Happy Monday! I hope every one had a wonderful weekend and is super excited about Monday! I know I am! I’m ready to listen to people and learn today. Maybe say a few things myself but unlikely as you can tell my platform for expressing my self isn’t exactly popular haha. Any way, lets get into the usual stuff.

So I’m starting to get this whole cabling thing but if you don’t know any thing about it, its gets a little confusing. Much like encryption types on the Security+ which I started studying for and decided to do this one first. Really I could have gone for the A+ too but I wasn’t really sure it was worth the money to be honest. Anyway lets take a look at the distance ratings for these cables.

• Cat 5e – The maximum length you can run Cat5, Cat5e, Cat6 and Cat6a cable is 100 meters or 328 feet
• Cat 6e – unclear based on google results but it does appear to be 328 feet
• Multimode – Typical transmission speed and distance limits are 100 Mbit/s for distances up to 2 km (100BASE-FX), 1 Gbit/s up to 1000 m, and 10 Gbit/s up to 550 m
• Coaxial – Using coaxial cable increases this distance to 500m (1640.4 feet)

I mean, you could use coax according this but we can go with multimode fiber.

This one is a little more confusing to me. I also cant prove that the 4 port hub is one domain and that 12+2+1=14 somehow. I guess maybe we don’t count the hub? That’s the most logical explanation but I’m still not sure.

I think all i need to do is define docsis: Data Over Cable Service Interface Specification, or DOCSIS. Ok, easy.

This is a list question.

• MDF – Short for main distribution frame, a cable rack that interconnects and manages the telecommunications wiring between itself and any number of IDFs. Unlike an IDF, which connects internal lines to the MDF, the MDF connects private or public lines coming into a building with the internal network
• MT-RJ – MT-RJ stands for Mechanical Transfer Registered Jack. MT-RJ is a fiber-optic Cable Connector that is very popular for small form factor devices due to its small size. Housing two fibers and mating together with locating pins on the plug, the MT-RJ comes from the MT connector, which can contain up to 12 fibers.
• BNC – coax connector
• GBIC – A gigabit interface converter (GBIC) is a transceiver that converts electric currents (digital highs and lows) to optical signals, and optical signals to digital electric currents. The GBIC is typically employed in fiber optic and Ethernet systems as an interface for high-speed networking.
• F-type – BNC (Bayonet Neill-Concelman) RF connectors make it easy to connect coaxial cables with radio-frequency equipment like radios and TVs, composite video on commercial video devices, and ethernet networks. … And they come in handy when you need to combine them with, say, an RCA connector on the end of the coaxial cable

Ok, that makes sense with the assumption that GBIC is super fast.

Honestly, I’m not sure why cat6 is needed but ok. However, so that we are aware: Plenum rated cable has a special insulation that has low smoke and low flame characteristics. Plenum cable is mandated to be installed in any “air handling” space. For example, most large office buildings use the ceiling to return air to the AC unit.

That’s all for tonight! Fairly simple stuff.

Blogging, its a ton of fun. I mean, if I’m being honest, I rather enjoy it and I feel like I learn a lot. It can be taxing on me to simply go through and memorize answers plus I actually learn the material like this and anyone that looks at this blog realizes exactly how much effort it takes to really learn the material for obtaining certs. I’m critical of test content at times but all in all I really enjoy acquiring them. I mean, like its one of my favorite things. Why? I honestly enjoy working my brain to solve puzzles.

Im aware of what NGFW is, sort of, im not exactly sure what makes it ‘Next Generation’ but I have my theory and im sticking with it. No I wont stand for any of your technical jargon:

So this may take some research. I have no idea if they mean internally or externally but wouldnt some sort of logging need to be turned on regardless? Like SIEM logging? Which is separate from the NGFW?

