- Interface

- a set of logical rules that devices must follow to communicate

- uses documents called RFC - Requests for Comments

- Protocols

- provide services to the application software running on a computer

- provide an interface between software running on an computer

and the network itself

- Protocols

- functions

- Encapsulation

- Protocols

- Encapsulation

- Protocols

- Encapsulation

- Addressing

- Protocols

- Bit Transmission

- step.1 Create and encapsulate the application data with any

required application layer headers

- step. 2 Encapsulate the data supplied by the application layer

inside a transport layer header.

- step. 3 Encapsulate the data supplied by the transport layer

inside a network layer (IP) header

- step. 4 Encapsulate the data supplied by the network layer inside

a data link layer header and trailer

- step 5 Transmit the bits

- Transport layer 04 port - 80

- Transport layer 04 port - 440

- Transport layer 04 port - 23

- Transport layer 04 port - 22

- Transport layer 04 port - 20,21

- Transport layer 04 port - 22

- Transport layer 04 port - 143

- Transport layer 04 port - 110

- Transport layer 04 port - 25

- Transport layer 04 port - 53

- Transport layer 04 port - 69

- description

- Protocols and specifications

- Devices

- description

- Protocols and specifications

- Primary tasks

- Devices

- description

- Protocols and specifications

- Devices

- description

- Protocols and specifications

- Devices

- Encapsulation

- description

- Protocols and specifications

- Devices

- Encapsulation

- Routing

- description

- Protocols and specifications

- Devices

- Encapsulation

- Switches

- two sub-layers

- performs error detection

- description

- Protocols and specifications

- Devices

- represents the bits that include the header and trailer fo that

layer, as well as the encapsulated data.

- Speed

- Imformal IEEE Standard Name

- Formal IEEE Standard Name

- Cable Type

- Maximum Length

- Speed

- Imformal IEEE Standard Name

- Formal IEEE Standard Name

- Cable Type

- Maximum Length

- Speed

- Imformal IEEE Standard Name

- Formal IEEE Standard Name

- Cable Type

- Maximum Length

- Speed

- Imformal IEEE Standard Name

- Formal IEEE Standard Name

- Cable Type

- Maximum Length

- Speed

- Imformal IEEE Standard Name

- Formal IEEE Standard Name

- Cable Type

- Maximum Length

- suffix "T"

- suffix "X"

- Fiber-optic cabling contains long thin strands of fiberglass.

The attached Ethernet nodes send light over the glass fiber in the

cable, encoding the bits as changes in the light

- 10BASE-T

- 1000BASE-T

- rules

- 7 Bytes

- Synchronization

- 1 Byte

- Signifies that the next byte begins the Destination MAC Address

field

- 6 Bytes

- Identifies the intended recipient of this frame

- 6 Bytes

- Identifies the sender of this frame

- 2 Bytes

- Defines the type of protocol listed inside the frame; today

, most likely identifies IPv4 or IPv6

- Holds data from a higher layer, typically an L3PDU (usually

an IPv4 or IPv6 packet). The sender adds padding to meet the minimum

length requirement for this field (46 Bytes)

- MTU (maximum transmition unit)

- 4 Bytes

- Provides a method for the receiving NIC to determine whether

the frame experienced transmission errors

- length

- type

- OUI (Oranizationally Unique Identifier)

- the only field in the Ethernet trailer

- gives the receiving node a way to compare results with the sender,

to discover whether errors occurred in the fra

- acts like an ethernnet switch

- is a Service Provider that provides any form of WAN connectivity,

including Internet services

- router

- Serial interface card

- CSU/DSU (Channel Service Unit/Data Service Unit)

- slower speed links run at multiples of 64 kbps

- faster speed links run at multiples of about 1,5 Mbps

- two serial cables

- CSU/DSU provides a function called Clocking

- HDLC (High-Level Data Link Control)

- PPP (Point-to-Point Protocol)

- splits out the data over to the router on the lower right which

completes the connection to the internet

- also splits out the voice signals over to the voice switch on

the upper right

- IP networks

- IP subnets

- The process of routing forwards Layer 3 packets, also called

Layer 3 PDU (Protocol Data Units), based on the destination Layer

3 address in the packet

- The routing process uses the data link layer to encapsulate

the Layer 3 packets into Layer 2 frames for transmission across

each successive data link

- 1. If the destination IP address is in the same IP subnet as I am,

send the packet directly to that destination host.

