Network operation and maintenance engineer interview (written test)

How many layers does the TCP/IP model have, and what are their functions?
How many layers does the OSI model have and what are their functions?
The same vlan is connected to different switches, how to communicate?
The principle of arp deception?
The process of ping
There are several Senat, the difference between static and dynamic?
What information does the routing table contain?
The three-way handshake process of tcp?
How to solve liunx server poisoning?
Port number for telnet dns ftp smtp pop3 snmp?
The difference between tcp and udp?
What are the private network addresses?
What is the maximum rate of Category 5 twisted pair?
How does arp work?
Three-tier network architecture? effect?
What is the principle of the respective implementation of switches and routers? At which level is it implemented?
Type of protective wall?
The role of vlan?
What is the line sequence of twisted pair T568B?

Answer (non-standard):

The TCP/IP protocol is divided into four layers, which are network interface layer, network layer, transport layer and application layer from bottom to top.

The network interface layer is responsible for receiving IP datagrams and sending these datagrams to the designated network.

The function of the network layer is to perform network interconnection. According to the IP address of the Internet message, it is transmitted from one network to another network through a router.

The function of the transport layer is to provide end-to-end services for the hosts on both sides of the communication. The transport layer can regulate the flow of information, provide reliable transmission, and ensure that the data arrives without error.

The function of the application layer is a request sent by the client, and the server responds and provides corresponding services.
One layer of physical layer: specify the physical medium, network cable, optical fiber, current, voltage, and the level of voltage represents 0, 1.
Layer 2 data link layer: mac address switch segment forwarding
Layer 3 network layer: ip address router address management and routing selection
Layer 4 transport layer: port number tcp udp port establishes connection and disconnects data reliable
transmission when the connection is established? When to disconnect? How many connections to establish?
Six-layer presentation layer: data format conversion encoding format UTF-8
Seven-layer application layer: data of specific application protocols QQ mail game content

Reference: http://net.wjlyzz.com/project-1-netword/p16OSI7Layers.html
The switch interface connected to the user is classified as an access port, and the connection between the two switches is classified as a trunk port
By spoofing the gateway MAC address of the visitor PC in the LAN, the visitor PC mistakenly thinks that the MAC address changed by the attacker is the MAC address of the gateway, resulting in network failure
The source host compares its own IP with the IP of the destination host before initiating communication.

If the two are located on the same network segment, the source host sends an arp request broadcast message to request the MAC address of the destination host, and obtains the MAC address of the other party after receiving the ARP response from the destination host, and then uses the MAC address of the other party as the destination MAC of the message. Message sent. This is the case when hosts in the same VLAN (network segment) visit each other, and the switches used for interconnection perform Layer 2 switching and forwarding;

When the source host judges that the destination host is in a different network segment than itself, it will submit the message through the gateway (Gateway), that is, send an ARP request to obtain the MAC corresponding to the gateway IP address, and use the gateway MAC address after receiving the gateway's ARP response. Send the message as the destination MAC of the message
There are three ways to implement NAT, namely, static translation, dynamic translation, and port multiplexing (napt).

Static nat: one-to-one, as many public network addresses as there are private network addresses.

Dynamic nat: the many-to-many mapping relationship is not fixed (does not convert ports)
destination: destination address mask: netmask

pre: identifies the priority of the route added to the IP routing table

nexthop: next hop IP address interface: output interface

cost: routing cost
The client sends a SYN packet to the server and waits for an acknowledgment from the server.

Among them: the flag bit is SYN, which means a request to establish a connection; the sequence number is Seq = x (x is generally a random number); then the client enters the SYN-SENT stage.

After receiving the SYN packet from the client, the server confirms the packet and ends the LISTEN stage, and returns a TCP message.

Among them: The flag bits are SYN and ACK, indicating that the Seq sequence number of the message confirmed by the client is valid, the server can normally receive the data sent by the client, and agrees to create a new connection; the sequence number is Seq = y; the confirmation number is Ack = x + 1, It means receiving the sequence number Seq of the client and adding 1 to its value as the value of its own confirmation number Ack, and then the server enters the SYN-RECV stage.

