计算机网络安全技术(第6版 课后练习题简答题练习


一:概念

(1)列举出自己所了解的与网络安全相关的知识。

网络安全的相关知识包括物理安全技术,系统安全技术,网络安全技术,应用安全技术,数据加密技术,认证授权技术,访问控制技术,审计跟踪技术,防病毒技术,灾难恢复和备份技术等

( 2)为什么说网络安全非常重要?

(1)网络安全和信息化首先关乎国家安全。例如早在多年以前,互联网就成为了恐怖组织招募成员和“洗钱”的渠道,去年欧洲发生了多起恐怖事件都是通过网络联络组织执行的。与此同时,欧洲公民自由委员会也于去年通过了新的法案,允许欧洲刑警组织通过网络来追捕恐怖分子、打击犯罪。 (2)网络安全还影响经济和社会的稳定,处理不好可能造成社会动荡。例如有些网络信息专门针对辩识能力不足的青少年进行传播,如黄色信息、暴力影像、不良游戏……还有一些似是而非、扮着“学术”面纱的信息,实则宣传历史虚无、诋毁民族英雄、鄙视传统文化,对青少年价值观产生不良影响。 (3)网络安全遭到破坏,会侵犯到人民群众的利益。网络是把双刃剑:在常人手中,便于信息的获取和传播;而到了别有用心的人手中,就成了侵犯人民群众利益的工具。 网络安全和信息化工作艰巨且复杂。我国目前在大数据、人工智能、5G网络等领域已经形成了全球优势,经济社会发展也正从后工业化大跨步迈向信息化。网络安全和信息化对于我们实现“两个一百年”的奋斗目标,以及中华民族伟大复兴的“中国梦”都具有重要意义。

( 3)网络本身存在哪些安全缺陷?

答:1、开放性的网络环境 2、协议本身的脆弱性 3、操作系统的漏洞 4、网络人为操作

(4)信息安全的发展经历了哪几个阶段?

答:通信保密阶段、计算机安全阶段、信息技术安全阶段、信息保障阶段

二:黑客常用的攻击方法

( 1)一般的黑客攻击有哪些步骤?各步骤主要完成什么工作?

答:黑客入侵攻击的一般过程

(1) 确定攻击的目标。

(2) 收集被攻击对象的有关信息。 黑客在获取了目标机及其所在的网络类型后,还需要进一步获取有关信息,如目标机的 IP 地址、操作系统类型和版本、系统管理人员的邮件地址等,根据这些信息进行分析,可得到被攻击方系统中可能存在的漏洞。

(3) 利用适当的工具进行扫描。 收集或编写适当的工具,并在对操作系统分析的基础上对工具进行评估,判断有哪些漏洞和区域没有被覆盖。然后,在尽可能短的时间内对目标进行扫描。完成扫描后,可以对所获数据进行分析,发现安全漏洞,如 FTP 漏洞、 NFS 输出到未授权程序中、不受限制的服务器访问、不受限制的调制解调器、 Sendmail 的漏洞及 NIS 口令文件访问等。

(4) 建立模拟环境,进行模拟攻击。 根据之前所获得的信息,建立模拟环境,然后对模拟目标机进行一系列的攻击,测试对方可能的反应。通过检查被攻击方的日志,可以了解攻击过程中留下的“痕迹”。这样攻击者就可以知道需要删除哪些文件来毁灭其入侵证据了。

(5) 实施攻击。 根据已知的漏洞,实施攻击。通过猜测程序,可对截获的用户账号和口令进行破译 ; 利用破译程序,可对截获的系统密码文件进行破译 ; 利用网络和系统本身的薄弱环节和安全漏洞,可实施电子引诱 ( 如安放特洛伊木马 ) 等。黑客们或修改网页进行恶作剧,或破坏系统程序,或放病毒使系统陷人摊痪,或窃取政治、军事、商业秘密,或进行电子邮件骚扰,或转移资金账户、窃取金钱等。

(6) 清除痕迹,创建后门。通过创建额外账号等手段,为下次人侵系统提供方便。

(2)扫描器只是黑客攻击的工具吗?常用的扫描器有哪些?

答:不是,扫描器还可以作为网络管理者检测网络安全状况的工具。 常用的扫描器有:Namp、X-Scan、Nessus等。

(3)端口扫描分为哪几类?其工作原理是什么?

答:端口扫描的原理是向目标主机的TCP/IP端口发送探测数据包,并记录目标主机的响应。通过分析响应来判断端口是打开还是关闭等状态信息。根据所使用通信协议的不同,网络通信端口可以分为TCP端口和UDP端口两大类,因此端口扫描技术也可以相应的分为TCP端口扫描技术和UDP端口扫描技术。

(4)什么是网络监听?网络监听的作用是什么?

答:

概念:网络监听指在网络中监听他人的数据包,分析数据包,从而获得一些敏感信息,如账号和密码等。

作用:网络监听是网管用来监视网络的状态、数据流动情况以及传输的信息等工具。也是黑客常用的攻击方法。

(5)能否在网络中发现一个网络监听?说明理由。

答:可以。

方法一:用Ping模式向对方发送一一个具 有正确的IP地址和错误的MAC地址包,运行监听程序的机器会有响应。因为正常的机器不接收错误的MAC地址,而处于监听状态的机器则能接收。

方法二:往网络上发送大量不存在的MAC地址的包,由于监听程序将处理这些包,将导致性能下降,通过比较前后该机器性能(如响应时间的长短)加以判断。

(6)特洛伊木马是什么?其工作原理是什么?

答:是一种基于远程控制的黑客攻击方式。客户端/服务端之间采用TCP/UDP的通信方式,攻击者控制的是相应的客户端程序,服务器端程序是木马程序,木马程序被植入到用户计算机,以里应外合的工作方式,服务器程序通过打开特定的端口并进行监听,客户端程序通过连接监听端口实现远程控制客户机。

( 7)使用木马攻击的一般过程是什么?

答:

1、木马的配置:有客户端配置服务端。

2、木马的传播:将配置好的服务端传播出去。

3、木马的自启动:进入目标之后设法获得启动机会。

4、建立连接:和控制端建立连接,有主动式和被动式。

5、远程控制:操控者利用木马控制目标,窃取目标信息。

(8)如何发现计算机系统感染了木马?如何防范计算机系统感染木马?

答:

如何发现计算机系统感染木马: 通过各种杀毒软件进行查找。

如何防范计算机系统感染木马?

1.我们自身不制造或者传播计算机病毒或者木马,在网上发发现计算机病毒或者木马的时候,可以向网站举报。

2.电脑软件库一定要不定期更新。最新型的病毒就是针对某些软件的漏洞而制作的,没有完善的软件很容易受到病毒攻击。

3.我们从某些小网站安装应用软件的时候,一定要谨慎。部分网站为了盈利,往往在软件里面植入广告程序,甚至有些带有病毒木马攻击程序。

4.打开腾讯电脑管家,找到里面的“病毒查杀”对电脑系统安全不定期进行检测,随时开启此软件监测电脑系统安全。

(9)什么是拒绝服务攻击?其分为哪几类?

答:

广义上讲可以指任何导致网络设备不能正常提供服务的攻击,现在一般指针对服务器的DOS攻击服务。

死亡之ping,SYN Flood攻击,LAND攻击,teardrop攻击,CC攻击,分布式拒绝服务攻击。

(10)拒绝服务攻击是如何导致的?说明SYN Flood攻击导致拒绝服务的工作原理。

答:拒绝服务攻击即攻击者想办法让目标机器停止提供服务,是黑客常用的攻击手段之。其实对网络带宽进行的消耗性攻击只是拒绝服务攻击的一小部分,只要能够对目标造成麻烦,使某些服务被暂停甚至主机死机,都属于拒绝服务攻击。拒绝服务攻击问题也一直得不到合理的解决,究其原因是因为这是由于网络协议本身的安全缺陷造成的,从而拒绝服务攻击也成为了攻击者的终极手法。攻击者进行拒绝服务攻击,实际上让服务器实现两种效果:一是迫使服务器的缓冲区满,不接收新的请求;二是使用IP欺骗,迫使服务器把合法用户的连接复位,影响合法用户的连接。

SYN Flood攻击导致拒绝服务的原理:

SYN Flood SYN Flood是当前最流行的DoS(拒绝服务攻击)与DDoS(Distributed Denial Of Service分布式拒绝服务攻击)的方式之一,这是一种利用TCP协议缺陷,发送大量伪造的TCP连接请求,使被攻击方资源耗尽(CPU满负荷或内存不足)的攻击方式。 SYN Flood攻击的过程在TCP协议中被称为三次握手(Three-way Handshake), (1) 攻击者向被攻击服务器发送一个包含SYN标志的TCP报文,SYN(Synchronize)即同步报文。同步报文会指明客户端使用的端口以及TCP连接的初始序号。这时同被攻击服务器建立了第一次握手。 (2) 受害服务器在收到攻击者的SYN报文后,将返回一个SYN+ACK的报文,表示攻击者的请求被接受,同时TCP序号被加一,ACK(Acknowledgment)即确认,这样就同被攻击服务器建立了第二次握手。 (3) 攻击者也返回一个确认报文ACK给受害服务器,同样TCP序列号被加一,到此一个TCP连接完成,三次握手完成。导致攻击拒绝服务。 解析:本题考查拒绝服务攻击是如何导致的以及SYN Flood攻击导致拒绝服务的原理。具体解答可参考上述答案

(11)什么是缓冲区溢出?产生缓冲区溢出的原因是什么?

概念:缓冲区溢出是指计算机程序向特定缓冲区内填充数据时,超出了缓冲区本身的容量,导致外溢数据覆盖了相邻内存空间的合法数据,从而改变程序执行流程破坏系统运行完整性。

原因:试图将太多数据写入某内存位置,超出该位置能容纳的数据量。

( 12)缓冲区溢出会产生什么危害?

1.淹没了其他的局部变量。如果被淹没的局部变量是条件变量,那么可能会改变函数原本的执行流程。这种方式可以用于破解简单的软件验证。

2.淹没了ebp的值。修改了函数执行结束后要恢复的栈指针,将会导致栈帧失去平衡。

3.淹没了返回地址。这是栈溢出原理的核心所在,通过淹没的方式修改函数的返回地址,使程序代码执行“意外”的流程!

4.淹没参数变量。修改函数的参数变量也可能改变当前函数的执行结果和流程。

三:计算机病毒

( 1)什么是计算机病毒?

答:计算机病毒,指编制或者在计算机程序中插入的破坏计算机功能或者破坏数据,影响计算机使用并且能够自我复制 的一组计算机指令或者程序代码

( 2)计算机病毒有哪些特征?

答:1、破坏性 2、隐蔽性 3、传染性 4、潜伏性与触发性 5、不可预见性

(3)计算机病毒是如何分类的?举例说明有哪些种类的病毒。

答:

一:按照计算机病毒依附的操作系统分类

  1. 基于DOS操作系统的病毒
  2. 基于Windows操作系统的病毒
  3. 基于UNIX/Linux操作系统的病毒
  4. 基于嵌入式操作系统的病毒

二:按照计算机病毒的宿主分类

  1. 引导型病毒
  2. 文件型病毒
  3. 宏病毒

(4)什么是宏病毒?宏病毒的主要特征是什么?

答:宏病毒主要以Micrsoft Office的“宏”为宿主,寄存在文档或模板的宏中的计算机病毒。一旦打开这样的文档,其中的宏就会被执行,于是宏病毒就会被激活,并能通过DOC文档及DOT模板进行自我复制及传播。

(5)什么是蠕虫病毒?蠕虫病毒的主要特征是什么?

答:蠕虫病毒是一种常见的计算机病毒。它是利用网络进行复制和传播,传染途径是通过网络和电子邮件。蠕虫病毒是自包含的程序,它能传播自身功能的拷贝或自身的某些部分到其他的计算机系统中(通常是经过网络连接)。(3分)

蠕虫病毒的主要特点是:传染方式多、传播速度快、清除难度大、破坏性强等。(2分)

(6)计算机病毒的检测方法有哪些?简述其原理。

1、特征代码法。主要用来判断文件是否感染病毒,要求兑现关于软件进行不断的更新以适应要求。特征代码法主要运用了比较法、分析法和扫描法。

2、检验和法。通过计算正常文件内容校验和,将该校验和写入文件中或写入别的文件中保存。使用文件前通过对比前后校验和来确定文件是否感染病毒。它的弊端是不能识别病毒种类和病毒名称,而且还会影响文件的运行速度,出现错误警示。

3、行为监测法。这种方法主要利用病毒的特有行为特性来判断是否存在病毒。每种病毒都会有自己独一无二的特性,这种方法正好充分利用了这一点。这种方法具有很强的优势,即对许多未知病毒都能够有效发现,但缺点是不能识别病毒名称,实现起来有一定的难度。

4、虚拟机法法。主要利用相关软件来模式和分析程序的运行状况,确定有无病毒。

5、主动防御法。可以在病毒发作时用主动防御主动而有效地进行全面的防范,从技术层面上有效应对未知病毒的传播

(7)计算机病毒最主要的传播途径是什么?