- 2. Otherwise, send the packet to may default gateway, also known

as a default router. (This router has an interface on the same subnet

as the host)

- 1. Use the data link Frame Check Sequence (FCS) field to ensure

that the frame had no errors; if errors occurred, discard the frame.

- 2. Assuming that the frame was not discarded at Step 1, discard

the old data link header and trailer, leaving the IP packet.

- 3. Compare the IP packet's destination IP address to the

routing table, and find the route that best matches the destination

address. This route identifies the outgoing interface of the router,

and possibly the next-hop router IP address.

- 4. Encapsulate the IP packet inside a new data link layer header

and trailer, appropriate for the outgoing interface, and forward

the frame.

- refers more generally to a network made up of routers, switches,

cables and other equipment.

- the range of decimal number for each octet is from 0 to 255

- A - Unicast

- reserved

- B - Unicast

- C - Unicast

- D - Multicast

- E - Experimental

- Classful IP network

- defines methods of further subdividing IPv4 addresses intro

groups that are smaller then a single IP network

- defines a flexible way for anyone to take a single class A, B and

C and further subdivide it more into even smaller groups of consecutive

IP addresses.

- To dynamically learn and fill the routing table with a route

to each subnet in the internetwork

- If more than one route is available, to place the best route in

the routing table

- To notice when routes in the table are no longer valid, and to

remove them from the routing table.

- If a route is removed from the routing table and another route

through another neighboring router is available, to add the route to

the routing table.

- To work quickly when adding new routes or replacing lost routes.

(The time between losing the route and finding a working replacement

route is called convergence time.)

- To prevent routing loops.

- 1. Each router, independent of the routing protocol, adds a

route to its routing table for each subnet directly connected to the

router

- 2. Each router's routing protocol tells its neighbors

about the routes in its routing table, including the directly connected

routes, and routes learned from other routers.

- 3. After learning a new route from a neighbor, the router's

routing protocol adds a route to its IP routing table with the next-hop

router of of that route typically being the neighbor from which the

route was learned.

- the method by which any host or router on a LAN can dynamically

learn the MAC address of another IP host or router on the same LAN.

- is a message that asks the simple request "if this is your

IP address, please reply with your MAC address"

- is a message which indeed lists both the original IP address

and the matching MAC address.

- to do so it consumes more bandwidth and uses more processing

cycles.

- Source port (16 bits)

- Destination port (16 bits)

- Sequence number (32 bits)

- Acknowledgment number (32 bits)

- Data Offset (4 bits)

- Reserved (3bits)

- Frag bits aka Control bits (9 bits)

- Window size (16 bits)

- Checksum (16 bits)

- Urgent pointer (16 bits)

- occurs before any of the other TCP features can begin their work.

- refers to the process of initializing sequence and acknowledgment

fields and agreeing on the port numbers used.

- three-way connection establishment flow (three-way handshake)

must complete before data transfer can begin.

- A protocol that requires an exchange of messages before data

transfer begins, or that has a required preestablished correlation

between two endpoints.

- Source port (16 bits)

- Destination port (16 bits)

- Length (16 bits)

- Checksum (16 bits)

- A protocol that does not require an exchange of messages and

that does not require a preestablished correlation between two

endpoints.

- An IP address

- A transport protocol

- A port number

- Bandwidth

- Delay

- Jitter

- Loss

- Interactive

- Batch

- Real-Time

- web servers

- web browsers

- build the address table by listening to incoming frames and

examining the source MAC address in the frame

- Inactivity timer

- frame types

- steps

- loop prevention

- store and forward processing

- cut through

- fragment free

- switch ports connected to a single device microsegment the

LAN, providing dedicated bandwitdth to that single device.

- allow multiple simultaneous conversations between devices

on different ports.

- switch ports connected to a single device support full-duplex,

in effect doubling the amount of bandwidth available to the device.

- support rate adaptation, which means that devices that use

different Ethernet speeds can communicate through the switch

- A set of network interface cards (NIC) for wich a frame sent by

one NIC could result in a collision with a frame sent by any other

NIC in the same collision domain.

- an Ethernet concept of all ports whose transmitted frames would

cause a collision with frames sent by other devices in the collision

domain.

- The devices share the available bandwidth.

- The devices might inefficiently use the bandwidth because

of the effects of collisions, particularly under higher utilization.

- is the set of devices to which the broadcast is delivered.

