Networking Assignment and Wireshark Lab, Quiz Example

Question1

Subnet

An internal connection is called a subnet. Networks become more effective with subnetworks. Thanks to subnetting, a communication network can go a smaller area to its destinations without using extraneous routers.

Prefix

Prefix serves as a unit of measure for huge numbers. In networking, prefixes like 10.0.0/8 and 10.0.0/24 are employed to characterize many hosts and networks.

BGP route

The gateway mechanism known as Border Gateway Protocol (BGP) allows the internet to transmit routing data among autonomous computers (AS). Systems connect a method of communication whenever they communicate with one another. Peering provides for the accomplishment of this.

Question2

The matched interface for the five host addresses.

(These addresses are shown in order from Link Interface through Destination Address Ranges.)

01110000 to 10111111 0

10100000 to 10111111 1

11000000 to 10111111 2

11010000 to 10111111 2

11110000 to 10111111 3

Question3

1. MAC address space is 48bits long. They are divided into two halves: the Organizationally Distinctive Identification (OUI) formed by the initial 24 bits and the serial number formed by the final 24 bits (formally called an extension identifier).
2. Ipv4 is 32bit long. There are 4,294,967,296 (232) different numbers available in the 32-bit Ipv4 and ipv6 space, although significant blocks are set aside for technical network communication.
3. The ipv6 address is 128bit long. Consequently, there really are 2128=340,282,366,920,938,463,463,374,607,431,768,211,456 addresses in the main memory (or roughly 3.41038 addresses). This satellite’s blocks and some particular addresses are set aside for special purposes.

Question4

After the fifth interaction, the node will select a K value randomly between 0 to 31 (i.e., 0 to 1, 1, 2,…, 25 – 1). The node will now wait for K*512-bit intervals following selecting K=4. The bit rate of Ethernet at 10 Mbps is 0.1 microseconds. As a result, the total node’s average wait time is 4 * 512 * 0.1 microseconds or 204.8 microseconds.

Question5

Key management issues, practical implications, and general encryption method vulnerability are the main WEP of 802.11 networking flaws. Although WEP may make it more difficult for attackers, it offers no actual protection from a dedicated intruder.

The other concern is the lack of physical barriers, which makes wireless LANs more vulnerable. These are vulnerable to all known attacks on wired LANS, including espionage, jamming, intrusion, and many others.

The original remote monitoring standard (WEP) has security issues resolved by WPA due to TKIP encryption, which is superior to WEP’s fixed-key encrypted communications and a 256-bit encrypted message.

Question6

A collection of protocols known as IPsec are used to establish secure communications among machines. Data exchanged across open networks is kept safer, thanks to it. VPNs are frequently set up using IPsec, which operates by encryption Internet protocol and verifying the source of the transmissions. The inner IP data packet is shielded against tampering, eavesdropping, information gathering, and eavesdropping by multiple layers of encrypted communications.

However, the five steps which should be followed to achieve this include the following:

1. Step 1: Fascinating traffic commences the IPSec process—Interesting communication is determined whenever the IKE procedure is launched by the Internet standard policy set in the IPSec peers.
2. Step 2: Complete IKE phase one. Throughout this step, IKE negotiates IKE SAs and authorizes IPSec peers to establish a secure negotiation channel for negotiation with IPSec SAs during phase 2.
3. IKE needs to negotiate IPSec SA specifications in step 3 and creates complementary IPSec SAs in the peers.
4. The IPSec settings and keys kept in the SA databases are used to move information among IPSec peers in Step 4.
5. Step 5: Suspension of the IPSec tunnel—IPSec SAs are deleted or time out.

Question7

Whenever a mobile node is connected to its home network, its IP address serves as its permanent address. Whenever a device visits a neighbouring network, it receives a care-of-address. The foreign entity is the one who assigns the COA. (This may be the mobile nodes or the destination node’s edge gateway.)

