The Physical Connection: Local Networks

As mentioned, using cables is one of the ways that computers are connected to each other. The cable connection used with traditional NICs (meaning not wireless) is an RJ-45 connection. (RJ is short for Registered Jack, which is an international industry standard.) In contrast to the computer’s RJ-45 jacks, standard telephone lines use RJ-11 jacks. The biggest difference between jacks involves the number of wires in the connector, also called the terminator. Phone lines have four wires (though some have six wires), whereas RJ-45 connectors have eight wires.

If you look on the back of most computers or the connection area of a laptop, you will probably find two ports that, at first glance, look like phone jacks. One of the two ports is probably for a traditional modem and accepts a standard RJ-11 jack. The other port is larger and accepts an RJ-45 jack. It would be extremely rare to find a modern computer that did not have a NIC.

This standard connector jack must be on the end of the cable. The cable used in most networks today is a Category 5 or Category 6 cable, abbreviated as Cat 5 cable or Cat 6 cable. The specifications for cable are laid out in ISO/IEC 11801. Table 2.1 summarizes the various categories of cable and their uses.

The type of cable used in connecting computers is also often referred to as unshielded twisted-pair (UTP) cable. In UTP, the wires in the cable are in pairs, twisted together without additional shielding. As you can see in Table 2.1, each subsequent category of cable is somewhat faster and more robust than the last. It should be noted that although Cat 4 can be used for networks, it almost never is used for that purpose, as it is simply slower, less reliable, and an older technology. You will usually see Cat 5 cable and, increasingly, Cat 6. You should note that we are focusing on UTP because that is what is found most often. There are other types of cable, such as shielded twisted-pair (STP), but they are not nearly as common as UTP.

As shown in Table 2.1, a key specification is speed, measured in Mbps, or megabits per second (though gigabits per second, or Gbps, speeds are becoming more common). You are probably already aware that ultimately everything in a computer is stored in a binary format—namely, in the form of a 1 or a 0. These units are called bits. It takes 8 bits, which equals 1 byte, to represent a single character such as a letter, number, or carriage return. Remember that the data specification for each cable is the maximum that the cable can handle. A Cat 5 cable can transmit up to 100 mega (million) bits per second. This is known as the bandwidth of the cable. If multiple users are on a network, all sending data, that traffic uses up bandwidth rather quickly. Any pictures transmitted also use a lot of bandwidth. Simple scanned-in photos can easily reach 2 megabytes (2 million bytes, or 16 million bits) or much larger. And streaming media, such as video, is perhaps the most demanding in terms of bandwidth.

If you simply want to connect 2 computers, you can have the cable go directly from one computer to the other. You would have to use a crossover cable, but you could connect 2 computers directly. But what do you do if you want to connect more than 2 computers? What if you have 100 computers that you need to connect on a network? There are three devices that can help you to accomplish this task: the hub, the switch, and the router. These each use Cat 5 or Cat 6 cable with RJ-45 connectors and are explained in the following sections.

Faster Connection Speeds

So far we have looked at the connections between computers on a local network, but there are faster connection methods. In fact, your Internet service provider or the company for which you work probably has a much faster connection to the Internet. Table 2.2 summarizes the most common high-speed connection types and their speeds.

It is common to find T1 connection lines in many locations. A cable modem can sometimes achieve speeds comparable to that of a T1 line. Note that cable connections are not included in Table 2.2 simply because their actual speeds vary greatly, depending on a variety of circumstances, including how many people in the immediate vicinity are using the same cable modem provider. You are not likely to encounter OC lines unless you work in telecommunications.

Wireless

Today, most of us use wireless networking or Wi-Fi. The Institute of Electrical and Electronics Engineers (IEEE) standard 802.11 provides guidelines for wireless networking. Various letter designations are used to denote different wireless speeds. The various wireless speeds, starting from the oldest to the most recent, are listed here:

• 802.11a: This was the first widely used Wi-Fi; it operated at 5GHz and was relatively slow.