- is a set of NICs for which a broadcast frame sent by one NIC is received

by all other NICs in the same broadcast domain.

- connect directly to end users, providing user device access

to the LAN

- Provides a connection point (access) for end-user devices.

Does not forward frames between two other access switches under

normal circumstances.

- most designs us at least two uplinks to two different distribution

switches for redundancy

- Provides an aggregation point for access switches, forwarding

frames between switches, but not connecting directly to end user devices.

- the largest campus LANs often use core switches to forward traffic

between distribution switches.

- Aggregates distribution switches in very large campus LANs,

providing very high forwarding rates.

- 10BASE-T

- 100BASE-T

- 1000BASE-T

- 1000BASE-SX

- 1000BASE-LX

- 1000BASE-LX

- Speed

- Duplex

- port 23

- port 22

- console

- Telnet

- ?

- help

- Command ?

- com?

- command parm?

- command parm<Tab>

- command parm1 ?

- shows what's true at a single point in time, and it takes

less effort

- Cisco IOS sends the output of show commands to the user that issued

the show command, and no other users.

- Cisco IOS treats the show command as a very short lived event

- shows what's true over time, but it requires more effort.

As a result, the debug command requires more CPU cycles, but it

lets you watch what is happening in a switch while it its happening.

- Cisco IOS reacts to debug commands by creating log messages

related to that debug command's options. Any user logged in can

choose to view the log messages, just by using the terminal monitor

command from enable mode.

- Cisco treats the debug command as an ongoing task.

- the options enabled by a single debug command are not disabled

until the user takes action or until the switch is reloaded.

- disables all currently enabled debug options

- reinitialization of the software

- mostly for read only

- if the command prompt lists the hostname followed by a ">"

- privileged commands can be executed in this mode

- if the command prompt lists the hostname followed by the "#"

- EXEC commands

- accepts configuration commands that tell the switch the details

of what to do and how to do it

- the console

- Telnet

- SSH

- AAA server (Authentication, Authorization and Accounting)

- ip ssh

- ssh

- the "|" at the end of a "show" command

- history

- interfaces vlan 1

- all (telnet ssh)

- none

- telnet

- SSH

- global configuration command that affects IOS stores passwords

for the password command, in both console and vty modes and the username

password global command.

- the encryption type used by the "service password-encryption"

command, as noted with the "7" in the password commands, is

weak.

- rules

- MOTD (message of the day)

- login

- Exec

- disables the display of log messages

- enables the display of log messages

- the switch can be configured to display syslog messages only

t more convenient times, such as at the end of output from a show

command

- 1. Enter VLAN 1 configuration mode using the "interface

vlan 1" global configuration command

- 2. Assign an IP address and mask using the "ip address ip-address

mask interface" subcommand

- 3. If not already enabled, enable the VLAN 1 interface using

the "no shutdown interface" subcommand

- 4. Add the "ip default-gateway ip-address" global

command to configure the default gateway

- 5. (Optional) Add the ip name-server ip-address1 ip-address2

... global command to configure the switch to use DNS to resolve

names into their matching IP address.

- 1. Enter VLAN 1 configuration mode using the "interface

vlan 1" global configuration command, and enable the interface

using the "no shutdown" command as necessary

- 2. Assign an IP address and mask using the "ip address dhcp"

interface command

- Verifying DHCP-learned Information on a switch

- define a maximum number of source MAC addresses allowed for

all frames coming in the interface

- watch all incoming frames, and keep a list of all source MAC addresses,

plus a counter of the number of different source MAC addresses

- when adding a new source MAC address to the list, if the number

of MAC addresses pushes past the configured maximum, a port security

violation has occurred. The switch takes action (the default action is

to shutdown the interface)

- sticky secure MAC addresses

- disable of a feature ???

- steps

- switchport port-security violation

- enable password

- enable secret

- Console

- Telnet

- SSH

- includes all devices in the same broadcast domain.

- a switch can configure some interfaces into one broadcast domain

and some into another, creating multiple broadcast domains. These

individual broadcast domains created by the switch are called virtual

LANs (VLAN)

- broadcast

- multicast

- unknown unicasts

- def.

- Concepts

- 802.1Q

- ISL (Inter-Switch Link)

- VLAN Trunking Protocol (VTP)

- routing packets between VLANs

- creating VLANs

- assigning VLANs to an interface

- Full VLAN configuration example.