In addition to be clear lets talk about the VPN concentrator and the IDS/IPS, assume everyone knows what a proxy server is

• VPN Concentrator – type of networking device that provides secure creation of VPN connections and delivery of messages between VPN nodes. It is a type of router device, built specifically for creating and managing VPN communication infrastructures.
• NGFW
• IDS/IPS – Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are both parts of the network infrastructure. … IDS systems compare the current network activity to a known threat database to detect several kinds of behaviors like security policy violations, malware, and port scanners

Without further specificity on ‘internet applications’ im getting that a WAF is more appropriate in this scenario but I could be wrong. Or the question is old.

I have no idea what this is getting at so lets look for a definition of BGP. Hybrid is mentioned no where, I guess I’ll just go with it.

I’m not 100% on this stuff, so lets cover it again!

• Spanning tree – The Spanning Tree Protocol (STP) is a network protocol that builds a loop-free logical topology for Ethernet networks. The basic function of STP is to prevent bridge loops and the broadcast radiation that results from them.
• Clustering – A computer cluster consists of a set of loosely or tightly connected computers that work together so that, in many aspects, they can be viewed as a single system. Unlike grid computers, computer clusters have each node set to perform the same tasks, which are controlled and scheduled by software. Weird. Like a lan party?
• Port aggregation – Port aggregation lets you combine two Gigabit Ethernet ports on the Nighthawk router to improve the aggregated file transfer speed. If a device supports Ethernet aggregation like a NAS or managed network switch, you can use the Ethernet aggregate ports 1 and 2 to cable the device to your router.

You know, I’m sure there is some truth to this but I’m betting its hard to prove. Or maybe not

I would say we should investigate the others but ports feel a bit overwhelming at the moment to be honest, so lets not.

Highly confused, lets start with VLSM Variable-Length Subnet Masking (VLSM) amounts to “subnetting subnets,” which means that VLSM allows network engineers to divide an IP address space into a hierarchy of subnets of different sizes, making it possible to create subnets with very different host counts without wasting large numbers of addresses.

• OSPF – Variable-Length Subnet Masking (VLSM) amounts to “subnetting subnets,” which means that VLSM allows network engineers to divide an IP address space into a hierarchy of subnets of different sizes, making it possible to create subnets with very different host counts without wasting large numbers of addresses.
• IS-IS – OSPF supports virtual link, whereas IS-IS does not support. OSPF elects a DR and BDR, whereas IS-IS elects only a single DR called DIS. OSPF defines a backbone area called area 0 for inter-area advertisements, whereas IS-IS categorizes the domain into two layers
• RIPv1 – RIPv1 is a classful protocol. RIP supports up to six equal-cost paths to a single destination. Equal-cost path are the paths where the metric is same (Hop count).
• BGP – (previously explained
• VRRP – a computer networking protocol that provides for automatic assignment of available Internet Protocol (IP) routers to participating hosts. This increases the availability and reliability of routing paths via automatic default gateway selections on an IP subnetwork.

This is complicated by the fact that it seems like you could use one or the other and the idea of using them together isn’t exactly clear.

Had some kind of tough ones tonight. Any way, I’m getting a little sleepy and I think its bed time!

I feel like this is going pretty good. I didn’t get to look at any questions last night but we did do this cross fit type of work out at the gym and like I was absolutely dead. I’m really enjoying this whole feeling sore thing and seeing results. Its great fun and is doing wonders for dad bod. I mean, I guess it didn’t really work out for me and you know, at some point id like to look and feel healthy while fitting into skinny jeans. Which I suppose is possible. You forgot that I also used this as a personal diary didn’t you? Have you seen the new Bill Gates doc? I haven’t either but I might watch it tonight. Also, my trainer keeps saying things like so uha what are you doing this weekend and like “I’m not doing anything” “I really like working out with you,” is she trying to get me to ask her out? Unclear at this time but I cant say I’m not prepared for a personal relationship like that. lol, who knows, maybe. But like gah, im so damn busy.