• 802.11b: This standard operated at 2.4GHZ and had an indoor range of 125 feet with a bandwidth of 11Mbps.

• 802.11g: There are still many of these wireless networks in operation, but you can no longer purchase new Wi-Fi access points that use 802.11g. This standard includes backward compatibility with 802.11b. 802.11g has an indoor range of 125 feet and a bandwidth of 54Mbps.

• 802.11n: This standard was a tremendous improvement over preceding wireless networks, providing bandwidth of 100Mbps to 140Mbps and operating at frequencies of 2.4GHz or 5.0GHz over an indoor range of up to 230 feet.

• IEEE 802.11n-2009: This technology provides bandwidth of up to 600Mpbs with the use of four spatial streams at a channel width of 40MHz. It uses multiple-input multiple-output (MIMO), in which multiple antennas coherently resolve more information than is possible using a single antenna.

• IEEE 802.11ac: This standard, which was approved in January 2014, has throughput of up to 1Gbps and at least 500Mbps. It uses up to 8 MIMO.

• IEEE 802.11ad Wireless Gigabyte Alliance: Supports data transmission rates up to 7Gbps, which is more than 10 times faster than the highest 802.11n rate.

• IEEE 802.11af: Also referred to as “White-Fi” and “Super Wi-Fi,” this standard, which was approved in February 2014, allows WLAN operation in TV white space spectrum in the VHF and UHF bands between 54MHz and 790MHz.

• 802.11aj: IEEE 802.11aj is a rebranding of 802.11ad for use in the 45GHz unlicensed spectrum available in some regions of the world (specifically China).

The methods for securing Wi-Fi have evolved over the years. First there was Wired Equivalent Privacy (WEP), then Wi-Fi Protected Access (WPA), then WPA2, and most recently WPA3.

WEP uses the stream cipher RC4 to secure the data and a CRC-32 checksum for error checking. Standard WEP (known as WEP-40) uses a 40-bit key with a 24-bit initialization vector (IV) to effectively form 64-bit encryption. 128-bit WEP uses a 104-bit key with a 24-bit IV.

Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way its IV is used also opens WEP to a related key attack. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets.

WPA uses Temporal Key Integrity Protocol (TKIP), which is a 128-bit per-packet key, meaning that it dynamically generates a new key for each packet.

WPA2 is based on the IEEE 802.11i standard and provides the Advanced Encryption Standard (AES) using the Counter Mode-Cipher Block Chaining (CBC)-Message Authentication Code (MAC) Protocol (CCMP), which provides data confidentiality, data origin authentication, and data integrity for wireless frames.

WPA3 requires attackers to interact with your Wi-Fi for every password guess they make, making it much harder and time-consuming to crack. With WPA3’s “Wi-Fi Easy Connect,” however, you can connect a device by merely scanning a QR code on your phone. One of the important new security features is that with WPA3, even open networks will encrypt your individual traffic.

Bluetooth

Short-distance radio using the 2.4GHz to 2.485GHz frequency. The IEEE standardized Bluetooth as IEEE 802.15.1, but it no longer maintains the standard. This standard enables devices to discover other Bluetooth devices within range. The name comes from king Harald “Bluetooth” Gormsson, a tenth-century Danish king who united the tribes of Denmark. The idea behind the Bluetooth technology is that it unites communication protocols. (The king’s nickname has been explained a few different ways. One explanation is that he had a bad tooth that was blue. Another is that he was often clothed in blue.) The speed and range of Bluetooth depends on the version, as outlined in Table 2.3.

Other Wireless Protocols

There are several other wireless communication protocols, including the following:

• ANT+: This wireless protocol is often used with sensor data such as in bio sensors or exercise applications.