答:网络传播

(8)网络防病毒与单机防病毒有哪些区别?

答:网络防病毒主要是防止病毒通过网络对联网计算机进行攻击,

而单机防病毒则是防止计算机系统不被非授权用户使用。

四:数据加密技术

(1)数据在网络中传输时为什么要加密?现在常用的数据加密算法主要有哪些?

为什么:(一句话就是:传输不安全,要加密保护)

数据传输加密技术的目的是对传输中的数据流加密,通常有线路加密与端—端加密两种。

线路加密侧重在线路上而不考虑信源与信宿,是对保密信息通过各线路采用不同的加密密钥提供安全保护。 端—端加密指信息由发送端自动加密,并且由TCP/IP进行数据包封装,然后作为不可阅读和不可识别的数据穿过互联网,当这些信息到达目的地,将被自动重组、解密,而成为可读的数据。

数据存储加密技术的目的是防止在存储环节上的数据失密,数据存储加密技术可分为密文存储和存取控制两种。前者一般是通过加密算法转换、附加密码、加密模块等方法实现;后者则是对用户资格、权限加以审查和限制,防止非法用户存取数据或合法用户越权存取数据。

常见加密算法

1、DES(Data Encryption Standard):对称算法,数据加密标准,速度较快,适用于加密大量数据的场合;

2、3DES(Triple DES):是基于DES的对称算法,对一块数据用三个不同的密钥进行三次加密,强度更高;

3、RC2和RC4:对称算法,用变长密钥对大量数据进行加密,比 DES 快;

4、IDEA(International Data Encryption Algorithm)国际数据加密算法,使用 128 位密钥提供非常强的安全性;

5、RSA:由 RSA 公司发明,是一个支持变长密钥的公共密钥算法,需要加密的文件块的长度也是可变的,非对称算法;

解析:本题考察数据加密的原因以及主要算法,设计知识面较广,要求具备扎实的理论基础和广泛的知识面。

(2)简述 DES算法和RSA 算法的基本思想。这两种典型的数据加密算法各有什么优势与劣势?

答:

DES是对称密码算法,是美国数据加密标准,对称加密就是加密秘钥和解密秘钥相同的加密算法,DES算法的基本思想是对明文进行分组,然后利用用户秘钥对明文分组进行16轮的移位和循环移位、置换、扩展、压缩、异或等位运算,利用复杂运算把明文编码彻底打乱,从而使得加密后的密文无法破解。 (3分) DES加密算法优点是密钥较短,加密处理简单,加解密速度快,适用于加密大量数据的场合。缺点对称算法的安全性依赖于密钥,泄漏密钥就意味着任何人都能对消息进行加密解密,因此秘钥的管理与分发存在缺陷。(2分)

RSA算法安全性基于大数分解的难度。将两个大素数相乘容易,但要对其乘积进行因式分解却极其困难,因此可以将乘积公开作为加密密钥。从一个公开密钥和密文中恢复出明文的难度等价于分解两个大素数的乘积。为提高保密强度,RSA密钥至少为500位长,一般推荐使用1024位,目前商用RSA算法密钥长度2048位。(3分) RSA算法的安全性要优于对称加密算法,但因算法复杂度较高,其加密处理效率不如对称加密算法。故在网络传输重要信息时,常将两种加密算法混合使用。(2分)

(3)在网络通信的过程中,为了防止信息在传输的过程中被非法窃取,一般采用对信息进行加密后再发送出去的方法。但有时不是直接对要发送的信息进行加密,而是先对其产生一个报文摘要(散列值),再对该报文摘要(散列值)进行加密,这样处理有什么好处?

答:我们知道,使用RSA公开密钥体制进行加密时,往往需要花费很长的时间。当需要在网络上传送的报文并不要求保密但却不容许遭受篡改时,使用报文摘要就能够确保报文的完整性(因为这时仅仅对很短的报文摘要进行加密),可以提高效率。

(4)简述散列函数和消息认证码的区别和联系。

答:消息认证码和散列函数都属于认证函数。

简单来说,消息认证码 是一种使用密钥的认证技术,它利用密钥来生成一个固定长度的短数据块,并将该数据块附加在消息之后。而散列函数是将任意长的消息映射为定长的hash值的函数,以该hash值作为认证符。

散列函数也称为消息的“指纹”。但是散列函数用于认证时,通常和数字签名结合使用。 它们都可以提供消息认证,认证内容包括:消息的源和宿;消息内容是否曾受到偶然的或有意的篡改;消息的序号和时间栏。

(5)在使用PGP时,如果没有对导入的其他人的公钥进行签名并赋予完全信任关系,会有什么后果?设计一个实验并加以证明。

答:在使用PGP加密系统时,如果没有对导入的其他人的公钥进行签名并赋予完全信任关系,没有任何后果。

解析:我们之所以要对某公钥进行签名,是为了增加公钥传递时的可信度的,举例说明吧: A和B是好朋友,B和C是好朋友,但A和C不认识,现在A和C认识了,C向A要密钥,如果A直接给C发送,那么这就会存在一个问题,如何确保C收到的就是A的公钥,当然了,有个办法就是打电话核对密钥的fingerprint,还有个办法就是,因为C有B的公钥,而B又同A很熟悉,B也有A的公钥,这时如果B将A的公钥签名后再发给C,那么C只要核对收到的A的公钥是经过B签名的,就可以了,因为C有B的公钥,所以核对是很简单的事。

(6)使用PGP对文件进行单签名后,在将签名后扩展名为“.sig”的文件发送给对方的同时,为什么还要发送原始文件给对方?

答:首先签名不是加密。签名是为了证明这个文件是真的没有被人修改过。你发送的sjp文件是签名算法的结果,对于任何一个文件,他的签名算法结果是唯一的。发送原始文件给对方,对方再利用签名算法计算出签名的结果。这样一来可以防止接受到的文件中途被他人拦截,篡改,提高了文件的安全性和可靠性。

(7)结合日常生活的应用,简述常见的身份认证技术。

答:

口令认证;

生物特征认证;

智能卡认证

五:防火墙技术

(1)什么是防火墙?防火墙应具有的基本功能是什么?使用防火墙的好处有哪些?

答:

概念:防火墙是指设置在不同网络(如可信任的企业内部网和不可信任的公共网)或网络安全域之间的一系统部件的组合。

基本功能

  1. 访问控制
  2. 应用识别
  3. VPN功能
  4. NAT功能

好处:

  1. 保障网络安全;
  2. 强化网络安全策略;
  3. 监控审计网络存取和访问;
  4. 防止信息外泄

(2)防火墙主要由哪几部分组成?

答:防火墙主要由服务访问规则,验证工具,包过滤和应用网关4个部分组成。

解析:防火墙是一项协助确保信息安全的设备,会依照特定的规则,允许或是限制传输的数据通过。防火墙可以是一台专属的硬件也可以是架设在一般硬件上的一套软件。防火墙主要由服务访问规则、验证工具、包过滤和应用网关4个部分组成。防火墙是一种保护计算机网络安全的技术性措施,它通过在网络边界上建立相应的网络通信监控系统来隔离内部和外部网络,以阻挡来自外部的网络入侵。防火墙有网络防火墙和计算机防火墙的提法。网络防火墙是指在外部网络和内部网络之间设置网络防火墙。这种防火墙又称筛选路由器。网络防火墙检测进入信息的协议、目的地址、端口(网络层)及被传输的信息形式(应用层)等,滤除不符合规定的外来信息。

(3)防火墙按照技术可以分为几类?

答:答案:三类

解析:包过滤型、代理服务器型、复合型以及其他类型(双宿主主机、主机过滤以及加密路由器)防火墙。

包过滤型通常安装在路由器上,而且大多数商用路由器都提供了包过滤的功能。包过滤规则以IP包信息为基础,对IP源地址、目标地址、封装协议、端口号等进行筛选。包过滤在网络层进行。 代理服务器型防火墙通常由两部分构成,服务器端程序和客户端程序。客户端程序与中间节点连接,中间节点再与提供服务的服务器实际连接。与包过滤防火墙不同的是,内外网间不存在直接的连接,而且代理服务器提供日志和审计服务。 复合型防火墙将包过滤和代理服务两种方法结合起来,形成新的防火墙,由堡垒主机提供代理服务。

(4)简单包过滤防火墙的工作原理是什么?简单包过滤防火墙有什么优缺点?

答:

原理: 包过滤(PacketFilter)是在网络层中根据事先设置的安全访问策略(过滤规则),检查每一个数据包的源IP地址、目的IP地址、源端口、目的端口以及IP分组头部或TCP头部等其他各种标志信息(如协议、服务类型等),确定是否允许该数据包通过防火墙。

简单包过滤防火墙的优点如下。

(1)利用路由器本身的包过滤功能,以访问控制列表(Access Control List,ACL)方式实现。

(2)处理速度较快。

( 3)对用户来说是透明的,用户的应用层不受影响。

简单包过滤防火墙工作在数据包过滤中时有如下局限。

(1)无法关联一个会话中数据包之间的关系。

(2)无法适应多通道协议,如FTP。

(3)通常不检查应用层数据。

(5)简单包过滤防火墙一般检查哪几项?

答:数据包过滤一般要检查网络层的IP头和传输层的头:IP源地址、IP目标地址、协议类型(TCP包、UDP包和ICMP包)、TCP或UDP包的目的端口、TCP或UDP包的源端口、ICMP消息类型、TCP包头的ACK位、TCP包的序列号、IP校验和等。

(6)简单包过滤防火墙中制定访问控制规则时一般有哪些原则?

答:

数据包经过了简单包过滤防火墙,在执行安全策略的时候,规则的顺序非常重要,所以设计防火墙安全策略时应注意以下几点。

(1)默认规则,根据安全需求先设定好默认规则。如果默认规则是允许一切,则前面设计的是拒绝的内容;如果默认规则是拒绝一切,则前面设计的是允许的内容。相对而言,前者设计的网络连通性好,后者设计的网络更安全。

(2)应该将更为具体的表项放在不太具体的规则前面。

(3)访问控制列表的位置。将扩展访问控制列表尽量放在靠近过滤源的位置上,过滤规则不会影响其他接口的数据流。

(4)注意访问控制列表作用的接口及数据的流向。

(7)代理服务器的工作原理是什么?代理服务器有什么优缺点?

答:

所谓代理服务器,是指代表客户处理连接请求的程序。当代理服务器得到一个客户的连接意图时,它将核实客户请求,并用特定的安全化的proxy应用程序来处理连接请求,将处理后的请求传递到真实的服务器上,然后接受服务器应答,并进行下一步处理后,将答复交给发出请求的最终客户。代理服务器在外部网络向内部网络申请服务时发挥了中间转接和隔离内、外部网络的作用,所以又叫代理防火墙。代理防火墙工作于应用层,且针对特定的应用层协议。

代理服务技术的优点是:隐蔽内部网络拓扑信息;网关理解应用协议,可以实施更细粒度的访问控制;较强的数据流监控和报告功能。

缺点是:对每一类应用都需要一个专门的代理,灵活性不够;每一种网络应用服务的安全问题各不相同,分析困难,因此实现困难。速度慢。

(8)举例说明现在应用的几种代理服务。

(1)HTTP代理:主要代理浏览器的HTTP。

( 2)FTP代理:代理FTP。

( 3)POP3代理:代理客户端的邮件软件,用POP3方式收邮件。

(4)Telnet代理:能够代理通信机的 Telnet,用于远程控制。

(5 )SSL代理:可以作为访问加密网站的代理。加密网站是指以“https:/”开始的网站。

(9)在防火墙的部署中,一般有哪几种结构?

