Introduction to Networks and Internetworks

This paper covers topics related to networks and internetworks, including passive and active attackers, stateless and stateful protocols, and more.

Running head: INTRODUCTION TO NETWORKS AND INTERNETWORKS
Introduction to Networks and Internetworks
Name of Student-
Name of University-
Author’s Note-

1INTRODUCTION TO NETWORKS AND INTERNETWORKS
Paper 1
Answer to Question 1:
a) The following shows the difference between the terms:
i. Passive attacker and active attacker
Passive attacker Active attacker
The attack that are based on
eavesdropping or based on monitoring
of transmission of data is passive
attack and the person who carries out
these type of attack is known as
passive attacker.
The active attacks are mainly based
on changing original message with
some procedures and then create a
false message and send to receiver.
Theses attackers are known as active
attackers.
The attacker observes the
conversation that is carried out in
between the sender and the receiver.
The attacker needs to gain physical
control on the network to gain access.
ii. Off- path attacker and on-path attacker
Off-path attacker On-path attacker
An attacker is known as off-path attacker
when the attacker or some malicious
program acts on someone else.
On-path attack happen when some
unauthorized person attacks the network
and gets the data access of the company or
the person.
The attacker who attacks the network
pretends to be some other device or
On-path attackers are less harmful than the
off-path attacker.

2INTRODUCTION TO NETWORKS AND INTERNETWORKS
computer to trick others.
iii. Stateless protocol and stateful protocol
Stateless protocol Stateful protocol
The state of the connections is not recorded
at server end in stateless protocol. Any
track of request is not saved in stateless
protocol.
In stateful protocol, the connection of the
state are recorded and there is a strong
dependency in between the server and the
client.
In stateless protocol, the client sends some
request to server and then the response is
reverted back from the server depending on
current state.
When client sends some request to server,
some response is generally expected from
the server. If the server does not respond
back, the request is again resend to the
server.
iv. IP and UDP
Internet Protocol User Datagram Protocol
All traffics are included in internet
protocol.
When the user wants some specific filtering
on certain traffic, then User datagram
Protocol is used.
IP is generally a routing protocol and there
are three layers of protocol in IP protocol.
UDP generally has four layers of protocol
and it is a transport protocol.
v. UDP and TCP
User Datagram Protocol Transmission Control Protocol

3INTRODUCTION TO NETWORKS AND INTERNETWORKS
UDP protocol is mostly used in message
transferring.
TCP is a connected protocol that is used for
transferring message from one system to
another.
vi. Message gain authentication and entity authentication
Message gain authentication Entity authentication
This means the message that is being
gained by the user is to be authenticated.
In entity authentication, the identity of a
party is to be proved by another party.
vii. AH and ESP
AH ESP
Authentication Header provides integrity
service and authentication.
Encapsulation Security Payload generally
provides authentication, integrity services
and confidentiality.
viii. WEP and WPA
WEP WPA
Wired Encryption Protocol is a networking
standard used for encryption of data on
radio waves.
Wi-Fi Protected Access provides more
secured encryption than WEP and also
enables wireless devices so that they can
communicate over network.
ix. WPA and WPA2

4INTRODUCTION TO NETWORKS AND INTERNETWORKS
WPA WPA2
WPA is a security measure to protect all
the wireless network. WPA uses TKIP
network for security.
WPA2 is more secured than WPA and uses
more secured algorithm known as AES
algorithm.
b) i) The echo sender can send the sequence number or identifier for aiding the match
replies with echo requests. The protocol of TCP or the protocol or UDP can be used
for identifier to get the session identified. Sequence number can be incremented with
each increment of echo request.
ii) For the DNS attack, the on-path attacker can exploit the vulnerabilities in the DNS
(Domain name system) of the server so that the small queries can be sent to large
payloads. The DNS is a reflection attack that manipulates the domain name system
with UDP packets.
Off-path attackers cannot realize an ICMP echo request.
Answer to Question 3
a) If a channel is available for the purpose of using for a particular time can be stated as
a reliable channel. The percentage of the total time that a channel is available to the
user is known as channel reliability. Channel reliability is represented as
ChR = 100(1- Ta/Ts) = 100Ta/Ts
b) A reliable connection is provided if the service notifies the failure of the delivery. The
Internet protocol fails to notify the failure of a delivery. The internet protocol does not
provide safe delivery of the messages to the recipient. Failure in delivery will affect
the performance of system.
c) The ICMP packet does not gives the guarantee of having a reliable Internet Protocol.
It tries to make the IP reliable by having a checksum in ICMP header and IP header.

