Topic: 请问高手，关于网络管理的面试题。。。 @枫下论坛 The Rolia Forum

工作学习 / IT技术讨论 / 请问高手，关于网络管理的面试题。。。 -tjchjf(Jeff); 2001-11-5 {578} (#249419@0)
今天去面试，洋人出了20道问答题，内容涵盖“sniffer, Windows NT, Cisco, Firewall,\" 还有五道human resource 的问题，根据他们的答案，我只答对了55%, 肯定没戏了，有几道题请教各位。
一。我完全不会的题：
1。TCP session 用什么作标识？
2。两台hosts 之间的RST 表示什么？
二。我认为对，他认为错的问题：
1。在Windows Network Environment, 用什么机制实现名字解析。
答：WINS。
2。网络A和B用router 连接，A网络的地址为：192.168.0.1/24，B网络的地址为：192.168.0.128/25，router 的相应interface 的地址是什么？
答：for a: 192.168.0.2/24
for b: 192.168.0.129/25

多谢高手指教。

I'm no expert, just try to answer your questions. -dennis2(Dennis); 2001-11-5 {1197} (#249476@0)
本文发表在 rolia.net 枫下论坛> 一。我完全不会的题：
> 1。TCP session 用什么作标识？

Sequence number?

> 2。两台hosts 之间的RST 表示什么？

Host A is trying to connect to host B on TCP port N. But host B doesn't have a program listenning on TCP port N, so the TCP/IP stack in the kernel of host B sends back a TCP reset (with RST flag on).

Recently there's a bad trend for browser (IE to be specific) to send RST to end the connection after grabbing the data instead of 4 packet close. Very bad.

> 二。我认为对，他认为错的问题：
> 1。在Windows Network Environment, 用什么机制实现名字解析。
> 答：WINS。

Maybe they want you to describe the whole process (ie., lmhost, host, broadcast, dns, wins, etc. for different type of nodes)? I can only remember the order before I took my MCSE exam :-)

> 2。网络A和B用router 连接，A网络的地址为：192.168.0.1/24，B网络
> 的地址为：192.168.0.128/25，router 的相应interface 的地址是什么？
> 答：for a: 192.168.0.2/24
> for b: 192.168.0.129/25

This doesn't look quite right. For network A, the valid host range is 192.168.0.1 - 192.168.0.254. For network B, the valid host range is 192.168.0.129 - 192.168.0.254. In other words, they are overlapping. ???更多精彩文章及讨论，请光临枫下论坛 rolia.net

neither do I. -lottery(©_©); 2001-11-5 {280} (#249669@0)
To Q1, my consideration is: sq number is increased in every message. It seems not right for session, especially when keepalive flag is used.
To Q4, the router seems free to choose a IP from your listed range, it is multi homed.
all these questions looks I need a manual at hand.

and Acknowledge number. sq number start with a random number to guarantee no conflict. -urfr(urfr); 2001-11-5 (#249676@0)

yah -lottery(©_©); 2001-11-5 {329} (#249688@0)
I don't remeber well. The sequence number help to identify the message is arrived secure and right. But it seems not help to idetify the start and the stop of the session. If the client ask for a N objects from a web server file, however, in the exchange of messages, the sequence number already has been changes a lot of times.

my comments: -songl(风); 2001-11-5 {197} (#249812@0)
I think the first one maybe " Soruce/Dest IP/Port Number", if their questions is "how to identify / distinguish two TCP session"

and agree with you on the last one, it would be just a trick.

I think you are right. I must have been out of my mind... -dennis2(Dennis); 2001-11-5 (#249924@0)
That could be a mistake. Remember session layer is upper than transportation layer in OSI model. You will find in in protocol design. -lottery(©_©); 2001-11-6 (#250146@0)
ip/port is essential, you still need sq and ack number .The session is between SYN and FIN. -urfr(urfr); 2001-11-6 (#250154@0)

I think you are more right. Your 2nd sentence hit the point. So I wasn't completely out of my mind. :-) -dennis2(Dennis); 2001-11-6 (#250177@0)

哇,真考试啊!! 别的题你能提供出来吗?谢谢啊! -firephoenix(雨后会出现彩虹吗?); 2001-11-5 (#249523@0)
Let me try -rina1998(rina); 2001-11-5 {231} (#249701@0)
1. tcp session: port number.
2 I am nor sure
3. I think it is DNS, Wins and DNS are used in Window NT, but Windows 2k only use DNS
2. the interface on router for a can be any one of 192.168.0.1~192.168.0.254. same as interface b
2/1不是NETBIOS吗？ -avacao(吃草的大老虎白白胖胖); 2001-11-5 (#249919@0)
I am sorry to not write the complete question,the complete question is... -tjchjf(Jeff); 2001-11-5 {187} (#250030@0)
1.when using sniffer, how to identify the tcp sessions?
2.when using sniffer, you capture the frames,what the identification RST means?
3.what is the name resolution in Windows Network.
The answers for first 2 questions -billy(bluesky); 2001-11-6 {280} (#250078@0)
1.TCP Session:It is a problem between two hosts that one send a request but another does not reply but the first one still use the whole port and line unless reboot first one to response the next connection request from the other host.

