Comparison Scenarios - Part 2

A TCP Segment Header is a complex, 20-byte minimum header engineered for connection state management. It contains dedicated fields for tracking numbers (Sequence Number, Acknowledgment Number), flow management (Window Size), and state flags (SYN, ACK, FIN, RST). A UDP Datagram Header is a lightweight, 8-byte fixed header designed for raw speed. It contains only four essential fields: Source Port, Destination Port, Length, and an optional Checksum.

A Forward Proxy is positioned in front of internal clients inside a corporate local network. It evaluates and intercepts outbound internet requests to mask client identities, cache external data, and enforce corporate web filtering compliance policies. A Reverse Proxy is positioned in front of back-end web servers at an enterprise edge. It intercepts incoming public internet requests to handle web load balancing, perform centralized SSL/TLS decryption, cache web application assets, and shield internal application structures from direct exposure.

FDM (Frequency Division Multiplexing) combines multiple separate analog signals onto a single transmission medium by shifting each signal into its own unique, isolated frequency band. TDM (Time Division Multiplexing) interleaves multiple separate digital data streams onto a single high-speed channel by assigning alternating, revolving time slots to each data stream. WDM (Wavelength Division Multiplexing) is a specialized form of multiplexing engineered for fiber-optic cabling that combines multiple distinct streams of digital data onto a single fiber strand by transmitting each stream using a different color/wavelength of laser light.

Standard FDM requires broad, unutilized frequency 'guard bands' positioned between active communication channels to prevent signal overlap and adjacent-channel interference, which sacrifices total usable bandwidth. OFDM arranges subcarrier frequency channels so they are mathematically perpendicular (orthogonal) to one another. This spatial orientation allows the subcarriers to overlap closely without causing mutual interference, eliminating the need for guard bands and maximizing data throughput.

The 2.4 GHz Spectrum operates across lower frequencies, offering longer transmission ranges and superior ability to penetrate solid walls, but it provides lower peak data speeds and suffers from high signal congestion because it contains only three non-overlapping channels (1, 6, and 11). The 5 GHz Spectrum operates across higher frequencies, delivering faster data transfer rates and offering up to 23 non-overlapping channels, but it has a shorter overall coverage footprint and struggles to penetrate dense physical walls.

A Traditional Firewall applies stateful inspection rules linearly and directly to individual physical hardware interfaces, a framework that becomes increasingly difficult to manage and audit as interface count scales. A Zone-Based Firewall abstracts physical interfaces into logical groups called security zones (such as Inside, Outside, DMZ). Security policies are then applied to zone pairs, which greatly simplifies access control configuration.

Transport Mode encrypts only the payload section of an IP packet while leaving the original source and destination IP header entirely intact and visible, primarily used to secure direct, end-to-end host communications on internal networks. Tunnel Mode encrypts the entire original packet (including its original headers) and wraps it inside a brand-new, secondary outer IP header. This mode completely hides the internal source and destination addresses, making it the standard for building secure site-to-site VPN connections over the public internet.

An IDS is a passive, out-of-band monitoring technology that receives a duplicated copy of network traffic via port mirroring to analyze it for signature threats; if it flags malicious activity, it generates log alerts but cannot stop the attack payload. An IPS is an active, inline security appliance through which all live network traffic must flow directly. It inspects packets in real time and can drop malicious traffic on the fly to stop an attack as it happens.

A DoS attack is a malicious attempt where a single computer generates a flood of traffic to overwhelm a target server's resource pool (such as CPU or bandwidth), aiming to take it offline. A DDoS attack is a highly scalable attack where the perpetrator orchestrates thousands of malware-infected hosts (a botnet) to flood a target destination simultaneously, making the attack much harder to mitigate because blocking a single attacking IP address is ineffective.

Traditional WAN relies on physical routers configured individually via CLI, where traffic routing is tied to fixed hardware paths and typically relies on expensive leased circuits (like MPLS) to connect remote branches to a central data center. SD-WAN is a software-defined approach that abstracts the control plane into a centralized controller. It dynamically routes traffic across a mix of cheap consumer broadband, cellular links, and MPLS lines based on real-time link health and application priorities.

The Internet is the public network of interconnected routers accessible by any individual globally. An Intranet is a strictly secured private network restricted to internal organization employees, housing internal databases and tools. An Extranet is a secured extension of an intranet that grants controlled, limited access to trusted external entities, such as authorized vendors, suppliers, or select enterprise clients.

Latency is the total time delay it takes for a single data packet to travel from its source endpoint to its final target destination. Jitter is the structural variance in that packet arrival delay time. High jitter means packets arrive at unpredictable intervals, which degrades real-time services like VoIP and video conferencing.

A Collision Domain is a physical network segment where data packets can collide if two devices transmit simultaneously (such as devices connected to a shared hub); collisions are isolated by switch ports. A Broadcast Domain is a logical network division where a broadcast frame sent by one device is received by all other devices in that segment; broadcast domains are bounded by routers or separate VLANs.

A Straight-through Cable maintains the exact same pin configuration on both ends (T568B to T568B) and is used to connect dissimilar devices, such as a PC to a switch or a switch to a router. A Crossover Cable crosses the transmit and receive wire pairs on one end (T568A to T568B) and is used to connect similar devices directly without an intermediary switch, such as a PC directly to another PC.

Ping uses basic ICMP Echo Requests and Replies to verify end-to-end layer 3 connectivity, providing a quick look at whether a destination is reachable and its round-trip time. Traceroute maps the exact hop-by-hop path packets take to a destination by incrementing the Time-To-Live (TTL) field for sequential packets, coaxing each intermediary router along the path to return an ICMP Time Exceeded message to pinpoint where a connection is failing.