Jarrod69's Blog

Chapter 9

jarrod69 — Tue, 08 Sep 2009 05:55:45 +0000

Chapter 9

Top Down - starts with the application layer and works down. It looks at the problem from the point of view of the user and the application.
Bottom Up - starts with the physical layer and works up. The physical layer is concerned with hardware and wire connections.
Divide and Conquer - typically begins at one of the middle layers and works up or down from there.
Physical Topology - shows the physical layout of the devices connected to the network, it includes:
device types
models and manufacturers of device
locations
operating system versions
cable types and identifiers
cabling endpoints
Logical Topology - shows how data is transfered on the network, it includes:
device identifiers
IP addresses and subnet masks
interface identifiers
routing protocols
static and default routes
data link protocols
WAN technologies
OSI Model Troubleshooting -
Layer 1 -
performance lower than baseline
loss of conectivity
high collision counts
network bottlenecks or congestion
high CPU utilization rates
console error messages
Layer 2 -
no functionality or connectivity at the network layer or above
network operating below baseline performance levels
excessive broadcasts
console error messages
Layer 3 -
network failure
network performance below baseline
Layer 4 -
intermitent network problems
security problems
trouble reaching websites
Upper Layer Problems -
user complains about slow application performance
application error messages
unable to access application services
unable to access web services
Router Commands -
show version - displays operating system version and whether all interface hardware is recognized.
show flash - displays the contents of the flash memory.
show ip interfaces brief - shows the operational status of the device interface and IP addresses assigned:
up/up status – indicates normal operation and that both the media and the layer 2 protocol are functional.
down/down status – indicates that a connectivity or media problem exists.
up/down status – indicates that the media is connected properly, but that the layer 2 protocol is not functioning or is misconfigured.
show interfaces - provides information on media errors.
show interface port counters errors - shows port error statistics.
show interface port status - shows the speed and duplex settings on a port and whether manual or autonegotiation features were used.
show interfaces serial - used for troubleshooting serial interfaces and line problems.
show dhcp binding - checks whether the DHCP server has available addresses.
show ip dhcp conflict - displays all address conflicts recorded by the DHCP server.
ip helper-address - forwards all broadcast packets, including DHCP requests to a specific server. This allows a router to change the destination broadcast addresses within a packet to a specified unicast address.
show ip nat translations - verifies NAT is operational.
show ip route - displays all the routes the router uses to forward traffic.
debug ip rip - displays the exchange of RIP routing updates and packets as they occur.

