CS6250 COMPUTER NETWORKS EXAM 2
2026/2027 WITH ACTUAL CORRECT
QUESTIONS AND VERIFIED DETAILED
ANSWERS |CURRENTLY TESTING
QUESTIONS AND SOLUTIONS|ALREADY
GRADED A+|NEWEST |BRAND NEW
VERSION|JUST RELEASED!!
What metrics does Iris use to identify DNS manipulation once data annotation is complete?
Describe the metrics. Under what condition do we declare the response as being manipulated?
o 1. Consistency Metrics - domains should have some consistency, interms of network
properties, infrastructure, or content, even when accessed from different global vantage points
o Independent Verifiability Metrics - metrics that could be externally verified using external data
sources such as HTTPS certificate (whether the IP address presents a valid, browser-trusted
certificate for the correct domain name when queries without SNI) and HTTPS certificates with
SNI
o If any consistency metric or independent verifiability metric is satisfied, the response is
correct; otherwise the response is classified as manipulated
How is it possible to achieve connectivity disruption using the routing disruption approach?
o Routers use BGP to communicate updates to other updates to other routers in the network,
the routers share which destinations it can reach and continuously update its forwarding tables
to select the best path for an incoming packet
1|Page
,o If this communication is disrupted or disabled on critical routers, it could result in
unreachability of large parts of a network
o This approach is easy to detect as it disrupts the global routing state of the network
How is it possible to achieve connectivity disruption using the packet filtering approach?
o Packet filtering can be used to block packets matching a certain criteria disrupting the normal
forwarding action
o This approach can be harder to detect and might require active probing of the forwarding
path or monitoring the traffic of the impacted network
Explain a scenario of connectivity disruption detection in the case when no filtering occurs.
o 1. The measurement machine probes the IP ID of the reflector by sending a TCP SYN-Ack
packet
§ It receives a RST response packet with IP ID set to 6
o 2. Now, the measurement machine performs perturbation by sending a spoofed TCP SYN to
the site
o 3. The site sends a TCP SYN-ACK packet to the reflector and receives a RST packet as a
response
§ The IP ID of the reflector is now incremented to 7
o 4. The measurement machine again probes the IP ID of the reflector and receives a response
with the IP ID value set to 8
o The measurement machine thus observes that the difference in IP ID's between steps 1 and 4
is two and infers that communication occurred between the two hosts
Explain a scenario of connectivity disruption detection in the case of inbound blocking.
o The scenario where filtering occurs on the path form the site to the reflector is termed as
inbound blocking
o In this case, the SYN-ACK packet sent form the site in step 3 does not reach the reflector
§ Hence, there is no response generated and the IP ID of the reflector does not increase
o The returned IP ID in step 4 will be 7
2|Page
,o Since the measurement machine observes the increment in IP ID value as 1, it detects filtering
on the path from the side to the reflector
Explain a scenario of connectivity disruption detection in the case of outbound blocking.
o Outbound blocking is the filtering imposed on the outgoing path from the reflector
o Here, the reflector receives the SYN-ACK packet and generates a RST packet
o As per our example, the IP ID increments to 7
§ However, the RST packet does not reach the site
o When the site does not receive a RST packet, it continues to send the SYN-ACK packets at
regular intervals depending on the sites' OS and its configurations
§ It results in further increment of the IP ID value of the reflector
o The probe by the measurement machine reveals the IP ID has again increased by 2, which
shows that retransmission of packets has occurred
§ In this way, outbound blocking can be detected
Compare the bit rate for video, photos, and audio.
o Video has a high bit rate, generally somewhere between 100 kbps to over 3 Mbps, depending
on video quality
o Video > Photos > Audio
What are the characteristics of streaming stored video?
o The video will start playing within a few seconds of receiving data, instead of waiting for the
entire file to download first
o It's also interactive, which means the user can pause, fast forward, skip ahead or move back in
the video, and then see the response in a few seconds
o Streaming stored video should also have continuous playout, which means that it should play
out the same way it was recorded without freezing up in the middle
What are the characteristics of streaming live audio and video?
3|Page
, o Very similar to streaming stored video or audio, and uses similar techniques, with some
important differences
o Since they are live, there are generally many simultaneous users
o They are also delay-sensitive, but not as much as conversational voice and video applications
are (10 second delay is ok)
What are the characteristics of conversational voice and video over IP?
o VoIP is like a phone service that goes over the internet instead of through traditional circuit-
switched telephony network
o Since these calls are real time, they are highly delay-sensitive (> 400 milliseconds is too high
delay)
o These applications are loss-tolerant (there are techniques to conceal glitches, and humans are
able to repeat what they said if need be)
How does the encoding of analog audio work (in simple terms)?
o Audio is encoded by taking many (as in thousands) of samples per second, and then rounding
each sample's value to a discrete number within a particular range (this "rounding" to a discrete
number is called quantization)
What are the three major categories of VoIP encoding schemes?
o Narrowband, broadband, and multimode (which can operate on either)
What are the functions that signaling protocols (traditional telephony) are responsible for?
o 1. User location - the caller locating where the callee is
o 2. Session establishment - handling the callee accepting, rejecting, or redirecting a call
o 3. Session negotiation - the endpoints synchronizing with each other on a set of properties for
the session
o 4. Call participation management - handling endpoints joining or leaving an existing session
What are three QoS VoIP metrics?
o End-to-end delay, jitter, packet loss
4|Page
2026/2027 WITH ACTUAL CORRECT
QUESTIONS AND VERIFIED DETAILED
ANSWERS |CURRENTLY TESTING
QUESTIONS AND SOLUTIONS|ALREADY
GRADED A+|NEWEST |BRAND NEW
VERSION|JUST RELEASED!!
