FE Electrical Computer Networks Practice Problems

Answer: B) 255.255.0.0

The Handbook defines the notation on p. 399: the integer after the slash is the number of leftmost bits common to all addresses on the network, and the same range can be written with a 32-bit dotted decimal mask that has ones in exactly those bits, its example being 192.168.5.0/24 = 192.168.5.0/255.255.255.0. A /16 has ones in the first 16 bits, two whole octets, and zeros in the last 16:

$$11111111.11111111.00000000.00000000 = 255.255.0.0$$

The network 172.16.0.0/16 therefore runs from 172.16.0.0 to 172.16.255.255, \(2^{16} = 65\,536\) addresses, of which the first names the network and the last is the broadcast, leaving 65 534 for hosts. It lies inside the private block 172.16.0.0/12 of the table on p. 400. Before CIDR the mask was implied by the first octet, and a /16 was a class B network; the Handbook's table now labels the old classes as former, because the prefix length is chosen freely and carried explicitly.

255.0.0.0 is the mask of a /8, one octet of network bits.

255.255.255.0 is a /24, three octets, the Handbook's own example.

255.255.255.255 is a /32, a single host address, and also the limited-broadcast address of p. 400.

Answer: C) 28

Count from one node: it needs a link to each of the other \(n - 1 = 7\) nodes. Doing that for all 8 nodes gives \(8 \times 7 = 56\) link ends, but every link has been counted twice, once from each of its two nodes, so the number of links is

$$\dfrac{n(n - 1)}{2} = \dfrac{8 \times 7}{2} = 28$$

This is the number of ways to choose 2 nodes out of 8, since a link is simply a pair of nodes. The Handbook's mesh diagram on p. 411 shows the pattern, every station joined to every other, and the arithmetic shows its cost: the link count grows with the square of the node count, so doubling the nodes to 16 needs 120 links, and each node needs \(n - 1\) interfaces. In return the mesh has no single point of failure and a one-hop path between every pair, which is why it is used for small backbone cores and among a handful of WAN sites but never for end stations, which are served by the star of p. 411 with one link each.

56 is \(n(n - 1)\), every link counted twice.

7 is \(n - 1\), the links, or interfaces, at a single node.

8 is the link count of a ring of 8 nodes, one link per node.

Answer: C) 101

The Handbook states the rule twice over, in the two field descriptions on p. 405. Of the sequence number it says that if the SYN flag is set, this is the initial sequence number, and 'the acknowledged number in the corresponding ACK are then this sequence number plus 1'. Of the acknowledgment number it says that its value is 'the next sequence number that the sender of the ACK is expecting', and that 'the first ACK sent by each end acknowledges the other end's initial sequence number itself, but no data'.

So the server acknowledges the client's SYN by naming what it expects next:

ack \(= 100 + 1 = 101\)

The reason a SYN consumes a sequence number even though it carries no data is that the handshake has to be acknowledgeable. If a SYN cost nothing, the acknowledgment would be indistinguishable from an acknowledgment of nothing having arrived, and a lost SYN could not be told apart from a delayed one.

100 is the client's sequence number repeated, which is the acknowledgment of everything up to and including byte 99 rather than of the SYN itself; the field names the next byte expected, not the last one received. 99 subtracts instead of adding. 301 is the server's own initial sequence number plus one, that is, the number that will appear in the client's acknowledgment in the third segment, not in the server's own.

The pattern for the whole exchange is worth carrying: SYN with seq = x, SYN-ACK with seq = y and ack = x + 1, ACK with seq = x + 1 and ack = y + 1. Here that makes the third segment seq = 101, ack = 301.

Answer: D) control 4, the host-based firewall

Locate the attacker on the figure first, then walk inward.

The web server is in the DMZ, and the DMZ sits between control 2 and control 3. Everything to the left of the attacker is already behind them: reaching the web server at all meant getting through control 1, the perimeter firewall, and control 2, the IPS. Those two protect the DMZ from the outside and have nothing left to say once the attacker is inside it.

Walking to the right, the attacker meets control 3, the internal firewall, which separates the DMZ from the internal LAN, and then control 4, the host-based firewall on the database server itself. Control 3 is the first control still standing; control 4 is the last, the one immediately in front of the data.

That ordering is the point of the arrangement. The value of layering is that a single compromise buys only one zone: taking the web server puts the attacker in the DMZ, not on the database, because the controls are placed in series rather than stacked at the edge. A design with the same four controls all at the perimeter would have handed over everything at the first breach. Note too that control 4 is on the server rather than in the network, so it still applies to an attacker who is already on the internal LAN, which a network firewall would not.

The perimeter firewall and the IPS are already passed, so neither can be the last control ahead of the attacker, and the internal firewall is the first one they meet rather than the last.

Answer: D) SW4

Apply the rule in two stages, in the order it is written.

The priority comes first. SW1 and SW2 carry 32768, SW3 and SW4 carry 4096, and 4096 is lower, so the election is between SW3 and SW4 and the other two are out. The priority alone does not finish it, because SW3 and SW4 are tied.

The MAC address breaks the tie. Compare the two byte by byte from the left: they agree through 00:1A:2B:00:00, and the last byte is 0C for SW3 and 07 for SW4. Hexadecimal 07 is 7 and 0C is 12, so SW4's address is the lower one and SW4 has the lowest bridge ID overall.

The link costs are drawn because they matter to the protocol, but not to this step. Once the root is elected, every other switch works out its own cheapest path to it and the ports that are not on a cheapest path are blocked, which is what breaks the loop. The cost 19 on SW1 to SW3 will decide port roles at that later stage; it has no vote in who becomes root. Picking a switch because its links are cheap is the most common way to get this wrong.

The other three are each the end of a recognisable slip. SW1 has the lowest MAC address of all four, 00:1A:2B:00:00:01, and is what you get by comparing MAC addresses and forgetting that the priority is read first. SW2 has the highest bridge ID of the four and is what you get by reading the comparison backwards, as though the largest number won. SW3 is the trap for stopping at the priority: it does tie for the lowest value, and it is the first switch you meet that has it, but the tie has to be settled on the address.

The Handbook draws a switch as a link-layer device, with a shorter protocol stack than a host, and that is the reason a loop between switches is a problem in the first place. A frame carries no hop count, so nothing in it expires; a broadcast frame sent into a loop of switches is forwarded round it indefinitely. The spanning tree protocol exists to leave exactly one active path between any two switches, and electing a root is its first step.