Monday, 10 October 2016

Network security Interview questions & answers

TCP:
1. Explain 3 way handshake process?
A three-way-handshake is a method used in a TCP/IP network to create a virtual connection between a client and server before transferring data. It is a three-step method that requires both the client and server to exchange SYN and ACK (acknowledgment) packets before actual data communication begins.

 

2. What is the importance of sequence number?

It is 32 bit field in TCP header which is used track the data sent and received.
TCP keeps track of data by assigning a sequence number to each byte sent, then it uses the corresponding acknowledgement numbers to determine if any data was lost in transit. At the beginning of a TCP connection, each side will start by using an Initial Sequence Number (ISN) which between 0 to 4,294,967,295(2^32).



3. What is the difference between Total length and header length?
Total length is header length + data
Header length is size of header.

4. What does window size indicate?

Window size indicate amount of data can received by host without sending acknowledgement.
TCP window is for efficient data transfer and flow control.

 

5. What is MSS and When the MSS value is getting negotiated?

MSS is part of TCP option field, it is used to define the maximum segment that will be used during a connection between two hosts. 
It is negotiated during the initial SYN and SYN/ACK phase of the TCP 3-way-handshake.
 
 

6. What is the difference between PUSH and URG flag?
PSH is used to ask receiving host not to buffer packets, but to process them as soon as they are received whereas URG flag is used to indicate that the packet should be given priority over other packets for processing.

7. What is the purpose of RST bit?

It indicate that service is not listening on given port.

8. What is SACK?

It is part of TCP option field called  as selective ack.
Receiver host send SACK to sender indicating that this amount of data has been received, you have to retransmit only missing data instead of retransmitting complete data.

 

9. Difference between TCP and UDP

10. TCP, UDP Header
TCP Header:















UDP Header:










11. What is Urgent Pointer In TCP field?

The URG pointer tell how many bytes of the data is urgent in the segment that has arrived. Let us assume  if the data size is 500 bytes and only first 100 bytes is urgent, the urgent pointer will have a value of 50.
When urgent flag is set to 1, urgent pointer also set.



IP:

1. Which ICMP message confirms the trace route is completed?
      Destination unreachable
2. What is Fragmentation ?
 Dividing IP packets into smaller pieces (fragments). Fragmentation is required when the packet is       larger than the MTU. Each fragment than becomes a datagram in itself and transmitted independently from source. These datagrams are reassembled only by the destination.

3. What is the importance of identification field in the IP packet?

It is 16bit field in IP header which is used to identify fragmented packets at receiver end.
E.g : Lets assume  packet length is 1600 bytes which need to be fragment(DF=0); so 1600 bytes data is further fragmented in 1500bytes and 100 bytes and both fragmented packet will have same ID value in identification field so that receiver can identify that both fragmented packets belong from same packet.

4. What is the importance of DF, MF flag?

IP header has flag field which has 3bit:
Reserved
DF
MF
Don’t fragment bit:
If DF bit is equal to 1, fragmentation is not allowed.
If DF bit set to 0, it means fragmentation is allowed.

when a router needs to forward a packet larger than the outgoing interface’s MTU, the router either fragments the packet or discards it. If the IP header’s Do Not Fragment (DF) bit set, the router discards the packet. If the DF bit is not set, fragmentation will be done by router.

More fragments bit:
If MF Bit is set to 1 means more fragments packet are coming. If it is set to 0 means This is the Last Fragment.
All fragments that belong to an IP datagram will have more fragments bit set except for the last packet. Last fragmented packet must have MF=0.
















5: What is the purpose of fragment offset?
It is used to define the Size of each Fragmented Packet and useful for rearrange the fragmented packet in correct order.
6. What does the protocol field determines in the IP packet?

    It has 8-bit field in IP header which is used to define which protocol is running on above layer.




No comments:

Post a Comment