Chapter 8

jarrod69 — Mon, 07 Sep 2009 01:03:11 +0000

Chapter 8

AAA - Authentication, Authorization, Accounting – is a three step process used by network administrators.
Authentication - requires users to prove their identity using a username and password. Authentication databases are typically stored on servers that use the RADIUS or TACACS protocols.
Authorization - gives users rights to access specific resources and perform specific tasks.
Accounting - tracks which applications are used and the length of time that they are used.
Data Encryption -
Web Servers - use HTTP by default, which is not a secure protocol. Using HTTPS, which uses the Secure Socket Layer (SSL) protocol, enables the exchange of data to be performed securly.
E-mail Servers - when a user logs on to an e-mail server, POP3 and IMAP4 require a username and password for authentication. POP3 can be secured using SSL. SMTP and IMAP4 can use either SSL or Transport Layer Security (TLS).
Telnet Servers - sends authentication information and any commands a user types across the network in clear text. Use the Secure Shell (SSH) protocol to authenticate and work with the router or switch securly.
FTP Servers - is an unsecure protocol. Authentication information is sent in clear text. FTP can use SSL and some versions can use SSH.
IPSec - IP Security – is a network layer security protocol that can be used to secure any application protocol used for communication.
DoS - Denial of Service – attack is when a server or service is attacked to prevent ledgitimate access to that service. Examples are SYN floods, ping floods, LAND attacks, bandwidth consumption attacks and buffer overflow attacks.
DDoS - Distributed Denial of Service – attack occurs when multiple computers are used to attack a specific target.
DRDoS - Distributed Reflected Denial of Service – attack occurs when an attacker sends a spoofed or mock request to many computer systems on the internet, with the source address modified to be the target computer system.
Port Filtering - controls the flow of traffic based on a specific TCP or UDP port, except port 80.
ACL - Access Control List – defines traffic that is permitted or denied through the network based on source and destination IP addresses. ACL’s can also permit or deny traffic based on the source and destination ports of the protocol being used.
IDS - Intrusion Detection System – is a software or hardware based solution that passively listens to network traffic. Network traffic does not pass through an IDS device, instead it monitors traffic through a network interface. When the IDS detects malicious traffic, it sends out an alert to a pre-configured management station.
IPS - Intrusion Prevention System – is an active physical device or software feature. Traffic travels in one interface of the IPS and out the other, it examines the actual data packets that are in the network traffic and works in real time to permit or deny packets that want access into the network.
Wireless Security -
Open Authentication - any and all clients are able to have access regardless of who they are.
PSK - Pre Shared Key – requires a matching pre-configured key on both the server and client. It encrypts a string and uses a key to decrypt it.
EAP - Extensible Authentication Protocol – provides mutual, or two way authentication and user authentication. When EAP software is installed on the client, the client communicates with a backend authentication server such as RADIUS.
WEP - Wired Equivalent Privacy – provides data security by encrypting data that is sent between wireless nodes. WEP uses a 64, 128 or 256 bit pre shared hexadecimal key. It’s weakness is it uses static encryption keys, meaning the same key is used by every device.
WPA - Wifi Protected Access – uses an improved encryption alogorithm called Temporal Key Integrity Protocol (TKIP). TKIP generates a unique key for each client and rotates security keys at a configurable interval.
WPA2 - uses the more advanced encryption standard AES technology.
Telnet - can be used over an IP network connection to connect to a device in-band for the purpose of monitoring and administrating it. A connection using Telnet is called a Virtual Terminal (VTY).
SSH - Secure Shell – provides secure remote login and other network services. It also provides stronger authentication than Telnet and supports the transport of session data using encryption.
SNMP - Simple Network Management Protocol – enables administrators to gather data about the network and corresponding devices.
Syslog - is the standard for logging system events.
File Backup -
Normal - or full backup copies all selected files, in their entirity. Each file is then marked as having been backed up, only the most recent backup is required to restore files. Normal backups take the most amount of time.
Differential - copies only the files that have been changed since the last full backup.
Incremental - a differential backup saves files that were changed since the last full backup, an incremental backup only saves files that were created or changed since the last incremental backup.

Chapter 7

jarrod69 — Sun, 06 Sep 2009 04:30:36 +0000

Chapter 7

MTBF – Mean Time Between Failure – average length of time that the device will work without failing. The measure of equipment robustness is fault tolerance, the longer the MTBF the greater the fault tolerance.
MTTR - Mean Time To repair – calculation of the length of time a device will take to recover from a non-terminal failure. A system with a shorter MTTR is more expensive.
Five 9′s - 99.999% – availability 99.999% of the time.
TCP/IP Protocols -
Application Layer – DNS, BOOTP, DHCP, SMTP, POP, IMAP, FTP, TFTP, HTTP.
Transport Layer – UDP, TCP.
Internet Layer – IP, NAT, ARP, ICMP, RIP, OSPF, EIGRP, BGP.
Network Access Layer – PPP, Ethernet, Interface Drivers.
TCP - Transmission Control Protocol – is a reliable guaranteed delivery protocol. TCP specifies the methods hosts use to acknowledge the recipt of packets, and reqires the source host to resend packets that are not acknowledged. TCP also governs the exchange of messages between the source and destination hosts to create a communication session. TCP requires overhead, which includes extra bandwidth and increased processing
UDP – User Datagram Protocol – is a very simple connectioless protocol. It provides low overhead data delivery. UDP is considered “best effort” transport layer protocol because it does not provide error checking, guaranteed data delivery or flow control.
Three Way Handshake - is used to setup a TCP session. 1. The source host sends a SYN message. 2. The destination host replies to the SYN message with a SYN-ACK message. 3. The sending host recieves the SYN-ACK message and sends an ACK message to complete the connection.
DNS Heirarchy -
Resource Records and Domain Namespace - a resource record is a data record in the database file of a DNS zone. It is used to identify a type of host, a host IP address or a parameter of the DNS database. The domain namespace refers to the heirarchial naming structure for organising resource records.
Domain Name System Servers - maintains the databases that store resource records and information about the domain namespace structure. DNS servers attempt to resolve client quires using the domain namespace and resource records it maintains in its zone databes files.
Resolvers - are application or operating system functions that run on DNS clients and DNS servers. When a domain name is used to resolve queries the DNS server to translate that name to an IP address.
FQDN - Fully Qualified Domain Name – defines the exact location of the computer within the heirarchial DNS namespace.
DNS Zones -
Forward Lookup Zone - is a standard DNS zone that resolves fully qualified domain names to IP addresses.
Reverse Lookup Zone - is a specified zone that resolves an IP address to a fully qualified domain name.
Primary Zone - is a zone that can be modified. When a new resource record needs to be added or an existing record needs to be updated or deleted, the change is made on a primary DNS zone.
Secondary Zones - is a read only backup zone maintained on a seperate DNS server than the primary zone. The secondary zone is a copy of the primary zone and recieves updates to the zone information from the primary server.
Proxy Server - allows clients to make indirect network connections to other network services. The client connects to the proxy server and requests from the proxy a resource on a different server. The proxy connects to the specified server and retrives the requested resource, it then forwards the resource back to the client.