• ZigBee: This standard was developed by a consortium of electronics manufacturers for mainly residential applications of wireless devices related to appliances and security. It is based on the 802.15.4 standard. What appears to be confusing is that the standard is represented by the name “ZigBee” rather than a number. The term ZigBee is used similar to the way the term Wi-Fi is used.

• Z-Wave: This wireless communications protocol is used primarily for home automation. It uses a low-energy radio for appliance-to-appliance communication using a mesh network.

Data Transmission

We’ve seen, briefly, the physical connection methods; but how is data actually transmitted? To transmit data, a packet is sent. The basic purpose of a cable is to transmit packets from one machine to another. It does not matter whether the packets are part of a document, a video, an image, or just some internal signal from the computer. So what, exactly, is a packet? As we discussed earlier, everything in a computer is ultimately stored as 1s and 0s, called bits, which are grouped into sets of eight, each called a byte. A packet is a certain number of bytes divided into a header and a body. The header is 20 bytes at the beginning of the packet that tells you where the packet is coming from, where it is going, and more. The body contains the actual data, in binary format, that you wish to send. The aforementioned routers and switches work by reading the header portion of any packets that come to them. This process is how they determine where the packet should be sent.

IP Addresses

With tens of thousands of networks and millions of individual computers communicating and sending data, a predictable problem arises. That problem is ensuring that the data packets go to the correct computer. This task is accomplished in much the same way as traditional “snail” mail letter is delivered to the right person: via an address. With network communications, this address is a special one, referred to as an “IP” address. An IP address can be IP version 4 or version 6.

ping6 www.yahoo.com

Uniform Resource Locators

After you connect to your ISP, you will, of course, want to visit some websites. You probably type names, rather than IP addresses, into your browser’s address bar. For example, you might type in www.chuckeasttom.com to go to my website. Your computer or your ISP must translate the name you typed in (called a uniform resource locator [URL]) into an IP address. The DNS protocol, mentioned in Table 2.4, handles this translation process. So you are typing in a name that makes sense to humans, but your computer is using a corresponding IP address to connect. If that address is found, your browser sends a packet (using HTTP) to port 80. If that target computer has software that listens and responds to such requests (for example, web server software such as Apache or Microsoft Internet Information Server), then the target computer will respond to your browser’s request, and communication will be established. This method is how web pages are viewed.

When you receive an Error 404: File Not Found, what you are seeing is that your browser received back a packet (from the web server) with error code 404, denoting that the page you requested could not be found. There are a series of error messages that the web server can send back to your web browser to indicate different situations. Many of these problems the browser handles itself, and you never see the error message. All error messages in the 400 series are client errors. This term means something is wrong on your side, not with the web server. Messages in the 500 series are server errors, which means there is a problem on the web server. The 100 series messages are simply informational; 200 series messages indicate success (you usually do not see these, the browser simply processes them); and 300 series messages are redirectional, meaning the page you are seeking has moved, and your browser is then directed to the new location.

Using email works the same way as visiting websites. Your email client will seek out the address of your email server. Then your email client will use either POP3 to retrieve your incoming email or SMTP to send your outgoing email. Your email server (probably at your ISP or your company) will then try to resolve the address you are sending to. If you send something to [email protected], your email server will translate that email address into an IP address for the email server at yahoo.com, and your server will send your email there. Note that there are newer email protocols available, but POP3 is still the most commonly used.

Many readers are probably familiar with chat rooms. A chat room, like the other methods of communication we have discussed, works with packets. You first find the address of a chat room, and then you connect. The difference here is that your computer’s chat software is constantly sending packets back and forth, unlike email, which only sends and receives when you tell it to (or on a predetermined time interval).

Remember that a packet has a header section, and that header section contains your IP address and the destination IP address that you are going to (as well as other information). This packet structure will become important as we proceed through this book.

What Is a Packet?

We have mentioned network packets and how they are routed through a network and through the Internet. What we have not discussed is exactly what a packet is. You probably know that network traffic is really a lot of 1s and 0s that are in turn transmitted as voltages (over UTP), light wave (over optic cable), or radio frequencies (over Wi-Fi). The data is divided into small chunks called packets.

