Cissp Sunflower

- used in applications that are dedicated, such as embedded systems, when individual processors can be dedicated to specific tasks at design time.

FTP, SNMP, TELNET, TFTP, SMTP, HTTP, NNTP, CDP, GOPHER, SMB, NDS, AFP, SAP, NCP, SET, LDAP. Technology: Gateways. User data

encrypting HTTP documents. Also overtaken by SSL

encryption technology to provide secure transactions like credit card numbers exchange. Two layered: SSL record protocol and handshake protocol. Same as SSH it uses symmetric encryption for private connections and asymmetric or public key cryptography for peer authentication.

authentication for credit card transactions. Overtaken by SSL Also uses message authentication code for integrity checking.

terminal emulation enables user to access resources on another machine. Port 23

for file transfers. Cannot execute remote files as programs. Authentication. Port 20 and 21

stripped down, can only send/receive but not browse directories. No authentication thus insecure. Port 69

email queuing. Port 25 (UDP)

collection of network information by polling the devices from a management station. Sends out alerts -called traps- to an database called Management Information Bases (MIBs)

Translations like EBCDIC/ANSI; compression/decompression and encryption/decryption. Uses a common format to represent data, Standards like JPEG, TIFF, MID, HTML; Technology: Gateway. Messages

Inter-host communication, logical persistent connection between peer hosts, a conversation, simplex, half duplex, full duplex. Protocols as NFS, SQL, RADIUS, and RPC. Protocols: PAP, PPTP, RPC Technology: Gateway PAP - Password Authentication Protocol PPTP - Point-to-Point Tunneling Protocol RPC - Remote Procedure Call Protocol

protocol that supports file sharing between two different file systems

End-to-end data transfer services and reliability. Technology: Gateways. Segmentation, sequencing, and error checking at this layer. Datagrams

SYN, SYN-/ACK, ACK Protocols: TCP, UDP, SSL, SSH-2, SPX, NetBIOS, ATP

Authentication, compression, confidentiality and integrity. Uses RSA certificates for authentication and triple DES for encryption

reliable, sequences and works with acknowledgements. Provides a manageable data flow to avoid congestions overloading and data loss. (Like having a telephone conversation with someone). Connection Oriented.

unreliable, scaled down version of TCP, no error correction, no sequencing. Less overhead. (Like sending a letter to someone). Connectionless.

Path selection and logical/network addressing. Technology: Virtual circuits (ATM), routers.

- IP uses the destination IP to transmit packets thru networks until delivered

IP will subdivide a packet if its size is greater than the maximum allowed on a local network Message routing, error detection and control of node data are managed. IP, IPSEC, ICMP, BGP, OSPF, RIP, BOOTP, DHCP, ZIP, DDP, X.25, NAT and IGMP

routing protocol short path

provides high availability in encrypted sessions to protect against crashes. Exchanges keys on a session by session basis.

Used to match an IP address to a hardware MAC address. ARP sends out broadcast to a network node to reply with its hardware address. It stores the address in a dynamic table for the duration of the session, so ARP requests are only sent the first time

sends messages between network nodes regarding the health of the network. Also informs about rerouting in case of errors. Utility PING uses ICMP messages to check physical connectivity of the network machines IPX, Appletalk, and NetBEUI are non-IP protocols. IP, Internet protocol - all hosts have an IP address. Each data packet has an IP address of sender and recipient. Routing in network is based upon these addresses. Datagram service is considered unreliable because there's no guarantee that the packet will be delivered, not even that its delivered only once and no guarantee that its delivered in the same sequence that its sent 32 bits long, IPv6 is 128 bits long

DHCP: Dynamic Host Configuration Protocol

when wireless workstation is on-line it sends out a BootP request with its MAC address to get an IP address and the file from which it should boot. Replaced by DHCP

This layer deals with addressing physical hardware. FRAMES Translates data into bits and formats them into data frames with destination header and source address. Error detection via checksums. LLC, the Logical Link Control Sub layer - Flow control and error notification

Physical addressing. Concerns frames, logical topologies and MAC-addresses Protocols: L2F, PPTP, L2TP, PPP, SLIP, ARP, RARP, SLARP, IARP, SNAP, BAP, CHAP, LCP, LZS, MLP, Frame Relay, Annex A, Annex D, HDLC, BPDU, LAPD, ISL, MAC, Ethernet, Token Ring, FDDI