Chapter 6

jarrod69 — Fri, 04 Sep 2009 07:37:24 +0000

Chapter 6

Directly Connected Routes – when the router powers up, the configured interfaces are enabled. As the interface becomes operational, the router starts the directly attatched local network addresses as connected routes in the routing table. On Cisco routers these routes are identified in the routing table with the prefix C. The routes are automatically updated whenever the interface is reconfigured or shutdown.
Static Routes – a network administrator can manually configure a static route to a specific network. A static route does not change until the administrator manually reconfigures it. These routes are identified in the routing table with the prefix S.
Dynamically Updated Routes – are automatically created and maintained by routing protocols. Routing protocols exchange routing information with other routers in the network. Dynamically updated routes are identified in the routing table with the prefix that corresponds to the type of protocol that created the route, for example, R is used for the Routing Information Protocol (RIP).
Default Route – is a type of static route that specifies the gateway to use when the routing table does’nt contain a path for the destination network.
Routing Algorithms - Distance Vector, Link State
Distance Vector - routing algorithm peridically passes copies of the routing table from router to router. These regular updates between routers communicate topology changes. The distance vector algorithm evalautes the route information it recieves from other routers using two basic criteria 1. Distance: how far is the network from this router? 2. Vector: in which direction should the packet be sent to reach this network.
Link State - routers that use the distance vector routing algorithm have little information about distant networks and none about distant routers. The link state routing algorithm maintains a full database of distant routers and how they interconnect.
RIP - Routing Information Protocol – is a distance vector routing protocol. Charactics of RIP are 1. uses hop count as the metric for path selection. 2. defines a hop count greater than 15 as an unreacheable route. 3. sends routing table contents every 30 seconds.
EIGRP - Enhanced Interior Gateway Routing Protocol – is an enhanced distance vector routing protocol. Characteristics of EIGRP are 1. uses a variety of metrics to calculate the cost of a route. 2. combines the next hop and metric features of distance vector protocols with additioanal database and update features. 3. has a maximum hop count of 224.
OSPF - Open Shortest Path First – link state routing protocol. Characteristics of OSPF are 1. uses the SPF algorithm to calculate the lowest cost to a destination. 2. sends routing updates only when the topology changes, does not send periodic updates of the entire routing table. 3. provides fast convergence. 4. supports Variable Length Subnet Mask (VLSM) and discontiguous. 5. provides route authentication.
AS – Autonomous System – is a set of networks controlled by a single administrative authority using the same internal routing policy throughout. Each AS is identified by a unique AS number (ASN).
IGP - Interior Gateway Protocol – are used to exchange routing information within an AS or individual organization. Examples are RIP, EIGRP and OSPF.
EGP - Exterior Gateway Protocol – are designed to exchange routing information between different autonmous systems. An example is Border Gateway Protocol (BGP).
Commands –
show ip route - displays the routes in the routing table.
show ip protocols – verifies that RIP routing is configured, that the correct interfaces are sending and recieving updates and that the router is advertising the correct networks.
debug ip rip - can be used to observe the networks advertised in the routing updates as the are sent and recieved (real time).

