Network Security Concepts: Protection Strategies

This assignment delves into the realm of network security, focusing on the various types of attacks that can compromise a network's integrity. It examines the vulnerabilities exploited by attackers, such as ARP spoofing, DNS poisoning, and Man-in-the-Middle attacks. Furthermore, it outlines practical strategies and technologies to mitigate these risks, including WPA2 encryption, firewalls, VPNs, MAC filtering, and responsible password management. The assignment emphasizes the importance of user awareness and best practices for securing wireless networks.

COIT12202 – Network Security Concepts
Term 2, 2017
Assessment 2 Short-Answer Questions
Name:
ID:
Lecturer / Tutor:
Course Coordinator: Yufeng Lin
Due Date: 22-Sep-2017 11:45 PM AEST
COIT12202 – Network Security Concepts 1

Table of Contents
Short-answer questions.........................................................................................................................3
Reference............................................................................................................................................12
Marking Criteria...................................................................................................................................13
COIT12202 – Network Security Concepts 2

Short-answer questions
Your answer of Question 6:
Network address translation (NAT) is a method to remap one IP address
space into another space by modifying network address information in
Internet Protocol datagram packet headers while in transit across a traffic
routing device.
Please complete the following tasks:
(1) The network address translation is used for limiting the use of public IP
address in an organization for increasing the security of the network. The
router installed in a network perceive that the demand is not for an asset
inside the system, so they sends data packets to the firewall.
For example in case of a small business organization that is using the IP
address 192.168.0.0 network ID for its intranet connections and has a public
Ip address of 172.29.69.1 which it got from the ISP. It can map all the intranet
address on 192.168.0.0 with the 172.29.69.1 address provided by the ISP for
reducing the wastage of the IP address.
(2) The network address translation and port address translation differs from
each other on their methodology. If the site hosted in 10.10.0.0 network is
required to be connected from the 10.10.10.0 network the NAT can be
implemented for accessing the data. For the implementation of the NAT a
DNS server is required to be used and an address pool is required to be
configured. While in case of PAT the original source port address is masked
The PAT is basically a one to many to one connection as opposed to
NAT which performs the one to many connection within the network. The
Internal IP Internet IP Port used for PAT are
192.168.3.10 24.30.10.10 5000
192.168.3.11 24.30.10.10 5001
192.168.3.12 24.30.10.10 5002
COIT12202 – Network Security Concepts 3

192.168.3.13 24.30.10.10 5003
(3) The NAT technology is used for the security of the network and the technology is
implemented within a network via a network router. The NAT router acts as an interface in
between the WAN and the LAN. This helps the local network to get connected to the global
network. In addition to this, the NAT provides various type of security benefits to the network and
the technology is very useful for the network. The NAT act as a single machine having a single IP
and hence are very difficult to track. Hence, various systems within the network can access the
internet as s single instance of a machine. This provides ample amount of security to the systems.
Although all the NAT routers are not meant for security but they can provide a great deal of
security for the network. The NAT routers inherit the properties of the firewall in the network. The
also serve the function as the hardware firewalls for the network. In addition to this, the NAT
routers also provide the network security from the unsolicited", unexpected, unwanted, and
potentially annoying or dangerous traffic from the public Internet. They prevent these form
entering into the private networks for the system. Hence, the NAT technology provides a great
deal of security for the networks.
COIT12202 – Network Security Concepts 4

Your answer of Question 7:
a.
b. The DNS resolver cache can be flushed using the command
ipconfig/flushdns. It is used for wireshark for removing the unnecessary
capture in the .pcap file. The webserver is configured using a unique IP
address and during the resolution of the DNS IP address the DNS server is
required to be contacted the translated IP address is returned. From the pcap
file the domain name resolution can be identified because the file contains
the DNS traffic. An external name resolver can also be used for the
identification of the IP addresses utilizing the DNS of the machine used for
capturing the packets.
COIT12202 – Network Security Concepts 5

COIT12202 – Network Security Concepts 6

c.
Pack
et
No.
Time Source Destinatio
n
Proto
col
Info
1 1.3342
50
Fe80::c47c:d55d:2d
e0:57a4
Fe80::1 DNS Standar
d
Querry
Explanation: The dns name can be resolved from the packet and the
details of the server can be found such as the response time and source
port and the destination port address used for establishment of the
connection.
2 2.0796
65
192.168.1.37 203.71.185
.246
TCP 2300 ->
80 [RST,
ACK]
Seq=1
Ack=1
Win=0
Len=0
Explanation: The three-way handshaking connection is used for
establishment of the connection. The sequence number 0 is used for
sending the acknowledgement and the acknowledgement 1 is received and
then the sequence 1 is sent back for the establishment of the TCP
connection.
3 27.389
263
192.168.1.37 138.77.3.1
35
TCP 2350 ->
80
COIT12202 – Network Security Concepts 7