A packet is divided into three sections: the header (actually there are at least three headers, but we will get to that in just a moment), the data, and the footer. The header contains information about how to address the packet, what kind of packet it is, and related data. The data portion is obviously the information you want to send. The footer serves both to show where the packet ends and to provide error detection.

As just mentioned, there are usually at least three headers. In normal communication a packet usually has an Ethernet header, a TCP header, and an IP header. Each contains different information. Combined they have several pieces of information that will be interesting for forensic investigations.

Let’s begin with the TCP header. It contains information related to the transport layer of the OSI model. (We will be discussing the OSI model later in this chapter.) It contains the source and destination port for communications. It also has the packet number, such as packet 10 of 21.

There is also an IP header. The most obvious useful information are source and destination addresses. The IP header has the source IP address, the destination IP address, and the protocol. The IP header also has a version number, showing if this is a version 4.0 or 6.0 IP packet. The size variable describes how large the data segment is. There is also information regarding the protocol this packet represents.

The Ethernet header contains information regarding the source MAC address and destination MAC address. When a packet gets to the last network segment in its journey, it is the MAC address that is used to find the NIC that the packet is being sent to.

Basic Communications

The packet headers described in the previous section also contain some signal bits. These are single bit flags that are turned on to indicate some type of communication. A normal network conversation starts with one side sending a packet with the SYN (synchronize) bit turned on. The target responds with both SYN and ACK (acknowledge) bits turned on. Then the sender responds with just the ACK bit turned on, and communication commences. After a time, the original sender terminates the communication by sending a packet with the FIN (finish) bit turned on.

There are some attacks that depend on sending malformed packets. For example, in the common denial of service (DoS) attack, the SYN flood is based on flooding the target with SYN packets but never responding to the SYN/ACK that is sent back. Some session hijacking attacks use the RST command to help hijack communications.

IPConfig

The first step in studying networks is to get information about your own system. To accomplish this fact-finding mission, you will need to get to a command prompt. In Windows XP, go to the Start menu, select All Programs (in Windows Vista or 7), and then choose Accessories. You will then see an option called Command Prompt. In Windows 10 just type cmd at the search bar. (For Windows 2000 users, the process is identical, except the first option is simply called Programs rather than All Programs.) Next, type in ipconfig. (You could use the same command in UNIX or Linux by typing it once you’re inside the shell.) After typing ipconfig and pressing the Enter key, you should see something much like what is shown in Figure 2.1.

This command gives you some information about your connection to a network (or to the Internet). Most importantly, you find out your own IP address. The command also has the IP address for your default gateway, which is your connection to the outside world. Running the IPConfig command is a first step in determining your system’s network configuration. Most commands that this book will mention, including IPConfig, have a number of parameters, or flags, that can be passed to the commands to make the computer behave in a certain way. You can find out what these commands are by typing in the command, followed by a space, and then typing in a hyphen and a question mark: -?. Figure 2.2 shows the results of using this method for the IPConfig command.

As you can see in Figure 2.2, there are a number of options you might use to find out different details about your computer’s configuration. The most commonly used method would probably be IPConfig /all, shown in Figure 2.3. You can see that this option gives you much more information. For example, IPConfig /all gives the name of your computer, when your computer obtained its IP address, and more.

Ping

Another commonly used command is ping. ping is used to send a test packet, or echo packet, to a machine to find out if the machine is reachable and how long the packet takes to reach the machine. This useful diagnostic tool can be employed in elementary hacking techniques. In Figure 2.4 you see a ping command executed on www.yahoo.com.

This figure tells you that a 32-byte echo packet was sent to the destination and returned. The TTL (Time to Live) item shows how many intermediary steps, or hops, the packet should take to the destination before giving up. Remember that the Internet is a vast conglomerate of interconnected networks. Your packet probably won’t go straight to its destination; it will take several hops to get there. As with IPConfig, you can type in ping -? to find out various ways you can refine your ping.