5INTRODUCTION TO NETWORKS AND INTERNETWORKS
A protocol of higher level should send the packet of the error generated that generates
another Time Exceeded packet received by sender. ICMP is internal part of an IP and
should be implemented on all IP module.
d) After one packet is transmitted, the sender generally waits for the acknowledgement
known as ACK from receiver before transferring to the next one. By this process, the
senders are able to recognize the packets that are successfully transmitted previously
and the protocol of Stop-n-wait ensures a guaranteed transfer in between the nodes.
For providing a support to this feature, a record is kept by the sender for each and
every packet that is send by the sender. If some confusion exists by duplicate or
delayed ACKs, the confusion is avoided with USN (Unique Sequence Number) and
the unique number is received in ACKs. In this way, the reliable channel is provided
by Stop and Wait protocol.
e) The ARQs of Stop and Wait protocol offers a flow and error control but the stop and
wait protocol cause larger issues on its performance. The stop and wait ARQ cannot
connect with networks that have high bandwidth and high rate of propagation delay.
To overcome this efficiency, sliding window protocol is implemented which can send
more number of packets at one time with large sequence number.
Sequence number can solve the problem by producing one bit of sequence number in
header section of frame. When acknowledgment is sent back from receiver, sequence
number is included in them. The duplicate frames can be detected by the receiver.
f) i) Sequence number helps to protect the packet of IPSec. The contents that are
involved in the packet of IPSec protects the packet against the relay attacks with the
help of sliding window and also discards the older packets.
ii) Sequence number can be wrapped around at the time of large data transfers. The
number of sequence number is non- infinite. There are about four billion possibility of

6INTRODUCTION TO NETWORKS AND INTERNETWORKS
sequence number. So, there remains a chance of reusing the same sequence number
which might happen in some of the circuits. Mainly for this reason, the sequence
numbers are ignored by the recipients.
g) In SSL, all the parties maintains some sequence number for the purpose of
transmission and receiving the messages in each of the connections. When a change is
required in a CipherSpec to receive and send message, the sequence number is
generally set to zero.
Answer to Question 5
a) A home network for mobile telecommunication is generally a type of network in
computer, which enhances the communication in devices within a home or a closed
area. The devices that are capable to accompany with this network are smart devices
such as mobile phones, computers.
Access network is basically a user network, which connects the subscribers to
particular service provider and also via carrier network to all other networks including
internet.
b) The challenges that are faced by the designers of security infrastructure are i) there are
many policies that are imposed by the government agencies. All the policies are very
difficult to implement in a multi-domain environment ii) the environment that the
designer is working on has more than one security goals that the designers face
problem to achieve various goals iii) there are also various system components,
applications, services that needs database federations, and iv) the operational needs of
the services and needs of environment changes which gives the designer to fulfill the
aim of the project.
c) Smart cards that has tampered resistant modules has the capability to secure the
cryptographic materials secretly and also execute autonomous execution of the