Question8

1. Application using outdated and unpatched technology – Using a computer system or software application that software engineers no longer maintain implies that neither fixes nor upgrades will be released to areas that need improvement. To lower your risk, it’s crucial to always upgrade to the most recent editions and run network vulnerability analysis (or have a network management security provider conduct these regular businesses).
2. Poor Password protection – By employing weaker or common passwords on an internal software package and web apps, you risk a security breach. Simple credentials are generally simple for malware attacks to decipher or for hackers to obtain, like the standard selection “password” and the company name. They ensured that the credentials one or their team used were also secure.
3. Solitary Strong Authentication – Single-step verification is the practice of logging access programs, a program, or a file with just one password. Possessing only one level of defence makes it simple to get past, even after addressing the above issue with weak passwords. To increase your privacy, we advise switching to a multi-factor authentication strategy. An unauthorized person can’t obtain access using a secure password, supplemented by secondary means, like a texting password, secret questions, or a biometric scan.

Question9

Asymmetric encryption, often referred to as cryptography and public-key encrypted communications, utilizes statistically connected public- and private-key combinations that encode and decode confidential material between senders and receivers as opposed to symmetric key encryption, which operates the very same private key for both operations.

Question10

1. False- An IP address is contained inside the actual frame employed by a network when it is transferred across that connection. This Ethernet frame may be seen to have an IP packet inside of it.
2. True- A standard internet typically provides all hosts to receive a transmission sent by one host. It uses the CSMA/CD operating system. The term “collision domain” refers to a group of hosts fighting for the same connexion. MAC has been its protocols. Each produced adaptor seems to have a 48-bit HEX identifier that is specific to it. Ip Packet Format: Type-Demultiplexing Secret, Source and Pathname Ethernet Address, Repetitive Format of 0s and 1s, Body Cargo (minimum 46 bytes and maximum 1500 bytes) 802.11 still uses that were, has complicated broadcast domain, operates via CSMA/CA, and uses an enhanced MAC protocol without slot restriction. Prologue, PLCP header, and MAC PDU make up the 802.11 fame protocol (34-2346).

THE LAB ASSIGNMENT

Question1

Question2

Content Type = 1 byte

Version = 2 bytes

Size or length = 2 bytes

Question3

It is clear that the classification result again for the handshake message, which is 22, is 22. The client hello record’s interaction type inside the capture is 01, according to the image.

Question4

The problem sent by the client hello is as continues to follow: 66df 784c 048c d604 35dc 4489 8946 9909.

Question5

The primary suite incorporates the MD5 hash computation, RC4 for the symmetric-key calculation, and RSA for entrance control encryption.

Question6

The cypher package includes the RC4 symmetric-key cypher, RSA for open key cryptography, and the MD5 hash function.

Question7

Yes, a sequence number registered beneath Randomized exists present in this record. In the nonce, 32 bits total—28 for information and 4 for time. The goal is to continue the retransmission.

Question8

Yes, indeed, it does. It provides the SSL session, which is supplied for free, with a unique persistent identifier. By using the session ID provided by the server whenever it receives the ClientHello, the customer can resume the very same session later.

Question9

No, there isn’t a certification included in this file. These individual records include the certificate. A standard Ethernet frame did fit the accreditation. The information is contained in another document. It can be controlled in a single Ethernet outline.

Question10

A consists secret is contained in the client key. It is used to construct expert mysteries used by both the server and the client to generate shared keys enabling MAC and encryption. The server’s accessible secret, which even the client extracted from the server’s authorization, is used to encrypt its mystery. One hundred twenty-eight bytes make up the mystery.

Question11

The Changing Cipher Spec record’s purpose is to show that the body—not the header—of the following SSL recordings supplied by the client will be encrypted. Every title of this record is 5 bytes long, and the message part comprises 1 byte long.

Question12

All previous handshake communications supplied by this client are produced into a MAC of relationship and forwarded to the server.

Question13

Yes, because the server will also transmit an encrypted handshake and a Change Cipher Spec information to the client. The encrypted handshake recording supplied by the server differs from that sent by the client because it includes the links to all the greeting information conveyed from the server rather than the customer. Typically, the data might turn out to be identical.

We can conclude that all the handshake information conveyed by the server is included in the encryption handshake. Other includes messages that clients have sent.

Question14

Applications information is encrypted to use the symmetric encryption algorithm (RC4) chosen during the handshake step, which uses keys made and utilized by the pre-expert key and nonces from both client and the server. Technologies that allow the client to the server are encrypted using the client encryption method, and data transmitted from the server to the client is encrypted using the server encryption algorithm.

The application’s data is encrypted using the symmetric encryption technique. A MAC is present in the records that carry application data. No, Wireshark didn’t distinguish between MAC and the encrypted application programs.

Question15

Since everything functions as intended, I have no more comments on this.