You know that part where I’m all “I don’t know what these answers are so I should make list” and herereere we goooo:

• OTDR – Optical Time Domain Reflectometer, an instrument that analyzes the light loss in an optical fiber in optical network trouble shooting. An OTDR injects a short, intense laser pulse into the optical fiber and measures the backscatter and reflection of light as a function of time.
• Light meter – optical power meter (OPM) is a device used measure the power in an optical signal
• Tone generator – Networks tone generator to apply a tone signal to a wire pair or single conductor, and trace with an amplifier probe. When used with the amplifier probe, the tone generator allows technicians to identify a wire within a bundle, at a cross connect or at a remote end.
• CSU/DSU – A CSU/DSU (channel service unit/data service unit) is a digital-interface device used to connect data terminal equipment (DTE), such as a router, to a digital circuit, such as a Digital Signal 1 (DS1) T1 line.

Given this information the light meter still seems plausible but its only measuring power and it says the levels are within range which leaves me questioning what exactly light loss is if its not related to the power of the signal. Assuming I’ll understand this eventually.

In the last post we learned what trap messages are in SNMPv3 monitoring and now we are seeing them again. Wondering if SOC Analysts use this a lot? Who knows. Maybe if I keep studying I will find out. Would be cool to pick up a SOC spot one day. Honestly, just trying to get in where I fit in. Sys Admin jobs would be cool as well but it seems like a hard field to break into due to a lot of old heads in the field. I have to clearly make out another list of definitions here:

• SNMP traps – (we covered this but you know) alert messages sent from a remote SNMP-enabled device to a central collector, the “SNMP manager”. A Trap might tell you that a device is overheating, for example.
• SNMP polling – involves retrieving Management Information Base (MIB) variables from devices in order to determine faulty behavior or connection problems. … During remote ping polling, enterprise-specific device MIBs are used to verify the status of the path between devices
• SNMP polling vs traps – initiated by the server and the router or switch responds to the server. An SNMP trap is initiated by the router or switch when it has information to send (usually some event happened) and does not want to wait for the server to ask for information.
• snmpwalk – is an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information. An object identifier (OID) may be given on the command line. This OID specifies which portion of the object identifier space will be searched using GETNEXT requests.
• SNMP version – Three versions of SNMP exist: version 1 (SNMPv1), version 2 (SNMPv2), and version 3 (SNMPv3). SNMPv1 represents the initial implementation of SNMP that functions within the specifications of the Structure of Management Information (SMI) and operates over protocols, such as User Datagram Protocol (UDP) and IP.

Given that snmpwalk seems like its user initiated this question absolutely makes sense. Which is really nice haha, even if you poll after hours its still going to use resources when you could get real time trap messages that alert you to errors much faster.

To be honest, after seeing this once I remembered the answer but I have no idea what a PAN is, the other ones im aware of. personal area network (PAN) is a computer network for interconnecting devices centered on an individual person’s workspace.

This is a question requiring a list

• Single-mode fiber – really, this, entire page is very helpful
• Cat 5e – Category 5e (Category 5 enhanced) Ethernet cables are newer than category 5 cables and support faster, more reliable data transmission through networks.
• Cat 6 – now with 6 wires
• Plenum-rated cabling – Cable that is run in the plenum spaces of buildings. In building construction, the plenum (pronounced PLEH-nuhm) is the space that is used for air circulation in heating and air conditioning systems, typically between the structural ceiling and the suspended ceiling or under a raised floor.

I’ve probably gone through all of that before but I want to be sure that I know it in case I encounter a new question on the test related to cable types.

Is this a common port usage? I’m not really sure, I could find out I suppose. SIP can be carried by several transport layer protocols including Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Stream Control Transmission Protocol (SCTP).[12][13] SIP clients typically use TCP or UDP on port numbers 5060 or 5061 for SIP traffic to servers and other endpoints. Port 5060 is commonly used for non-encrypted signaling traffic whereas port 5061 is typically used for traffic encrypted with Transport Layer Security also noted several times that its commonly used with VOIP

Any way, lets list these out for good measure

• TCP 443 – is mainly used by web servers providing HTTPS
• UDP 1720 – Port 1720 is used by the H.323 teleconferencing protocol (most commonly encountered in Microsoft NetMeeting) during call setup negotiation.
• TCP 8080 – is a place to host a secondary or alternate web server. It is commonly used for proxy and caching
• TCP 8181 – TCP is one of the main protocols in TCP/IP networks. TCP is a connection-oriented protocol, it requires handshaking to set up end-to-end communications. Only when a connection is set up user’s data can be sent bi-directionally over the connection.