When a hardware address is known but the IP address has to be found. (like an diskless machine) Switches, bridges, hardware addressing

Developed by Department of Defense in the 1970s to support the construction of the internet (Hubs, Cables, Modem)

for printing and spooling

graphical user interface

- All users can access all data. - Clearance for all information. - Need to know for ALL data system high security mode: - All users can access some data, based on need to know - Clearance for all information - Need to know for SOME data compartmented security mode: - All users can access some data, based on their need to know and approval. - Clearance for all information they access - Need to know for SOME data - Use of information labels Multi-level: - All users can access some data, based on their need to know, approval and clearance. - Clearance for all information they access - Need to know for SOME data Others: controlled type of multilevel security where a limited amount of trust is placed in the system's hardware/software along with classification limited access: minimum user clearance is not cleared and the maximum data classification is unclassified but sensitive

A method of guarding a private network by analyzing the data leaving and entering. Firewalls can also provide network address translation, so the IP addresses of computers inside the firewall stay hidden from view.

use rules based on a packet's source, destination, port or other basic information to determine whether or not to allow it into the network.

have access to information such as; conversation, look at state table and context of packets; from which to make their decisions.

which look at content and can involve authentication and encryption, can be more flexible and secure but also tend to be far slower.

looks at header of packet only, protects wide range of protocols and services than app-level proxy, but as detailed a level of control. Basically once the circuit is allowed all info is tunneled between the parties. Although firewalls are difficult to configure correctly, they are a critical component of network security.

802.11 2 Mbps 2.4 GHz FHSS/DSSS 802.11a 54 Mbps 5 GHz 150 - OFD A 802.11b 11 Mbps 2.4 GHz 300 - DSSSS b/g/n 802.11g 54 Mbps 2.4 GHz 300 b/g/n 802.11n 200+ Mbps 2.4 or 5 GHz 300 a/b/g 802.11ac 1 Gbps 5 GHz 300 a/b/g 802.16 IEEE 802 WBA 802.11i AES CCMP WPA2

Secure remote procedure call (SRA)

Secure Shell over Telnet for remote server administration via the command line

network number values begin at 1 and end at 127

network number values begin at 128 and end at 191

network number values begin at 192 and end at 223

channel 64Kbps, D-channel 16Kbps

and D-channels are 64Kbps

has CSMA/CA as protocol. Can use DSSS and FHSS (ss stands for spread spectrum)

uses only DSSS

Before a computer can communicate with the internet, it needs an IP-address, a default gateway and a subnet mask To connect multiple LAN segments you can use Bridges, Switches and Routers Fast Ethernet 100Base-TX has as characteristics: 100Mbps data transmission, 1 pairs Cat5 UTP and max segment of 100 meters (328 feet) Unsubnetted netmask is shown as /24 Other word for DMZ is screened subnet FTP, RLOGIN and TELNET never uses UDP but TCP

is a decrease in amplitude as a signal propagates along a transmission medium

is from 40bit to 256 bit

connects multiple networks at the data link layer

connects multiple networks at the network layer.

addresses availability, integrity and recovery but not confidentiality

contain 32-bit addresses (in IPv4) and 128 in IPv6

addresses for attached devices are 48 bits long

Class A 255.0.0.0

Class C 255.255.255.0

Class B 255.255.0.0

Uses the 802.11x specification to create a wireless LAN

directly connect two+ clients, no access point

connects endpoints to a central network, not directly to each other, need access point and wireless clients for IM mode wireless

isolated system

don't use can be cracked in seconds, predecessor to WPA and WPA2, confidentiality, uses RC4 for encryption, weakened by use of RC4 use of common key and a limited number of initialization vectors

uses TKIP for data encryption

based on 802.11i, uses AES, key management, reply attack protection, and data integrity, most secure, CCMP included, WPA2 ENTERPRISE Mode - uses RADIUS account lockout if a password-cracker is used

Temporal Key Integrity Protocol, uses RC4

Lightweight Extensible Authentication Protocol, Cisco proprietary protocol to handle problems with TKIP, security issues don't use. Provides reauthentication but was designed for WEP

many workstations, length. 1000Base-T - 100 M Twisted pair to long. Cat 5 better than cat3 for interference Fiber optics immune to EMI, can be broken and high cost/expertise Topology failures

more resistant than coaxial Token Ring because a token is passed by every station, a NIC that's is set to wrong speed or error can take all network down

form of token ring that has second ring that activates on error Leased lines use multiple lines and/or multiple vendors

over a public switched network. High Fault tolerance by relaying fault segments to working.

