Final Exam

This final exam is due Wednesday, May 6th at 6:00 PM, the scheduled exam time. You may send your answers to me electronically and I will send you a reply email that I got it, or you may turn it in on paper. You can turn it in any time before then; if you want to send an update after you've turned it in, I will accept those as well. This is a take-home short-answer exam, and as long as I can read it, I don't care about the format. The exam is open reference, but you may not share answers with your fellow students: you must turn in your own answers in your own words. If you have questions, please contact me; email hope or my office phone is 445-9385.

Vocabulary
1. Give me an example of a connection-oriented network and a connectionless network. How are they different? I'd like you to explain the differences in a way that relates to the name of the type (like connectionless), address how QoS is different, and work in these words (but only if relevant): centralized, distributed, decentralized
Hardware
1. Describe these network devices. Please include the OSI network layer at which they operate, what packets they forward to all ports, what packets are forwarded selectively, what packets they drop, and what information about users (like MAC addresses) or subnets they store. You should be able to work in a short discussion about shared versus switched.
  - hub
  - switch
  - router
Know Thyself
1. Look up your current IP configuration.
2. Tell me how you looked up your IP configuration. (You can answer both parts in one step if you copy-and-paste a command line, but this is not required.)
IP Basics
1. My current wireless configuration is 152.23.43.140, netmask 255.255.252.0, gateway 152.23.40.1. What is my netmask in hexadecimal?
2. How many network bits are in my netmask?
3. We typically use the lowest address for the gateway, and that's the case here. However, what would my gateway be if we instead used the highest address?
4. How many other hosts could be on this network with me?
Remedy (trouble) Tickets
- When a user sends us a Remedy ticket, they are asked certain standard questions (below).
  - The more information you can provide below, the faster we can solve the problem.
  - What is the nature of your problem? (required):
  - Please provide the location where you are having the problem (building name, etc) (required):
  - Your computer's IP and physical/MAC/hardware address (required):
    - To find this info on Windows 98/NT/2000/XP:
    - Open a command window
    - Type: ipconfig /all
  - Destination IP address or URL:
  - Is the problem machine a CCI model?
  - What is the operating system?
  - Please cut and past the Ping results:
  - Please cut and paste the traceroute results:
1. What basic information do we request, and why?
2. What troubleshooting information do we request, and why? For why, you might want to mention the standard network performance metrics: latency, jitter, throughput, and packet loss.
- BONUS: What other questions would you ask for basic network troubleshooting? Keep in mind, the information collection has to be somewhat reasonable for anyone on campus to do.
Basic Protocols: Short Answer
- Pick any two of these to answer:
  1. ARP maps Layer 3 addresses (IP addresses) to Layer 2 addresses (MAC addresses). When do you use ARP? (My answer, an incomplete sentence, is three words. You can go longer, but it's not necessary.)
  2. What does DNS map?
  3. What does . mean to DNS?
  4. Explain DORA in the context of DHCP.
  5. UDP and TCP are very different protocols. When is a good time to use UDP? (You might answer this with what applications use UDP, and mention the good reasons for that.) When is a good time to use TCP?
  6. Describe either how a TCP session starts, or how it ends assuming it ends normally and completely.
  7. What is the difference between TCP flow control and TCP congestion control? When do the respective window sizes change?
  8. What is some challenges for Network Security? (Remember, this is short answer, so stick with The Big Picture.)
SNMP
1. How does a MIB relate to SNMP?
2. What is the difference between a trap (also called an snmptrap) with a PDU type of 4, and any other type of SNMP PDU?
VLANs and Packet Capture
1. Packet capture on gomez only sees traffic within the ITS-Networking VLAN, even in promiscuous mode. Why?
2. Tell me about the interaction between VLANs and these traffic types: unicast, multicast, broadcast
Multicast
- Multicast questions tend to spook students, and I don't want to do that. But I do want to challenge you to think, so here goes.
- Multicast is like a conversation shared with a group. When an end station joins a multicast group, it starts listening for traffic destined for that multicast address. Likewise, network devices detecting multicast joins (since we enable IGMP snooping) will also join so they know to pass this traffic. This is very similar to the SAT (source address table) on a switch, a table of the MAC addresses seen on each port. SAT entries age out after 5 minutes of no traffic, and so do switch multicast joins. (This should be more background than you need to know!) Anyway, last year we had a multicast storm from an incorrectly configured Apple Software Restore server (ASR uses multicast on the address 224.0.0.123). What we saw were four switches in Physics dropping management (not answering SNMP queries from the SNMP manager). The building entrance switch in Phillips feeding those four switches had the exact same number of errors, incrementing at the same time, just on the four ports feeding those four switches. Fortunately, only the switches and the four Mac users in that multicast group on each of those four switches were affected. (Even better containment than a typical packet storm within a VLAN! That's good news.)
  1. Why did that pattern of errors correlating with the four switch's connection lead us to think multicast? Hint: Physics uses more than 4 switches.
  2. In what other ways would you be able to guess that this storm was multicast and not broadcast? What would you do to test that idea? Hint: use an important tool in our toolbox.
  3. One of the router interfaces (gateways) for Physics is 152.2.4.254 with a netmask of 255.255.252.0; given the size of that subnet, how many users would be affected if this were a broadcast storm?
Honor Code
- Please state and "sign" UNC's Honor Code: On my honor, I pledge that I have neither given nor received unauthorized aid on this exam.
Comments?
- All class comments welcomed!

FinalExam

Final Exam