LAB 7

In data Encapsulation Decapsulation Routing O Addresing MAC sublayer adds header and a trailer to the IP Packet * It primarily refers to error detection and retransmission. * Error checking Error control Error detection Error coding

DNS records should be sorted according to their record type. Each one has to be defined precisely, with illustrations and explanations of why it's useful. Is it feasible for a web server and an internal mail server to share a hostname?

The many kinds of DNS records are explained. Each of them will be briefly discussed, with specific instances and justifications for their usage. Do you think it's feasible to use the same hostnames for both a web server and a mail server?

An attacker is sending packets to the target with the URG flag set in order to scan the target port's status. a. What type of scanning is being performed? b. How will the target port respond if it is open? c. What is the response in the event that the target port is closed?

Keep in mind that packet reordering and reassembly occur throughout the transport phase of the TCP/IP protocol suite's operation. It is possible for a firewall to operate at a lower abstraction level, such as the Internet or data layer. Any information about a traffic stream that is out of order or has been deleted will be lost by a stateful inspection firewall that is using stateful inspection.

DISCOVER the purpose of Header fields used in TCP /IP: i. Sequence Numberii. Fragment offsetiii. Urgent Pointeriv. Header Checkv. Option + Padding

IL PCAP Scanner alert udp any 61348 -> any any (content: "109 69 63 61 6e 68 61 7a 69 70 03 63 6f 6d 001; msg: "DNS Test"; Sid:1000001) Question Number 2 Scan The scan results for your snort rule will be displayed below. There is a problem with your rule. Check the alerts below to determine what went wrong and then try again. Something went wrong with your snort rule. Check the Syntax Syntax error please help! Create a rule to detect DNS requests to 'icanhazip', then test the rule with the scanner and submit the token. O X

When HTTP streaming is being used, are the TCP receive buffer and the application buffer on the client both the same thing? If they are unable to speak with one another, it is unclear how they will behave toward one another.

Given IPV6 address 7000:0db8: cafe: 0000:0835:0000: 0000:0100. Write the most compressed form after applying Omit leading and Omit all 0 segments

Place the fields in the correct order BEGIN PACKETBEGIN PACKET   1. SOURCE PORT 2. ACKNOWLEDGEMENT FIELD SIGNIFICANT 3. DATA 4. PUSH FUNCTION 5. DATA OFFSET 6. DESTINATION PORT 7. CHECKSUM 8. RESERVED 9. URGENT.POINTER FIELD SIGNIFICANT 10. OPTIONS 11. RESET THE CONNECTION 12. SEQUENCE NUMBER 13. ACKNOWLEDGMENT NUMBER 14. NO MORE DATA FROM SENDER 15. SYNCHRONIZE SEQUENCE NUMBERS 16. URGENT POINTER 17. PADDING 18. WINDOW

It is important to keep in mind that the reordering and reassembly of packets takes place during the transport step of the TCP/IP protocol suite. The Internet or the data layer are two examples of lower levels of abstraction that a firewall is able to function at. If a traffic stream is either out of order or has been deleted, a firewall that uses stateful inspection will be unable to determine anything about the stream's contents.

Determine whether or not the following IPv6 address notations are correct:•::0F53:6382:AB00:67DB:BB27:7332•7803:42F2:::88EC:D4BA:B75D:11CD•::4BA8:95CC::DB97:4EAB•74DC::02BA•::00FF:128.112.92.116

Remember that packet reordering and reassembly take place during the transport step of the TCP/IP protocol suite. A firewall can operate at a lower level of abstraction, such as the Internet or the data layer. A stateful inspection firewall will not be able to determine anything about a traffic stream if it is out of order or has been deleted.