Awesome to remind my self what those do. I mean, I had a vague idea but to be honest I’m not the best at direct memorization.

Friday was off to a somewhat slow start at work with lots of hardware dispatches so thankful to have a little free time to get this knocked out. Its a great day.

Its been a little while since I posted something and its kind of a slow day at work, waiting on images to finalize and so forth.  I would say I’ve been personally busy but really I’ve kind of been taking a small break. Test prep is coming along though. I think I should be good to test nov-dec hopefullly. Honestly there are a lot more questions than I assumed. So I guess, maybe I could try to be more lively in this blog. Perhaps thats what was holding me up. Not really sure. So anyway, heres some questions!

I think I sort of understand this but not really. I mean, the question is purely definitional so lets do that.

• VLAN Hopping – The idea is obvious but I’m not really sure how it works. However there are two methods for doing this, 1. In a switch spoofing attack, an attacking host imitates a trunking switch[1] by speaking the tagging and trunking protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q, Dynamic Trunking Protocol) used in maintaining a VLAN. Traffic for multiple VLANs is then accessible to the attacking host. 2. In a double tagging attack, an attacker connected to an 802.1Q-enabled port prepends two VLAN tags to a frame that it transmits. The frame (externally tagged with VLAN ID that the attacker’s port is really a member of) is forwarded without the first tag because it is the native VLAN of a trunk interface. The second tag is then visible to the second switch that the frame encounters. This second VLAN tag indicates that the frame is destined for a target host on a second switch. The frame is then sent to the target host as though it originated on the target VLAN, effectively bypassing the network mechanisms that logically isolate VLANs from one another.[3] However, possible replies are not forwarded to the attacking host (unidirectional flow).
• Session Hijacking – In computer science, session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.

Now that I’ve actually done the research instead of memorizing the answer, this seems to be a running joke, I kind of understand whats going on with these two things now though. Honestly, there is always so much to learn and its an on going process that I love.

• CSMA/CD – Short for Carrier Sense Multiple Access / Collision Detection, a set of rules determining how network devices respond when two devices attempt to use a data channel simultaneously (called a collision). Standard Ethernet networks use CSMA/CD to physically monitor the traffic on the line at participating stations.
• CSMA/CA – is a protocol for carrier transmission in 802.11 networks. Unlike CSMA/CD (Carrier Sense Multiple Access/Collision Detect) which deals with transmissions after a collision has occurred, CSMA/CA acts to prevent collisions before they happen.
• MPLS – Multiprotocol Label Switching (MPLS) is a protocol-agnostic routing technique designed to speed up and shape traffic flows across enterprise wide area and service provider networks.
• OSPF – is a routing protocol for Internet Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls into the group of interior gateway protocols (IGPs), operating within a single autonomous system (AS). It is defined as OSPF Version 2 in RFC 2328 (1998) for IPv4.

Learning that CD stands for collision detection

Ok, so this one is actually hard. By layer 1, I’ve figured out that they mean physical stuff. So, that’s a plus I suppose. However I have no idea what some of this stuff is and the more I look at it the more it looks like its kind of subject to interpretation. The old armchair coaching thing.

• Pinout Tester – this is basically an RJ45 cable tester, helpful link rj45 testing
• OTDR – An Optical Time Domain Reflectometer (OTDR) is an important instrument used by organizations to certify the performance of new fiber optics links and detect problems with existing fiber links.
• OC – Optical Carrier (fiber)

There are a few things going on here that I don’t know what they are so lets start with the first thing that it seems like I should have figured out by now.

So its like a thing that sends signals but its like small. Cool! The question, not completely convinced that it makes sense how however fiber jumper (cable) would seem to be the issue if it works at the point it comes in and then not at the next point. Why it would need to be single mode is beyond me. Maybe in the future I’ll figure that out.