T-1 - 1.544 Mbps, T-3 - 44,736 Mbps (45) ATM - 155 Mbps, ISDN - 64 or 128 Mbps CAT 3 UTP; 10 Mbps, CAT 5;100 Mbps CAT 5e/6 - 1,000 Mb

Lightweight Directory Access Protocol, client/server based directory query protocol loosely based upon X.500, commonly manages user information, for accessing directory services and manage certificates Ex. Active Directory, cn=ben+ou=sales Zero or more, comma separated, no semi-colon, + to join

provides secure LDAP authentication

default, stores user PW in the clear

used to identify clients to servers via SSL (client authentication)

used for signed and encrypted emails, can form sign, and use as part of a SSO solution

MIME Object Security Services, provides authentication, confidentiality, integrity, and nonrepudiation

provides authentication, confidentiality, integrity, and nonrepudiation

Domain Keys Identified Mail, domain validation tool

ability to access resources from another service (Ex. Login with Google or Facebook)

paired with OAuth is a RESTful, JSON-based authentication protocol can provide identity verification and basic profile information, phishing attack possible by sending fake data

The first line of protection between trusted and untrusted networks. Generally includes a firewall and router that help filter traffic. May also include proxies, IDSs, and IPSs. Zero Day - application white list

device that enables more than one signal to be send out of one physical circuit

multi-port networking devices that are used in carrier networks. Connect private data over public data by using digital signals. Data link layer.

server that provides dial-in and dial-out connections to the network

transmits data over telephone lines

digital interface device used to terminate the physical interface on a DTE device. They connect to the closest telephone company switch in a central office (CO)

amplify data signals to extend range (physical)

connect multiple LAN devices into a concentrator. Is actually a multi-port repeater (physical)

Forwards data to all other network segments if it's not on the local segment. Operates at level 2 (thus no IP-addressing)

Will only send data to the specific destination address. It's actually a multi-port bridge. (Data link)

opens up data packet, reads hardware or network address and then forwards it to the correct network

software that acts as access point to another network or device that translates between different protocols

remote access, multi layer switch that connects LANs over a WAN

ISDN, cable modems, DSL, and T1/T3 lines that can support multiple simultaneous signals. They are analog and not broadcast technologies.

set of systems that can receive a broadcast from each other

- Challenge-Handshake Authentication Protocol, used by PPP servers to authenticate remote clients. Encrypts username and PW and performs periodic re authentication while connected using techniques to prevent replay attacks.

(committed Information Rate) minimum bandwidth guarantee provided by service provider to customers

set of systems that could cause a collision if they transmitted at the same time, more number of systems in domain increases likelihood of network congestion due to more collisions

occur at Application, Presentation, and Session layers.

an authentication framework. Effectively, EAP allows for new authentication technologies to be compatible with existing wireless or point-topoint connection technologies, extensible was used for PPP connections

Fiber Channel Over Ethernet, allows existing high-speed networks to be used to carry storage traffic FDDI - Fiber Distributed Data Interface, token-passing network uses a pair of rings with traffic flowing in opposite directions, uses tokens

File Transfer Protocol

Internet Control Message Protocol, means to send error messages for non-transient error conditions and provides a way to probe the network in order to determine general characteristics about the network, ping

Internet Small Computer Interface, Converged protocol that allows location-independent file services over traditional network technologies. Cost less than Fiber. Standard for linking data storage sites

PRI (Primary Rate Interface) bandwidth of 1.544 Mbps, faster than BRI's 144 Kbps

Machine Access Control, hardware address of machine, can tell manufacturer,

- allow encryption at various layers, support a range of protocols at higher levels. Bad - conceal covert channels, filters can be bypassed, sometimes logical boundaries can be bypassed

Multiprotocol Label Switching, high performance networking, uses path labels instead of network addresses, wide area networking protocol, label switching, finds final destination and then labels route for others to follow

