Top 25 - Part 2

1. What malicious technique involves an attacker altering the source IP address in a packet header to mimic a trusted system?

IP Spoofing.

The attacker rewrites the source IP in the packet header so it looks like the traffic comes from a trusted local node — not the attacker’s real address.

Normal packet:

[ Attacker IP ] ───────────────→ [ Server ]
  192.168.1.99


IP Spoofing:

[ Fake Source IP ] ────────────→ [ Server ]
  192.168.1.10
       ↑
   Trusted IP

The attacker has forged the SOURCE IP address.

Why it matters: firewalls and access rules may trust certain IPs. Spoofing can help an attacker bypass weak IP-based filters or hide the true source of traffic. It’s also used in attacks such as DDoS reflection.

Real identity:
Attacker
   │
   │ changes source IP
   ↓
Packet says: "I am 192.168.1.10"
   │
   ↓
Network receives forged packet

• MAC Flooding — overwhelms a switch’s CAM table.
• MitM — intercepts traffic between two parties.
• Broadcast Storming — floods the network with broadcast frames.

IP spoofing is the one that specifically fakes the source IP address.

2. What is the primary architectural purpose of a Demilitarized Zone (DMZ) in network security?

A DMZ is a buffer zone between the untrusted internet and the trusted internal network.

                    INTERNET
                        │
                        ▼
                 ┌────────────┐
                 │  Firewall  │
                 └─────┬──────┘
                       │
                       ▼
              ┌─────────────────┐
              │       DMZ       │
              │                 │
              │  Web Server     │
              │  Mail Server    │
              │  DNS Server     │
              └────────┬────────┘
                       │
                 stricter rules
                       │
                       ▼
                 ┌────────────┐
                 │  Firewall  │
                 └─────┬──────┘
                       │
                       ▼
              ┌─────────────────┐
              │  Internal LAN   │
              │                 │
              │  PCs / Servers  │
              │  Databases      │
              └─────────────────┘

The idea: public-facing servers are more exposed to attacks. Putting them in a DMZ means a compromise of a web server doesn’t automatically give access to the internal network.

Internet
   │
   ▼
[ Web Server ]  ← attacked
      │
      X  ← DMZ isolation
      │
[ Internal LAN ] ← protected

The DMZ provides an additional security boundary between public-facing systems and trusted internal systems.

3. How does Multi-Protocol Label Switching (MPLS) accelerate data routing across a network backbone?

MPLS attaches a short label to each packet and forwards packets using that label rather than performing a full IP routing lookup at every hop.

Traditional IP routing:

Packet
  │
  ▼
[Router 1]
  │  inspect IP
  │  routing-table lookup
  ▼
[Router 2]
  │  inspect IP
  │  routing-table lookup
  ▼
[Router 3]
  │  inspect IP
  │  routing-table lookup
  ▼
Destination

MPLS:

Packet + Label
      │
      ▼
 [Router 1]
   read label
      │
      ▼
 [Router 2]
   read/swap label
      │
      ▼
 [Router 3]
   read/swap label
      │
      ▼
 Destination

How it works:

Edge Router
    │
    │ Assign label
    ▼
[ Label 25 | IP Packet ]
    │
    ▼
Core Router
    │
    │ label 25 → label 42
    ▼
[ Label 42 | IP Packet ]
    │
    ▼
Core Router
    │
    ▼
Edge Router
    │
    │ Remove label
    ▼
Normal IP packet

MPLS sits conceptually between Layer 2 and Layer 3, and it can carry different types of network traffic using labels.

4. Which OSPF area type is highly restrictive, blocking both external internet routes and summary routes from other internal areas?

Totally Stubby Area.

                OSPF Backbone
                     │
        ┌────────────┴────────────┐
        │                         │
   Area 0                     Area 1
                                 │
                                 │
                         ┌───────▼───────┐
                         │ Totally Stubby │
                         │     Area       │
                         └───────┬───────┘
                                 │
                                 ▼
                           Branch Network

A Totally Stubby Area allows:

✓ Intra-area routes
✓ One default route
✗ External routes
✗ Inter-area summary routes

              Totally Stubby Area
                       │
       ┌───────────────┼───────────────┐
       │               │               │
   Local route      Local route     Default
       ✓               ✓               ✓
                                       │
                                       ▼
                              "Everything else
                                goes this way"

Area type	External routes	Inter-area summaries	Default route
Normal	✓	✓	optional
Stub	✗	✓	yes
Totally Stubby	✗	✗	yes
NSSA	limited	✓	yes

It is useful for small branch networks that don’t need detailed knowledge of the entire OSPF topology.

5. What is the primary role of the Border Gateway Protocol (BGP) on the global internet?

BGP routes traffic between Autonomous Systems (ASes).

       AS 100                AS 200                AS 300
      ISP A                  ISP B                 Cloud
   ┌─────────┐            ┌─────────┐            ┌─────────┐
   │         │            │         │            │         │
   │ Network │◄─── BGP ──►│ Network │◄─── BGP ──►│ Network │
   │         │            │         │            │         │
   └─────────┘            └─────────┘            └─────────┘

An Autonomous System is a network under one administrative authority.

BGP exchanges information such as:

Network prefix
     +
AS Path
     +
Next Hop
     +
Local Preference
     +
Other path attributes

For example:

AS 100
  │
  │ "I can reach 203.0.113.0/24"
  │
  ▼
AS 200
  │
  │ learns the route
  ▼
AS 300

BGP is a path-vector routing protocol. Its decisions are heavily influenced by administrative policies, not simply by the shortest physical distance.