7INTRODUCTION TO NETWORKS AND INTERNETWORKS
algorithms that are involved with cryptography. The smart card is considered to be a
safe place to store the data with high protection against the unauthorized access. The
SIM module of the smart cards implements special application to protect data in the
smart card and also allows the access control to GSM network.
d) The method of Authentication in a processor is usually located on the HLR (Home
Location Register) and the VLR system has all information that is required to perform
the process of authentication. The triplets in an access network to authenticate SIM
are generated by Randomly Generated Number, SRES, A3, A8, and also by Ki
method.
e) A random number is generated by the operator of the network that are sent to mobile
phones. The secret Ki is attached with the random number by the help of A8
algorithm and the session key KC is generated. The session key is the generated with
the combination with A5 algorithm so that the data can be encrypted or decrypted.
f) When the mobile phone is turned on, the user wants to connect the network. A
location update request is then send including the TMSI. If TMSI is not available in
the database, VLR then asks for the IMSI and after receiving IMSI, HLR is asked for
IMSI for the information based on the IMSI of the subscriber. For keeping the
location privacy, HLR then needs the authentication triplet for IMSI. The triplets are
then forwarded to the VLR. The MSC gathers the details from VLR and pass the
RAD value to MS. SRES is again calculated and send back to MSC. The SRES that is
stored in the VLR is compared with the SRES that is sent by MS. If both the SRES
matches, then the location will be successfully updated. The current location of the
mobile phone is updated and TMSI allocation is done in this MS.
g) The mechanism of quintet has to support a re-synchronization secured counter
SQNHE in authentication with the value to the counter SQNMS in USIM where as

8INTRODUCTION TO NETWORKS AND INTERNETWORKS
triplet is manual authentication. The quintet has the ability to protect against any
failure that can cause by wrapping the counter of SQNMS in USIM and triplet ensures
integrity protection of the signaling messages with secured algorithm of encryption.
Paper 2
Answer to 1
a) i) Both the attackers attack on the network of internet causing data loss of the user.
The difference between them is that the passive attack is based on eavesdropping or
based on monitoring of transmission of data and the person who carries out these type
of attack is known as passive attacker. The active attacks are mainly based on
changing original message with some procedures and then create a false message and
send to receiver. These attackers are known as active attackers.
ii) An attacker is known as off-path attacker when the attacker or some malicious
program acts on someone else. On-path attack happen when some unauthorized
person attacks the network and gets the data access of the company or the person.
iii) All traffics are included in internet protocol. The attacker who attacks the network
pretends to be some other device or computer to trick others. When the user wants
some specific filtering on certain traffic, then User datagram Protocol is used. On-path
attackers are less harmful than the off-path attacker.
iv) Tcpcrypt is a communication of transport layer with encryption protocol like SSL.
Tcpcrypt is generally implemented as TCP extension. Tcpcrypt enables encryption
using the TCP. On the other hand, TCP is a secured protocol for communication. TCP
use a hash function that is keyed used for authenticating the problem.
v) Tcpcrypt is a communication of transport layer with encryption protocol like SSL.
Tcpcrypt is generally implemented as TCP extension. Tcpcrypt enables encryption

9INTRODUCTION TO NETWORKS AND INTERNETWORKS
using the TCP. TLS is known as Transport Layer Security provides data integrity and
privacy for establishing communication between computer applications. When a
network is secured with the TLS, the connection is set to be private.
vi) Wired Encryption Protocol is a networking standard used for encryption of data on
radio waves. Wi-Fi Protected Access provides more secured encryption than WEP
and also enables wireless devices so that they can communicate over network.
vii) WPA is a security measure to protect all the wireless network. WPA uses TKIP
network for security. WPA2 is more secured than WPA and uses more secured
algorithm known as AES algorithm.
viii) Firewall is generally a system of network security, which controls and monitors
the outgoing and incoming of the network that is traffic based on some security rules
that is predetermined. Intrusion detection system is an application software or a
device, which monitors a network or monitors a system for some policy violation or
some malicious activity.
ix) Authentication Header provides integrity service and authentication.
Encapsulation Security Payload generally provides authentication, integrity services
and confidentiality.
b) Difference between circuit-switched and packet-switched network
Circuit-Switched Network Packet-Switched Network
CS network is a network that is to be
established before making the call in
between the users.
Establishing a connection is not required
initially in between the users. The
connection channel is available by
multiple users.