1,双宿主主机体系结构

2,被屏蔽主机体系结构

3,被屏蔽子网体系结构

( 10)简述网络地址转换的工作原理及其主要应用。

答:

当具有私有 IP 地址的内网主机访问外网时,路由器查询 NAT 转换表,找到匹配的转换记录后,将数据包中私有源 IP 地址转换成全局公有 IP 地址,然后发送至外网;当具有公有 IP 地址的外网主机访问内网时,路由器查询 NAT 转换表,找到匹配的转换记录后,将数据包中的目标公有 IP 地址转换成私有 IP 地址后,发送至内网。

应用(作用):

(1)可以解决IP地址不足的问题。

(2)可实现通过一个或几个公有IP将局域网接入互联网。

(3)在一定程度上保护内部网络。

(4)可以将内部FTP服务器发布到Internet上。

( 11)常见的防火墙产品有哪些?试比较其特点与技术性能。

答:

答案: 1.ZoneAlarm(ZA) 这是Zone Labs公司推出的一款防火墙和安全防护软件套装,除了防火墙外,它包括有一些个人隐私保护工具以及弹出广告屏蔽工具。与以前的版本相比,新产品现在能够支持专家级的规则制定,它能够让高级用户全面控制网络访问权限,同时还具有一个发送邮件监视器,它将会监视每一个有可能是由于病毒导致的可疑行为,另外,它还将会对网络入侵者的行动进行汇报。除此之外,ZoneAlarm Pro 4.5还保留了前几个版本易于使用的特点,即使是刚刚出道的新手也能够很容易得就掌握它的使用。 2.傲盾(KFW) 本软件是具有完全知识版权的防火墙,使用了目前最先进的第三代防火墙技术《DataStream Fingerprint Inspection》数据流指纹检测技术,与企业级防火墙Check Point和Cisco相同,能够检测网络协议中所有层的状态,有效阻止DoS、DDoS等各种攻击,保护您的服务器免受来自I nternet上的黑客和入侵者的攻击、破坏。通过最先进的企业级防火墙的技术,提供各种企业级功能,功能强大、齐全,价格低廉,是目前世界上性能价格比最高的网络防火墙产品。 3.Kaspersky Anti-Hacker(KAH) Kaspersky Anti-Hacker 是Kaspersky 公司出品的一款非常优秀的网络安全防火墙!和著名的杀毒软件 AVP是同一个公司的作品!保护你的电脑不被黑客攻击和入侵,全方位保护你的数据安全!所有网络资料存取的动作都会经由它对您产生提示,存取动作是否放行,都由您来决定,能够抵挡来自于内部网络或网际网络的黑客攻击! 4.BlackICE 该软件在九九年获得了PC Magazine 的技术卓越大奖,专家对它的评语是:“对于没有防火墙的家庭用户来说,BlackICE是一道不可缺少的防线;而对于企业网络,它又增加了一层保护措施–它并不是要取代防火墙,而是阻止企图穿过防火墙的入侵者。BlackICE集成有非常强大的检测和分析引擎,可以识别200 多种入侵技巧,给你全面的网络检测以及系统防护,它还能即时监测网络端口和协议,拦截所有可疑的网络入侵,无论黑客如何费尽心机也无法危害到你的系统。而且它还可以将查明那些试图入侵的黑客的NetBIOS(WINS)名、DNS名或是他目前所使用的IP 地址记录下来,以便你采取进一步行动。封言用过后感觉,该软件的灵敏度和准确率非常高,稳定性也相当出色,系统资源占用率极少,是每一位上网朋友的最佳选择。 解析:本题考察防火墙产品的发展方向,以主流的防火墙产品为例,通过分析其特点和技术性能来预测发展趋势,要求具备广泛的知识面。

六:Windows操作系统安全

( 1 ) Windows NT操作系统的安全模型是怎样的?

答:

解析: 在Windows NT 系统中,Windows NT系统的安全模型是指用户对整个系统能够做的事情,如关掉系统、往系统中添加设备、更改系统时间等。权限专指用户对系统资源所能做的事情,如对某文件的读、写控制,对打印机队列的管理。 NT系统中有一个安全帐号数据库,其中存放的内容有用户帐号以及该帐号所具有的权力等。用户对系统资源所具有的权限则与特定的资源一起存放。

(2)为了加强Windows NT账户的登录安全性,Windows NT做了哪些登录策略?

答:

1.Windows强密码原则:不少于8字符;包含3种类型;不用完整词汇、用户名、 姓名、生日等;

2.启用系统账户策略,设置适当的密码策略与锁定策略

3.重新命名管理员Administrator账号

4.创建陷阱用户:增加黑客入侵难度。

5.禁用或删除不必要的账号:降低风险

6.SYSKEY双重加密账户保护。 (每个1分,5个以上满分)

(3) Windows NT注册表中有哪几个根键?各存储哪方面的信息?

答:五个根键(主键)

1、HKEY_LOCAL_MACHINE 主键保存的是本地计算机硬件、软件相关的信息。

2、HKEY_USER主 键保存的是所有用户配置文件的数据信息。

3、HKEY_CURRENT_USER主键保存的是当前用户登录信息。

4、HKEY_CLASSES_ROOT主键保存着各种 文件的关联信息(即打开方式),还有一些类标识和 OLE、DDE之类的信息。

5、 HKEY_CURRENT_CONFIG主键保 存着计算机当前的配置信息。 (每个1分)

(4)什么是安全标识符?其有什么作用?用户名为"administrator" 的用户一定是内置的系统

管理员账户吗?

答:就是我们经常说的SID,每次当我们创建一个用户或一个组的时候,系统会分配给改用户或组一个唯一SID,当你重新安装Windows NT后,也会得到一个唯一的SID。 SID永远都是唯一的,由计算机名、当前时间、当前用户态线程的CPU耗费时间的总和三个参数决定以保证它的唯一性。(3分) SID是用户的身份象征,对用户的权限及访问控制都是基于SID的。(2分)

错。

(5) Windows NT操作系统的安全配置有哪些方面?如何实现?

答:略

(6) Windows NT文件的共享权限和NTFS权限之间是什么关系?

答:

共享权限只对共享文件夹的安全性做控制,即只控制来自网络的访问,但也适合于FAT和FAT32文件系统;而NTFS权限则对所有文件和文件夹做安全控制,无论访问来自本地还是网络,但它只适合于NTFS文件系统。

(1)共享权限是基于文件夹的,也就是说你只能够在文件夹上设置共享权限,不可能在文件上设置共享权限;NTFS权限是基于文件的,你既可以在文件夹上设置也可以在文件上设置. (2)共享权限只有当用户通过网络访问共享文件夹时才起作用,如果用户是本地登录计算机则共享权限不起作用;NTFS权限无论用户是通过网络还是本地登录使用文件都会起作用,只不过当用户通过网络访问文件时它会与共享权限联合起作用,规则是取最严格的权限设置. 比如:共享权限为只读,NTFS权限是写入,那么最终权限是完全拒绝。这是因为这两个权限的组合权限是两个权限的交集。 (3)共享权限与文件操作系统无关,只要设置共享就能够应用共享权限;NTFS权限必须是NTFS文件系统,否则不起作用。 共享权限只有几种:读取,更改和完全控制;NTFS权限有许多种,如读,写,执行,改变,完全控制等…我们可以进行非常细致的设置。

(7) Windows NT的日志系统有哪些?安全日志一般记录什么内容?

答:答案:见解析

解析:一.Windows日志系统  WindowsNT/2000的系统日志文件有应用程序日志AppEvent.Evt、安全日志SecEvent.Evt、系统日志SysEvent.Evt,根据系统开通的服务还会产生相应的日志文件。例如,DNS服务器日志DNS Serv.evt,FTP日志、WWW日志等。日志文件默认存放位置:%systemroot%\system32\config,默认文件大小512KB。这些日志文件在注册表中的位置为HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Eventlog,可以修改相应键值来改变日志文件的存放路径和大小。 Windows NT/2000主要有以下三类日志记录系统事件:应用程序日志、系统日志和安全日志。 1.应用程序日志 记录由应用程序产生的事件。例如,某个数据库程序可能设定为每次成功完成备份后都向应用程序日志发送事件记录信息。应用程序日志中记录的时间类型由应用程序的开发者决定,并提供相应的系统工具帮助用户查看应用程序日志。 2.系统日志 记录由WindowsNT/2000操作系统组件产生的事件,主要包括驱动程序、系统组件和应用软件的崩溃以及数据丢失错误等。系统日志中记录的时间类型由Windows NT/2000操作系统预先定义。 3.安全日志 记录与安全相关的事件,包括成功和不成功的登录或退出、系统资源使用事件(系统文件的创建、删除、更改)等。与系统日志和应用程序日志不同,安全日志只有系统管理员才可以访问。在WindowsXP中,事件是在系统或程序中发生的、要求通知用户的任何重要事情,或者是添加到日志中的项。事件日志服务在事件查看器中记录应用程序、安全和系统事件。通过使用事件查看器中的事件日志,用户可以获取有关硬件、软件和系统组件的信息,并可以监视本地或远程计算机上的安全事件。事件日志可帮助您确定和诊断当前系统问题的根源,还可以帮助用户预测潜在的系统问题。WindowsNT/2000的系统日志由事件记录组成。每个事件记录为三个功能区:记录头区、事件描述区和附加数据区。

(8)简述Windows NT操作系统中常见的系统进程和常用的服务。

答:答案:见解析

解析: (1)[system Idle Process] 进程文件: [system process] or [system process] 进程名称: Windows内存处理系统进程 描 述: Windows页面内存管理进程,拥有0级优先。 介 绍:该进程作为单线程运行在每个处理器上,并在系统不处理其他线程的时候分派处理器的时间。它的cpu占用率越大表示可供分配的CPU资源越多,数字越小则表示CPU资源紧张。

(2)[alg.exe] 进程文件: alg or alg.exe 进程名称: 应用层网关服务 描 述: 这是一个应用层网关服务用于网络共享。 介 绍:一个网关通信插件的管理器,为 “Internet连接共享服务”和 “Internet连接防火墙服务”提供第三方协议插件的支持。

(3)[csrss.exe] 进程文件: csrss or csrss.exe 进程名称: Client/Server Runtime Server Subsystem 描 述: 客户端服务子系统,用以控制Windows图形相关子系统。 介 绍: 这个是用户模式Win32子系统的一部分。csrss代表客户/服务器运行子系统而且是一个基本的子系统必须一直运行。csrss用于维持Windows的控制,创建或者删除线程和一些16位的虚拟MS-DOS环境。

(4)[ddhelp.exe] 进程文件: ddhelp or ddhelp.exe 进程名称: DirectDraw Helper 描 述: DirectDraw Helper是DirectX这个用于图形服务的一个组成部分。 简 介:Directx 帮助程序

(5)[dllhost.exe] 进程文件: dllhost or dllhost.exe 进程名称: DCOM DLL Host进程 描 述: DCOM DLL Host进程支持基于COM对象支持DLL以运行Windows程序。

七:Web应用安全

(1)结合自己的亲身体验,说明Internet中 Web应用存在的安全问题。

答:

1、针对Web服务器软件的安全威胁

2、针对Web应用程序的安全威胁

3、针对传输网络的安全威胁

4、针对浏览器和终端用户的Web浏览器安全威胁

( 2) Web服务器软件的安全漏洞有哪些,分别有哪些危害?

答:

(危害略)

1、数据驱动的远程代码执行安全漏洞

2、服务器功能扩展模块漏洞

3、源代码泄露安全漏洞

4、资源解析安全漏洞

(3)IIS的安全设置包括哪些方面?

答:

  1. IS安装安全
  2. 用户控制安全
  3. 访问权限控制
  4. IP地址控制
  5. 端口安全
  6. IP转发安全
  7. SSL安全

(4)列举Web应用程序的主要安全威胁,并说明Web应用程序的安全防范方法。

答:

安全威胁:注入,失效的身份认证,敏感数据泄露,XML外部实体,失效的访问控制,安全配置错误,跨站脚本攻击,不安全的反序列化,使用含有已知漏洞的组件,不足的日志记录和监控

方法:

(1)在满足需求的情况下,尽量使用静态页面代替动态页面。采用动态内容、支持用户输入的Web应用程序与静态HTML相比具有较高的安全风险,因此,在设计和开发Web应用时,应谨慎考虑是否使用动态页面。通常,信息发布类网站无须使用动态页面引入用户交互,目前搜狐.新浪等门户网站就采用了静态页面代替动态页面的构建方法。

( 2)对于必须提供用户交互、采用动态页面的Web站点,尽量使用具有良好安全声誉和稳定技术支持力量的 Web应用软件包,并定期进行 Web应用程序的安全评估和漏洞检测,升级并修复安全漏洞。

(3)强化程序开发者在Web应用开发过程中的安全意识和知识,对用户输入的数据进行严格验证,并采用有效的代码安全质量保障技术,对代码进行安全检测。

(4)操作后台数据库时,尽量采用视图、存储过程等技术,以提升安全性。

( 5)使用Web服务器软件提供的日志功能,对Web应用程序的所有访问请求进行日志记录和安全审计。

(5)什么是SQL注入?SOL注入的基本步骤一般是怎样的,如何防御?

答:

SQL注入是最常见的一种代码注入方法。其出现的原因通常是没有对用户输入进行正确的过滤,以消除SQL语言中的字符串转义字符,例如,单引号(')、双引号(")、分号(😉、百分号(%)、井号(#)、双减号(–)、双下划线(_)等;或者没有进行严格的类型判断,如没有对用户输入参数进行类型约束的检查,从而使得用户可以输入并执行一些非预期的SQL语句。

实现SQL注入的基本步骤如下:首先,判断环境,寻找注入点,判断网站后台数据库类型其次,根据注入参数类型,在脑海中重构SQL语句的原貌,从而猜测数据库中的表名和列名;后,在表名和列名猜解成功后,使用SQL语句得出字段的值。当然,这里可能需要一些运气。果能获得管理员的用户名和密码,则可以实现对网站的管理。

针对SQL注入攻击的防御,可以采用以下4种方法。

(1)最小权限原则,如非必要,不要使用sa、dbo等权限较高的账户。

( 2)对用户的输入进行严格的检查,过滤掉一些特殊字符,强制约束数据类型,约束输入长度等。

(3)使用存储过程代替简单的SQL语句。

(4)当SQL运行出错时,不要把全部的出错信息都显示给用户,以免泄露一些数据库的信

(6)什么是跨站脚本攻击?跨站脚本攻击有哪些基本类型,如何防御?

