Question

Computer Network Interview question:

1. What factors should be considered to implement networks? Why?

2. Explain route filtering

3. Describe the differences between routing protocols for enterprise network systems?

4. How does the TCP 3 way handshake work?

5. Please share your experience in trying to improve network performance?

6. How would you describe the equipment and methods for network security?

Answer 1

1. The factors to be considered while implementing a network are as follows:

• Create a budget and acquire components

Budget should be fixed early to make sure that the capital is reserved for required components for IT costs can   escalate quickly when they are not managed properly.

• Security

  Properly assessing the strengths and weaknesses of network will determine its stability in the future. It’s important to stress test the IT infrastructure and security against various threats. Otherwise, all the investment involved in creating  the network will be threatened by malicious third parties.

• Maintanence

If  the network design is simple then less technical support is required for both installation and maintenance. On the other hand if there is a complex network then there should be highly capable technical support .

• Expansion

   Buying equipment with an eye to expansion may delay the need for additional investment in equipment.

2. Route Filtering

  Route filtering is a method for selectively identifying routes that are advertised or received from neighbor routers. It may be used to manipulate traffic flows, reduce memory utilization, or to improve security.

  There are two times when a filter can be naturally applied, when learning routes from a neighbour, and when announcing routes to a neighbour.

Input Filtering:

A filter is applied to routes as they are learned from a neighbour. A route that has been filtered out is discarded straight away, and hence not considered for inclusion into the local routing database.

Output Filtering:

A filter is applied to routes before they are announced to a neighbour. A route that has been filtered out is never learned by a neighbour, and hence not considered for inclusion in the remote route database.

3. The routing protocols are:

Enhanced Interior Gateway Routing Protocol (EIGRP)

Enhanced Interior Gateway Routing Protocol is a hybrid routing protocol developed by Cisco systems for routing many protocols across an enterprise Cisco network.

It has characteristics of both distance vector routing protocols and link state routing protocols. It is proprietary which requires Cisco routers. EIGRP will route the same protocols that IGRP routes (IP, IPX, Decnet and Appletalk) and use the same composite metrics as IGRP to select a best path destination.

Open Shortest Path First (OSPF)

Open Shortest Path First is a true link state protocol developed as an open standard for routing IP across large multi-vendor networks. A link state protocol will send link state advertisements to all connected neighbours of the same area to communicate route information. Each OSPF enabled router, when started, will send hello packets to all directly connected OSPF routers.

The hello packets contain information such as router timers, router ID and subnet mask. If the routers agree on the information they become OSPF neighbours. Once routers become neighbours they establish adjacencies by exchanging link state databases. Routers on point-to-point and point-to-multipoint links (as specified with the OSPF interface type setting) automatically establish adjacencies.

Border Gateway Protocol (BGP)

Border Gateway Protocol is an exterior gateway protocol, which is different from the interior gateway protocols discussed so far. The distinction is important since the term autonomous system is used somewhat differently with protocols such as EIGRP than it is with BGP. Exterior gateway protocols such as BGP route between autonomous systems, which are assigned a particular AS number. AS numbers can be assigned to an office with one or several BGP routers. The BGP routing table is comprised of destination IP addresses, an associated AS-Path to reach that destination and a next hop router address. The AS-Path is a collection of AS numbers that represent each office involved with routing packets. Contrast that with EIGRP, which uses autonomous systems as well. The difference is their autonomous systems refer to a logical grouping of routers within the same administrative system.

Integrated IS-IS

Integrated Intermediate System – Intermediate System routing protocol is a link state protocol similar to OSPF that is used with large enterprise and ISP customers. An intermediate system is a router and IS-IS is the routing protocol that routes packets between intermediate systems. IS-IS utilizes a link state database and runs the SPF Dijkstra algorithm to select shortest paths routes. Neighbor routers on point to point and point to multipoint links establish adjacencies by sending hello packets and exchanging link state databases. IS-IS routers on broadcast and NBMA networks select a designated router that establishes adjacencies with all neighbor routers on that network. The designated router and each neighbor router will establish an adjacency with all neighbor routers by multicasting link state advertisements to the network itself. That is different from OSPF, which establishes adjacencies between the DR and each neighbor router only. The difference with IS-IS is that the links between routers comprise the area borders and not the router. Each IS-IS router must have an assigned address that is unique for that routing domain. An address format is used which is comprised of an area ID and a system ID. The area ID is the assigned area number and the system ID is a MAC address from one of the router interfaces. There is support for variable length subnet masks, which is standard with all link state protocols.IS-IS assigns the routing process to an interface instead of a network.

4. TCP 3 way handshake Mechanism:

Step 1 (SYN) : In the first step, client wants to establish a connection with server, so it sends a segment with SYN(Synchronize Sequence Number) which informs server that client is likely to start communication and with what sequence number it starts segments with

Step 2 (SYN + ACK): Server responds to the client request with SYN-ACK signal bits set. Acknowledgement(ACK) signifies the response of segment it received and SYN signifies with what sequence number it is likely to start the segments with

Step 3 (ACK) : In the final part client acknowledges the response of server and they both establish a reliable connection with which they will start eh actual data transfer

The steps 1, 2 establish the connection parameter (sequence number) for one direction and it is acknowledged. The steps 2, 3 establish the connection parameter (sequence number) for the other direction and it is acknowledged. With these, a full-duplex communication is established.

5. Network performance can be improved in the following ways:

Use network monitoring tool

Educate users and establish policies

Limit the number of network users

Compress data

Virtualise network smartly

Ensure protection against viruses.

6. Network security can be introduced by the following methods:

  

• Access control: should be able to block unauthorized users and devices from accessing your network. Users that are permitted network access should only be able to work with the limited set of resources for which they have been authorized.
  
• Application security: Insecure applications are often the vectors by which attackers get access to your network. You need to employ hardware, software, and security processes to lock those apps down.
• Behavioral analytics: You should know what normal network behavior looks like so that you can spot anomalies or breaches as they happen.
• Data loss prevention: Human beings are inevitably the weakest security link. You need to implement technologies and processes to ensure that staffers don't deliberately or inadvertently send sensitive data outside the network.
• Email security: Phishing is one of the most common ways attackers gain access to a network. Email security tools can block both incoming attacks and outbound messages with sensitive data.
• Firewalls: Perhaps the granddaddy of the network security world, they follow the rules you define to permit or deny traffic at the border between your network and the internet, establishing a barrier between your trusted zone and the wild west outside. They don't preclude the need for a defense-in-depth strategy, but they're still a must-have.
• Intrusion detection and prevention: These systems scan network traffic to identify and block attacks, often by correlating network activity signatures with databases of known attack techniques.
• Mobile device and wireless security: Wireless devices have all the potential security flaws of any other networked gadget — but also can connect to just about any wireless network anywhere, requiring extra scrutiny.
• Network segmentation: Software-defined segmentation puts network traffic into different classifications and makes enforcing security policies easier.
• Security information and event management (SIEM): These products aim to automatically pull together information from a variety of network tools to provide data you need to identify and respond to threats.
• VPN: A tool (typically based on IPsec or SSL) that authenticates the communication between a device and a secure network, creating a secure, encrypted "tunnel" across the open internet.
• Web security: You need to be able to control internal staff's web use in order to block web-based threats from using browsers as a vector to infect your network.