Chapter 5

jarrod69 — Tue, 01 Sep 2009 06:58:52 +0000

Chapter 5

Startup Configuration File – is the saved configuration file that sets the proporties of the device each time the device is powered up. This file is stored in non-volatile RAM (NVRAM), meaning that it is saved even when power to the device is turned off. When a Cisco router is first powered up, it loads the Cisco los software to working memory or RAM, next the startup configuration file is copied from NVRAM to RAM. When the startup configuration file is loaded into RAM, the file becomes the initial running configuration.
Running Configuration File – refers to the current configuration running in RAM on the device. The running configuration file is stored in the working memory of the device. Changes to the configuration and various device parameters can be made when the file is in working memory. These changes will be lost each time the device is shutdown unless the Copy Run Start command is used.
ROMmon – if the router fails to boot the IOS, it then boots up in ROM monitor. When the router boots up to ROMmon mode, one of the first steps in troubleshooting is to look in flash memory for a valid image using the dir flash command. If an image is located attempt to boot the image with the boot flash command.
Out of Band Management – requires a computer to be directly connected to the console port or auxiliary port of the network device being configured. This type of connection does not require the local network connections on the device to be active.
In Band Management – is used to monitor and make configuration changes to a network device over a network connection. For a computer to connect to the device and perform in band management tasks, at least one network interface on the device must be connected to the network and be opperational.
CLI Command Modes –
Router> commands that can be executed in user EXEC made are limited to obtaining information about how the device is operating.
Router# to enter commands that can alter the operation of the device requires priviledged access. Enable priviliged EXEC mode by entering enable at the command prompt.
Commands –
show version - can be used to verify and troubleshoot some of the basic hardware and software components used during the boot process.
config t – used to enter global configuration mode. It is displayed with the Router(config)#.
interface (type) (number) – interface configuration made is used to configure LAN and WAN interfaces. It is displayed as Router(config-if)#.
help - displays help system. ? can be used halfway through a command to help finish it.
terminal history size - the command history is enabled by default and the system records 10 command lines in the history buffer. To change the amount use the terminal history size command, the maximum is 256 lines.
hostname (name) - changes the default host name.
enable password - enables a password but it is not encrypted.
enable secret - encrypted password, overrides enable password.
service password-encryption - ensures all passwords are encrypted.
shutdown - turns off an interface.
ip route - configures the default route.

Chapter 4

jarrod69 — Fri, 07 Aug 2009 07:56:19 +0000

Chapter 4

Ip Address classes –
Class A : 1-127 N.H.H.H 128 networks 16,77,214 hosts per network
Class B : 128-191 N.N.H.H 16,384 networks 65,534 hosts per network
Class C : 192-223 N.N.N.H 2,097,152 networks 254 hosts
Class D : 224-239 Multi-cast
Class E : 240-255 Experimental
Private IP Address Range –
Class A : 10.0.0.0 to 10.255.255.255
Class B : 172.16.0.0 to 172.31.255.255
Class C : 192.168.0.0 to 192.168.255.255
Classful Subnetting – design requires that all subnets of a single classed network be of the same size.
VLSM - Varible Length Subnet Masking – addressing allows an address space to be divided into networks of various sizes, this is done by subnetting subnets. VLSM saves thousands of IP addresses that would be wasted with traditional classful subnetting.
CIDR - Classless Inter-Domain Routing – ignores network classes based on the value of the higher order bits. CIDR identifies networks based solely on the number of bits in the network prfix, which corresponds to the number of ones in the subnet mask. An example of an IP address written using CIDR notation is 172.16.1.1 /16, where the /16 represents the number of bits in the network prefix. CIDR allowes for more efficent use of IPv4 address space and prefix aggregation, which reduces the size of the routing tables.
NAT - Network Address Translation – allows a large group of private users to access the internet by sharing one or more public IP addresses. In addition, NAT hides private IP addresses from public networks. The advantage of this is that NAT operates much like an access control list, not allowing outside users to access internal services. The disadvantage is that additional configurations are required to allow access from leditimate external users.
NAT terms –
Inside Local Network – refers to any network connected to a router interface that is part of the privately addressed LAN. Hosts on inside networks have their IP addresses translated before they are transmitted to outside destinations.
Outside Global Network – any network attatched to the router that is external to the LAN and does not recognize the private addresses assigned to the host on the LAN.
Inside Local Address – private IP address configured on a host on an inside network. The address must be translated before it can travel outside the local network and addressing structure.
Inside Global Address – Ip address of an inside host as it appears to the outside network. This is the translated IP address.
Outside Local Address – destination address of thepacket while it is on the local network. Usually this address is the same as the outside global address.
Outside Global Address – public IP address of an external host. The address is allocated from a globally routable address or network space.
Dynamic NAT – occurs when a router assigns an outside global address from a predefined address, or pool of address, to an outside private network device.
Static NAT – allows hosts on the public network to access selected hosts on a private network. If a device on the inside network needs to be accesible from the outside, use static NAT.
PAT - Port Address Translation – translates multiple local addresses to a single global IP address.