答:

跨站脚本攻击是目前最常见的 Web应用程序安全攻击手段之一。该攻击利用了Web应用程序的漏洞,以在Web页面中插入恶意的 HTML、JavaScript或其他恶意脚本。当用户浏览该页面时,客户端浏览器就会解析和执行这些代码,从而造成客户端用户信息泄露、客户端被渗透攻击等后果。

类型:反射型XSS攻击 和 存储型XSS攻击

(7)简述如何通过SSL实现客户端和服务器的安全通信。

答:使用SSL协议进行客户端与服务器双向认证的流程如下:⑴客户端浏览器连接到Web服务器,发出建立安全连接通道的请求。⑵服务器接受客户端请求,发送服务器证书作为响应。⑶客户端验证服务器证书的有效性,如果通过验证,则用服务器证书中包含的服务器公钥加密一个对称密钥,并将加密后的数据和客户端用户证书一起发送给服务器。⑷服务器收到客户端发来的加密数据后,先验证客户端的有效性,如果验证通过,则用其专用的私有密钥解开加密数据,获得对称密钥。然后服务器用客户端证书中包含的公钥加密该对称密钥,并将加密后的数据发送给客户端浏览器。⑸客户端在收到服务器发来的加密数据后,用其专用的私有密钥与原来发出去的公共密钥进行对比,如果两把密钥一致,说明服务器身份已经通过认证,双方将使用这把公共密钥建立安全连接通道。

(8)针对Web浏览器及其用户的安全威胁主要有哪些?如何进行Web浏览器的安全防范?

答:

常见的针对Web浏览器的安全威胁主要有以下几种。

(1)针对 Web浏览器所在的系统平台的安全威胁。用户使用的浏览器及其插件都是运行在Windows等桌面操作系统之上的,桌面操作系统所存在的安全漏洞使得Web浏览环境存在被攻击的风险。

(2)针对Web浏览器软件及其插件程序的安全漏洞实施的渗透攻击威胁。这种安全威胁主要包括以下几方面。

​ ①网页木马。攻击者将一段恶意代码或脚本程序嵌入到正常的网页中,利用该代码或脚本实施木马植入,一旦用户浏览了被挂马的网页就会感染木马,从而被攻击者控制以获得用户敏感信息。

​ ②浏览器劫持。攻击者通过对用户的浏览器进行篡改,引导用户登录被修改或并非用户本意要浏览的网页,从而收集用户敏感信息,危及用户隐私安全。

( 3)针对互联网用户的社会工程学攻击威胁。攻击者利用Web用户本身的人性、心理弱点,通过构建钓鱼网站的手段来骗取用户的个人敏感信息。这是网络钓鱼攻击所采用的方法。

针对常见的Web浏览器安全威胁,通用的安全防范措施包括以下3种。

( 1)加强安全意识,通过学习提升自己抵御社会工程学攻击的能力。例如,尽量避免打开来历不明的网站链接、邮件附件和文件,不要轻易相信未经证实的陌生电话,尽量不要在公共场所访问需要个人信息的网站等。

(2)勤打补丁,将操作系统和浏览器软件更新到最新版本,确保所使用的计算机始终处于-个相对安全的状态。

(3)合理利用浏览器软件、网络安全厂商软件和设备提供的安全功能设置,提升Web浏览器的安全性。

下面以E浏览器为例,从设置IE浏览器的安全级别、清除E缓存、隐私设置、关闭自动完成功能等几个方面简单介绍一些提升E浏览器安全性的方法。

( 9) Cookie 会对用户计算机系统产生危害吗?为什么说 Cookie的存在对个人隐私是-潜在的威胁?

答:

不会,Cookies是一种能够让网站服务器把少量数据储存到客户端的硬盘或内存,或是从客户端的硬盘读取数据的一种技术。

Cookies是当你浏览某网站时,由Web服务器置于你硬盘上的一个非常小的文本文件,它可以记录你的用户ID、密码、浏览过的网页、停留的时间等,理论上讲,Cookie里面当然可以存储这些信息,但是,像性别、年龄、QQ号等等这些精确的个人信息,除了你自己提交给网站再由网站记录在Cookie里之外,是不可能凭空出现在Cookie里的。而正规设计的网站,一般不会把这些信息保存在Cookie里(用户一清空Cookie就没了),它们最有可能将其保存在自己的数据库中,Cookie里顶多保存一个相关联的身份识别号码。但是cookie在http协议中是明文传输的,并且直接附在http报文的前面,所以只要在网络中加个嗅探工具,获取http包,就可以分析并获得cookie的值。,当我们获取到别人的cookie的值,就产生了一种攻击漏洞,即cookie欺骗。我们将获取到的cookie值加在http请求前,服务器就会把我们当作是该cookie的用户,我们就成功的冒充了其他用户,可以使用其他用户在服务器的资源等。 解析:本题考查cookie安全问题,Cookie,有时也用其复数形式 Cookies。类型为“小型文本文件”,是某些网站为了辨别用户身份,进行Session跟踪而储存在用户本地终端上的数据(通常经过加密),由用户客户端计算机暂时或永久保存的信息,但是cookie在http协议中是明文传输的,并且直接附在http报文的前面,所以只要在网络中加个嗅探工具,获取http包,就可以分析并获得cookie的值。,当我们获取到别人的cookie的值,就产生了一种攻击漏洞,即cookie欺骗。我们将获取到的cookie值加在http请求前,服务器就会把我们当作是该cookie的用户,我们就成功的冒充了其他用户,可以使用其他用户在服务器的资源等。所以Cookie对用户计算机系统不会产生伤害,但是Cookie的存在对个人隐私是一种潜在的威胁。

(10 ) Cookie欺骗是什么?

