HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
Net Engineer 1 Boek Samenvatting
Belangrijke begrippen/concepten uit de boeken ‘Computer
Networking…’ en ‘Network Forensics...’.
Deze samenvatting is ook verbeterd en aangevuld met belangrijke informatie die op het
tentamen van het vak Net Engineer 1 voorkwam. Het cijfer dat ik met de eerste versie van
deze samenvatting heb gehaald is een 7.5. Het is belangrijk om de begrippen en de
betekenissen te onthouden en vooral de concepten goed te begrijpen. Tijdens het tentamen
moet je soms begrippen matchen met betekenissen en soms andersom. Het is ook handig
om de powerpoints uit de lessen goed te begrijpen, waarbij deze samenvatting een
aanvulling is.
De boeken waarvan de samengevatte hoofdstukken zijn worden aangegeven door:
- (CN) -- Computer Networking, a top-down approach, 7th edition
- (NF) -- Network Forensics, tracking hackers through cyberspace
Deze samenvatting van de boeken is in het Engels geschreven.
Table of Contents
Table of Contents 1
Week 1 3
(CN) 3.5 Connection-Oriented Transport: TCP 3
(CN) 3.7 TCP Congestion Control 4
Week 2 5
(CN) 2.4 DNS - The Internet’s Directory Service 5
(CN) 5.2 Routing Algorithms 7
(CN) 5.3 Intra-AS Routing in the Internet: OSPF 8
(CN) 5.4 Routing Among the ISPs: BGP 9
Week 3 11
(CN) 4.4 Generalized Forwarding and SDN 11
(CN) 5.1 Introduction 11
(CN) 5.5 The SDN Control Plane 12
(CN) 5.7 Network Management and SNMP 13
(CN) 6.4 Switched Local Area Networks 14
Week 4 15
(CN) 6.4 Switched Local Area Networks 15
(CN) 6.6 Data Center Networking 17
(CN) 6.7 Retrospective: A Day in the Life of a Web Page Request 18
(CN) 7.1 Introduction Wireless and Mobile Networks 19
,HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
(CN) 7.2 Wireless Links and Network Characteristics 20
(CN) 7.3 WiFi: 802.11 Wireless LANs 21
(CN) 8.8 Securing Wireless LANs 23
Week 5 24
(CN) 8.4 End-Point Authentication 24
Week 6 25
(NF) 1. Practical Investigative Strategies 25
(NF) 7. Network Intrusion Detection and Analysis 27
(NF) 9. Switches, Routers and Firewalls 29
(NF) 10. Web Proxies 32
(NF) 12. Malware Forensics 34
Extra concepts from the exam but mentioned not in the book 35
,HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
Week 1
(CN) 3.5 Connection-Oriented Transport: TCP
Chapter 3.5 (except 3.5.3 - 3.5.5) already covered in Infrastructure Book Notes. Skipping..
New paragraphs (3.5.3 - 3.5.5).
- The SampleRTT for a segment is the amount of time between sending and receiving
an acknowledgment for the segment. Often only one measurement is sent at a time.
- EstimateRTT is the average/typical RTT and its calculated by:
EstimatedRTT = (1−α) ⋅ previous EstimatedRTT + α ⋅ SampleRTT
with recommended α = 0.125 (that is, 1/8), so:
EstimatedRTT = 0.875 ⋅ previous EstimatedRTT + 0.125 ⋅
SampleRTT
- DevRTT is an estimate of how much SampleRTT typically deviates from
EstimatedRTT.
DevRTT = (1−β) ⋅ DevRTT + β ⋅ |SampleRTT − EstimatedRTT|
- TCP creates a reliable data transfer service on top of IP’s unreliable best-effort
service.
- A sends one segment to B. Seq = 92 and contains 8 bytes. Host A will wait on
ACK 100. If ACK to B gets lost, A retransmits the segment. B sees Seq = 92,
discards bytes in the retransmitted segment and sends ACK again.
- A duplicate ACK is when the sender gets the same ACK as received earlier.
- When three duplicate ACKS are received by the sender, it means that the
segment following the segment that has been ACKed three times has been
lost. The TCP sender performs a fast retransmit, retransmitting the missing
segment before the timer expires.
- A proposed modification to TCP, so-called selective acknowledgment allows TCP
receiver to ack out-of-order segments selectively rather than just cumulatively ack-ing
the last correctly received in-order segment.
- TCP provides a flow-control service, which is a speed-matching service, to
eliminate the possibility of the sender overflowing the receiver’s buffer. A TCP sender
can also be throttled due to congestion within the IP network; this form of sender
control is referred to as congestion control.
- Flow control happens by having the sender maintain a variable called the
receive window.
