Digital Router Interview Preparation Guide

The progressive weakening of a signal as it travels over a cable or other medium. The longer the distance a signal travels, the weaker the signal gets, until it becomes unreadable by the receiving system

☛ Defines the process for connecting two layers, promoting interoperability between vendors.
☛ Separates a complex function into simpler components.
☛ Allows vendors to compartmentalize their design efforts to fit a modular design, which eases implementations and simplifies troubleshooting

At first glance it may be difficult to judge the difference between a hub and a switch since both look roughly the same. They both have a large number of potential connections and are used for the same basic purpose- to create a network. However the biggest difference is not on the outside, but on the inside in the way that they handle connections. In the case of a hub, it broadcasts all data to every port. This can make for serious security and reliability concerns, as well as cause a number of collisions to occur on the network. Old style hubs and present-day wireless access points use this technique. Switches on the other hand create connections dynamically, so that usually only the requesting port can receive the information destined for it. An exception to this rule is that if the switch has its maintenance port turned on for an NIDS implementation, it may copy all data going across the switch to a particular port in order to scan it for problems. The easiest way to make sense of it all is by thinking about it in the case of old style phone connections. A hub would be a 'party line' where everybody is talking all at the same time. It is possible to transmit on such a system, but it can be very hectic and potentially release information to people that you don't want to have access to it. A switch on the other hand is like a phone operator- creating connections between ports on an as-needed basis.

The twin to TCP is UDP- User Datagram Protocol. Where TCP has a lot of additional under-the-hood features to make sure that everybody stays on the same page, UDP can broadcast 'into the dark'- not really caring if somebody on the other end is listening (and thus is often called a 'connectionless' protocol). As a result, the extra heavy lifting that TCP needs to do in order to create and maintain its connection isn't required so UDP oftentimes has a faster transmission speed than TCP. An easy way to picture the differences between these two protocols is like this: TCP is like a CB radio, the person transmitting is always waiting for confirmation from the person on the other end that they received the message. UDP on the other hand is like a standard television broadcast signal. The transmitter doesn't know or care about the person on the other end, all it does care about is that its signal is going out correctly. UDP is used primarily for 'small' bursts of information such as DNS requests where speed matters above nearly everything else. The above listing for TCP also contains counterparts for UDP, so it can be used as a reference for both.

Although you may never have heard of this program, but if you have ever dealt with Apple devices you've seen its effects. Bonjour is one of the programs that come bundled with nearly every piece of Apple software (most notably iTunes) that handles a lot of its automatic discovery techniques. Best described as a hybrid of IPX and DNS, Bonjour discovers broadcasting objects on the network by using mDNS (multicast DNS) with little to no configuration required. Many admins will deliberately disable this service in a corporate environment due to potential security issues, however in a home environment it can be left up to the user to decide if the risk is worth the convenience.

A subnet mask tells the network how big it is. When an address is inside the mask, it will be handled internally as a part of the local network. When it is outside, it will be handled differently as it is not part of the local network. The proper use and calculation of a subnet mask can be a great benefit when designing a network as well as for gauging future growth.

An IDS is an Intrusion Detection System with two basic variations: Host Intrusion Detection Systems and Network Intrusion Detection Systems. An HIDS runs as a background utility in the same as an anti-virus program for instance, while a Network Intrusion Detection System sniffs packets as they go across the network looking for things that aren't quite ordinary. Both systems have two basic variants- signature based and anomaly based. Signature based is very much like an anti-virus system, looking for known values of known 'bad things' while anomaly looks more for network traffic that doesn't fit the usual pattern of the network. This requires a bit more time to get a good baseline, but in the long term can be better on the uptake for custom attacks.

Also known as the program that can give your admin nightmares, telnet is a very small and versatile utility that allows for connections on nearly any port. Telnet would allow the admin to connect into remote devices and administer them via a command prompt. In many cases this has been replaced by SSH, as telnet transmits its data in cleartext (like ftp). Telnet can and does however get used in cases where the user is trying to see if a program is listening on a particular port, but they want to keep a low profile or if the connection type pre-dates standard network connectivity methods.

Shadow copies are a versioning system in place on Windows operating systems. This allows for users to go back to a previously available version of a file without the need for restoring the file from a standard backup- although the specific features of shadow copies vary from version to version of the OS. While it is not necessary to use a backup function in conjunction with Shadow Copies, it is recommended due to the additional stability and reliability it provides. Please note- Shadow Copies are not Delta Files. Delta files allow for easy comparison between versions of files, while Shadow Copies store entire previous versions of the files.

/etc/passwd is the primary file in Unix/Linux operating system that stores information about user accounts and can be read by all users. /etc/shadow many times is used by the operating system instead due to security concerns and increased hashing capabilities. /etc/shadow more often than not is highly restricted to privileged users.