Cookies欺骗是通过盗取、修改、伪造Cookies的内容来欺骗Web系统,并得到相应权限或者进行相应权限操作的一种攻击方式。

  • 58
    点赞
  • 305
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 3
    评论
Computer Networking: A Top-Down Approach, 6th Edition Solutions to Review Questions and Problems Version Date: May 2012 This document contains the solutions to review questions and problems for the 5th edition of Computer Networking: A Top-Down Approach by Jim Kurose and Keith Ross. These solutions are being made available to instructors ONLY. Please do NOT copy or distribute this document to others (even other instructors). Please do not post any solutions on a publicly-available Web site. We’ll be happy to provide a copy (up-to-date) of this solution manual ourselves to anyone who asks. Acknowledgments: Over the years, several students and colleagues have helped us prepare this solutions manual. Special thanks goes to HongGang Zhang, Rakesh Kumar, Prithula Dhungel, and Vijay Annapureddy. Also thanks to all the readers who have made suggestions and corrected errors. All material © copyright 1996-2012 by J.F. Kurose and K.W. Ross. All rights reserved Chapter 1 Review Questions There is no difference. Throughout this text, the words “host” and “end system” are used interchangeably. End systems include PCs, workstations, Web servers, mail servers, PDAs, Internet-connected game consoles, etc. From Wikipedia: Diplomatic protocol is commonly described as a set of international courtesy rules. These well-established and time-honored rules have made it easier for nations and people to live and work together. Part of protocol has always been the acknowledgment of the hierarchical standing of all present. Protocol rules are based on the principles of civility. Standards are important for protocols so that people can create networking systems and products that interoperate. 1. Dial-up modem over telephone line: home; 2. DSL over telephone line: home or small office; 3. Cable to HFC: home; 4. 100 Mbps switched Ethernet: enterprise; 5. Wifi (802.11): home and enterprise: 6. 3G and 4G: wide-area wireless. HFC bandwidth is shared among the users. On the downstream channel, all packets emanate from a single source, namely, the head end. Thus, there are no collisions in the downstream channel. In most American cities, the current possibilities include: dial-up; DSL; cable modem; fiber-to-the-home. 7. Ethernet LANs have transmission rates of 10 Mbps, 100 Mbps, 1 Gbps and 10 Gbps. 8. Today, Ethernet most commonly runs over twisted-pair copper wire. It also can run over fibers optic links. 9. Dial up modems: up to 56 Kbps, bandwidth is dedicated; ADSL: up to 24 Mbps downstream and 2.5 Mbps upstream, bandwidth is dedicated; HFC, rates up to 42.8 Mbps and upstream rates of up to 30.7 Mbps, bandwidth is shared. FTTH: 2-10Mbps upload; 10-20 Mbps download; bandwidth is not shared. 10. There are two popular wireless Internet access technologies today: Wifi (802.11) In a wireless LAN, wireless users transmit/receive packets to/from an base station (i.e., wireless access point) within a radius of few tens of meters. The base station is typically connected to the wired Internet and thus serves to connect wireless users to the wired network. 3G and 4G wide-area wireless access networks. In these systems, packets are transmitted over the same wireless infrastructure used for cellular telephony, with the base station thus being managed by a telecommunications provider. This provides wireless access to users within a radius of tens of kilometers of the base station. 11. At time t0 the sending host begins to transmit. At time t1 = L/R1, the sending host completes transmission and the entire packet is received at the router (no propagation delay). Because the router has the entire packet at time t1, it can begin to transmit the packet to the receiving host at time t1. At time t2 = t1 + L/R2, the router completes transmission and the entire packet is received at the receiving host (again, no propagation delay). Thus, the end-to-end delay is L/R1 + L/R2. 12. A circuit-switched network can guarantee a certain amount of end-to-end bandwidth for the duration of a call. Most packet-switched networks today (including the Internet) cannot make any end-to-end guarantees for bandwidth. FDM requires sophisticated analog hardware to shift signal into appropriate frequency bands. 13. a) 2 users can be supported because each user requires half of the link bandwidth. b) Since each user requires 1Mbps when transmitting, if two or fewer users transmit simultaneously, a maximum of 2Mbps will be required. Since the available bandwidth of the shared link is 2Mbps, there will be no queuing delay before the link. Whereas, if three users transmit simultaneously, the bandwidth required will be 3Mbps which is more than the available bandwidth of the shared link. In this case, there will be queuing delay before the link. c) Probability that a given user is transmitting = 0.2 d) Probability that all three users are transmitting simultaneously = = (0.2)3 = 0.008. Since the queue grows when all the users are transmitting, the fraction of time during which the queue grows (which is equal to the probability that all three users are transmitting simultaneously) is 0.008. 14. If the two ISPs do not peer with each other, then when they send traffic to each other they have to send the traffic through a provider ISP (intermediary), to which they have to pay for carrying the traffic. By peering with each other directly, the two ISPs can reduce their payments to their provider ISPs. An Internet Exchange Points (IXP) (typically in a standalone building with its own switches) is a meeting point where multiple ISPs can connect and/or peer together. An ISP earns its money by charging each of the the ISPs that connect to the IXP a relatively small fee, which may depend on the amount of traffic sent to or received from the IXP. 15. Google's private network connects together all its data centers, big and small. Traffic between the Google data centers passes over its private network rather than over the public Internet. Many of these data centers are located in, or close to, lower tier ISPs. Therefore, when Google delivers content to a user, it often can bypass higher tier ISPs. What motivates content providers to create these networks? First, the content provider has more control over the user experience, since it has to use few intermediary ISPs. Second, it can save money by sending less traffic into provider networks. Third, if ISPs decide to charge more money to highly profitable content providers (in countries where net neutrality doesn't apply), the content providers can avoid these extra payments. 16. The delay components are processing delays, transmission delays, propagation delays, and queuing delays. All of these delays are fixed, except for the queuing delays, which are variable. 17. a) 1000 km, 1 Mbps, 100 bytes b) 100 km, 1 Mbps, 100 bytes 18. 10msec; d/s; no; no 19. a) 500 kbps b) 64 seconds c) 100kbps; 320 seconds 20. End system A breaks the large file into chunks. It adds header to each chunk, thereby generating multiple packets from the file. The header in each packet includes the IP address of the destination (end system B). The packet switch uses the destination IP address in the packet to determine the outgoing link. Asking which road to take is analogous to a packet asking which outgoing link it should be forwarded on, given the packet’s destination address. 21. The maximum emission rate is 500 packets/sec and the maximum transmission rate is 350 packets/sec. The corresponding traffic intensity is 500/350 =1.43 > 1. Loss will eventually occur for each experiment; but the time when loss first occurs will be different from one experiment to the next due to the randomness in the emission process. 22. Five generic tasks are error control, flow control, segmentation and reassembly, multiplexing, and connection setup. Yes, these tasks can be duplicated at different layers. For example, error control is often provided at more than one layer. 23. The five layers in the Internet protocol stack are – from top to bottom – the application layer, the transport layer, the network layer, the link layer, and the physical layer. The principal responsibilities are outlined in Section 1.5.1. 24. Application-layer message: data which an application wants to send and passed onto the transport layer; transport-layer segment: generated by the transport layer and encapsulates application-layer message with transport layer header; network-layer datagram: encapsulates transport-layer segment with a network-layer header; link-layer frame: encapsulates network-layer datagram with a link-layer header. 25. Routers process network, link and physical layers (layers 1 through 3). (This is a little bit of a white lie, as modern routers sometimes act as firewalls or caching components, and process Transport layer as well.) Link layer switches process link and physical layers (layers 1 through2). Hosts process all five layers. 26. a) Virus Requires some form of human interaction to spread. Classic example: E-mail viruses. b) Worms No user replication needed. Worm in infected host scans IP addresses and port numbers, looking for vulnerable processes to infect. 27. Creation of a botnet requires an attacker to find vulnerability in some application or system (e.g. exploiting the buffer overflow vulnerability that might exist in an application). After finding the vulnerability, the attacker needs to scan for hosts that are vulnerable. The target is basically to compromise a series of systems by exploiting that particular vulnerability. Any system that is part of the botnet can automatically scan its environment and propagate by exploiting the vulnerability. An important property of such botnets is that the originator of the botnet can remotely control and issue commands to all the nodes in the botnet. Hence, it becomes possible for the attacker to issue a command to all the nodes, that target a single node (for example, all nodes in the botnet might be commanded by the attacker to send a TCP SYN message to the target, which might result in a TCP SYN flood attack at the target). 28. Trudy can pretend to be Bob to Alice (and vice-versa) and partially or completely modify the message(s) being sent from Bob to Alice. For example, she can easily change the phrase “Alice, I owe you $1000” to “Alice, I owe you $10,000”. Furthermore, Trudy can even drop the packets that are being sent by Bob to Alice (and vise-versa), even if the packets from Bob to Alice are encrypted. Chapter 1 Problems Problem 1 There is no single right answer to this question. Many protocols would do the trick. Here's a simple answer below: Messages from ATM machine to Server Msg name purpose -------- ------- HELO Let server know that there is a card in the ATM machine ATM card transmits user ID to Server PASSWD User enters PIN, which is sent to server BALANCE User requests balance WITHDRAWL User asks to withdraw money BYE user all done Messages from Server to ATM machine (display) Msg name purpose -------- ------- PASSWD Ask user for PIN (password) OK last requested operation (PASSWD, WITHDRAWL) OK ERR last requested operation (PASSWD, WITHDRAWL) in ERROR AMOUNT sent in response to BALANCE request BYE user done, display welcome screen at ATM Correct operation: client server HELO (userid) --------------> (check if valid userid) <------------- PASSWD PASSWD --------------> (check password) <------------- AMOUNT WITHDRAWL --------------> check if enough $ to cover withdrawl (check if valid userid) <------------- PASSWD PASSWD --------------> (check password) <------------- AMOUNT WITHDRAWL --------------> check if enough $ to cover withdrawl <------------- BYE Problem 2 At time N*(L/R) the first packet has reached the destination, the second packet is stored in the last router, the third packet is stored in the next-to-last router, etc. At time N*(L/R) + L/R, the second packet has reached the destination, the third packet is stored in the last router, etc. Continuing with this logic, we see that at time N*(L/R) + (P-1)*(L/R) = (N+P-1)*(L/R) all packets have reached the destination. Problem 3 a) A circuit-switched network would be well suited to the application, because the application involves long sessions with predictable smooth bandwidth requirements. Since the transmission rate is known and not bursty, bandwidth can be reserved for each application session without significant waste. In addition, the overhead costs of setting up and tearing down connections are amortized over the lengthy duration of a typical application session. b) In the worst case, all the applications simultaneously transmit over one or more network links. However, since each link has sufficient bandwidth to handle the sum of all of the applications' data rates, no congestion (very little queuing) will occur. Given such generous link capacities, the network does not need congestion control mechanisms. Problem 4 Between the switch in the upper left and the switch in the upper right we can have 4 connections. Similarly we can have four connections between each of the 3 other pairs of adjacent switches. Thus, this network can support up to 16 connections. We can 4 connections passing through the switch in the upper-right-hand corner and another 4 connections passing through the switch in the lower-left-hand corner, giving a total of 8 connections. Yes. For the connections between A and C, we route two connections through B and two connections through D. For the connections between B and D, we route two connections through A and two connections through C. In this manner, there are at most 4 connections passing through any link. Problem 5 Tollbooths are 75 km apart, and the cars propagate at 100km/hr. A tollbooth services a car at a rate of one car every 12 seconds. a) There are ten cars. It takes 120 seconds, or 2 minutes, for the first tollbooth to service the 10 cars. Each of these cars has a propagation delay of 45 minutes (travel 75 km) before arriving at the second tollbooth. Thus, all the cars are lined up before the second tollbooth after 47 minutes. The whole process repeats itself for traveling between the second and third tollbooths. It also takes 2 minutes for the third tollbooth to service the 10 cars. Thus the total delay is 96 minutes. b) Delay between tollbooths is 8*12 seconds plus 45 minutes, i.e., 46 minutes and 36 seconds. The total delay is twice this amount plus 8*12 seconds, i.e., 94 minutes and 48 seconds. Problem 6 a) seconds. b) seconds. c) seconds. d) The bit is just leaving Host A. e) The first bit is in the link and has not reached Host B. f) The first bit has reached Host B. g) Want km. Problem 7 Consider the first bit in a packet. Before this bit can be transmitted, all of the bits in the packet must be generated. This requires sec=7msec. The time required to transmit the packet is sec= sec. Propagation delay = 10 msec. The delay until decoding is 7msec + sec + 10msec = 17.224msec A similar analysis shows that all bits experience a delay of 17.224 msec. Problem 8 a) 20 users can be supported. b) . c) . d) . We use the central limit theorem to approximate this probability. Let be independent random variables such that . “21 or more users” when is a standard normal r.v. Thus “21 or more users” . Problem 9 10,000 Problem 10 The first end system requires L/R1 to transmit the packet onto the first link; the packet propagates over the first link in d1/s1; the packet switch adds a processing delay of dproc; after receiving the entire packet, the packet switch connecting the first and the second link requires L/R2 to transmit the packet onto the second link; the packet propagates over the second link in d2/s2. Similarly, we can find the delay caused by the second switch and the third link: L/R3, dproc, and d3/s3. Adding these five delays gives dend-end = L/R1 + L/R2 + L/R3 + d1/s1 + d2/s2 + d3/s3+ dproc+ dproc To answer the second question, we simply plug the values into the equation