Chapter 3

jarrod69 — Tue, 04 Aug 2009 08:45:43 +0000

Chapter 3

Site Survey – provides the network designer important information and creates a proper starting point for the project. It shows what is already on site and gives a good indication as to what is needed, important pieces of information that can be gathered during a site survey include:
number of uses and types of equipment.
projected growth.
current internet connectivity.
application requirements.
existing network infrastructure and physical layout.
new services required.
security and privacy considerations.
reliability and uptime expectations.
budget constraints.
Physical Topology – is the actual physical location of cables, computers and other peripherals. In a wireless network the physical topology contains the wireless signal coverage area.
Logical Topology - documents the path that data takes through the network, it includes the naming and layer 3 addressing of end stations, router gateways and other network devices regardless of the physical location. It indicates the location of routing, network address translation and firewall filtering.
Star Topology - each device is connected via a single connection to a central point. The central point is typically a switch or wireless access point. The advantage of a star topology is that if a single connecting device fails, only that device is affected. However, if the central device, such as the switch, then all connecting devices lose connectivity.
Mesh Topology - every device has a connection to every other device. While full mesh topologys provide the benefit of a fully redundant network they can be difficult to wire and manage and are more costly.
MDF – Main Distribution Facility – typically contains many of the network devices, including switches or hubs, routers and access points. It is where all of the network cable concentrates to a single point. Many times, the MDF also contains the Point of Presence of the ISP, where the network makes the connection to the internet through a telecommunications service provider.
IDF – Intermediate Distribution Facility – if additional wiring closets are required they are referred to as IDF’s. An IDF is typically smaller than an MDF and connects to it.
STP – Shielded Twisted Pair – usually category 5, 5e or 6 cable that has a foil shielding to protect from outside electromagnetic interferance (EMI). In an Ethernet environment, the distance limitation is approximately 100 meters.
UTP - Unshielded Twisted Pair – usually category 5, 5e or 6 cable that does not provide extra shielding from EMI, but it is inexpensive. Cable runs should avoid electrically noisy areas. In an Ethernet environment the distance limitation is approximately 100 meters.
Fibre Optic Cable – a medium that is not suseptible to EMI, and can transmit data faster and farther than copper. Depending on the type of fibre optics, distance limitations can be several kilometers. Fibre optic can be used for backbone cabling and high speed connections.
Straight Through - connects dissimilar devices, such as a switch and a computer, or a switch and a router.
Crossover – connects similar devices, such as two switches or two computers.
Console (or Rollover) – connects a computer to the port of a router or switch to do initial configuration.
Serial Cable - is typically used to connect the router to an internet connection like an ISP.

