TCP Dup ACK and Selective Acknowledgement

• Duplicate ACKs occur when some data from a group of packets was lost
• Receiver will send again ACKs for those group of data to tell sender what part is lost
• The ACKs that were already received by sender previously are the duplicate ACKs
• The ACKs that will be missing from this group of ACKs will be the indicator on what packet is missing
• Several dup ACKs may be an indicator of packet loss
• Further Reading:
  • What Causes Network Packet Loss?
  • How TCP Works - Selective Acknowledgment (SACK)

OSI Layer

Overview

Layer 7 - Application

• HTTP, FTP, ..

Layer 6 - Presentation

• jpg, mpg

Layer 5 - Session

• NetBIOS

Layer 4 - Transport

• TCP/UDP
• Ports
• Segmentation (breaks large files into smaller segments)
• Segments
• Flow control - ensures that receiving host can handle the transfer (prevents overwhelming the receiver)
• Session multiplexing
• Stateful firewalls - return traffic is allowed by keeping track of src and dst ports on client end

• 3-way handshake
• TCP header

• UDP header

Layer 3 - Network

• IP addressing, logical addressing
• Routers
• Packets
• IP Header

• Maximum Transmission Unit (MTU)
  • Max packet size
  • Default: 1500 byte
  • Packets larger than MTU will be splitted into parts (fragments)
• Time to Live (TTL)
  • Lifetime of a packet
  • Every time a packet passes on a router, the router decrements this by 1
  • Prevents routing loop (e.g on broken network)
  • Once the TTL reaches 0, the router will discard/drop the packet and send back time exceeded message to original sender
• 8-bit Protocol - layer 4 information (TCP or UDP)
• Quality of Service (QoS)
• Connectionless protocol
• Example protocols: ICMP and IPSec

Layer 2 - Data Link

• MAC address
  • 48-bit hexadecimal address
  • first 24 bits - OUI (Organizationally Unique Identifier)
  • last 24 bits - vendor assigned
  • 248 = 281,474,976,710,656 MACs
• Switches
• Frames
• Error detection (e.g CRC)
• Ethernet Header

• Preamble - for synchronization between source and destination
• FCS - frame sequence (for data integrity and error checking)
• In wireshark, the length column is the frame length (may not include FCS and Preamble)

Layer 1 - Physical Layer

• Cables
• Hubs
• Voltage levels, max transmission distance
• Straight-Through cable - connects end device (e.g PC, laptop) to a switch
• Crossover cable - connects devices of same type (e.g PC to PC)

• Fiber cables - supports longer distances and higher bandwidth
  • Single mode vs Multi mode
• Power over Ethernet (POE) - e.g IP Phones

• Others:
  • Cat5 - up to 100 Mbps
  • Cat5e - up to 1000 Mbps

Cisco Device Management

Backing up and Restoring IOS

----------------------------

Basic parts:

  Flash

    - stores IOS (around 29 MB)

    - slow

    - is copied to RAM when device boots

  RAM

    - holds running config and IOS

    - fast but volatile

 

  NVRAM

    - available on some devices to hold running config

    - fast and non-volatile

Where to put back ups?

  HTTP - web server

  FTP - old way; requires username and password

  TFTP - uses UDP; don't require username and password

Configuration Registers

-----------------------

Determines how device boots up

2100 (rommon)	device will boot here if it can't detect an IOS
2101 (rxboot)	limited version of IOS
2012	normal boot
2142	ignore/bypass NVRAM

How Cisco devices boot

----------------------

1. checks config register

2. checks for `boot system` command in startup config

3. looks for first IOS image in flash

4. broadcast for a tftp server

Commands

--------

key command	copy ?
general syntax of `copy`	copy FROM TO
copies flash to TFTP server	copy flash: tftp://192.168.1.100/
same as above but uses prompt	copy flash tftp
prints flash information	show flash
restoring	copy TFTP flash
copies running config	copy running-config DESTINATION
displays configuration register	show version

Some notes:

  - don't restore running config because it will just merge it to the present

  - e.g: copy tftp running-config

  - proper way is to restore running config from offsite box to startup config

  - e.g: copy tftp start-up config

Tutorials

---------

recovering enable password

1. Boot into rommon   -> connect to device via console   -> power off device via physical switch   -> power on device   -> hit CTRL+BREAK 2. Change config register to bypass NVRAM rommon 1 > confreg 0x2142 rommon 2 > reset 3. Copy the startup config to the running config and change    enable password Router> enable Router# copy startup-config running-config Router# conf t Router(conf)# enable secret newpassword Router(conf)# exit Router# copy run start