Tracert

The next command is the tracert command. This command is more-or-less a deluxe version of ping. tracert not only tells you if the packet got to its destination and how long it took but also tells you all the intermediate hops it took to get there. This utility will prove very useful to you later in this book. Figure 2.5 illustrates a tracert to www.yahoo.com. (This same command can be executed in Linux or UNIX, but there it is called traceroute rather than tracert.)

With tracert, you can see (in milliseconds) the IP addresses of each intermediate step listed and how long it took to get to that step. Knowing the steps required to reach a destination can be very important, as you will see later in this book.

Certainly there are other utilities that can be of use to you when working with network communications. However, the three we just examined—IPConfig, ping, and tracert—are the core utilities. These three utilities are absolutely essential to any network administrator, and you should commit them to memory.

Netstat

Netstat is another interesting command. It is an abbreviation for network status. Essentially this command tells you what connections your computer currently has. Don’t panic if you see several connections; that does not mean a hacker is in your computer. You will see many private IP addresses. This means your network has internal communication going on. You can see this in Figure 2.6.

NSLookup

nslookup, which is an abbreviation for name server lookup, is used to connect with your network’s DNS server. Often it can be used just to verify whether the DNS server is running. It can also be used to execute commands. Recall from Chapter 1, “Introduction to Computer Security,” that we discussed DNS poisoning. One of the first steps in DNS poisoning is to see if the target DNS server will perform a zone transfer. (It should not do so with any machine other than another DNS server that is authenticated in the domain.) That can be attempted with nslookup, as shown here:

Click here to view code image

run: nslookup
type: ls -d domain_name <enter>

You can see the basic nslookup command in Figure 2.7.

ARP

Address Resolution Protocol (ARP) is used to map IP addresses to MAC addresses. The arp command shows existing IP-to-MAC address mappings your computer is currently aware of. Figure 2.8 demonstrates the use of the arp -a command.

As with other commands, there are a variety of flags for ARP. Here are some of them:

• -a displays the current ARP cache table.

• /g does the same as /a.

• /d deletes a specific entry from the ARP cache table.

• /s adds a static entry to the ARP cache table.

Route

The route command is used to view the IP routing table. Figure 2.9 demonstrates sample output from the route – print 4 command.

Like most other commands, route has flags you can use. Some of the most common flags are summarized here:

• print prints a specific route; for example, print -4 displays the IPv4 routing table.

• add adds a route.

• delete deletes a route.

• change changes a route.

• destination sends a command to a specific computer.

The OSI Model

Let’s begin with the OSI model, or Open Systems Interconnection model, which describes how networks communicate. It outlines the various protocols and activities, and it tells how the protocols and activities relate to each other. This model is divided into seven layers, as shown in Table 2.6, and was originally developed by the International Organization for Standardization (abbreviated ISO) in the 1980s.

Many networking students memorize this model. It’s good to at least memorize the names of the seven layers and to understand basically what each one does. From a security perspective, the more you understand about network communications, the more sophisticated your defense can be. The most important thing for you to understand is that the OSI model describes a hierarchy of communication. One layer will only communicate with the layer directly above it or below it.

Media Access Control (MAC) Addresses

A MAC address is a unique address for a NIC. (MAC is also a sublayer of the data link layer of the OSI model.) Every NIC in the world has a unique address that is represented by a 6-byte hexadecimal number, and ARP is used to convert IP addresses to MAC addresses. When you type in a web address, DNS is used to translate that into an IP address; then ARP translates that IP address into a specific MAC address of an individual NIC.