What metrics does Iris use to identify DNS manipulation once data annotation is complete?
Describe the metrics. Under what condition do we declare the response as being manipulated?
o 1. Consistency Metrics - domains should have some consistency, interms of network
properties, infrastructure, or content, even when accessed from different global vantage points
o Independent Verifiability Metrics - metrics that could be externally verified using external data
sources such as HTTPS certificate (whether the IP address presents a valid, browser-trusted
certificate for the correct domain name when queries without SNI) and HTTPS certificates with
SNI
o If any consistency metric or independent verifiability metric is satisfied, the response is
correct; otherwise the response is classified as manipulated
How is it possible to achieve connectivity disruption using the routing disruption approach?
o Routers use BGP to communicate updates to other updates to other routers in the network,
the routers share which destinations it can reach and continuously update its forwarding tables
to select the best path for an incoming packet
1|Page
,o If this communication is disrupted or disabled on critical routers, it could result in
unreachability of large parts of a network
o This approach is easy to detect as it disrupts the global routing state of the network
How is it possible to achieve connectivity disruption using the packet filtering approach?
o Packet filtering can be used to block packets matching a certain criteria disrupting the normal
forwarding action
o This approach can be harder to detect and might require active probing of the forwarding
path or monitoring the traffic of the impacted network
Explain a scenario of connectivity disruption detection in the case when no filtering occurs.
o 1. The measurement machine probes the IP ID of the reflector by sending a TCP SYN-Ack
packet
§ It receives a RST response packet with IP ID set to 6
o 2. Now, the measurement machine performs perturbation by sending a spoofed TCP SYN to
the site
o 3. The site sends a TCP SYN-ACK packet to the reflector and receives a RST packet as a
response
§ The IP ID of the reflector is now incremented to 7
o 4. The measurement machine again probes the IP ID of the reflector and receives a response
with the IP ID value set to 8
o The measurement machine thus observes that the difference in IP ID's between steps 1 and 4
is two and infers that communication occurred between the two hosts
Explain a scenario of connectivity disruption detection in the case of inbound blocking.
o The scenario where filtering occurs on the path form the site to the reflector is termed as
inbound blocking
o In this case, the SYN-ACK packet sent form the site in step 3 does not reach the reflector
§ Hence, there is no response generated and the IP ID of the reflector does not increase
o The returned IP ID in step 4 will be 7
2|Page
,o Since the measurement machine observes the increment in IP ID value as 1, it detects filtering
on the path from the side to the reflector
Explain a scenario of connectivity disruption detection in the case of outbound blocking.
o Outbound blocking is the filtering imposed on the outgoing path from the reflector
o Here, the reflector receives the SYN-ACK packet and generates a RST packet
o As per our example, the IP ID increments to 7
§ However, the RST packet does not reach the site
o When the site does not receive a RST packet, it continues to send the SYN-ACK packets at
regular intervals depending on the sites' OS and its configurations
§ It results in further increment of the IP ID value of the reflector
o The probe by the measurement machine reveals the IP ID has again increased by 2, which
shows that retransmission of packets has occurred
§ In this way, outbound blocking can be detected
Compare the bit rate for video, photos, and audio.
o Video has a high bit rate, generally somewhere between 100 kbps to over 3 Mbps, depending
on video quality
o Video > Photos > Audio
What are the characteristics of streaming stored video?
o The video will start playing within a few seconds of receiving data, instead of waiting for the
entire file to download first
o It's also interactive, which means the user can pause, fast forward, skip ahead or move back in
the video, and then see the response in a few seconds
o Streaming stored video should also have continuous playout, which means that it should play
out the same way it was recorded without freezing up in the middle
What are the characteristics of streaming live audio and video?
3|Page
, o Very similar to streaming stored video or audio, and uses similar techniques, with some
important differences
o Since they are live, there are generally many simultaneous users
o They are also delay-sensitive, but not as much as conversational voice and video applications
are (10 second delay is ok)
What are the characteristics of conversational voice and video over IP?
o VoIP is like a phone service that goes over the internet instead of through traditional circuit-
switched telephony network
o Since these calls are real time, they are highly delay-sensitive (> 400 milliseconds is too high
delay)
o These applications are loss-tolerant (there are techniques to conceal glitches, and humans are
able to repeat what they said if need be)
How does the encoding of analog audio work (in simple terms)?
o Audio is encoded by taking many (as in thousands) of samples per second, and then rounding
each sample's value to a discrete number within a particular range (this "rounding" to a discrete
number is called quantization)
What are the three major categories of VoIP encoding schemes?
o Narrowband, broadband, and multimode (which can operate on either)
What are the functions that signaling protocols (traditional telephony) are responsible for?
o 1. User location - the caller locating where the callee is
o 2. Session establishment - handling the callee accepting, rejecting, or redirecting a call
o 3. Session negotiation - the endpoints synchronizing with each other on a set of properties for
the session
o 4. Call participation management - handling endpoints joining or leaving an existing session
What are three QoS VoIP metrics?
o End-to-end delay, jitter, packet loss
4|Page
