’ by all as they travel through the air. It is of course possible to use encryption and WPA & WPA2 offer some form of protection, however there does need to be a judicious approach to the selection of passphrase and frequency of change. WLANs can be affected by physical obstructions and atmospheric conditions. They tend to offer lower bandwidth and the bandwidth diminishes as the number of users attached to an access point increases, however they provide flexibility.

OSI Reference Model & TCP\IP Suite Concepts

• The OSI (Open Systems Interconnection) Model is a reference model created by the ISO (International Standards Organisation).
• The main aim was to ensure that networks were interoperable and remove ‘vendor’ issues from the ability of one network to communicate with another. The OSI model has seven layers.
• Working from top to bottom: Application, Presentation, Session, Transport, Network, Data Link & Physical. Each layer has a well defined purpose and operates on data known as Protocol Data Units (PDUs).
• Data is encapsulated and de-encapsulated in these PDUs when moving both down and up the layers.
• The process of encapsulation is shown below. The top three layers deal with data, whilst the bottom four layers deal with their respective PDUs, namely segments, packets, frames and bits.