What the hell is SNMPv3, assuming a dashboard? Honestly, this is one of those amazingly specific things that its not necessarily questionable but probably really hard to know unless you have seen this specific scenario.

• Trap message – SNMP Traps are alert messages sent from a remote SNMP-enabled device to a central collector, the “SNMP manager”. A Trap might tell you that a device is overheating, for example.
• SNMPv3 – Simple Network Management Protocol version 3 (SNMPv3) is an interoperable, standards-based protocol that is defined in RFCs 3413 to 3415. This module discusses the security features provided in SNMPv3 and describes how to configure the security mechanism to handle SNMP packets.
• Management information base – so that answer (i realize I’m miss formatting this) looks like its sending an error to a generic repository

That’s all for this afternoon. Going to the gym later and then will probably go through some questions.

I’ve really got to come up with some better text for opening and closings on these things. I mean, not that any one reads it but jesus my writing skills are terrible. Perhaps start with a clever joke from a dad joke book? A video of a man skateboarding in a video game?

Lets do both!

Did you hear the rumor about butter? Well, I’m not going to spread it!

It was the first thing came up and it seemed pretty cool. i mean, its an authentic Louisiana skull boy on a tricycle doing a trick. amazing.

a song to go with it and a picture of some of some new, endearing, Kanye shoes that are like crocs for motorcycle enthusiasts, apparently.

Now that ive grabbed your attention lets get into the usual process that involves about 0 creative writing with no tongue in cheek jokes.

Im not sure what two of these things are.

• NGFW – A next-generation firewall (NGFW) is a part of the third generation of firewall technology that is implemented in either hardware or software and is capable of detecting and blocking sophisticated attacks by enforcing security policies at the application, port and protocol levels.
• IDS/IPS – Intrusion Detection Systems (IDS) analyze network traffic for signatures that match known cyberattacks. Intrusion Prevention Systems (IPS) also analyzes packets, but can also stop the packet from being delivered based on what kind of attacks it detects — helping stop the attack.

This one seems debatable based on vendor. To be honest, if we are splitting hairs here I’m not clear on how this is different from a UTM. I’m sure someone can explain the differences however at some point I’m sure the nomenclature turns to grey. Ok though, NGFW it is.

I have no idea how far cat5 reaches but it seems easier to cut a cord, wire ends into it and plug it into a repeater than replace the entire cable given that distance is a factor. However, it seems to not be the case. The difference between cat5 and cat5e is speed and it cuts down on interference. I suppose that’s plausible.

Honestly, I have no idea why I thought this was important, the answer is really straight forward. I honestly agree with it and don’t know why I chose less vlans.

Umm kay, there was an error, we arnt sure what it is or what the response was when trying SSH but for sure we need to generate new keys. So in the spirit of learning, lets learn about generating new SSH keys.

SSH keys

That’s a whole lot of information that I’m going to have to come back to. I was also hoping there would be some more basic information on like how/why so maybe we should check YouTube.

That’s a little boring and the confusing part of this is that, in my experience, when using SSH you just type ssh (ip) then it prompts for login. I don’t know though. Lots to learn and this is help for capture the flag later on, maybe.

ok, hes a bit wordy and throws in important information under the radar but I’m starting to understand what hes saying and whats happening much better.

I have so many questions. Basic networking stuff is still kind of a mystery to me and I guess that’s why I’m doing this but OSI, … , any way. lets see if we can find any actual info on this one. The first thing i need to understand is what do they mean by highest? is physical low? ok, the answer to that is yes. OSI layers and this is also helpful peer to peer OSI

So, how do know this answer is correct? Well most things are saying layer 3 but this says 4. I guess we have to trust it but I did learn about osi regardless!

So its been fairly slow going so far, to be honest, but i do have screen shot sets for about 8 blog post and have gone through most of the material at least one. I’m not sure what the lack of a huge drive to get through the material as fast as possible stems from. Honestly, though I think it from the annoyance at troubleshooting flow questions. However, I would like to get through this and progress on with things. Anyway, lets get into questions.