LastByteRcvd − LastByteRead ≤ RcvBuffer
- Receive window (rwnd) is set to the amount of spare room in the buffer:
rwnd = RcvBuffer − [LastByteRcvd − LastByteRead]
Because the spare room changes with time, the rwnd is dynamic.
, HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
- UDP does not provide flow control and consequently, segments may be lost at the
receiver due to buffer overflow. If the process does not read the segments fast
enough from the buffer, the buffer will overflow and segments will get dropped.
Chapter 3.5.6 is already covered in Infrastructure Book Notes. Skipping..
(CN) 3.7 TCP Congestion Control
- The TCP congestion-control mechanism operating at the sender keeps track of an
additional variable, the congestion window.
- The congestion window (cwnd) imposes a constraint on the rate at which a
TCP sender can send traffic into the network.
LastByteSent − LastByteAcked ≤ min{cwnd, rwnd}
- The dropped datagram, in turn, results in a loss event at the sender - either a
timeout or the receipt of three duplicate ACKs - which is taken by the sender
to be an indication of congestion on the sender-to-receiver path.
- Because TCP uses acknowledgments to trigger (or clock) its increase in
congestion window size, TCP is said to be self-clocking.
- TCP has the following guiding principles:
- A lost segment implies congestion, and hence, the TCP sender’s rate should
be decreased when a segment is lost.
- An acknowledged segment indicates that the network is delivering the
sender’s segments to the receiver, and hence, the sender’s rate can be
increased when an ACK arrives for a previously unacknowledged segment.
- Bandwidth probing. ACKs and loss events serve as implicit signals and each
TCP sender acts on local information asynchronously from other TCP
senders.
- TCP congestion-control algorithm has three major components:
- Slow start (just as can be seen when downloading a game from steam for
example).
- Congestion avoidance.
- Fast recovery (as for example is done when three ACKs are sent).
- TCP congestion control is often referred to as an additive-increase,
multiplicative-decrease (AIMD) form of congestion control.
- The TCP Vegas algorithm attempts to avoid congestion while maintaining good
throughput. The basic idea of Vegas is to (1) detect congestion in the routers
between source and destination before packet loss occurs (2) lower the rate when
this imminent packet loss is detected.
Covered up until Macroscopic Description of TCP Throughput (page 320) as it was
mentioned by the teacher as not important for the exam.
Net Engineer 1 Boek Samenvatting
Belangrijke begrippen/concepten uit de boeken ‘Computer
Networking…’ en ‘Network Forensics...’.
Deze samenvatting is ook verbeterd en aangevuld met belangrijke informatie die op het
tentamen van het vak Net Engineer 1 voorkwam. Het cijfer dat ik met de eerste versie van
deze samenvatting heb gehaald is een 7.5. Het is belangrijk om de begrippen en de
betekenissen te onthouden en vooral de concepten goed te begrijpen. Tijdens het tentamen
moet je soms begrippen matchen met betekenissen en soms andersom. Het is ook handig
om de powerpoints uit de lessen goed te begrijpen, waarbij deze samenvatting een
aanvulling is.
De boeken waarvan de samengevatte hoofdstukken zijn worden aangegeven door:
- (CN) -- Computer Networking, a top-down approach, 7th edition
- (NF) -- Network Forensics, tracking hackers through cyberspace
Deze samenvatting van de boeken is in het Engels geschreven.
Table of Contents
Table of Contents 1
Week 1 3
(CN) 3.5 Connection-Oriented Transport: TCP 3
(CN) 3.7 TCP Congestion Control 4
Week 2 5
(CN) 2.4 DNS - The Internet’s Directory Service 5
(CN) 5.2 Routing Algorithms 7
(CN) 5.3 Intra-AS Routing in the Internet: OSPF 8
(CN) 5.4 Routing Among the ISPs: BGP 9
Week 3 11
(CN) 4.4 Generalized Forwarding and SDN 11
(CN) 5.1 Introduction 11
(CN) 5.5 The SDN Control Plane 12
(CN) 5.7 Network Management and SNMP 13
(CN) 6.4 Switched Local Area Networks 14
Week 4 15
(CN) 6.4 Switched Local Area Networks 15
(CN) 6.6 Data Center Networking 17
(CN) 6.7 Retrospective: A Day in the Life of a Web Page Request 18
(CN) 7.1 Introduction Wireless and Mobile Networks 19
,HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
(CN) 7.2 Wireless Links and Network Characteristics 20
(CN) 7.3 WiFi: 802.11 Wireless LANs 21
(CN) 8.8 Securing Wireless LANs 23
Week 5 24
(CN) 8.4 End-Point Authentication 24
Week 6 25
(NF) 1. Practical Investigative Strategies 25
(NF) 7. Network Intrusion Detection and Analysis 27
(NF) 9. Switches, Routers and Firewalls 29
(NF) 10. Web Proxies 32
(NF) 12. Malware Forensics 34
Extra concepts from the exam but mentioned not in the book 35
,HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
Week 1
(CN) 3.5 Connection-Oriented Transport: TCP
Chapter 3.5 (except 3.5.3 - 3.5.5) already covered in Infrastructure Book Notes. Skipping..