Password Authentication Protocol, sends PW unencrypted

provides encryption for EAP methods and can provide authentication, does not implement CCMP, encapsulates EAS in a TLS tunnel

802.1x, can be used with EAP

most common, used for dial up connections, replaced SLIP

form of gateway that provide clients with a filtering, caching, or other service that protects their information from remote systems

Private Virtual Circuits

used to reset or disconnect a session, resumed by restarting the connection via a new three-way handshak

carries multiple types of traffic like voice, video, and data

a unique approach to network operation, design, and management. SDN aims at separating the infrastructure layer (i.e., hardware and hardware-based settings) from the control layer (i.e., network services of data transmission management). Furthermore, this also removes the traditional networking concepts of IP addressing, subnets, routing, and so on from needing to be programmed into or be deciphered by hosted applications. SDN offers a new network design that is directly programmable from a central location, is flexible, is vendor neutral, and is open-standards based.

may be software defined, but it could also use traditional network devices running as virtual machines

normally disabled for secure networks

identify areas where wireless network may be accessible

protocol for sending multiple optical streams over fiber

logical division of a network

made up of two or more networks

User Datagram Protocol, lightweight service for connectionless data transfer without error detection and correction

Web Application Firewall

uses WAP to link wireless clients to a wired network

hardware and software architecture where two or more identical processors are connected to a single, shared main memory, have full access to all I/O devices, and are controlled by a single operating system instance that treats all processors equally, reserving none for special purposes.

when attackers send unsolicited messages via Bluetooth

targets the data or information on Bluetoothenabled devices

when an attacker sends false replies to a requesting system, beating valid replies from the real DNS server DNS Poisoning - when an attacker changes the domain name to IP address mappings of a system to redirect traffic to alternative systems

copy actual screen, subset of remote control

Spam over Internet Telephony and targets VoIP systems

web application vulnerability scanners

- Filling up hard drive by using huge email attachments or file transfers - Sends messages to reset targets host subnets masks - Using up all system resources

performed by sending malformed packets to a system; can interrupt service or completely deny legitimate users of system resources, an attack that attempts to prevent authorized use of a resource. This can be done through flaw exploitation, connection overloading, or traffic flooding.

botnet, zombie, massive dos attack using multiple computers

ICMP requires three players (attacker, victim and amplifying network); attacker spoofs packet header to make it appear that it originated on the victim system with amplifying network broadcasting the message. Countermeasures - disable broadcast at border routers; border routers should not accept packets that originate within network; restrict ICMP traffic (Hint IC = Its Smurf though spelled wrong)

similar to Smurf but uses UDP Countermeasures - disable broadcast at border routers; border routers should not accept packets that originate within network; restrict UDP traffic; employ IDS; apply appropriate patches, block UDP port 7 & 9 from entering network

The attack involves sending a spoofed TCP SYN packet (connection initiation) with the target host's IP address and an open port as both source and destination. The reason a LAND attack works is because it causes the machine to reply to itself continuously.

TCP packets requesting a connection (SYN bit set) are sent to the target network with a spoofed source address. The target responds with a SYN-ACK packet, but the spoofed source never replies. This can quickly overwhelm a system's resources while waiting for the half-open connections to time out. This causes the system to crash or otherwise become unusable. Counter: sync cookies/proxies, where connections are created later

The length and fragmentation offset fields of sequential IP packets are modified, causing the target system to become confused and crash. Uses fragmented packets to target a TCP flaw in how the TCP stack reassembles them. DOS

IP spoofing involves altering a TCP packet so that it appears to be coming from a known, trusted source, thus giving the attacker access to the network. Intercept cookies from a request header

intruder tricks target to believe it is connected to a trusted host and then hijacks the session by predicting the targets choice of an initial TCP sequence number

defines point-to-point communication between Data terminal Equipment (DTE) and Data Circuit Terminating Equipment (DCE)

created for use with X25, LAPB defines frame types and is capable of retransmitting, exchanging and acknowledging frames as detecting out of sequence or missing frames

High performance WAN protocol designed for use across ISDN interfaces. Is fast but has no error correction, supports multiple PVCs, unlike X.25, packet switched technology that provides CIR, requires DTE/DCE at each connection point

high speed communication over public switches networks for exchanging 'bursts of data' between enterprises

very high bandwidth. It uses 53-byte fixed size cells instead of frames like Ethernet. It can allocate bandwidth up on demand making it a solution for Busty applications. Requires fiber optics.