10INTRODUCTION TO NETWORKS AND INTERNETWORKS
If there is overload, call setup can be
blocked.
Overload always increases some packet
delay.
c) The cellular network infrastructure is complex and massive with many entities
working together including the IP internet that coordinate with core network. As
cellular network communicates on wireless channel, authentication is a major issue
that is related to first generation mobile. The network should be used by right people
so that there is no cross connection. This issue can be solved by introducing the 3G
network, this issue can be solved.
Answer to Question 2
a) Reliable communication is a communication that guarantees all the messages to reach
their destination in an uncorrupted form in which they are sent.
b) There are mainly three steps that are followed to built an reliable communication
channel. The steps that are to be followed are: Know the channel, build relationship,
and then communicate on the network decisively.
c) The protocol, which keeps the internal state on server, is stated to be a stateful
protocol. The TCP mainly establishes a session that is connection oriented that is a
stateful connection. This is because both the systems keeps information regarding the
session in its life time.
d) Three messages that are involved in TCP handshake are:
 A data packet SYN is generally over the IP network that is send by the client to
server on external network or the same network.
 There must be open port with the target server, which has the capability to accept
and also initiate some new connection. When the SYN packet is received from
client node, it returns and responds confirmation receipt.

11INTRODUCTION TO NETWORKS AND INTERNETWORKS
 The SYN/ACK message is received by the client from server and then responds
with ACK message.
e) The denial of service attack is generally considered as a cyber attack that seeks the
perpetrator so that the network and the machine becomes unavailable to all its users
by disrupting the services of the host. The DOS attack has incoming traffic that floods
the network of the victim.
f) i) In spoofing, the sender can send arbitrary packets of IP addresses with some
different fake source. Spoofing makes the handshake protocol in TCP very difficult
because all the party should sent a s+1 message as acknowledgement to generate the
sequence number sent by the sender.
ii) An off-path attacker who attacks blindly , has two arbitrary host that are inferred
on internet. This communicates with the help of TCP connection. If connection is
established with TCP, off path attacker can infer the sequence number of TCP that is
in use usually, which form connection on both sides. This allows the off path attacker
to establish a connection termination and also performs attacks of data injection.
iii) The patch that runs algorithms on TCP congestion based on NS2 along with same
kind of simulation memory and speed use with other NS2 TCP. The implementation
of Linux TCP produces the results that compares to the experimental result of Linux.
Answer to Question 4
a) Mainly secrets are shared in between parties that use secret communication for
exchanging of data in Diffie Hellman Key Exchange protocol. The process of the
exchange protocol begins by having two parties. Each of the party select a particular
color that are kept with themselves. The number or color that is kept secret with them
is then mixed together with their shared secret key. The result of the mixture of the

12INTRODUCTION TO NETWORKS AND INTERNETWORKS
keys is identical to the mixture color of the partner. This way Diffie Hellman Key
Exchange protocol works.
b) If some other party other than the two parties in between the exchange is taking place,
interprets, then it is said to be a middle-man attack. Entity authentication is basically
the security service that is to be the fundamental part of any security system.
c) Station-to-Station protocol is used in Diffie Hellman protocol, which helps to mitigate
the problem of man-in-the-middle attack. The station-to-station protocol helps to
provide security to the network giving the signature keys in the network.
d) Cipher suite negotiation helps to built a secure network that generally uses the TLS
and SSL protocol. The algorithms that are used by cipher suite are key exchange
algorithm, MAC algorithm, and algorithm of Bulk Encryption.
e) Cipher negotiation helps to change the messages by an attacker that are sent from the
sender to the receiver. The attacker has the advantage to change the data or message
that is sent to the receiver.
Paper 3
Answer to question 1
a) Network consists of LAN, MAN, WAN that is generally a network that is defined by
a connected group of computers. Internetwork consists of LAN and WAN that are
connected through router. It is usually collection of single network that is connected
by all the networking devices that works a large single network.
b) An attacker is known as off-path attacker when the attacker or some malicious
program acts on someone else. On-path attack happen when some unauthorized
person attacks the network and gets the data access of the company or the person.
Eavesdropping, traffic analysis, and monitoring are on path attack.