2.RST means Reset connection,it is a flag
Windows网络内部首先用WINS解析。 -ottawa(ottawa); 2001-11-6 {259} (#251012@0)
A网络192.168.0.1/24 的地址空间是：192。168。0。0 －－ 192。168.0.255. 0.0 是网络地址（有问题），0。255是广播地址，所以路由器的interface 地址可以是从1-254中的任意一个未用地址。网络B是192.168.0.128-192.168.0.255 (mask bits=25),这段地址空间与A网络重叠？有问题！
1).TCP use \\\\\\\"socket/sequence number\\\\\\\" and \\\\\\\"port\\\\\\\" as a session identification to describe the path 3) DNS and WINS -cute(cute); 2001-11-10 {223} (#256596@0)
(WINS is used to register NetBIOS computers names and resolves them to IP address), DNS and WINS can be intergrated together. 4). as 192.168.0.1/24 and 192.168.0.128/25 are invalid network addresses the question is a trick

I think only connected socket (which has a unique ip associated with it) together with TCP port and sequence number can be used as a session identifier, not listenning socket. -dennis2(Dennis); 2001-11-10 (#256609@0)

What does \\\"listening paskets\\\" mean? Did you refer to the \\\"SYN packects\\\"? Anyway, TCP packets only have one fixed packet structure. -cute(cute); 2001-11-10 (#256619@0)

It's "listenning socket". From network programming point of view, ... -dennis2(Dennis); 2001-11-10 {1076} (#257311@0)
本文发表在 rolia.net 枫下论坛... if you want to create a TCP server, you call socket() first to create a socket. Then you fill out the sockaddr structure (with IP address and port number) and call bind() to assign the address and port to the socket. Then you call listen() to convert the socket into a passive socket so that it will accept incoming connections. That's why the socket is called "listenning socket" up until now.

Next you call accept() to retrieve the next completed connection and you get a connected socket. This is different from the listenning socket.

From "UNIX Network Programming Vol 1" (by Richard Stevens) P.100:

"A given server normally creates only one listenning socket, which then exists for the lifetime of the server. The kernel then creates one connected socket for each client connection that is accepted (which the TCP three-way handshake completes). When the server is finished serving the given client, the connected socket is closed."

So that's why I say, only connected socket can be used as the identifier of a TCP sesssion, not listenning socket.更多精彩文章及讨论，请光临枫下论坛 rolia.net

Listenning pockets are VISUAL sockets and are not really tranferred on the networks. The concept of it is especially designed for API programming and does not exit in the standard TCP/IP. -cute(cute); 2001-11-11 (#257431@0)

I think SOCKET is raw form of TCP packet. -urfr(urfr); 2001-11-11 (#257435@0)
Where did you get the term "VISUAL sockets"? I've never heard of it. Anyway, Socket API is part of Posix standard, right? -dennis2(Dennis); 2001-11-11 (#258047@0)

In got it from my garbage English! I meant \"virtual packet\" not \"Visual packets\". -cute(cute); 2001-11-11 (#258327@0)

Argh no, don't look down upon yourself too much! Actually I think I was being too picky, sorry. -dennis2(Dennis); 2001-11-12 (#258529@0)

UP yi xia. -jzwang(hello); 2001-11-11 (#257427@0)
First question: I believe the TCP session is identified by socket: (source IP, source TCP port, dest IP, dest TCP port) Hope my answer is right -cjun(cj); 2001-11-12 (#258809@0)
Second question Normally, when TCP peer established a connection, when either side is going to close the connection, it will send out the a packet with the RST bit set in the TCP header. -cjun(cj); 2001-11-12 (#258810@0)

I don't think so. Normal TCP termination should be 2 pairs of FIN/ACK from both client and server. RST is for aborting the connection. -dennis2(Dennis); 2001-11-12 (#259295@0)

Third question: The NetBios should be the answer, if specially talking about the TCP/IP, it should NetBios over TCP/IP. -cjun(cj); 2001-11-12 (#258811@0)
Forth question: the 192.168.0.1/24 is not a network address the interface A ip address can be 192.168.0.1~192.168.0.127 the interface B ip address can be 192.168.0.129~192.168.0.254 -cjun(cj); 2001-11-12 (#258812@0)