Consider a server that accepts a request via UDP and responds via UDP (for example, as done by a DNS server). Where would the server give its answer if a client with IP address X spoofs it with address Y? b. Assume a server receives a SYN with IP source address Y and responds with SYNACK. The server then receives an ACK with IP source address Y and the right acknowledgmentamount. Assuming the server selects a random initial sequence number and there is no "man-in-the-middle," how can the server be confident that the recipient is really at Y (and not at any other address X that spoofs Y)?

Suppose a process in Host C has a UDP socket with port number 6789. Suppose both Host A and Host B each send a UDP segment to Host C with destination port number 6789. Will both of these segments be directed to the same socket at Host C? If so, how will the process at Host C know that these two segments originated from two different hosts?

Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below: 1st: client:port1 -> server:port2, SYN 2nd: server:port2 -> client:port1, SYNACK 3rd: client:port1 -> server:port2, ACK When this client is performing scanning attacks, it will generated a large number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed. By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules without considering SYNACK:

Draw a sequence diagram for the following scenario. In a network, two nodes communicate with each other. These are the sequence. 1) Node J sends ping message to Node L 2) Node L sends ICMP echo reply to node L. Now Node A is having the MAC address of Node L. 3) Node J starts TCP handshake with Node L by sending SYN message. 4) Node L sends (SYN+ACK) back to node J. 5) Node J sends the ACK to Node L.

A simple CIDR routing table is shown in Figure 1. For each of the destination IP addresses below, indicate which entry in the table it matches. Indicating none if no routing entry can be matched (hint: given an IP packet, the router will check whether there is a routing entry which can be used to route this packet, by checking the destination IP address in the packet with each routing entry: based on the subnet mask of each routing entry, it can extract the network ID and compare it with each routing entry; if there are a few routing entries which can match, the entry with the longest subnet mask wins). Address Mask Output Port 10.19.0.0/16 1 10.19.128/17 2 10.19.192/18 3 10.19.192/19 4 0.0.0.0/1 5 141.219.2.10 10.10.10.10 10.19.86.141 10.19.193.6 10.19.255.86 10.19.192.18

Let's say that Host C is running a Web server that listens on port 80. Suppose that this web server is able to maintain persistent connections and responds to requests from both Host A and Host B. Is Host C sending all of the requests over the same connection, or are there many sockets in use? Do each of them have port 80 even though they are broadcast over separate sockets? It's something you need to discuss and provide some clarification on.

Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below:                    1st: client:port1 -> server:port2, SYN                2nd: server:port2 -> client:port1, SYNACK                3rd: client:port1 -> server:port2, ACK  When this client is performing scanning attacks, it will generated a large  number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed.  By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules  without considering SYNACK: If a client:port1 sends…

Hosts A and B have a TCP connection with neither side having any unacknowledged data. Now, host A sends two TCP segments back to back to host B. Host B sends an acknowledgement (ACK) for each segment. Host A receives the second ACK, but not the first one. How many packets does host A retransmit?