13INTRODUCTION TO NETWORKS AND INTERNETWORKS
c) IP spoofing generally consists of false IP addresses so that the identity of sender can
be hidden or may impersonate to some other computing system. In other words, the
sender uses proxy server for sending the message to the receiver.
d) i) The administrators of the private network generally assign the subnets and the
networks from the IPv4. The range of IPv4 generally ranges from 10.0.0.0 to
1902.168.255.255.
ii) IP addresses are needed because the amount of the Internet Protocol are increasing
day by day to a great amount. The total amount of the IP addresses that are available
are over 3706.65 million. The number of devices are increasing which each private IP
needed address.
iii) Datagram that uses IPv4 as the header can handle many 40 bytes of extension
header when they are needed. The host increments the internal counter 1 at a time in a
datagram that is sent.
e) The firewall technique that is used for controlling the network that is accessed by
monitoring the incoming and outgoing packets of data and also allow them to halt o
pass through the network on the IP is packet filtering. Packet filtering works by
transmitting a node that is matched and filtered with policies and rules that are
predefined. If the packet of data matches, then the packet is accepted or is denied.
f) BGP (Border Gateway Protocol) is standardized protocol of exterior gateway that is
mainly designed for exchanging the reachability and routing the data that is
transferred among the autonomous systems. DNS is known as a decentralized system
for naming for computer devices, or other resources that are connected via internet.
DNS has a domain name that is generally assigned with the entities that are
partitioned.

14INTRODUCTION TO NETWORKS AND INTERNETWORKS
g) The security of BGP and DNS routing protocol is that the prefix can be advertise by
anyone negligible of the fact that they own it or not own it.
Answer to Question 2
a) The non-cryptographic integrity checksum functions are observed so that they can be
synergized with all the data that sets the exhibit of the expected patterns. Example of
non-cryptographic checksum is Programmer Stack Exchange.
b) The characteristics of stop-and-wait ARQ is that it uses a communication that is
connection oriented. It offers a flow and error control environment with transport
layer and data link layer. The sender sends a packet of data at a time and then send the
next packet of data only if the receiver sends acknowledgement of the previous data.
While at the receiving end of Stop-and-wait ARQ process, the receiver send
acknowledgement after consuming the data and then sends ACK to the sender.
c) The ARQs of Stop and Wait protocol offers a flow and error control but the stop and
wait protocol cause larger issues on its performance. The stop and wait ARQ cannot
connect with networks that have high bandwidth and high rate of propagation delay.
To overcome this efficiency, sliding window protocol is implemented which can send
more number of packets at one time with large sequence number.
d) The structure of TCP header is
The purpose of TCP is to break the information in datagrams and the sends them
back, carrying the resends, and also reassembles the datagrams that are received if the
delivery is reliable and there is a service that is connection based in between the
applications.

15INTRODUCTION TO NETWORKS AND INTERNETWORKS
e) SYN cookies are the initial part of TCP sequence by TCP software and the SYN
cookie is used for SYN flood attack. SYN is sent by the client and the server then
responds back with ACK and SYN message. Until then, the server will hold the state
information with TCP stack and wait for the ACK message from the client. SYN
flood generates SYN packets that consumes all the TCP memory as server can
maintain the state of half-open connections.
Answer to Question 4
a) i) The AH datagram offers a sequence integrity service at discretion of receiver so that
the denial of services attack can be countered. But to encrypt all the data does not
ensures safe delivery of the data because there is always some procedure to decrypt
the datagram by some attacker.
ii) The message authentication code does not provide security like data integrity,
multifactor authentication, and PKI. So, MAC is not appropriate method for integrity
service.
b) IP tunneling is known as a communication channel of IP network between the two
networks. The packets to transport the network of packets use encapsulation.
c) i)
Authentication header helps to provide a connectionless integrity and authentication
that is data originated for IP datagram so that protection can be given against relays.