How is DNS is accomplished; that is, how does a URL get translated into an IP address? How does a computer know what IP goes with what URL? There are servers known as DNS servers that are set up just to do this task. If you are on a corporate network, you probably have a DNS server on your network. If you are not, then your ISP has one. These servers maintain a table of IP-to-URL entries. From time to time there are transfers of DNS data, called zone transfers, that allow one DNS server to send its changes to another. Across the Internet, there are root DNS servers that are maintained with centralized data for all registered URLs/IP addresses.

Multiple Choice Questions

1. Malek is purchasing cable to use in setting up small office networks. He wants to stock up on commonly used cable. What type of cable do most networks use?

A. Net cable

B. STP

C. Phone cable

D. UTP

2. You are assigned with attaching connectors to segments of cable. What type of connector is used with network cables?

A. RJ-11

B. RJ-85

C. RJ-12

D. RJ-45

3. What type of cable is used in most networks?

A. Unshielded twisted-pair

B. Shielded twisted-pair

C. Unshielded untwisted-pair

D. Shielded untwisted-pair

4. John is trying to simply connect three computers in a small network. He does not need any sort of routing capability and is not concerned about network traffic. What is the simplest device for connecting computers?

A. NIC

B. Interface

C. Hub

D. Router

5. Sharice is trying to teach a new technician basic networking terms. What should she tell this new technician NIC stands for?

A. Network interface card

B. Network interaction card

C. Network interface connector

D. Network interaction connector

6. Which of the following is a device used to connect two or more networks?

A. Switch

B. Router

C. Hub

D. NIC

7. Juan has just installed a new T1 line in a medical office. The front desk receptionist has asked what speed they can expect. A T1 line sends data at what speed?

A. 100Mbps

B. 1.54Mbps

C. 155Mbps

D. 56.6Kbps

8. How big is a TCP packet header?

A. The size depends on the data being sent.

B. The size is always 20 bytes.

C. The size depends on the protocol being used.

D. The size is always 40 bytes.

9. What protocol translates web addresses into IP addresses?

A. DNS

B. TFTP

C. DHCP

D. SMTP

10. What protocol is used to send email, and on what port does it work?

A. SMTP, port 110

B. POP3, port 25

C. SMTP, port 25

D. POP3, port 110

11. Gunther is setting up encrypted remote communications so that the server administrators can remotely access servers. What protocol is used for remotely logging on to a computer in a secure manner?

A. SSH

B. HTTP

C. Telnet

D. SMTP

12. Mohammed needs to open a firewall port so that web traffic can be passed through the firewall. What protocol is used for web pages, and on which port does it work?

A. HTTP, port 21

B. HTTP, port 80

C. DHCP, port 80

D. DHCP, port 21

13. What is the name for the point where the backbones of the Internet connect?

A. Connectors

B. Routers

C. Network access points

D. Switches

14. You are examining a list of IP addresses. Some are internal, some are external, and some are not valid. Which of the following is not a valid IP address?

A. 127.0.0.1

B. 295.253.254.01

C. 131.156.5.2

D. 245.200.11.1

15. What class of address is the IP address 193.44.34.12?

A. A

B. B

C. C

D. D

16. The IP address 127.0.0.1 always refers to your what?

A. Nearest router

B. ISP

C. Self

D. Nearest NAP

17. Internet addresses of the form www.chuckeasttom.com are called what?

A. User-friendly web addresses

B. Uniform resource locators

C. User-accessible web addresses

D. Uniform address identifiers

18. Which U.S. government agency created the distributed network that formed the basis for the Internet?

A. Advanced Research Projects Agency

B. Central Intelligence Agency

C. NASA

D. Department of Energy

19. Which of the following was one of the three universities involved in the original distributed network set up by a government agency?

A. UC Berkeley

B. Harvard

C. MIT

D. Princeton

20. You are explaining the history of networking to a group of first-year students. What did Vince Cerf invent?

A. The World Wide Web

B. Email

C. TCP

D. The first computer virus

21. You are explaining the history of networking to a group of first-year students. What did Tim Berners-Lee invent?

A. The World Wide Web

B. Email

C. TCP

D. The first computer virus

22. John is working with command-line utilities to gather diagnostic information about a computer that cannot connect to the network. Which utility provides information about a machine’s network configuration?