Ok, TTL is out but lease time is not as it gives no further details about this but im not really sure what IP helper is so I guess I should look it up. DHCP IP Helper addresses are IP addresses configured on a routed interface such as a VLAN Interface or a routers Ethernet interface that allows that specific device to act as a “middle man” which forwards BOOTP (Broadcast) DHCP request it receives on an interface to the DHCP server specified by the IP Helper address. Ok, so that seems like a great idea but im not sure there is enough evidence to support that the dhcp server needs this support but I get that its good to know about.

omfg. I hate OSI stuff however to be honest, i really need to learn it. like, i want to learn it. ok so, i mean its question and answer which should be enough but you know, i would like to know more.

So, holy shit. I feel like I understand this much better. Thanks for breaking it down my guy. Now, in regards to the accuracy of this answer, im assuming its debatable as they clearly do not have available data to prove this.

so is a UTM a firewall? i’m assuming it is. Unified threat management, commonly abbreviated as UTM. UTMs at the minimum should have some converged security features like Network firewall, Intrusion detection, Intrusion prevention. So yes and that’s a plausible answer.

Not exactly clear on udp. Its literally in the name. ok. im dork. UDP (User Datagram Protocol)

lets start with a list

• TFTP – Trivial File Transfer Protocol (TFTP) is an Internet software utility for transferring files that is simpler to use than the File Transfer Protocol (FTP) but less capable. It is used where user authentication and directory visibility are not required.
• DTLS – Datagram Transport Layer Security (DTLS) is a communications protocol designed to protect data privacy and preventing eavesdropping and tampering.
• SNMP – Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks

Awesome! another, if you know the answer its easy type of thing! The end.

So the gym is going pretty awesome. Its kind of therapeutic to work through years of terrible lifestyle choices and to try to get myself in better shape physically. Any way, i feel like its slowed down my studying a bit but thats ok. I making progress just not as fast as I would like. I also thought about going through all of the material and making screen caps as I went and then go back and write about each one as I went. I got through about 6 sets of 5 and decided that I wasnt really about this because it helps to learn as you go. You know, like really learn it.

Anyway, lets get into some questions.

Ok, i dont know that much about networking equipment and like blah blah blah anyway, yeah here is a list of stuff. Also I’m assuming that signal means signal strength

• channel overlap – Adjacent-Channel interference occurs when devices from overlapping channels are trying to talk over each other, i have no idea what a fucking symptom of this is though. Ok turns out if you have bad signal this could be why
• incorrect antenna type – I have no idea what type of antenna that its supposed to use but i don’t really care, i think we just have to go with this.
• latency – I’m kind of surprised i typed this out but it wouldn’t cause a poor connection. Quick elimination leaves c and a as options
• SNR – guess? Signal to noise ratio? Would this be an indicator of signal overlap if it was high? it sort of seems so and given that its an indicator in these ‘highly reliable sources of biblical information’ ill say yes

ok, what the hell is this. there is not factual information to support this. I wish someone would tell me why an iSCSI san wouldnt work.

This is confusing because I dont know what a g1/0/1 interface is but a console and rollover are the same thing. Assuming straight-through is a regular cable. Turns out this isnt the reason why and I guess the only reason they are saying this is because its going into another router. This is fucking jargon to make people look like dorks that go into the field and dont know what they are doing after passing this haha

I’m not finding a quick answer for this or any thing that even remotely looks like an actual explanation. Nothing says anything about a damn firewall so, ok we are just, again, going with the answer. See, this is why I like technet. I mean, its not perfect but its damn something. anyway.

I dont understand cidr at all, just when you think you sort of understand some things about it, they go and throw in this question. Summary? I’ve been looking at this shit for a while now and never heard this term or worded with two fucking subnets into one fucking ip that isnt the fucking same. For now, all I want to know is what it means. Ok, this appears to be not real life as well. ok, 16 it is. Ok, thats it for tonight!