Download CS6250 Module 10 Practice Exam 2026 Guide and more Exams Computer Networks in PDF only on Docsity!
CS 6250 Module 10 Practice Exam 2026
Guide
- What is DNS censorship? Large scale network traflc filtering strategy to suppress material which they deem as objec- tionable.
- What are the properties of GFW (Great Firewall of China)?
Locality of GFW nodes - majority view is that GFW censorship nodes are present at the edge.
Centralized management - blocklists ob- tained from two distinct GFW locations show a high possibility of a central GFW manage- ment entity that orchestrates blocklists.
Load balancing - GFW load balances be- tween processes based on source and desti- nation IP address.
- Censorship Technique 1: DNS injection For DNS requests that are blocked by the GFW, the GFW will respond with a fake DNS record to prevent the client from reaching the requested content.
- 3 steps of DNS injection 1) DNS probe is sent to a DNS resolver
The probe is checked against the blocklist
A fake DNS A record response is sent back if the request matches the blocklist. The direct domain can be blocked, or specific domain keywords can be blocked.
- How many DNS Censorship Techniques 5 are there?
CS 6250 Module 10 Practice Exam 2026
Guide
- Packet dropping all network traflc going to a set of specific IP addresses is discarded
Pros: (easy to implement, low cost) Cons: (maintain a long blocklist, overblock- ing)
- DNS Poisoning When a DNS receives a query for resolving hostname to IP address - if there is no answer returned or an incorrect answer is sent to redirect or mislead the user request
Pros: (No overblocking) Cons: (Blocks the entire domain)
- Content inspection all traflc traverses a proxy and is inspect- ed for objectionable content, if matches -> dropped
Pros: (precise censorship, flexible) Cons: (not scalable)
- Blocking with reset sends a TCP (RST) to block individual connec- tions that contain requests with objectionable content.
- Immediate reset suspends traflc coming from a source imme- diately, for a short period of time
What is overblocking? If two websites share the same IP address and the intention is to only block one of them, there's a risk of blocking both
What metrics does Iris use to identify DNS manipulation once data annotation is complete? Describe the metrics. Un- der what condition, do we declare the re- sponse as being manipulated?
- How is it possible to achieve connectivi- ty disruption using routing disruption ap- proach?
- How is it possible to achieve connectiv- ity disruption using packet filtering ap- proach?
Consistency metrics
Independent verifiability metrics
If neither of these metrics are satisfied, the response is said to be manipulated
Withdrawing previously advertised prefixes or re-advertising them with ditterent properties using BGP
Block packets meeting a certain criteria dis- rupting the normal forwarding action.
- IP ID Assigned a unique 16-bit IP identifier ("IP ID"), which the destination host can use to reassemble a fragmented packet. This IP ID should be ditterent for the packets that are generated by the same host.
- 2 mechanisms used by Augur 1) Probing: a mechanism to monitor the IP ID of a host over time.
- Perturbation: mechanism which forces a host to increment its IP ID counter by sending traflc from ditterent sources such that the host generates a response packet.
- Explain a scenario of connectivity disrup- tion detection in case when no filtering occurs.
When no filtering occurs, the measurement machine will see an increase of 2 in the IP ID
- this means the two hosts communicated
Explain a scenario of connectivity disrup- tion detection in case of the inbound blocking.
- Explain a scenario of connectivity disrup- tion detection in case of the outbound blocking.
Traflc from the reflector to the site containing objectionable data is blocked. Thus, the IP ID only increases by 1 because the SYN-ACK from the site never reaches the reflector.
Outbound reset packets from the reflector do not reach the site. The site will continue to send SYN-ACK packets until it receives an ACK, causing the reflector's IP ID to increase by 2 each time.