- Shorter VLAN configuration example

- Trunking Administrative Mode options with the switchport

mode command

- reasons to prevent a particular VLAN's traffic from crossing

a trunk

- typically the host name

- Network and data link addresses

- The interface on the remote router or switch on the other end

of the link that sent the CDP advertisement.

- Information on what type of device it is (fo example, a router

or a switch)

- The model and OS level running on the device

- line status

- protocol status

- interface status

- The interface is configured with the shutdown command

- No cable, bad cable, wrong cable pinouts; the speeds are mismatched

on the two connected devices; the device on the other end of the

cable is powerd off, shutdown or error disabled.

- An interface up/down state is not expected on LAN switch physical

interfaces

- Port security has disabled the interface

- The interface is working

- if the speed is not known through any means, use 10 Mbps, half-duplex.

- if the switch successfully senses the speed without IEEE autonegotiation,

by just looking at the signal on the cable

- On opposite ends of any Ethernet link, the condition in wich

one of the two devices uses full-duplex logic and the other uses

half-duplex logic, resulting in unnecessary frame discards and retransmissions

on the link.

- 1.1. If configured, apply port security logic to filter the

frame as appropriate

- 1.2. If the port is an access port, determine the interface's

access VLAN.

- 1.3. If the port is a trunk, determine the frame's tagged

VLAN

- 2.1. Found (unicast)

- 2.2. Not Found (unicast)

- 2.3. Broadcast

- ACL (Access Control List)

- IP ACLs

- forward the frame out the only interface listed in the matched

address table entry

- Flood the frame out all other access ports in that same VLAN and

out all trunk ports that list this VLAN as fully supported (active,

in the allowed list, not pruned, STP forwarding)

- the root switch is always the designated switch on all connected

segments

- the port through which the switch has the least cost to reach

the root switch (lowest root cost)

- the switch forwarding the hello on to the segment, with the lowest

root cost, is the designated switch for that segment.

- the port is not used for forwarding user frames, nor are any frames

received on these interfaces considered for forwarding.

- Root bridge ID

- Sender's bridge ID

- Sender's root cost

- Timer values on the root switch

- the listed root's BID is better (numerically lower)

- the listed root's BID is worse (numerically higher)

- the lowest bridge ID

- if that ties, the lowest switch MAC address

- hello

- MaxAge

- Forward delay

- Like the blocking state, the interface does not forward frames.

The switch removes old states (unused) MAC table entries for which

no frames are received from each MAC address during this period.

These MAC table entries could be the cause of the temporary loops.

- interfaces in this state still do not forward frames, but the

switch begins to learn the MAC addresses of frames received on the interface.

- an attacker could connect a switch to one of these ports, one

with low STP priority value, and become the root switch. The new STP

topology could have worse performance than the desired topology.

- the attacker could plug into multiple ports, into multiple

switches, become root, and actually forward much of the traffic in the

LAN. Without the networking staff realizing it, the attacker could

use a LAN analyzer to copy large numbers of data frames sent through

the LAN.

- users could innocently harm the LAN when they connect an inexpensive

consumer LAN switch (one that does not use STP). Such a switch, without

any STP function, would not choose to block any ports and would likely

cause a loop

- Base:32,768

- spanning-tree vlan "vlan-id" root {primary | secondary}

- spanning-tree vlan "vlan-id" priority "pritority"

- If the current root has a base priority higher than 24,576, the

local switch uses a base priority of 24,576.

- If the current root’s base priority if 24,576 or lower, the local

switch sets its base priority to the highest multiple of 4096 that still

results in the local switch becoming root.

- 100 for 10 Mbps

- 19 for 100 Mbps

- 4 for 1 Gbps

- 2 fro 10 Gbps

- spanning-tree vlan "vlan-id" cost "cost"

- not enabled

- spanning-tree portfast

- not enabled

- spanning-tree bpduguard enable

- 1. Add the channel-group number mode on interface subcommand

under each physical interface that should be in the channerl

- 2. Use the same number for all commands on the same switch, but

the channel-group number on the neighboring switch cand differ.

- PAgP (Port Aggregation Protocol)

- IEEE standard LACP (Link Aggregation Control Protocol

- first priority

- if there is a tie than the switch MAC

- 1. Begin with a list or diagram of switches, and consider all

as possible root switches.