16INTRODUCTION TO NETWORKS AND INTERNETWORKS
ii) The ESP header is generally designed so that a mix security service is provided in
IPv4 and IPv6. With AH, ESP can be applied or can be applied in nested fashion.
d) i) Traffic Selector- This is an agreement that is done in between IKE so that they can
permit the traffic through tunnel if traffic matches a remote address or a local address.
ii) Security Association Database- SAD is a policy content that provides security
service to the AH or the ESP. There are yes or no flag for all the policies that are
determined.
iii) Security Policy Database- SPD can be used for processing all the traffics that
includes all the traffic of non-IPsec. The entry policies of SPD can be ordered and
policies that are matched are used for process traffic.
iv) Security Parameter Index- This is an identification tag that is added in the header
of IPSec used for tunneling the IP traffic.
e) i) WEP is basically a security protocol that is used for wireless network and used for
better security such as DES,VPN, and WPA.WEP normally has three settings that is
difficult to crack and also reduces the performance.
ii) WEP generally uses shared key of authentication and then sends back the same key
with the data packets that are being transmitted within the wireless network. In WEP,
if the master key is to be changed, then it is to be done manually on all the devices on
the network.
Paper 4
Answer to Question 1
a) i) Active attacker can perform modification attack and fabrication.
ii) Off-path attacker can perform eavesdropping attack.
iii) Eavesdropping attack can be performed by passive attack.

17INTRODUCTION TO NETWORKS AND INTERNETWORKS
iv) DES algorithm can help to identify eavesdropping, fabrication, and modification
attack.
b) i) The main role of DNS is basically to change the domain names of the network to IP
addresses that are understandable by computers. DNS generally provides e-mail
services for all domain names.
ii) Modification attack is relevant to DNS.
c) i) IP spoofing is creation of the IP packets that has false IP addresses for hiding
identity of sender. Ingress filtering is considered as a technique that ensures the
incoming packets come from actual network.
ii) Transport Layer Security can counter measure IP spoofing because they can
encrypt the data that is sent and also authenticate all the data that are received.
Answer to Question 2
a) The TCP handshake protocol is used in TCP/IP to establish a connection over Internet
Protocol that is based on network. The technique of three way handshaking in TCP
includes three messages that are transmitted by the TCP so that they can be negotiated
and also start TCP session between two systems.
b) TCP SYN Flood, also known as SYN flood is considered as a type of DOS attack that
mainly exploits the normal three way TCP handshake protocol because the SYN
Flood consumes most of the resources that are targeted on the server.
c) The purpose of SYN attack is basically to resist the attacks of SYN flood. The SYN
cookies helps a server to avoid the dropping the connection when SYN queue
normally fills up. SYN cookie is basically stateless mechanism of SYN proxy.
d) Mainly secrets are shared in between parties that use secret communication for
exchanging of data in Diffie Hellman Key Exchange protocol. The process of the
exchange protocol begins by having two parties. Each of the party select a particular

18INTRODUCTION TO NETWORKS AND INTERNETWORKS
color that are kept with themselves. The number or color that is kept secret with them
is then mixed together with their shared secret key. The result of the mixture of the
keys is identical to the mixture color of the partner. This way Diffie Hellman Key
Exchange protocol works.
e) Correct protocol is a protocol that has convections and rules that are used for
communication in between the devices in the devices. The secure protocol is a secure
communication along with all the convections and rules that are involved in
networking.
f) The Diffie Hellman protocol can be modified by making modification on the
predefined algorithm of the protocol. There should be an ideal private key for the data
exchange.
Answer to Question to 5
a) The problems that rise in private IPv4 address are isolation and maintenance cost. The
network of IP addresses does not go to other public networks that can communicate
with all other computers. There is no information that enters the network from other
networks. The IPv4 address is difficult to maintain as the network is huge. The
alternative that can be used to minimize these problems are using the VPN networks.
b) i) Network address is basically an identifier used for node or a host that is on the tele-
communication network. Network addresses are unique identifier. Port Translation
Address is an extension to the network address that permits to connect many devices
on LAN that can be mapped in to single IP address.
ii) Transport mode generally encrypts the payload and the ESP trailer. This helps the
IP header of original packet cannot be encrypted. Transport mode is used with other
tunneling protocol, which encapsulates the data packet.