combines many types of data into a single IP packet. Cost, interoperability and performance wise it's a major benefit.

created by IBM for mainframes to connect to their remote offices. Uses a polling media access method. Works with dedicated leased lines permanent up. Data link layer of OSI model

extension to SDLC also for mainframes. Uses data encapsulation on synchronous serial links using frame characters and checksums. Also data link layer

Defines electrical and physical interfaces to use for DTE/DCE communications. Physical layer of OSI

Shielded (STP) or unshielded (UTP) Cat 3=10BaseT, Cat5=100BaseT

Most expensive, but hard to tap and resistant to EMI

Examines source/destination address, protocol and ports of the incoming package. Based on ACL's access can be denied or accepted. Is considered a firewall and operates at Network or Transport layer of OSI

While transferring data stream to another network, it masks the data origin. operating at Application layer of OSI

(also known as Dynamic) All packages are inspected at the Networking layer so it's faster. By examining the state and context of the data packages it helps to track connectionless protocols like UDP and RPC. Analyzed at all OSI Layers.

Enables modification of the firewall rule. It provides limited support for UDP by remembering UDP packages across the network.

Runs in windows NT, modular, kernel based, multiplayer session evaluation. Uses dynamic TCP/IP stacks to inspect network packages and enforce security policies.

Sits between trusted and un-trusted network, sometimes used as boundary router. Uses ACL's. Protects against standard generic external attacks. Has no user authentication, has minimal auditing.

Has both a packet-filter router and a bastion host. Provides both network layer (package filtering) as application layer (proxy) server.

Consists of a host with 2 NIC's. One connected to trusted, one to un-trusted. Can thus be used as translator between 2 network types like Ethernet/token ring. Internal routing capabilities must not be enabled to make it impossible to circumvent inspection of data.

Has also defined a De-Militarized Zone (DMZ) : a small network between trusted an untrusted.

Every workstation gets some Socks software to reduce overhead Tiers - design separates distinct protected zones and can be protected by a single firewall that has multiple interfaces

CALLBACK; system calls back to specific location (danger in user forwarding number) somewhere you are CHAP (part of PPP) supports encryption XTACACS separates authentication, authorization and accounting processes TACACS+: stronger through use of tokens

User passwords are administrated in a central database instead of individual routers. A network device prompts user for a username and static password then the device queries a TACACS server to verify the password. TACACSs does not support prompting for password change or use of dynamic password tokens. Port 49 TACACS: user-id and static password for network access via TCP

Enhanced version with use of two factor authentication, ability to change user password, ability of security tokens to be resynchronized and better audit trails and session accounting

Client/server protocol, often leads to TACACS+. Clients sends their authentication request to a central radius server that contains all of the user authentication and network ACL's RADIUS does not provide two way authentication, therefore it's not used for routerto-router authentication. Port 1812. Contains dynamic password and network service access information (Network ACLs) NOT a SSO solution, TLS over TCP - to encrypt, Default UDP, PW encrypted, supports TCP and TLD if set, Remote connectivity via dial in (user dials in to access server, access server prompt for credentials, user enters credentials and forwards to radius server, radius server accepts or rejects). USES UDP. Incorporates an AS and dynamic/static password user can connect to any network access server, which then passes on the user's credentials to the RADIUS server to verify authentication and authorization and to track accounting. In this context, the network access server is the RADIUS client and a RADIUS server acts as an authentication server. The RADIUS server also provides AAA services for multiple remote access servers

remote connectivity using phone wireless etc, more secure than radius, cordless phone signal is rarely encrypted and easily monitored

(390) Asynchronous Dial-Up Access This is how everyone connects to the internet. Using a public switched telephone network to access an ISP

protocol that permits telephone line to carry data, voice and other source traffic. Two types: BRI Basic rate interface and Primary Rate Interface (PRI)

uses regular telephone lines for high speed digital access

Via single shared coaxial cable, insecure because of not being filtered or firewalled

incoming calls are only allowed from specific addresses on an approval list. This authenticates the node, not the user!

User initiates a connection, supplies identifying code, and then the system will call back a predetermined telephone number. Also less useful for travelling users

checks incoming telephone number against an approval list and then uses Callback. Less useful for travelling users.

