Networking

Wireless

Wireless computer communication uses radio waves and micro waves, electromagnetic waves with frequency less than 300 GHz, to send messages. Computer wireless network cards are equipped with radio antennas that can be configured to listen for signals in a specific frequency band. These wireless frequency bands are government regulated to avoid interference and the most commonly used bands are 2.4 GHz, 5 GHz, and 6 GHz.

A gateway is network component that allows data to flow from one network to another.

Masquerading replaces the address of data exiting the network with the network's gateway address. Masquerading is required for communication with external networks, since devices cannot communicate over networks with private addresses.

High frequency radio waves can carry more data at faster speeds than low frequency radio waves, since they contain more energy. However, since higher frequency radio waves have a shorter wavelength, they are more easily obstructed by obstacles and thus have a shorter effective range.

MAC addresses are stored in the read only memory of network cards and are designed by manufactures to be unique.

• IEEE 802.11
• PHY (Physical Layer)
• Wi-Fi refers to a set interoperability certifications for protocols based on the 802.11 family of standards.
• Wi-Fi was created to add testing standards for 802.11.
• A zone is a collection of network interfaces.
  • Input allows packets to enter the zone.
  • Output allows packets to exit the zone.
  • Forward allows packets to transfer between network interfaces within the zone.

A wireless access point (WAP) is a device that allows other devices to wirelessly connect to a larger network, that is usually wired to a modem. A modem converts data between digital and analog mediums for transmission across landlines.

A wireless ad hoc networking (WANET) is wireless communication between two or more devices without a router. Ad hoc networks are usually undesirable for many devices, since every device must manage the data of all other devices.

A virtual local area network (VLAN) can segment a single physical network into multiple networks by tagging network packets.

Bluetooth

Bluetooth usually uses the 2.4 GHz frequency band to communicate over a range of around 30 meters. It can establish a limited number of connections using a personal area network (PAN), which usually has a range of less than 10 meters.

Mesh

Netfilter Tables

A netfilter checklist of rules is called a chain. Rules are based on inspect of packet headers.

The following list contains example nftables commands.

nft list tables
nft list table ip nat

Transport Layer Security

Transport Layer Security (TLS) is a cryptographic protocol that uses asymmetric key cryptography to securely communicate over the internet. Asymmetric key cryptography uses private and public key pairs to verify the identities of the communicating parties and to encrypt the communication messages. The keys

Asymmetric Keys

An asymmetric private key can sign and decrypt messages, while the public key can verify and encrypt messages.

• To generate a private key, execute openssl genpkey -algorithm rsa -out private.key -pkeyopt rsa_keygen_bits:4096.
• To generate the corresponding public key, execute openssl pkey -pubout -in private.key -out public.key.

Using other algorithms appears to cause compatibility issues with system and browser chains.

Digital Certificate

A digital certificate is generated by a trusted source's private key to verify a public key. The certificate contains the public key and information about its owner.

• To download a certificate from a website, execute true | openssl s_client -connect <domain:port> 2> /dev/null | openssl x509 > certificate.crt.
• To examine the certificate, execute openssl x509 -text < certificate.crt.

A TLS certificate can be received from certificate authority by the following steps.

1. Create a private and public key pair.
2. Use private key to create a Certificate Signing Request (CSR).
3. Send CSR to a certificate authority (CA).
4. Receive TLS certificate from certificate authority.

Certificate Authority

A Certificate Authority (CA) is trusted source that signs and issues digital certificates via their personal private key and certificate pair. The authority is a trusted source since they are a root authority or certified by a higher trusted authority. Root authorities are trusted since their self-signed public keys are installed by the operating system and web browsers.

To generate a private key and CA certificate, execute

openssl req -nodes -sha512 -x509 -extensions v3_ca -days 365 -keyout private.key -newkey rsa:4096 -out certificate.crt

The authority's issued certificates contain a public key and the identity of the owner who made the signing request. The associated private key is kept secret by the signing request owner.

To install a new root certificate authority on a system with Mkcert, place the authority certificate in a file called rootCA.pem and execute CAROOT='.' mkcert -install.

Digital Signature

A digital signature is a mechanism to authenticate a message. The signature confirms that identity of the signer and the message integrity. A private key is used to confirm the identity, and a hash is used to verify the message integrity.

The following steps sign the file document.txt with a private key and verify the signature with the associated public key. The steps require OpenSSL version 3 or later and place the signature in a separate file.

• To sign a document with the private key, execute openssl pkeyutl -rawin -sign -in document.txt -inkey private.key -out document.sign.
• To verify a signed document with the public key, execute openssl pkeyutl -rawin -verify -pubin -in document.txt -inkey public.key -sigfile document.sign.

Testing

To test TCP traffic between two computers, run iperf3 --server on the server and iperf3 --bitrate 0 --client <server-address> on the client. To test UDP traffic instead, add the --udp flag on the client.