to get 6 + 6 + 6 + 20+16 + 4 + 3 + 3 = 64 msec. Problem 11 Because bits are immediately transmitted, the packet switch does not introduce any delay; in particular, it does not introduce a transmission delay. Thus, dend-end = L/R + d1/s1 + d2/s2+ d3/s3 For the values in Problem 10, we get 6 + 20 + 16 + 4 = 46 msec. Problem 12 The arriving packet must first wait for the link to transmit 4.5 *1,500 bytes = 6,750 bytes or 54,000 bits. Since these bits are transmitted at 2 Mbps, the queuing delay is 27 msec. Generally, the queuing delay is (nL + (L - x))/R. Problem 13 The queuing delay is 0 for the first transmitted packet, L/R for the second transmitted packet, and generally, (n-1)L/R for the nth transmitted packet. Thus, the average delay for the N packets is: (L/R + 2L/R + ....... + (N-1)L/R)/N = L/(RN) * (1 + 2 + ..... + (N-1)) = L/(RN) * N(N-1)/2 = LN(N-1)/(2RN) = (N-1)L/(2R) Note that here we used the well-known fact: 1 + 2 + ....... + N = N(N+1)/2 It takes seconds to transmit the packets. Thus, the buffer is empty when a each batch of packets arrive. Thus, the average delay of a packet across all batches is the average delay within one batch, i.e., (N-1)L/2R. Problem 14 The transmission delay is . The total delay is Let . Total delay = For x=0, the total delay =0; as we increase x, total delay increases, approaching infinity as x approaches 1/a. Problem 15 Total delay . Problem 16 The total number of packets in the system includes those in the buffer and the packet that is being transmitted. So, N=10+1. Because , so (10+1)=a*(queuing delay + transmission delay). That is, 11=a*(0.01+1/100)=a*(0.01+0.01). Thus, a=550 packets/sec. Problem 17 There are nodes (the source host and the routers). Let denote the processing delay at the th node. Let be the transmission rate of the th link and let . Let be the propagation delay across the th link. Then . Let denote the average queuing delay at node . Then . Problem 18 On linux you can use the command traceroute www.targethost.com and in the Windows command prompt you can use tracert www.targethost.com In either case, you will get three delay measurements. For those three measurements you can calculate the mean and standard deviation. Repeat the experiment at different times of the day and comment on any changes. Here is an example solution: Traceroutes between San Diego Super Computer Center and www.poly.edu The average (mean) of the round-trip delays at each of the three hours is 71.18 ms, 71.38 ms and 71.55 ms, respectively. The standard deviations are 0.075 ms, 0.21 ms, 0.05 ms, respectively. In this example, the traceroutes have 12 routers in the path at each of the three hours. No, the paths didn’t change during any of the hours. Traceroute packets passed through four ISP networks from source to destination. Yes, in this experiment the largest delays occurred at peering interfaces between adjacent ISPs. Traceroutes from www.stella-net.net (France) to www.poly.edu (USA). The average round-trip delays at each of the three hours are 87.09 ms, 86.35 ms and 86.48 ms, respectively. The standard deviations are 0.53 ms, 0.18 ms, 0.23 ms, respectively. In this example, there are 11 routers in the path at each of the three hours. No, the paths didn’t change during any of the hours. Traceroute packets passed three ISP networks from source to destination. Yes, in this experiment the largest delays occurred at peering interfaces between adjacent ISPs. Problem 19 An example solution: Traceroutes from two different cities in France to New York City in United States In these traceroutes from two different cities in France to the same destination host in United States, seven links are in common including the transatlantic link. In this example of traceroutes from one city in France and from another city in Germany to the same host in United States, three links are in common including the transatlantic link. Traceroutes to two different cities in China from same host in United States Five links are common in the two traceroutes. The two traceroutes diverge before reaching China Problem 20 Throughput = min{Rs, Rc, R/M} Problem 21 If only use one path, the max throughput is given by: . If use all paths, the max throughput is given by . Problem 22 Probability of successfully receiving a packet is: ps= (1-p)N. The number of transmissions needed to be performed until the packet is successfully received by the client is a geometric random variable with success probability ps. Thus, the average number of transmissions needed is given by: 1/ps . Then, the average number of re-transmissions needed is given by: 1/ps -1. Problem 23 Let’s call the first packet A and call the second packet B. If the bottleneck link is the first link, then packet B is queued at the first link waiting for the transmission of packet A. So the packet inter-arrival time at the destination is simply L/Rs. If the second link is the bottleneck link and both packets are sent back to back, it must be true that the second packet arrives at the input queue of the second link before the second link finishes the transmission of the first packet. That is, L/Rs + L/Rs + dprop = L/Rs + dprop + L/Rc Thus, the minimum value of T is L/Rc  L/Rs . Problem 24 40 terabytes = 40 * 1012 * 8 bits. So, if using the dedicated link, it will take 40 * 1012 * 8 / (100 *106 ) =3200000 seconds = 37 days. But with FedEx overnight delivery, you can guarantee the data arrives in one day, and it should cost less than $100. Problem 25 160,000 bits 160,000 bits The bandwidth-delay product of a link is the maximum number of bits that can be in the link. the width of a bit = length of link / bandwidth-delay product, so 1 bit is 125 meters long, which is longer than a football field s/R Problem 26 s/R=20000km, then R=s/20000km= 2.5*108/(2*107)= 12.5 bps Problem 27 80,000,000 bits 800,000 bits, this is because that the maximum number of bits that will be in the link at any given time = min(bandwidth delay product, packet size) = 800,000 bits. .25 meters Problem 28 ttrans + tprop = 400 msec + 80 msec = 480 msec. 20 * (ttrans + 2 tprop) = 20*(20 msec + 80 msec) = 2 sec. Breaking up a file takes longer to transmit because each data packet and its corresponding acknowledgement packet add their own propagation delays. Problem 29 Recall geostationary satellite is 36,000 kilometers away from earth surface. 150 msec 1,500,000 bits 600,000,000 bits Problem 30 Let’s suppose the passenger and his/her bags correspond to the data unit arriving to the top of the protocol stack. When the passenger checks in, his/her bags are checked, and a tag is attached to the bags and ticket. This is additional information added in the Baggage layer if Figure 1.20 that allows the Baggage layer to implement the service or separating the passengers and baggage on the sending side, and then reuniting them (hopefully!) on the destination side. When a passenger then passes through security and additional stamp is often added to his/her ticket, indicating that the passenger has passed through a security check. This information is used to ensure (e.g., by later checks for the security information) secure transfer of people. Problem 31 Time to send message from source host to first packet switch = With store-and-forward switching, the total time to move message from source host to destination host = Time to send 1st packet from source host to first packet switch = . . Time at which 2nd packet is received at the first switch = time at which 1st packet is received at the second switch = Time at which 1st packet is received at the destination host = . After this, every 5msec one packet will be received; thus time at which last (800th) packet is received = . It can be seen that delay in using message segmentation is significantly less (almost 1/3rd). Without message segmentation, if bit errors are not tolerated, if there is a single bit error, the whole message has to be retransmitted (rather than a single packet). Without message segmentation, huge packets (containing HD videos, for example) are sent into the network. Routers have to accommodate these huge packets. Smaller packets have to queue behind enormous packets and suffer unfair delays. Packets have to be put in sequence at the destination. Message segmentation results in many smaller packets. Since header size is usually the same for all packets regardless of their size, with message segmentation the total amount of header bytes is more. Problem 32 Yes, the delays in the applet correspond to the delays in the Problem 31.The propagation delays affect the overall end-to-end delays both for packet switching and message switching equally. Problem 33 There are F/S packets. Each packet is S=80 bits. Time at which the last packet is received at the first router is sec. At this time, the first F/S-2 packets are at the destination, and the F/S-1 packet is at the second router. The last packet must then be transmitted by the first router and the second router, with each transmission taking sec. Thus delay in sending the whole file is To calculate the value of S which leads to the minimum delay, Problem 34 The circuit-switched telephone networks and the Internet are connected together at "gateways". When a Skype user (connected to the Internet) calls an ordinary telephone, a circuit is established between a gateway and the telephone user over the circuit switched network. The skype user's voice is sent in packets over the Internet to the gateway. At the gateway, the voice signal is reconstructed and then sent over the circuit. In the other direction, the voice signal is sent over the circuit switched network to the gateway. The gateway packetizes the voice signal and sends the voice packets to the Skype user.   Chapter 2 Review Questions The Web: HTTP; file transfer: FTP; remote login: Telnet; e-mail: SMTP; BitTorrent file sharing: BitTorrent protocol Network architecture refers to the organization of the communication process into layers (e.g., the five-layer Internet architecture). Application architecture, on the other hand, is designed by an application developer and dictates the broad structure of the application (e.g., client-server or P2P). The process which initiates the communication is the client; the process that waits to be contacted is the server. No. In a P2P file-sharing application, the peer that is receiving a file is typically the client and the peer that is sending the file is typically the server. The IP address of the destination host and the port number of the socket in the destination process. You would use UDP. With UDP, the transaction can be completed in one roundtrip time (RTT) - the client sends the transaction request into a UDP socket, and the server sends the reply back to the client's UDP socket. With TCP, a minimum of two RTTs are needed - one to set-up the TCP connection, and another for the client to send the request, and for the server to send back the reply. One such example is remote word processing, for example, with Google docs. However, because Google docs runs over the Internet (using TCP), timing guarantees are not provided. a) Reliable data transfer TCP provides a reliable byte-stream between client and server but UDP does not. b) A guarantee that a certain value for throughput will be maintained Neither c) A guarantee that data will be delivered within a specified amount of time Neither d) Confidentiality (via encryption) Neither SSL operates at the application layer. The SSL socket takes unencrypted data from the application layer, encrypts it and then passes it to the TCP socket. If the application developer wants TCP to be enhanced with SSL, she has to include the SSL code in the application. A protocol uses handshaking if the two communicating entities first exchange control packets before sending data to each other. SMTP uses handshaking at the application layer whereas HTTP does not. The applications associated with those protocols require that all application data be received in the correct order and without gaps. TCP provides this service whereas UDP does not. When the user first visits the site, the server creates a unique identification number, creates an entry in its back-end database, and returns this identification number as a cookie number. This cookie number is stored on the user’s host and is managed by the browser. During each subsequent visit (and purchase), the browser sends the cookie number back to the site. Thus the site knows when this user (more precisely, this browser) is visiting the site. Web caching can bring the desired content “closer” to the user, possibly to the same LAN to which the user’s host is connected. Web caching can reduce the delay for all objects, even objects that are not cached, since caching reduces the traffic on links. Telnet is not available in Windows 7 by default. to make it available, go to Control Panel, Programs and Features, Turn Windows Features On or Off, Check Telnet client. To start Telnet, in Windows command prompt, issue the following command > telnet webserverver 80 where "webserver" is some webserver. After issuing the command, you have established a TCP connection between your client telnet program and the web server. Then type in an HTTP GET message. An example is given below: Since the index.html page in this web server was not modified since Fri, 18 May 2007 09:23:34 GMT, and the above commands were issued on Sat, 19 May 2007, the server returned "304 Not Modified". Note that the first 4 lines are the GET message and header lines inputed by the user, and the next 4 lines (starting from HTTP/1.1 304 Not Modified) is the response from the web server. FTP uses two parallel TCP connections, one connection for sending control information (such as a request to transfer a file) and another connection for actually transferring the file. Because the control information is not sent over the same connection that the file is sent over, FTP sends control information out of band. The message is first sent from Alice’s host to her mail server over HTTP. Alice’s mail server then sends the message to Bob’s mail server over SMTP. Bob then transfers the message from his mail server to his host over POP3. 17. Received: from 65.54.246.203 (EHLO bay0-omc3-s3.bay0.hotmail.com) (65.54.246.203) by mta419.mail.mud.yahoo.com with SMTP; Sat, 19 May 2007 16:53:51 -0700 Received: from hotmail.com ([65.55.135.106]) by bay0-omc3-s3.