[ACK]
Seq=1
ACK=1
Win=17
408
Len=0
Explanations: The termination of the connection can be identified
from the final acknowledgement message sent from the IP
address and checking the TCp segments of the connection. The
filter tcp.flags.fin eq 1 or tcp.flags.reset eq 1 can also be used for
finding the termination of the connection.
d.
COIT12202 – Network Security Concepts 8

Your answer of Question 8:
a. access-list 15 deny 192.168.160.0 0.0.31.255
and for applying it in the interface of the router the following command is
used
int fa0/0
ip access-group 15 in
exit
b. Create a Cisco IOS extended IP access list that allows any host to access a
web server on TCP port 80 whose IP address is 138.77.15.100
ip access-list extended 100
permit tcp host 138.77.15.100 eq 80 host 138.77.15.101
c.
ip access-list extended 101
permit tcp host 138.77.15.100 eq 80 host 138.77.15.101
d. Allow any host on ports TCP/25 to access the SMTP server:
access-list 103 permit tcp any host 138.77.15.100 eq 25
COIT12202 – Network Security Concepts 9

Allow any host on ports TCP/25 and UDP/53 to access the DNS server:
access-list 103 permit tcp any host 138.77.15.174 eq 25
access-list 103 permit udp any host 138.77.15.100 eq 53
Your answer of Question 9:
There are various type of ways by which a wireless network can be attacked.
The two major type of attacks that can be performed very easily on a public
Wi-Fi network are Password Theft and Man in the Middle attacks.
Firstly the reader must be acquainted with the information about the
password theft. During the communication within the network over the
wireless medium the users of the network sends the passwords into the
network. Hence, this becomes very easy for the attacker to decipher if the
password is not encoded with SSL or TSL. In addition to this there are other
ways by which the attacker can steal the passwords from the protected
networks. This attacks generally extends to the man in the middle attacks.
Secondly the Man in the middle attacks can also be performed on the
networks, the man in middle attacks generally involve the hackers trying to
trick the devices that are communicating among themselves in to sending the
data required for the transmission directly to the attackers. The attackers are
then able to track the packets and also they are able to record the data that
is being used for transmission within the network. The attackers are even
able to access the data and change the actual data. They are also being able
to steal and hamper the data that are being transferred within the network.
The can attacker can also insert packets infected with malware into the
system that can tamper with the data transferred within the network and
also blocks the network so that the communication within the network is
blocked.
Therefore the users in the wireless network are advices to use the
WPA2 Security for addressing this type of attacks on the systems. This
method demands a lot of effort by the attackers to crack the network and
users should make sure that the WPS is turned off. In addition to this, the use
of firewalls is always effective for the network and always advisable. The use
of VNPs are also very effective on the network. The attacker would not be
COIT12202 – Network Security Concepts 10

able to track the network and hence there is less chance for the network to
be vulnerable to attacks. The users are also advised to use MAC filtering so
that the user is always conscious about the MAC addresses that belong to the
network and they are safe from sending their data to the attackers directly.
These are few steps that the users can take to protect themselves and
network from the attackers.
COIT12202 – Network Security Concepts 11

Reference
Göcs, László, Zsolt Csaba Johanyák, and Péter András Agg. "PROTECTION OF COMPUTER
LABORATORIES IN EDUCATIONAL INSTITUTIONS." Acta Technica Corviniensis-Bulletin of
Engineering 9, no. 2 (2016): 93.
Lammle, Todd, and John Swartz. CCNA Data Center-Introducing Cisco Data Center Networking Study
Guide: Exam 640-911. John Wiley & Sons, 2013.
Lammle, Todd. CCNA Routing and Switching Complete Study Guide: Exam 100-105, Exam 200-105,
Exam 200-125. John Wiley & Sons, 2016.
Odom, Wendell. CCNA Routing and Switching 200-120 Official Cert Guide Library. Cisco press, 2013.
Ristov, Sasko, Dejan Spasov, and Marjan Gusev. "Successful integration of practical Cisco CCNA in the
Computer Networks Design course." In Global Engineering Education Conference (EDUCON), 2015
IEEE, pp. 694-703. IEEE, 2015.
COIT12202 – Network Security Concepts 12

Marking Criteria
Assessment Item 2, Short-Answer Questions –Marking Criteria
Discussion
Week
Mark Allocation Criteria Max.
Mark
Allocated
Mark
Received3 2 1 or 0
Question 6 Excellent
response
with good
detail
Correct
response but
could be
improved or
more detail.
Limited/
Partially
correct
response or
did not use
your own
words
Not attempted
or incorrect
3
Question 7 6
Question 8 3
Question 9 3
Penalty for late submission
Total 15
COIT12202 – Network Security Concepts 13