19INTRODUCTION TO NETWORKS AND INTERNETWORKS
c) IPSec generally uses cryptography and packet filtering. Cryptography has user
authentication, ensures data integrity and confidentiality and enforce communication
that is trusted. The traffic is kept secured with the IP traverse the network paths that
are not trusted.
d) The internet key exchange is mainly divided into two protocol phase 1 and phase 2.
Phase 1 the IKE SA negotiation and phase 2 is the IPSec SA negotiation. Phase 1
happens generally in two modes that is main mode or the aggressive mode. Phase 2 or
the quick mode has three phases.
Paper 5
Answer to Question 1
a) i) Active on-path attacker can perform modification and fabrication.
ii) Passive on-path attacker can perform eavesdropping.
iii) Active off-path attacker can perform fabrication or eavesdropping.
iv) Passive off-path attacker can perform medication, fabrication ,and eavesdropping.
b) i) All traffics are included in internet protocol. When the user wants some specific
filtering on certain traffic, then User datagram Protocol is used.
ii) TCP is a connected protocol that is used for transferring message from one system
to another. TCP is a connected protocol that is used for transferring message from one
system to another.
iii) Wired Encryption Protocol is a networking standard used for encryption of data on
radio waves. Wi-Fi Protected Access provides more secured encryption than WEP
and also enables wireless devices so that they can communicate over network.

20INTRODUCTION TO NETWORKS AND INTERNETWORKS
iv) WPA is a security measure to protect all the wireless network. WPA uses TKIP
network for security. WPA2 is more secured than WPA and uses more secured
algorithm known as AES algorithm.
v) The TCP authentication Option use TCP value of 29. Authentication header
provides the integrity, authentication, and full packet of IP header.
vi) Authentication header provides the integrity, authentication, and full packet of IP
header. IPSec encapsulating payload provides confidentiality to the AH along with all
the features in authentication header.
c) i) DNS is known as a decentralized system for naming for computer devices, or other
resources that are connected via internet. DNS has a domain name that is generally
assigned with the entities that are partitioned.
ii) DNS query response are generally formatted and options and the variables that are
contained.
d) i) DNS query response protocol has modification attack.
ii) Attack can be of many types. Network attacks are intrusion to the network
infrastructure in which the attack can be from inside or from outside attack.
Answer to Question 2
a) CIDR is a process by which the IP routing and IP addresses are allocated. The goal of
CIDR is to slow the routing table growth on all the routers across Internet and helps to
exhaust IPv4 addresses.
b) i) Public IPv4 addresses are generally used by the user ISP, gives identification of
home network. Private IPv4 are addresses that are addresses to all network device that
are present inside the network.
ii) Private IPv4 addresses were introduced to connected all the devices that comes in
the same network and uses protocol for communication.

21INTRODUCTION TO NETWORKS AND INTERNETWORKS
c) i) Authentication header helps to provide a connectionless integrity and authentication
that is data originated for IP datagram so that protection can be given against relays.
d) IP spoofing generally consists of false IP addresses so that the identity of sender can
be hidden or may impersonate to some other computing system. In other words, the
sender uses proxy server for sending the message to the receiver.
e) Smurf attack is generally a DNS attack that has large amount of ICMP packets with
spoofed IP source. If number of machines on the network respond and receive the
packets is usually very large.
Answer to question 3
a) Reliable communication is a communication that guarantees all the messages to reach
their destination in an uncorrupted form in which they are sent. There are mainly three
steps that are followed to built an reliable communication channel. The steps that are
to be followed are: Know the channel, build relationship, and then communicate on
the network decisively.
b) The characteristics of stop-and-wait ARQ is that it uses a communication that is
connection oriented. It offers a flow and error control environment with transport
layer and data link layer. The sender sends a packet of data at a time and then send the
next packet of data only if the receiver sends acknowledgement of the previous data.
c) The TCP handshake protocol is used in TCP/IP to establish a connection over Internet
Protocol that is based on network. The technique of three way handshaking in TCP
includes three messages that are transmitted by the TCP so that they can be negotiated
and also start TCP session between two systems.
d) The denial of service attack is generally considered as a cyber attack that seeks the
perpetrator so that the network and the machine becomes unavailable to all its users