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sat, 19 May 2007 16:52:42 -0700 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Sat, 19 May 2007 16:52:41 -0700 Message-ID: Received: from 65.55.135.123 by by130fd.bay130.hotmail.msn.com with HTTP; Sat, 19 May 2007 23:52:36 GMT From: "prithula dhungel" To: prithula@yahoo.com Bcc: Subject: Test mail Date: Sat, 19 May 2007 23:52:36 +0000 Mime-Version: 1.0 Content-Type: Text/html; format=flowed Return-Path: prithuladhungel@hotmail.com Figure: A sample mail message header Received: This header field indicates the sequence in which the SMTP servers send and receive the mail message including the respective timestamps. In this example there are 4 “Received:” header lines. This means the mail message passed through 5 different SMTP servers before being delivered to the receiver’s mail box. The last (forth) “Received:” header indicates the mail message flow from the SMTP server of the sender to the second SMTP server in the chain of servers. The sender’s SMTP server is at address 65.55.135.123 and the second SMTP server in the chain is by130fd.bay130.hotmail.msn.com. The third “Received:” header indicates the mail message flow from the second SMTP server in the chain to the third server, and so on. Finally, the first “Received:” header indicates the flow of the mail messages from the forth SMTP server to the last SMTP server (i.e. the receiver’s mail server) in the chain. Message-id: The message has been given this number BAY130-F26D9E35BF59E0D18A819AFB9310@phx.gbl (by bay0-omc3-s3.bay0.hotmail.com. Message-id is a unique string assigned by the mail system when the message is first created. From: This indicates the email address of the sender of the mail. In the given example, the sender is “prithuladhungel@hotmail.com” To: This field indicates the email address of the receiver of the mail. In the example, the receiver is “prithula@yahoo.com” Subject: This gives the subject of the mail (if any specified by the sender). In the example, the subject specified by the sender is “Test mail” Date: The date and time when the mail was sent by the sender. In the example, the sender sent the mail on 19th May 2007, at time 23:52:36 GMT. Mime-version: MIME version used for the mail. In the example, it is 1.0. Content-type: The type of content in the body of the mail message. In the example, it is “text/html”. Return-Path: This specifies the email address to which the mail will be sent if the receiver of this mail wants to reply to the sender. This is also used by the sender’s mail server for bouncing back undeliverable mail messages of mailer-daemon error messages. In the example, the return path is “prithuladhungel@hotmail.com”. With download and delete, after a user retrieves its messages from a POP server, the messages are deleted. This poses a problem for the nomadic user, who may want to access the messages from many different machines (office PC, home PC, etc.). In the download and keep configuration, messages are not deleted after the user retrieves the messages. This can also be inconvenient, as each time the user retrieves the stored messages from a new machine, all of non-deleted messages will be transferred to the new machine (including very old messages). Yes an organization’s mail server and Web server can have the same alias for a host name. The MX record is used to map the mail server’s host name to its IP address. You should be able to see the sender's IP address for a user with an .edu email address. But you will not be able to see the sender's IP address if the user uses a gmail account. It is not necessary that Bob will also provide chunks to Alice. Alice has to be in the top 4 neighbors of Bob for Bob to send out chunks to her; this might not occur even if Alice provides chunks to Bob throughout a 30-second interval. Recall that in BitTorrent, a peer picks a random peer and optimistically unchokes the peer for a short period of time. Therefore, Alice will eventually be optimistically unchoked by one of her neighbors, during which time she will receive chunks from that neighbor. The overlay network in a P2P file sharing system consists of the nodes participating in the file sharing system and the logical links between the nodes. There is a logical link (an “edge” in graph theory terms) from node A to node B if there is a semi-permanent TCP connection between A and B. An overlay network does not include routers. Mesh DHT: The advantage is in order to a route a message to the peer (with ID) that is closest to the key, only one hop is required; the disadvantage is that each peer must track all other peers in the DHT. Circular DHT: the advantage is that each peer needs to track only a few other peers; the disadvantage is that O(N) hops are needed to route a message to the peer that is closest to the key. 25. File Distribution Instant Messaging Video Streaming Distributed Computing With the UDP server, there is no welcoming socket, and all data from different clients enters the server through this one socket. With the TCP server, there is a welcoming socket, and each time a client initiates a connection to the server, a new socket is created. Thus, to support n simultaneous connections, the server would need n+1 sockets. For the TCP application, as soon as the client is executed, it attempts to initiate a TCP connection with the server. If the TCP server is not running, then the client will fail to make a connection. For the UDP application, the client does not initiate connections (or attempt to communicate with the UDP server) immediately upon execution Chapter 2 Problems Problem 1 a) F b) T c) F d) F e) F Problem 2 Access control commands: USER, PASS, ACT, CWD, CDUP, SMNT, REIN, QUIT. Transfer parameter commands: PORT, PASV, TYPE STRU, MODE. Service commands: RETR, STOR, STOU, APPE, ALLO, REST, RNFR, RNTO, ABOR, DELE, RMD, MRD, PWD, LIST, NLST, SITE, SYST, STAT, HELP, NOOP. Problem 3 Application layer protocols: DNS and HTTP Transport layer protocols: UDP for DNS; TCP for HTTP Problem 4 The document request was http://gaia.cs.umass.edu/cs453/index.html. The Host : field indicates the server's name and /cs453/index.html indicates the file name. The browser is running HTTP version 1.1, as indicated just before the first pair. The browser is requesting a persistent connection, as indicated by the Connection: keep-alive. This is a trick question. This information is not contained in an HTTP message anywhere. So there is no way to tell this from looking at the exchange of HTTP messages alone. One would need information from the IP datagrams (that carried the TCP segment that carried the HTTP GET request) to answer this question. Mozilla/5.0. The browser type information is needed by the server to send different versions of the same object to different types of browsers. Problem 5 The status code of 200 and the phrase OK indicate that the server was able to locate the document successfully. The reply was provided on Tuesday, 07 Mar 2008 12:39:45 Greenwich Mean Time. The document index.html was last modified on Saturday 10 Dec 2005 18:27:46 GMT. There are 3874 bytes in the document being returned. The first five bytes of the returned document are : <!doc. The server agreed to a persistent connection, as indicated by the Connection: Keep-Alive field Problem 6 Persistent connections are discussed in section 8 of RFC 2616 (the real goal of this question was to get you to retrieve and read an RFC). Sections 8.1.2 and 8.1.2.1 of the RFC indicate that either the client or the server can indicate to the other that it is going to close the persistent connection. It does so by including the connection-token "close" in the Connection-header field of the http request/reply. HTTP does not provide any encryption services. (From RFC 2616) “Clients that use persistent connections should limit the number of simultaneous connections that they maintain to a given server. A single-user client SHOULD NOT maintain more than 2 connections with any server or proxy.” Yes. (From RFC 2616) “A client might have started to send a new request at the same time that the server has decided to close the "idle" connection. From the server's point of view, the connection is being closed while it was idle, but from the client's point of view, a request is in progress.” Problem 7 The total amount of time to get the IP address is . Once the IP address is known, elapses to set up the TCP connection and another elapses to request and receive the small object. The total response time is Problem 8 . . Problem 9 The time to transmit an object of size L over a link or rate R is L/R. The average time is the average size of the object divided by R:  = (850,000 bits)/(15,000,000 bits/sec) = .0567 sec The traffic intensity on the link is given by =(16 requests/sec)(.0567 sec/request) = 0.907. Thus, the average access delay is (.0567 sec)/(1 - .907)  .6 seconds. The total average response time is therefore .6 sec + 3 sec = 3.6 sec. The traffic intensity on the access link is reduced by 60% since the 60% of the requests are satisfied within the institutional network. Thus the average access delay is (.0567 sec)/[1 – (.4)(.907)] = .089 seconds. The response time is approximately zero if the request is satisfied by the cache (which happens with probability .6); the average response time is .089 sec + 3 sec = 3.089 sec for cache misses (which happens 40% of the time). So the average response time is (.6)(0 sec) + (.4)(3.089 sec) = 1.24 seconds. Thus the average response time is reduced from 3.6 sec to 1.24 sec. Problem 10 Note that each downloaded object can be completely put into one data packet. Let Tp denote the one-way propagation delay between the client and the server. First consider parallel downloads using non-persistent connections. Parallel downloads would allow 10 connections to share the 150 bits/sec bandwidth, giving each just 15 bits/sec. Thus, the total time needed to receive all objects is given by: (200/150+Tp + 200/150 +Tp + 200/150+Tp + 100,000/150+ Tp ) + (200/(150/10)+Tp + 200/(150/10) +Tp + 200/(150/10)+Tp + 100,000/(150/10)+ Tp ) = 7377 + 8*Tp (seconds) Now consider a persistent HTTP connection. The total time needed is given by: (200/150+Tp + 200/150 +Tp + 200/150+Tp + 100,000/150+ Tp ) + 10*(200/150+Tp + 100,000/150+ Tp ) =7351 + 24*Tp (seconds) Assuming the speed of light is 300*106 m/sec, then Tp=10/(300*106)=0.03 microsec. Tp is therefore negligible compared with transmission delay. Thus, we see that persistent HTTP is not significantly faster (less than 1 percent) than the non-persistent case with parallel download. Problem 11 Yes, because Bob has more connections, he can get a larger share of the link bandwidth. Yes, Bob still needs to perform parallel downloads; otherwise he will get less bandwidth than the other four users. Problem 12 Server.py from socket import * serverPort=12000 serverSocket=socket(AF_INET,SOCK_STREAM) serverSocket.bind(('',serverPort)) serverSocket.listen(1) connectionSocket, addr = serverSocket.accept() while 1: sentence = connectionSocket.recv(1024) print 'From Server:', sentence, '\n' serverSocket.close() Problem 13 The MAIL FROM: in SMTP is a message from the SMTP client that identifies the sender of the mail message to the SMTP server. The From: on the mail message itself is NOT an SMTP message, but rather is just a line in the body of the mail message. Problem 14 SMTP uses a line containing only a period to mark the end of a message body. HTTP uses “Content-Length header field” to indicate the length of a message body. No, HTTP cannot use the method used by SMTP, because HTTP message could be binary data, whereas in SMTP, the message body must be in 7-bit ASCII format. Problem 15 MTA stands for Mail Transfer Agent. A host sends the message to an MTA. The message then follows a sequence of MTAs to reach the receiver’s mail reader. We see that this spam message follows a chain of MTAs. An honest MTA should report where it receives the message. Notice that in this message, “asusus-4b96 ([58.88.21.177])” does not report from where it received the email. Since we assume only the originator is dishonest, so “asusus-4b96 ([58.88.21.177])” must be the originator. Problem 16 UIDL abbreviates “unique-ID listing”. When a POP3 client issues the UIDL command, the server responds with the unique message ID for all of the messages present in the user's mailbox. This command is useful for “download and keep”. By maintaining a file that lists the messages retrieved during earlier sessions, the client can use the UIDL command to determine which messages on the server have already been seen. Problem 17 a) C: dele 1 C: retr 2 S: (blah blah … S: ………..blah) S: . C: dele 2 C: quit S: +OK POP3 server signing off b) C: retr 2 S: blah blah … S: ………..blah S: . C: quit S: +OK POP3 server signing off C: list S: 1 498 S: 2 912 S: . C: retr 1 S: blah ….. S: ….blah S: . C: retr 2 S: blah blah … S: ………..blah S: . C: quit S: +OK POP3 server signing off Problem 18 For a given input of domain name (such as ccn.com), IP address or network administrator name, the whois database can be used to locate the corresponding registrar, whois server, DNS server, and so on. NS4.YAHOO.COM from www.register.com; NS1.MSFT.NET from ww.register.com Local Domain: www.mindspring.com Web servers : www.mindspring.com 207.69.189.21, 207.69.189.22, 207.69.189.23, 207.69.189.24, 207.69.189.25, 207.69.189.26, 207.69.189.27, 207.69.189.28 Mail Servers : mx1.mindspring.com (207.69.189.217) mx2.mindspring.com (207.69.189.218) mx3.mindspring.com (207.69.189.219) mx4.mindspring.com (207.69.189.220) Name Servers: itchy.earthlink.net (207.69.188.196) scratchy.earthlink.net (207.69.188.197) www.yahoo.com Web Servers: www.yahoo.com (216.109.112.135, 66.94.234.13) Mail Servers: a.mx.mail.yahoo.com (209.191.118.103) b.mx.mail.yahoo.com (66.196.97.250) c.mx.mail.yahoo.com (68.142.237.182, 216.39.53.3) d.mx.mail.yahoo.com (216.39.53.2) e.mx.mail.yahoo.com (216.39.53.1) f.mx.mail.yahoo.com (209.191.88.247, 68.142.202.247) g.mx.mail.yahoo.com (209.191.88.239, 206.190.53.191) Name Servers: ns1.yahoo.com (66.218.71.63) ns2.yahoo.com (68.142.255.16) ns3.yahoo.com (217.12.4.104) ns4.yahoo.com (68.142.196.63) ns5.yahoo.com (216.109.116.17) ns8.yahoo.com (202.165.104.22) ns9.yahoo.com (202.160.176.146) www.hotmail.com Web Servers: www.hotmail.com (64.4.33.7, 64.4.32.7) Mail Servers: mx1.hotmail.com (65.54.245.8, 65.54.244.8, 65.54.244.136) mx2.hotmail.com (65.54.244.40, 65.54.244.168, 65.54.245.40) mx3.hotmail.com (65.54.244.72, 65.54.244.200, 65.54.245.72) mx4.hotmail.com (65.54.244.232, 65.54.245.104, 65.54.244.104) Name Servers: ns1.msft.net (207.68.160.190) ns2.msft.net (65.54.240.126) ns3.msft.net (213.199.161.77) ns4.msft.net (207.46.66.126) ns5.msft.net (65.55.238.126) d) The yahoo web server has multiple IP addresses www.yahoo.com (216.109.112.135, 66.94.234.13) e) The address range for Polytechnic University: 128.238.0.0 – 128.238.255.255 f) An attacker can use the whois database and nslookup tool to determine the IP address ranges, DNS server addresses, etc., for the target institution. By analyzing the source address of attack packets, the victim can use whois to obtain information about domain from which the attack is coming and possibly inform the administrators of the origin domain. Problem 19 The following delegation chain is used for gaia.cs.umass.edu a.root-servers.net E.GTLD-SERVERS.NET ns1.umass.edu(authoritative) First command: dig +norecurse @a.root-servers.net any gaia.cs.umass.edu ;; AUTHORITY SECTION: edu. 172800 IN NS E.GTLD-SERVERS.NET. edu. 172800 IN NS A.GTLD-SERVERS.NET. edu. 172800 IN NS G3.NSTLD.COM. edu. 172800 IN NS D.GTLD-SERVERS.NET. edu. 172800 IN NS H3.NSTLD.COM. edu. 172800 IN NS L3.NSTLD.COM. edu. 172800 IN NS M3.NSTLD.COM. edu. 172800 IN NS C.GTLD-SERVERS.NET. Among all returned edu DNS servers, we send a query to the first one. dig +norecurse @E.GTLD-SERVERS.NET any gaia.cs.umass.edu umass.edu. 172800 IN NS ns1.umass.edu. umass.edu. 172800 IN NS ns2.umass.edu. umass.edu. 172800 IN NS ns3.umass.edu. Among all three returned authoritative DNS servers, we send a query to the first one. dig +norecurse @ns1.umass.edu any gaia.cs.umass.edu gaia.cs.umass.edu. 21600 IN A 128.119.245.12 The answer for google.com could be: a.root-servers.net E.GTLD-SERVERS.NET ns1.google.com(authoritative) Problem 20 We can periodically take a snapshot of the DNS caches in the local DNS servers. The Web server that appears most frequently in the DNS caches is the most popular server. This is because if more users are interested in a Web server, then DNS requests for that server are more frequently sent by users. Thus, that Web server will appear in the DNS caches more frequently. For a complete measurement study, see: Craig E. Wills, Mikhail Mikhailov, Hao Shang “Inferring Relative Popularity of Internet Applications by Actively Querying DNS Caches”, in IMC'03, October 27­29, 2003, Miami Beach, Florida, USA Problem 21 Yes, we can use dig to query that Web site in the local DNS server. For example, “dig cnn.com” will return the query time for finding cnn.com. If cnn.com was just accessed a couple of seconds ago, an entry for cnn.com is cached in the local DNS cache, so the query time is 0 msec. Otherwise, the query time is large. Problem 22 For calculating the minimum distribution time for client-server distribution, we use the following formula: Dcs = max {NF/us, F/dmin} Similarly, for calculating the minimum distribution time for P2P distribution, we use the following formula: Where, F = 15 Gbits = 15 * 1024 Mbits us = 30 Mbps dmin = di = 2 Mbps Note, 300Kbps = 300/1024 Mbps. Client Server N 10 100 1000 u 300 Kbps 