Chapter 2

jarrod69 — Tue, 28 Jul 2009 00:48:56 +0000

Chapter 2

Isp Technicians –
Level 1 –
diagnose basic network connectivity issues.
diagnose and document the symptoms of hardware, software and system problems.
resolve and document any basic user issues.
help customers complete online order forms to attain various systems, services, hardware, software, reports and entitlements.
escalate unresolved issues to the next level.
Level 2 –
diagnose and solve more difficult network problems.
use diagnostic tools and remote desktop sharing tools to identify and fix problems.
identify when an onsite technician must be dispatched to perform repairs.
Level 3 –
diagnose and resolve problems that have been escalated by the level 1 and level 2 technicians.
survey network conditions for analysis by a senior network technician.
install and configure new equipment, including customer premise equipment upgrades when necessary.
OSI model –
Application Layer –
defines interfaces between application software and network communication functions.
provides standardized services such as file transfer between systems.
Presentation Layer –
standardizes user data formats for use between different types of systems.
encodes and decodes user data; encrypts and decrypts; compresses and decompresses data.
Session Layer –
manages user sessions and dialogues.
manages links between applications.
Transport Layer –
manages end to end message delivery over the network.
can provide reliable and sequential packet delivery through error recovery and flow control mechanisms.
Network Layer –
provides logical network addressing.
routes packets between networks based on logical addressing.
Data Link Layer –
defines procedures for operating the communaication links.
detects and coorects frame transmit errors.
adds physical addresses to frame.
Physical Layer –
defines physical means of sending data over network devices.
interfaces between network medium and devices.
defines optical, electrical and mechanical characteristics for both wird and wireless media.
includes all forms of electromagnetic transmission such as light, electricity, infrared and radio waves.
OSI model process –
Application -
the application such as e-mail application initiates the communication process.
Presentation –
format and encode the data for transmission.
encrypt and compress the data.
Session –
establishes and monitors e-mail session with the destination.
Transport –
package data for transport across the network.
add TCP and UDP port numbers.
specify reliable delivery of data using TCP.
enable uninterupted streaming of data using UDP.
Network –
route packets between networks.
assign IP address
encapsulate data in packets for transmission.
Data Link –
transmit data to the next directly connected drive in path.
add the hardware address.
encapsulate data in a frame.
Physical –
convert data to bits for transmission.
generate signals and timing.
Troubleshooting –
Bottom up – approach starts with the physical components of the network and works its way up the layers of the OSI model.
Top down – approach starts with the application and works its way down the layers of the OSI model.
Divide and Conquer – approach is generally used by more experienced network technicians. The technician makes an educated guess targeting the problem layer then based on observed results, moves up or down the OSI layer.
Link Local Address – if a host is configured to recieve an address dynamically, and an assingnment server is unavailable, a link local address will be automatically assigned to the local host by the operating system. IPv4 addresses in the address block 169.254.0.1 to 169.254.255.254 are designated as link local addresses.
Loopback – is a special address, the reserved IPv4 address 127.0.0.1, which hosts use to direct traffic to themselves. Addresses 127.0.0.0 through 127.255.255.255 are reserved for testing purposes.

Chapter 1

jarrod69 — Tue, 14 Jul 2009 02:02:06 +0000

Chapter 1

Dial-up – access is an inexpensive option that uses any phone line and a modem. To connect to the ISP, a user calls the ISP access phone number. Dial-up is the slowest connection option, and is typically used by mobile workers and in areas where higher speed connection options are not available.
DSL - Digital Subscriber Line – is more expensive than dial-up, but provides a faster connection. DSL also provides a continous connection to the internet. This connection option uses a special high speed modem that seperates the DSL signal from the telephone signal and provides an ethernet connection to a host computer or LAN.
ADSL - Asymmetric Digital Subscriber Line – the download speed is higher than the upload speed.
SDSL - Symmetric Digital Subscriber Line – upload and download are the same.
Cable Modem - is a connection option offered by cable television service providers. The internet signal is carried on the same co-axial cable that delivers cable television to homes and business. A special cable modem seperates the internet signal from the other signals carried on the cable and provides an ethernet connection to a host computer or LAN.
Satellite - connection is an option offered by satellite service providers. The users computer connects through ethernet to a satellite modem that transmits radio signals to the nearest Point of Presence within the satellite network.
Bandwidth - is measured in bits per second (bps). Higher bandwidth speeds are measured in kilobits per second (kbps), megabits per second (Mbps), or gigabits per second (Gbps).
T1 connections - transmit data up to 1.544 Mbps. T1 connections are symmetrical, meaning that the upload bandwidth is the same as the download bandwidth. A medium sized business may need only one T1 connection.
T3 conections - transmit data up to 45 Mbps. Although considerably more expensive than a T1 connection, larger business may need a T3 connection to accomodate the number of employees. Large business with multiple locations might use a combination of T1 and T3 lines.
Metro Ethernet - offers a wide range of high bandwidth options, including Gbps links. Large companies with many branches in the same city, such as banks, use Metro Ethernet. Metro Ethernet connects the main office location and all the branches using switched technology.
IXP - Internet Exchange Point – or NAP is where multiple ISP’s join together to gain access to each others networks and exchange information.
Tier 1 - ISP’s are the top of the heirarchy. Tier 1 ISP’s are huge organizations that connect directly with each other through private peering, physicaly joining their individual network backbones together to create the global internet backbone.
Tier 2 - ISP’s are the next tier in terms of backbone access. Tier 2 ISP’s can also be very large, even extending across several countries, but very few have networks that span entire continents or between continents.
Tier 3 - ISP’s are the farthest away from the backbone. Tier 3 ISP’s are generally found in major cities and provide customers local access to the internet.