New paragraphs (3.5.3 - 3.5.5).
- The SampleRTT for a segment is the amount of time between sending and receiving
an acknowledgment for the segment. Often only one measurement is sent at a time.
- EstimateRTT is the average/typical RTT and its calculated by:
EstimatedRTT = (1−α) ⋅ previous EstimatedRTT + α ⋅ SampleRTT
with recommended α = 0.125 (that is, 1/8), so:
EstimatedRTT = 0.875 ⋅ previous EstimatedRTT + 0.125 ⋅
SampleRTT
- DevRTT is an estimate of how much SampleRTT typically deviates from
EstimatedRTT.
DevRTT = (1−β) ⋅ DevRTT + β ⋅ |SampleRTT − EstimatedRTT|
- TCP creates a reliable data transfer service on top of IP’s unreliable best-effort
service.
- A sends one segment to B. Seq = 92 and contains 8 bytes. Host A will wait on
ACK 100. If ACK to B gets lost, A retransmits the segment. B sees Seq = 92,
discards bytes in the retransmitted segment and sends ACK again.
- A duplicate ACK is when the sender gets the same ACK as received earlier.
- When three duplicate ACKS are received by the sender, it means that the
segment following the segment that has been ACKed three times has been
lost. The TCP sender performs a fast retransmit, retransmitting the missing
segment before the timer expires.
- A proposed modification to TCP, so-called selective acknowledgment allows TCP
receiver to ack out-of-order segments selectively rather than just cumulatively ack-ing
the last correctly received in-order segment.
- TCP provides a flow-control service, which is a speed-matching service, to
eliminate the possibility of the sender overflowing the receiver’s buffer. A TCP sender
can also be throttled due to congestion within the IP network; this form of sender
control is referred to as congestion control.
- Flow control happens by having the sender maintain a variable called the
receive window.
LastByteRcvd − LastByteRead ≤ RcvBuffer
- Receive window (rwnd) is set to the amount of spare room in the buffer:
rwnd = RcvBuffer − [LastByteRcvd − LastByteRead]
Because the spare room changes with time, the rwnd is dynamic.
, HBO-ICT, Jaar 1, Net Engineer 1 BraveBurger
- UDP does not provide flow control and consequently, segments may be lost at the
receiver due to buffer overflow. If the process does not read the segments fast
enough from the buffer, the buffer will overflow and segments will get dropped.
Chapter 3.5.6 is already covered in Infrastructure Book Notes. Skipping..
(CN) 3.7 TCP Congestion Control
- The TCP congestion-control mechanism operating at the sender keeps track of an
additional variable, the congestion window.
- The congestion window (cwnd) imposes a constraint on the rate at which a
TCP sender can send traffic into the network.
LastByteSent − LastByteAcked ≤ min{cwnd, rwnd}
- The dropped datagram, in turn, results in a loss event at the sender - either a
timeout or the receipt of three duplicate ACKs - which is taken by the sender
to be an indication of congestion on the sender-to-receiver path.
- Because TCP uses acknowledgments to trigger (or clock) its increase in
congestion window size, TCP is said to be self-clocking.
- TCP has the following guiding principles:
- A lost segment implies congestion, and hence, the TCP sender’s rate should
be decreased when a segment is lost.
- An acknowledged segment indicates that the network is delivering the
sender’s segments to the receiver, and hence, the sender’s rate can be
increased when an ACK arrives for a previously unacknowledged segment.
- Bandwidth probing. ACKs and loss events serve as implicit signals and each
TCP sender acts on local information asynchronously from other TCP
senders.
- TCP congestion-control algorithm has three major components:
- Slow start (just as can be seen when downloading a game from steam for
example).
- Congestion avoidance.
- Fast recovery (as for example is done when three ACKs are sent).
- TCP congestion control is often referred to as an additive-increase,
multiplicative-decrease (AIMD) form of congestion control.
- The TCP Vegas algorithm attempts to avoid congestion while maintaining good
throughput. The basic idea of Vegas is to (1) detect congestion in the routers
between source and destination before packet loss occurs (2) lower the rate when
this imminent packet loss is detected.
Covered up until Macroscopic Description of TCP Throughput (page 320) as it was
mentioned by the teacher as not important for the exam.