22INTRODUCTION TO NETWORKS AND INTERNETWORKS
by disrupting the services of the host. The DOS attack has incoming traffic that floods
the network of the victim.
e) SYN cookies are the initial part of TCP sequence by TCP software and the SYN
cookie is used for SYN flood attack. SYN is sent by the client and the server then
responds back with ACK and SYN message.

23INTRODUCTION TO NETWORKS AND INTERNETWORKS
Bibliography
Acemoglu, D., Malekian, A., & Ozdaglar, A. (2016). Network security and
contagion. Journal of Economic Theory, 166, 536-585.
Budka, K. C., Deshpande, J. G., & Thottan, M. (2014). Network Security. In Communication
Networks for Smart Grids(pp. 209-225). Springer, London.
Chen, G., Gong, Y., Xiao, P., & Chambers, J. A. (2015). Physical layer network security in
the full-duplex relay system. IEEE transactions on information forensics and
security, 10(3), 574-583.
Czyz, J., Luckie, M. J., Allman, M., & Bailey, M. (2016, February). Don't Forget to Lock the
Back Door! A Characterization of IPv6 Network Security Policy. In NDSS.
Ferguson, N., Schneier, B., & Kohno, T. (2011). Cryptography engineering: design
principles and practical applications. John Wiley & Sons.
He, X., Chomsiri, T., Nanda, P., & Tan, Z. (2014). Improving cloud network security using
the Tree-Rule firewall. Future generation computer systems, 30, 116-126.
Kizza, J. M. (2017). Guide to computer network security. Springer.
Lopez, D., Lopez, E., Dunbar, L., Strassner, J., & Kumar, R. (2018). Framework for interface
to network security functions(No. RFC 8329).
Mainanwal, V., Gupta, M., & Upadhayay, S. K. (2015, March). A survey on wireless body
area network: Security technology and its design methodology issue. In Innovations in
information, embedded and communication systems (ICIIECS), 2015 international
conference on (pp. 1-5). IEEE.

24INTRODUCTION TO NETWORKS AND INTERNETWORKS
Perlman, R., Kaufman, C., & Speciner, M. (2016). Network security: private communication
in a public world. Pearson Education India.
Peterson, L. L., & Davie, B. S. (2007). Computer networks: a systems approach. Elsevier.
Shin, S., Wang, H., & Gu, G. (2015). A first step toward network security virtualization:
From concept to prototype. IEEE Transactions on Information Forensics and
Security, 10(10), 2236-2249.
Wang, L., Jajodia, S., Singhal, A., Cheng, P., & Noel, S. (2014). k-zero day safety: A
network security metric for measuring the risk of unknown vulnerabilities. IEEE
Transactions on Dependable and Secure Computing, 11(1), 30-44.
Yang, N., Wang, L., Geraci, G., Elkashlan, M., Yuan, J., & Di Renzo, M. (2015).
Safeguarding 5G wireless communication networks using physical layer
security. IEEE Communications Magazine, 53(4), 20-27.
Yu, T., Sekar, V., Seshan, S., Agarwal, Y., & Xu, C. (2015, November). Handling a trillion
(unfixable) flaws on a billion devices: Rethinking network security for the Internet-of-
Things. In Proceedings of the 14th ACM Workshop on Hot Topics in Networks (p. 5).
ACM.
Zaalouk, A., Khondoker, R., Marx, R., & Bayarou, K. (2014, May). Orchsec: An
orchestrator-based architecture for enhancing network-security using network
monitoring and sdn control functions. In Network Operations and Management
Symposium (NOMS), 2014 IEEE (pp. 1-9). IEEE.