Chapter 9

jarrod69 — Tue, 19 May 2009 05:35:41 +0000

Chapter 9

Top down – starts with the application layer and works down. It looks at the problem from the point of view of the user and the application. It is just one application that is not functioning, or do all the applications fail? For example can the user access various web pages on the internet, but not e-mail. Do other workstations have similar issues.
Bottom up – starts with the physical and works up. The physical layer is concerned with hardware and wire connections. Have cables been pulled out of their socket? If the equipment has indicator lights, are they on or off.
Divide and conquer – typically begins troubleshooting with one of the middle layers and works down from there. For example, the troubleshooter may begin at the network layer by verifing IP configuration information.
Ipconfig – is used to display the current IP configuration information of a host. Issuing this command from the command prompt will display the basic configuration information including; IP address, subnet mask and default gateway.
Ipconfig /all – displays additional information including MAC address, IP address of the default gateway and the DNS server, it also indicates if DHCP is enabled, the DHCP server address and lease information.
Ipconfig /release and Ipconfig /renew – if IP addressing information is assigned dynamically the command Ipconfig /release will release the current DHCP bindings. Ipconfig /renew will request fresh configuration information from the DHCP server.
Ping – is used to test if a destination host is rechable. When a ping is sent to an IP address, a packet known as an echo request is sent accross the network to the IP address specified. If the destination host recieves the echo request, it responds with a packet known as an echo reply. If the source recieves the echo reply connectivity is verified.
Ping extensions –
-t : ping the specified host until stopped.
-a : resolve addresses to host names.
-n count : number of echo requests to send.
-l size : send buffer size.
-f : dont send fragment flag packet.
-i TTL : time to live.
-v TOS : type of service.
-r count : record route for count hops.
-s count : timestrap for count hops.
-j host-list : lose source route along host list.
-k host-list : strict source route along host list.
-w timeout : timeout in milliseconds to wait for reply.
Tracert – the ping utility can verify end to end conectivity, however if a problem exists and the device cannot ping the destination, the ping utility does not indicate where the connection was actually dropped. To accomplish this, another utility known as tracert must be used, it counts every router (hop) along the way, it will allow up to 30 hops between a source and destination device before it assumes that the destination is unreachable.
Tracert extensions –
-d : do not resolve addresses to host names.
-h maximum_hops : maximum hops to search for target.
-j host-list : loose source route along host-list.
-w timeout : wait timeout milliseconds for each reply.
Netstat – sometimes it is necessary to know which active TCP connections are open and running on a networked host. Netstat is an important network utility that can be used to verify those connections. Netstat lists the protocol in use, the local address and port number, the foreign address and port number and the state of the connection.
Nslookup – utility allows an end user to lokup information about a particular DNS name in the DNS server. When Nslookup command is issued, the information returned includes the IP address of the DNS server being used as well as the IP address associated with the specified DNS name.
LED’s –
Security LED –
solid green indicates security is enabled.
Acivity LED –
solid green indicates that a device is plugged in but no traffic is flowing.
flashing green indicates the device is plugged in and recieving traffic.
amber indicates the device is making adjustments to the way the port is operating.
no light indicates that nothing is plugged into yhe port, or there is a problem with the wired or wireless connection.
Power LED –
usually solid green.
no light indicates a problem with the power.