After the client receives the sent SYN + ACK packet, it is clear that the data transmission from the client to the server is normal, thus ending the SYN-SENT phase and returning the last segment of the message.

Among them: The flag bit is ACK, which means that the signal of the server’s consent to the connection is confirmed; the serial number is Seq = x + 1, which means that the server’s confirmation number Ack is received, and its value is used as its own serial number value; the confirmation number is Ack= y + 1 means that the sequence number seq of the server is received, and its value is added by 1 as the value of its own confirmation number Ack. Then the client enters ESTABLISHED.
1) The easiest and most effective way is to reinstall the system

2) If you want to check, find the virus file and delete it

After being poisoned, the cpu and memory usage of the general machine will be relatively high

For abnormal situations such as the machine sending out packets, the troubleshooting method is briefly introduced

The top command finds the process with the highest cpu usage

Generally, the naming of virus files is messy, you can use ps aux to find the location of virus files

rm -f command to delete virus files

Check the scheduled tasks, startup items and virus file directories for other possible files, etc.

3) Even if the virus file is deleted, there may be a latent virus, so it is best to reinstall the machine after backing up the data
FTP uses two ports; one is port 21 for control connections, and the other is port 20 for transferring data. The default port number of FTP is 21;

DNS 53;Telnet 23; Smtp 25; Pop3 110; snmp 161/162
TCP: reliable transmission, connection-oriented: slow, but high accuracy

UDP: unreliable transmission, non-connection-oriented: fast, but poor accuracy
Class A 10.0.0.0~10.255.255.255

Class B 172.16.0.0~172.31.255.255

Class C 192.168.0.0~192.168.255.255
1000Mbps
Each host will build an ARP list in its own ARP buffer to represent the correspondence between IP addresses and MAC addresses.

When the source host needs to send a data packet to the destination host, it will first check whether the MAC address corresponding to the IP address exists in its own ARP list.

If there is, the data packet will be directly sent to this MAC address; if not, an ARP request broadcast packet will be sent to the local network segment to query the MAC address corresponding to the destination host.

The ARP request packet includes the IP address of the source host, the hardware address, and the IP address of the destination host. After receiving this ARP request, all hosts in the network will check whether the destination IP in the data packet is consistent with their own IP address.

If they are not the same, this data packet is ignored; if they are the same, the host first adds the MAC address and IP address of the sending end to its own ARP list.

If the information of the IP already exists in the ARP table, it will be overwritten, and then an ARP response packet will be sent to the source host, telling the other party that it is the MAC address it needs to find.

After the source host receives the ARP response data packet, it adds the obtained IP address and MAC address of the destination host to its own ARP list, and uses this information to start data transmission.

If the source host has not received the ARP response packet, it means that the ARP query fails.
1. Core layer: the high-speed switching backbone of the network

2. Aggregation layer: Provide policy-based connections

3. Access layer: connect workstations to the network
The switch is used in the local area network, and uses the MAC address of the host computer for data transmission, and does not need to care about the IP address in the IP data packet. It works at the data link layer.

The router identifies the network through the network number of the IP address in the IP data packet, so in order to ensure the correctness of the data packet routing, each network must have a unique network number, and the router works at the network layer.
1. According to different software and hardware forms, firewalls are divided into software firewalls, hardware firewalls and chip-level firewalls.

2. According to the technology used, it can be divided into network layer firewall, packet filtering firewall, circuit level gateway, rule inspection firewall, application layer firewall and compound firewall.

3. According to different firewall structures, it can be divided into single host firewall, router integrated firewall and distributed firewall.

4. Firewalls can be divided into border firewalls, personal firewalls, and hybrid firewalls according to different deployment locations.

5. According to the performance of the firewall, it can be divided into 100M firewall and Gigabit firewall.

6. Firewalls can be divided into personal firewalls and network firewalls according to different scopes of use.
Enhance the security of LAN (isolate broadcast domain), reduce cost and simplify network management
Orange White Orange Green White Blue Blue White Green Brown White Brown

Network operation and maintenance engineer interview (written test)

Network operation and maintenance engineer interview (written test)

Guess you like