6. What is the core philosophy behind Software-Defined Networking (SDN)?

SDN decouples the control plane from the data plane.

                 CONTROL PLANE
             ┌───────────────────┐
             │  SDN Controller   │
             │   "THE BRAIN"     │
             └─────────┬─────────┘
                       │
                 Network API
                       │
        ┌──────────────┼──────────────┐
        │              │              │
        ▼              ▼              ▼
   ┌────────┐     ┌────────┐     ┌────────┐
   │Switch 1│     │Switch 2│     │Switch 3│
   │        │     │        │     │        │
   │Forward │     │Forward │     │Forward │
   └────────┘     └────────┘     └────────┘
        DATA PLANE

Traditional networking:

[Router 1] → control + forwarding
[Router 2] → control + forwarding
[Router 3] → control + forwarding

SDN:

             Central Controller
                    │
        ┌───────────┼───────────┐
        ▼           ▼           ▼
     Switch 1    Switch 2    Switch 3
      "How?"      "How?"      "How?"
                    ↑
              Controller decides

The controller decides where traffic should go, while switches primarily perform the forwarding.

7. What is the difference between Network Attached Storage (NAS) and a Storage Area Network (SAN)?

The simplest distinction is:

NAS = FILES
SAN = BLOCKS

             NAS
              │
        ┌─────▼─────┐
        │ NAS Device│
        └─────┬─────┘
              │
         Files/Folders
              │
       ┌──────┼──────┐
       ▼      ▼      ▼
      PC     PC     Server

             SAN
              │
        ┌─────▼─────┐
        │ SAN Fabric │
        └─────┬─────┘
              │
        ┌─────▼─────┐
        │ Storage   │
        │  Array    │
        └───────────┘
              │
          Raw Blocks
              │
              ▼
           Server
        sees a disk

	NAS	SAN
Access	File-level	Block-level
Common protocols	NFS, SMB	iSCSI, Fibre Channel
Appears as	Shared folder	Disk/storage device
Network	Usually IP/Ethernet	Dedicated storage fabric or IP

Think:

NAS → "Give me this FILE."
SAN → "Give me these DISK BLOCKS."

8. In network performance diagnostics, how do Latency and Jitter differ?

Latency is the delay.

Jitter is the variation in that delay.

Packet 1 ───────────────→ 20 ms
Packet 2 ───────────────────→ 25 ms
Packet 3 ──────────────→ 21 ms
Packet 4 ──────────────────────→ 30 ms

Latency = how long each packet takes

20 ms
25 ms
21 ms
30 ms


Jitter = how much the delay changes

20 → 25 → 21 → 30
     ↑     ↑     ↑
   variation in delay

A simple analogy:

Low latency + low jitter:

20ms ── 20ms ── 21ms ── 20ms
         ↓
      Consistent


Low latency + high jitter:

10ms ── 40ms ── 15ms ── 60ms
         ↓
      Unstable

This is especially important for:

VoIP
Video calls
Online gaming
Live streaming

Latency = delay

Jitter = inconsistency of delay

9. Under the legacy 5-4-3 network design rule for shared Ethernet hubs, what does the number ‘3’ represent?

The 5-4-3 rule means:

5 = physical network segments
4 = repeaters / hubs
3 = populated segments

Visual representation:

[Users]──Segment 1──[Hub]
                         │
                    Segment 2
                         │
                       [Hub]
                         │
                    Segment 3
                         │
                       [Hub]
                         │
                    Segment 4
                         │
                       [Hub]
                         │
                    Segment 5──[Users]

Only 3 of the 5 segments may contain active user devices.

5 total segments
│
├── 3 populated segments
│     └── contain computers/devices
│
└── 2 unpopulated segments
      └── just connect network devices

The rule existed because shared Ethernet had strict timing and collision-detection requirements.

Too many hubs
     ↓
More signal delay
     ↓
Poor collision detection
     ↓
Network problems

It is mainly a legacy Ethernet rule and is not relevant to modern switched Ethernet networks.

10. What diagnostic capability does a Traceroute (or Tracert) utility provide that a standard Ping cannot?

Ping tells you whether the destination is reachable and measures round-trip time.

Traceroute shows the hop-by-hop path to the destination.

Your PC
   │
   │ TTL = 1
   ▼
[Router 1]
   │
   │ TTL = 2
   ▼
[Router 2]
   │
   │ TTL = 3
   ▼
[Router 3]
   │
   ▼
[Web Server]

Traceroute gradually increases the TTL:

TTL = 1
   ↓
Router 1 expires packet
   ↓
"TTL exceeded" response
   ↓
We discover Hop 1


TTL = 2
   ↓
Router 1 forwards
   ↓
Router 2 expires packet
   ↓
We discover Hop 2


TTL = 3
   ↓
Router 1 → Router 2 → Router 3
   ↓
We discover Hop 3

The result might look conceptually like:

You
 │
 ▼
Hop 1 ── 192.168.1.1     2 ms
 │
 ▼
Hop 2 ── 10.0.0.1         8 ms
 │
 ▼
Hop 3 ── 172.16.0.1      15 ms
 │
 ▼
Hop 4 ── 203.0.113.1     25 ms
 │
 ▼
Destination               30 ms

So:

PING
 │
 └──→ "Can I reach the destination?"
       + round-trip delay


TRACEROUTE
 │
 └──→ "Which routers does my packet pass through?"
       + delay at each hop

This makes traceroute useful for finding where latency increases, where packets stop, or which hop is causing a routing problem.