Provides identification and authentication of the user using static replayable passwords. No encryption of user-id or password during communication

nonreplayable challenge/response dialog

all transmissions have to travel the full length of the cable

Workstations are connected to form a closed loop

nodes are connected to a central LAN device

bus type with multiple branches

all nodes interconnected

Packet is sent from single source to single destination

source packet is copied and sent to multiple destinations

source packet is copied and sent to all n

Infinite wave form, continuous signal, varied by amplification

Saw-tooth form, pulses, on-off only, digital signals are a means of transmission that involves the use of a discontinuous electrical signal and a state change or on‐off pulses.

sends bits of data sequentially. Same speed on both sides. Modems and dial-up remote access systems

very high speed governed by electronic clock timing signals Asynchronous communications, broadband connections, and halfduplex links can be digital or analog.

using CSMA with an BUS-topology Thinnet: 10base2 with coax cables up to 185 meters Thicknet: 10Base5, coax up to 500 meters UTP: 10BaseT=10MBps 100baseT=Fast Ethernet =100MBps 1000BaseT=Gigabit Ethernet=1GBps Ethernet networks were originally designed to work with more sporadic traffic than token ring networks

uses token passing in a star technology on coax

IBM created. All end stations are connected to a MAU Multi Access Unit. CAU: Controlled Access Units - for filtering allowed MAC (Extended Unique Identifier) addresses.

token-passing dual token ring with fiber optic. Long distances, minimal EMI interference permits several tokens at the time active

for Ethernet. Workstations send out packet. If it doesn't get an acknowledgement, it resends

are attached by 2 coax cables. In one direction only. Wireless 802.11

Only one host can send at the time, using jamming signals for the rest.

Host can only transmit when he polls a secondary to see if its free

Used in token rings, Hosts can only transit when they receive a clear to send token.

Limited geographically to e.g. a building. Devices are sharing resources like printers, email and files. Connected through copper wire or fiber optics.

campus area network, multiple building connected to fast backbone on a campus

metropolitan network extends over cities

Connects LANS over a large geographical area

Internet is global, intranet local for use within companies and extranet can be used e.g. by your customers and clients but is not public.

A VPN is created by dynamically building a secure communications link between two nodes, using a secret encapsulation method via network address translation (NAT) where internal IP addresses are translated to external IP addresses. Cannot double NAT with the same IP range, same IP address cannot appear inside and outside of a NAT router.

- Works at data link layer of OSI - Only one single point-to-point connection per session - Point To Point protocol (PPP) for authentication and tunneling - Dial-up network use - Does not support EAP - Sends initial packets in plaintext

- Cisco developed its own VPN protocol called which is a mutual authentication tunneling mechanism. - L2F does not offer encryption. L2F was not widely deployed and was soon replaced by L2TP. - both operate at layer 2. Both can encapsulate any LAN protocol.

- Also in data-link layer of OSI - Single point-to-point connection per session - Dial-up network use - Port 115 - Uses IPsec

- Operates at Network Layer of OSI - Enables multiple and simultaneous tunnels - Encrypt and authenticate - Build into IPv6 - Network-to-network use - Creates a private, encrypted network via a public network - Encryption for confidentiality and integrity 2 protocols: AH Authentication header and ESP Encapsulated Security Payload works with Security Associations (SA's) works with IKE protocols IKE IS FOR MANAGING SECURITY ASSOCIATIONS 2 modes: transport, data is encrypted header is not tunneled: new uses rc6; IP header is added, old IP header and data is encrypted cipher types: block (padding to blocks of fixed size) like DES 3DES AES or stream (bit/byte one by one o padding) like RC4, Sober

- encrypt and protect transactions to prevent sniffing while data is in transit along with VPN and IPsec - most effective control against session hijacking - ephemeral session key is used to encrypt the actual content of communications between a web server and client - TLS - MOST CURRENT not SSL!!!

Permanent virtual circuits, is like a dedicated leased line; the logical circuit always exists and is waiting for the customer to send data. Like a walkie-tealie

switched virtual circuit, is more like a shortwave or ham radio. You must tune the transmitter and receiver to a new frequency every time you want to communicate with someone.