7680 51200 512000 700 Kbps 7680 51200 512000 2 Mbps 7680 51200 512000 Peer to Peer N 10 100 1000 u 300 Kbps 7680 25904 47559 700 Kbps 7680 15616 21525 2 Mbps 7680 7680 7680 Problem 23 Consider a distribution scheme in which the server sends the file to each client, in parallel, at a rate of a rate of us/N. Note that this rate is less than each of the client’s download rate, since by assumption us/N ≤ dmin. Thus each client can also receive at rate us/N. Since each client receives at rate us/N, the time for each client to receive the entire file is F/( us/N) = NF/ us. Since all the clients receive the file in NF/ us, the overall distribution time is also NF/ us. Consider a distribution scheme in which the server sends the file to each client, in parallel, at a rate of dmin. Note that the aggregate rate, N dmin, is less than the server’s link rate us, since by assumption us/N ≥ dmin. Since each client receives at rate dmin, the time for each client to receive the entire file is F/ dmin. Since all the clients receive the file in this time, the overall distribution time is also F/ dmin. From Section 2.6 we know that DCS ≥ max {NF/us, F/dmin} (Equation 1) Suppose that us/N ≤ dmin. Then from Equation 1 we have DCS ≥ NF/us . But from (a) we have DCS ≤ NF/us . Combining these two gives: DCS = NF/us when us/N ≤ dmin. (Equation 2) We can similarly show that: DCS =F/dmin when us/N ≥ dmin (Equation 3). Combining Equation 2 and Equation 3 gives the desired result. Problem 24 Define u = u1 + u2 + ….. + uN. By assumption us <= (us + u)/N Equation 1 Divide the file into N parts, with the ith part having size (ui/u)F. The server transmits the ith part to peer i at rate ri = (ui/u)us. Note that r1 + r2 + ….. + rN = us, so that the aggregate server rate does not exceed the link rate of the server. Also have each peer i forward the bits it receives to each of the N-1 peers at rate ri. The aggregate forwarding rate by peer i is (N-1)ri. We have (N-1)ri = (N-1)(usui)/u = (us + u)/N Equation 2 Let ri = ui/(N-1) and rN+1 = (us – u/(N-1))/N In this distribution scheme, the file is broken into N+1 parts. The server sends bits from the ith part to the ith peer (i = 1, …., N) at rate ri. Each peer i forwards the bits arriving at rate ri to each of the other N-1 peers. Additionally, the server sends bits from the (N+1) st part at rate rN+1 to each of the N peers. The peers do not forward the bits from the (N+1)st part. The aggregate send rate of the server is r1+ …. + rN + N rN+1 = u/(N-1) + us – u/(N-1) = us Thus, the server’s send rate does not exceed its link rate. The aggregate send rate of peer i is (N-1)ri = ui Thus, each peer’s send rate does not exceed its link rate. In this distribution scheme, peer i receives bits at an aggregate rate of Thus each peer receives the file in NF/(us+u). (For simplicity, we neglected to specify the size of the file part for i = 1, …., N+1. We now provide that here. Let Δ = (us+u)/N be the distribution time. For i = 1, …, N, the ith file part is Fi = ri Δ bits. The (N+1)st file part is FN+1 = rN+1 Δ bits. It is straightforward to show that F1+ ….. + FN+1 = F.) The solution to this part is similar to that of 17 (c). We know from section 2.6 that Combining this with a) and b) gives the desired result. Problem 25 There are N nodes in the overlay network. There are N(N-1)/2 edges. Problem 26 Yes. His first claim is possible, as long as there are enough peers staying in the swarm for a long enough time. Bob can always receive data through optimistic unchoking by other peers. His second claim is also true. He can run a client on each host, let each client “free-ride,” and combine the collected chunks from the different hosts into a single file. He can even write a small scheduling program to make the different hosts ask for different chunks of the file. This is actually a kind of Sybil attack in P2P networks. Problem 27 Peer 3 learns that peer 5 has just left the system, so Peer 3 asks its first successor (Peer 4) for the identifier of its immediate successor (peer 8). Peer 3 will then make peer 8 its second successor. Problem 28 Peer 6 would first send peer 15 a message, saying “what will be peer 6’s predecessor and successor?” This message gets forwarded through the DHT until it reaches peer 5, who realizes that it will be 6’s predecessor and that its current successor, peer 8, will become 6’s successor. Next, peer 5 sends this predecessor and successor information back to 6. Peer 6 can now join the DHT by making peer 8 its successor and by notifying peer 5 that it should change its immediate successor to 6. Problem 29 For each key, we first calculate the distances (using d(k,p)) between itself and all peers, and then store the key in the peer that is closest to the key (that is, with smallest distance value). Problem 30 Yes, randomly assigning keys to peers does not consider the underlying network at all, so it very likely causes mismatches. Such mismatches may degrade the search performance. For example, consider a logical path p1 (consisting of only two logical links): ABC, where A and B are neighboring peers, and B and C are neighboring peers. Suppose that there is another logical path p2 from A to C (consisting of 3 logical links): ADEC. It might be the case that A and B are very far away physically (and separated by many routers), and B and C are very far away physically (and separated by many routers). But it may be the case that A, D, E, and C are all very close physically (and all separated by few routers). In other words, a shorter logical path may correspond to a much longer physical path. Problem 31 If you run TCPClient first, then the client will attempt to make a TCP connection with a non-existent server process. A TCP connection will not be made. UDPClient doesn't establish a TCP connection with the server. Thus, everything should work fine if you first run UDPClient, then run UDPServer, and then type some input into the keyboard. If you use different port numbers, then the client will attempt to establish a TCP connection with the wrong process or a non-existent process. Errors will occur. Problem 32 In the original program, UDPClient does not specify a port number when it creates the socket. In this case, the code lets the underlying operating system choose a port number. With the additional line, when UDPClient is executed, a UDP socket is created with port number 5432 . UDPServer needs to know the client port number so that it can send packets back to the correct client socket. Glancing at UDPServer, we see that the client port number is not “hard-wired” into the server code; instead, UDPServer determines the client port number by unraveling the datagram it receives from the client. Thus UDP server will work with any client port number, including 5432. UDPServer therefore does not need to be modified. Before: Client socket = x (chosen by OS) Server socket = 9876 After: Client socket = 5432 Problem 33 Yes, you can configure many browsers to open multiple simultaneous connections to a Web site. The advantage is that you will you potentially download the file faster. The disadvantage is that you may be hogging the bandwidth, thereby significantly slowing down the downloads of other users who are sharing the same physical links. Problem 34 For an application such as remote login (telnet and ssh), a byte-stream oriented protocol is very natural since there is no notion of message boundaries in the application. When a user types a character, we simply drop the character into the TCP connection. In other applications, we may be sending a series of messages that have inherent boundaries between them. For example, when one SMTP mail server sends another SMTP mail server several email messages back to back. Since TCP does not have a mechanism to indicate the boundaries, the application must add the indications itself, so that receiving side of the application can distinguish one message from the next. If each message were instead put into a distinct UDP segment, the receiving end would be able to distinguish the various messages without any indications added by the sending side of the application. Problem 35 To create a web server, we need to run web server software on a host. Many vendors sell web server software. However, the most popular web server software today is Apache, which is open source and free. Over the years it has been highly optimized by the open-source community. Problem 36 The key is the infohash, the value is an IP address that currently has the file designated by the infohash.   Chapter 3 Review Questions Call this protocol Simple Transport Protocol (STP). At the sender side, STP accepts from the sending process a chunk of data not exceeding 1196 bytes, a destination host address, and a destination port number. STP adds a four-byte header to each chunk and puts the port number of the destination process in this header. STP then gives the destination host address and the resulting segment to the network layer. The network layer delivers the segment to STP at the destination host. STP then examines the port number in the segment, extracts the data from the segment, and passes the data to the process identified by the port number. The segment now has two header fields: a source port field and destination port field. At the sender side, STP accepts a chunk of data not exceeding 1192 bytes, a destination host address, a source port number, and a destination port number. STP creates a segment which contains the application data, source port number, and destination port number. It then gives the segment and the destination host address to the network layer. After receiving the segment, STP at the receiving host gives the application process the application data and the source port number. No, the transport layer does not have to do anything in the core; the transport layer “lives” in the end systems. For sending a letter, the family member is required to give the delegate the letter itself, the address of the destination house, and the name of the recipient. The delegate clearly writes the recipient’s name on the top of the letter. The delegate then puts the letter in an envelope and writes the address of the destination house on the envelope. The delegate then gives the letter to the planet’s mail service. At the receiving side, the delegate receives the letter from the mail service, takes the letter out of the envelope, and takes note of the recipient name written at the top of the letter. The delegate then gives the letter to the family member with this name. No, the mail service does not have to open the envelope; it only examines the address on the envelope. Source port number y and destination port number x. An application developer may not want its application to use TCP’s congestion control, which can throttle the application’s sending rate at times of congestion. Often, designers of IP telephony and IP videoconference applications choose to run their applications over UDP because they want to avoid TCP’s congestion control. Also, some applications do not need the reliable data transfer provided by TCP. Since most firewalls are configured to block UDP traffic, using TCP for video and voice traffic lets the traffic though the firewalls. Yes. The application developer can put reliable data transfer into the application layer protocol. This would require a significant amount of work and debugging, however. Yes, both segments will be directed to the same socket. For each received segment, at the socket interface, the operating system will provide the process with the IP addresses to determine the origins of the individual segments. For each persistent connection, the Web server creates a separate “connection socket”. Each connection socket is identified with a four-tuple: (source IP address, source port number, destination IP address, destination port number). When host C receives and IP datagram, it examines these four fields in the datagram/segment to determine to which socket it should pass the payload of the TCP segment. Thus, the requests from A and B pass through different sockets. The identifier for both of these sockets has 80 for the destination port; however, the identifiers for these sockets have different values for source IP addresses. Unlike UDP, when the transport layer passes a TCP segment’s payload to the application process, it does not specify the source IP address, as this is implicitly specified by the socket identifier. Sequence numbers are required for a receiver to find out whether an arriving packet contains new data or is a retransmission. To handle losses in the channel. If the ACK for a transmitted packet is not received within the duration of the timer for the packet, the packet (or its ACK or NACK) is assumed to have been lost. Hence, the packet is retransmitted. A timer would still be necessary in the protocol rdt 3.0. If the round trip time is known then the only advantage will be that, the sender knows for sure that either the packet or the ACK (or NACK) for the packet has been lost, as compared to the real scenario, where the ACK (or NACK) might still be on the way to the sender, after the timer expires. However, to detect the loss, for each packet, a timer of constant duration will still be necessary at the sender. The packet loss caused a time out after which all the five packets were retransmitted. Loss of an ACK didn’t trigger any retransmission as Go-Back-N uses cumulative acknowledgements. The sender was unable to send sixth packet as the send window size is fixed to 5. When the packet was lost, the received four packets were buffered the receiver. After the timeout, sender retransmitted the lost packet and receiver delivered the buffered packets to application in correct order. Duplicate ACK was sent by the receiver for the lost ACK. The sender was unable to send sixth packet as the send win
教材名称:《计算机网络技术》(第六版) 主  编: 出时间:2017年8月 适用专业:计算机专业及各类工科高职网络基础课程教学 建议学时:48~64学时 一、编写说明 (一)本课程的性质和任务 性质:《计算机网络技术》是计算机类专业(专科)的一门职业技术基础课程。计算 机网络技术是信息系统的平台,因此必须掌握计算机网络的基础理论和基本知识。 任务:通过学习,使学生掌握计算机网络的工作原理,理解计算机网络的一系列标 准和协议,了解计算机网络的新技术,为计算机网络的应用和信息系统的建设打下坚实 的基础。 (二)课程教学的基本要求 通过本课程的学习,要求学生达到如下几点: 1.理解计算机网络的概念、功能、组成与分类。 2.理解数据通信的概念及其组成,理解数据编码、解码的多路复用技术、数据交换 技术等网络基本念,了解常用传输介质。 3.理解网络体系结构的概念,理解OSI和TCP/IP参考模型。 4.掌握应用层HTTP、SMTP、DNS、FTP等协议的原理和过程。 5.掌握广域网络的概念以及PSTN、DDN、X25.ISDN、帧中继等技术。 6.了解传输层UDP、TCP协议。 7.了解和掌握层次性网络概念、IP协议、ICMP协议。 8.掌握局域网的概念,掌握多路访问控制协议、ARP协议以及集线器、路由器、网 桥等网络互连设备。 9.了解网络管理的相关知识,了解VPN、防火墙等计算机网络安全知识。 (三)建议实践环节 "名 称 "实践类型"目的要求 "学时" "双绞线的制作 "实验 "掌握双绞线的制作方法 "2 " "交换机和集线器的级联 "实验 "掌握交换机和集线器的级联方 "2 " " " "法 " " "计算机对等网的组建 "实验 "掌握对等网的组建方法 "2 " "以太网组网 "实验 "掌握以太网组网的方法 "2 " "子网划分 "实验 "掌握子网划分的方法 "2 " "ARP、Ping、Tracert命令 "实验 "掌握常用的网络命令 "2 " "的使用 " " " " "DNS服务器的设置 "实验 "掌握DNS服务器的设置 "2 " "域名搜索 "实验 "掌握域名搜索的方法 "2 " "合计 "16 " (四)本课程与其他课程的关系 1.先修课程: 《计算机应用基础》、《程序设计基础》。 2.后续课程: 《交换机与路由器配置》、《网络信息安全》等 (五)建议教学时数分配表 "章节 " "课堂"讨论"实验"其它"课程"小计" "序号 " "讲授" " " "设计" " "一 "计算机网络基础概述 "4 " " " " " " "二 "数据通信基础 "4 " " " " " " "三 "网络体系结构 "4 " " " " " " "四 "TCP/IP协议 "8-10" " " " " " "五 "局域网 "4 " " " " " " "六 "网络互连技术 "2 " " " " " " "七 "Internet应用技术 "2 " " " " " " "八 "网络管理与安全 "2 " " " " " " "九 "移动互联网技术 "2 " " " " " " "十 "广域网技术 "2 " " " " " " "总计 " " " " " " " (六)考核方式与要求 1.《计算机网络技术》课程是考查课。 2.考试形式:闭卷。 3.成绩的计算方法: 平时成绩:20% 实验成绩:20% 试卷成绩:60% 课程综合成绩:平时成绩×20% + 实验成绩×20% + 试卷成绩×60% (七)教材与主要参考书 1. 教材 《计算机网络技术》(第六版),边倩,鞠光明,陈晓范,大连理工大学出社,2 017.8。 配套实训教程:《计算机网络技术》(实训篇)(第五),王新风,大连理工大学 出社,2013.9。 2.主要参考书 《计算机网络》(第四) 吴功宜,清华大学出社,2017.4。 《计算机网络》(第六版)[美] Keith W.Ross,机械工业出社,2014。 二、课程各章教学内容纲要 第一章 计算机网络概述 1.教学基本要求 (1)了解计算机网络的产生和发展、理解计算机网络的基本概念、功能。 (2)明确计算机网络的组成,理解通信子网与资源子网的构成、功能。 (3)了解计算机网络的分类、应用。 (4)掌握计算机网络的各种拓扑结构特点 2.具体教学内容 (1)计算机网络的形成、结构与发展。 (2)计算机网络的功能及应用。 (3)计算机网络的组成。 (4)计算机网络的分类。 (5)计算机网络的拓扑结构。 (6)计算机网络的传输介质。 第二章 数据通信基础 1.教学基本要求 (1)熟练掌握 数据通信系统模型;数据通信的基本概念;数据通信的方式。 (2)掌握数据传输技术、多路复用技术的原理。 2.具体教学内容 (1)数据通信系统模型。 (2)数

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 3
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

Meow_Sir

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值