A. Ping

B. IPConfig

C. Tracert

D. MyConfig

23. Sheryl is explaining the OSI model to new technicians at her company. She is trying to explain what protocols operate at the various layers of the OSI model. At what layer of the OSI model does TCP operate?

A. Transport

B. Application

C. Network

D. Data link

24. Which layer of the OSI model is divided into two sublayers?

A. Data link

B. Network

C. Presentation

D. Session

25. Which of the following is a unique hexadecimal number that identifies your network card?

A. NIC address

B. MAC address

C. NIC ID

D. MAC ID

Exercises

Exercise 2.1: Using IPConfig

1. Open your command prompt or (Just type cmd at the search bar In Windows 10)

2. Type in ipconfig.

3. Use the output of the IPConfig command to find out information about your computer.

4. Write down your computer’s IP address, default gateway, and subnet mask.

Exercise 2.2: Using Tracert

1. Open your command prompt or DOS prompt.

2. Type in tracert www.chuckeasttom.com.

3. Note what hops your computer takes to get to www.chuckeasttom.com.

4. Repeat steps 2 and 3 with www.whitehouse.gov and http://home.pearsonhighered.com/.

5. Notice that the first few hops are the same. Write down what hops are taken to reach each destination and what hops are the same. Then briefly describe why you think some of the intermediate steps are the same for different destinations.

Exercise 2.3: NSLOOKUP

1. Go to the command prompt

2. Type nslookup www.chuckeasttom.com.

3. Note that this command gives you the actual name of the server, as per the hosting company’s naming conventions; its IP address; and any aliases under which that server operates.

Exercise 2.4: More About IPConfig

1. Open your command prompt or DOS prompt.

2. Use the -? flag with the IPConfig command to find out what other options you have with IPConfig. You should notice a number of options, including /all, /renew, and others.

3. Now try ipconfig /all. What do you see now that you didn’t see when you simply used ipconfig in Exercise 2.1?

Exercise 2.5: More About Ping

1. Open your command prompt or DOS prompt.

2. Use the -? flag on the ping command and find out what other options you have with ping. You should notice several additional options, such as -w, -t, -n, and -i.

3. Try ping www.chuckeasttom.com.

4. Try the option ping -n 2 www.chuckeasttom.com. Then try ping -n 7 www.chuckeasttom.com. What differences do you notice?

Projects

Project 2.1: Learning About DNS

1. Using web resources, look up the DNS protocol. You may find the following website to be of help: www.freesoft.org/CIE/Topics/75.htm.

2. Look up these facts: Who invented the DNS protocol? What is its purpose? How is it used?

3. Write a brief paper describing what the protocol does. Mention a bit about who invented it, when, and how it works.

Project 2.2: Learning About Your System

1. Find out if your organization (for example, your school or business) uses switches, hubs, or both. Why does your group use these? You can find out by simply asking the network administrator or the help desk. Make sure you tell them that you are seeking this information for a class project.

2. Write a brief paper explaining your findings and any changes you would make if you could. For example, if your organization uses only hubs, would you change that method? If so, why?

Project 2.3: Learning About NetStat

1. At the command prompt, type netstat. Notice the information it provides you. You should see the IP addresses or names of server that are currently connected to your computer. If you are using a home computer, you will need to log on to your Internet service provider to see anything.

   Caution

   Stopping NetStat

   Note that with many versions of Windows, for the next steps you need to use the Ctrl+Break key combination to stop netstat before starting it again with a new option.

2. Now type in netstat -? to see what options are available for this command. You should see -a, -e, and others.

3. Now type in netstat -a and note the information you see.

4. Finally, try netstat -e. What do you see now?