Is hardware or software to create secure tunnels

- Encryption via Tunnel mode (entire data package encrypted) or Transport mode (only datagram encrypted) - Only works with IP at Network layer of OSI

Socks-based proxy servers Used to reach the internal network from the outside. Also contains strong encryption and authentication methods PTP used in windows machines. Multiprotocol, uses PAP or CHAP Dial-up VPN's remote access servers using PPTP commonly used by ISP's Secure Shell SSH2 not strictly a VPN product but opens a secure encrypted shell session from the internet through a firewall to a SSH server

Encrypts IP packets and ensured integrity. ESP Header - contains information showing which security association to use and the packet sequence number. Like the AH, the ESP sequences every packet to thwart replay attacks. ESP Payload

Frequency Hopping Spread Spectrum, The entire range of available frequencies is employed, but only one frequency at a time is used.

Direct Sequence Spread Spectrum, employs all the available frequencies simultaneously in parallel. This provides a higher rate of data throughput than FHSS. DSSS also uses a special encoding mechanism known as chipping code to allow a receiver to reconstruct data even if parts of the signal were distorted because of interference.

Orthogonal Frequency-Division Multiplexing, employs a digital multicarrier modulation scheme that allows for a more tightly compacted transmission. The modulated signals are perpendicular and thus do not cause interference with each other. 5 All use spread spectrum techniques to transmit on more than one frequency at the same time. Neither FHSS nor DHSS uses orthogonal modulation, while multiplexing describes combining multiple signals over a shared medium of any sort. Wi-Fi may receive interference from FHSS systems but doesn't use it.

reserved communication, always available Leased line can be reserved for communications. Type of dedicated line. - T1 1,5 Mbps through telephone line - T3 44,7 Mbps through telephone line - E1 European 2048 Mbps digital transmission - Serial Line IP (SLIP) TCP/IP over slow interfaces to communicate with external hosts (Berkley UNIX, windows NT RAS), no authentication, supports only half-duplex communications, no error detection, manual link establishment and teardown

improvement on slip, adds login, password and error (by CHAP and PAP) and error correction. Data link.

combination of digital telephony and data transports. Overtaken by xDSL, not all useable due to "D Channel" used for call management not data xDSL Digital subscriber Line uses telephone to transport high bandwidth data to remote subscribers - ADSL - Asymmetric. More downstream bandwidth up to 18,000 feet over single copper cable pair - SDSL - Symmetric up to 10,000 feet over single copper cable pair - HDSL - High Rate T1 speed over two copper cable pairs up to 12,000 feet - VDSL - Very High speed 13-52MBps down, 1,5-2,3 Mbps upstream over a single copper pair over 1,00 to 4500 feet

There must be a dedicated physical circuit path exist during transmission. The right choice for networks that have to communicate constantly. Typically for a telephone company network Voice oriented. Sensitive to loss of connection

Involves the transmission of messages from node-to-node. Messages are stored on the network until a forwarding path is available.

Nodes share bandwidth with each other by sending small data units called packets. Packets will be send to the other network and reassembled. Data oriented. Sensitive to loss of data. More cost effective than circuit switching because it creates virtual circuits only when they are needed.

are the merging of specialty or proprietary protocols with standard protocols, such as those from the TCP/ IP suite. The primary benefit of converged protocols is the ability to use existing TCP/ IP supporting network infrastructure to host special or proprietary services without the need for unique deployments of alternate networking hardware.

a form of network datastorage solution (SAN or NAS) that allows for high-speed file transfers at upward of 16 GBps. It was designed to be operated over fiber-optic cables; support for copper cables was added later to offer less-expensive options. Fibre Channel over Ethernet (FCoE) can be used to support it over the existing network infrastructure. FCoE is used to encapsulate Fibre Channel communications over Ethernet networks. Fibre Channel operates as a Network layer or OSI layer 3 protocol, replacing IP as the payload of a standard Ethernet network.

is a high-throughput highperformance network technology that directs data across a network based on short path labels rather than longer network addresses. MPLS is designed to handle a wide range of protocols through encapsulation.

is a networking storage standard based on IP. This technology can be used to enable location-independent file storage, transmission, and retrieval over LAN, WAN, or public Internet connections. It is often viewed as a low-cost alternative to Fibre Channel.

a tunneling mechanism used to transport voice and/ or data over a TCP/ IP network. VoIP has the potential to replace or supplant PSTN because it's often less expensive and offers a wider variety of options and features.