- 2. Rule out any switches that have an RP because root switches

do not have an RP (Root Port)

- 3. Always try the show spanning-tree, because it identifies

the local switch as root directly: "This switch is the root"

on the fifth line of output.

- 4. Always try the show spanning-tree root, because it identifies

the local switch as root indirectly: The RP column is empty if the

local switch is the root.

- 5. When using a sim, rather than try switches randomly, chase

the RPs. For example, if starting with SW1, and SW!'s G0/1

is an RP, next try the switch on the other end of SW1's G0/1

port.

- 6. When using a Sim, using show spanning-tree vlan x on a few switches,

and recording the root switch, RP, and DP ports can quickly show

you most STP fact. Use this strategy is available.

- 1. Chose based on the lowest neighbor bridge ID

- 2. Chose based on the lowest neighbor port priority

- 3. Chose based on the lowest neighbor internal port number

- 1. If available look at the show spanning-tree and show spanning-tree

root commands. These both list the root port, and the first of these

also lists the root cost

- 2. the show spanning-tree command list cost in two places:

- 3. For problems where you have to calculate a switch's

root cost

- 1. For switches connected to the same LAN segment, the switch

with the lowest cost to reach the root, as advertised in the hello

they send onto the link, becomes the DP on that link.

- 2. In the case of a tie, among the switches that tied on cost, the

switch with the lowest BID becomes the DP

- For interfaces that stay in the same STP state, nothing needs

to change.

- For interfaces that need to move from a forwarding state to a

blocking state, the switch immediately changes the state to blocking.

- For interfaces that need to move from blocking state to a forwarding

state, the switch first moves the interface to listening state, then

learning state, each for the time specified by the forward delay timer

(default 15 seconds). Only then is the interface placed into forwarding

state.

- 1. On the local switch, all the channel-group commands for all

the physical interfaces must use the same channel-group number

- 2. The channel-group number can be different on the neighbouring

switches.

- 3. If using the on keyword, you must use it on the corresponding

interfaces on both switches.

- 4. If you use the desirable keyword on one switch, the switch

uses PAgP; the other switch must use either desirable or auto

- 5. If you use the active keyword on one switch, the switch uses

LACP; the other switch must use either active or passive.

- speed

- duplex

- operational access or trunking state (all must be access, or

all must be trunks)

- if an access port, the access VLAN

- if a trunk port, the allowed VLAN list (per the switchport trunk

allowed command)

- if a trunk port, the native VLAN

- STP interface settings

- settings on neighboring switches

- What should happen in this network?

- data plane

- control plane

- 1. Examine the data plane:

- 2. Examine the control plane:

- What specifically is not working ?

- Before problem isolation

- After problem isolation

- 1. Begin by examining the layer 3 data plane (IP forwarding),

comparing the results to the expected normal behavior until you identify

the first major routing step that fails.

- 2. Further isolate the problem to as few components as possible

- What can we fix that solves the problem ?

- 1. Continue isolating the problem until you identify the true

root cause, which in turn has an obvious solution

- 2. If you cannot reduce the problem to its true root cause, isolate

the problem as much as possible and change something in the network,

which may change the symptoms and help you identify the root cause.

- 1. Determine interface status code(s) for each required interface,

and if not in a connected or up/up state, resolve the problems until

the interface reaches the connected or up/up state.

- 2. For interfaces in a connected up/up state, also check for

two other problems:

- use commands like show interface on each end of the link to confirm

the duplex setting on each end.

- watch for increases to certain counters on half duplex interfaces.

The counters-runts, collisions, and late collisions-occur when

other devices uses full duplex.

- limit which specific MAC addresses can send and receive frames

on a switch interface, discarding frames to/from other MAC addresses

- limit the number of MAC addresses using the interface, discarding

frames to/from MAC addresses learned after the maximum limit is reached

- a combination of the previous two points.

- 1. Identify all interfaces on which port security is enabled

- 2. Determine whether a security violation is currently occurring

based in part on the violation mode of the interface's port security

configuration:

- 3. In all cases, compare the port security configuration to

the diagram and to the last source address field in the output of

the show port-security interface command

- 1. Identify all access interfaces and their assigned access

VLANs and reassign into the correct VLANs as needed

- 2. Determine whether the VLANs both exist (configured or learned

with VTP) and are active on each switch. If not, configure and activate

the VLANs to resolve problems as needed.

- 3. Identify the operationally trunking interfaces on each

switch and determine the VLANs that can be forwarded over each trunk.