Network Services

This objective focuses on core infrastructure services, specifically, how devices dynamically receive their IP addresses, how they resolve user-friendly domain names back into machine-readable numbers, and how they synchronize their system clocks.

1. Dynamic Addressing (IP Allocation)

Before a device can communicate, it needs an IP address. We can automate this for both IPv4 and IPv6 using specific operational boundaries.

IPv4: DHCP (Dynamic Host Configuration Protocol)

A DHCP server manages a pool of IP addresses and automatically leases them to clients. To configure it properly, you must understand its core parameters:

• Scope: The defined range of valid IP addresses that the DHCP server is allowed to hand out on a specific subnet (e.g., 192.168.1.50 to 192.168.1.150).
• Exclusions: Specific IP addresses within the scope range that the server is explicitly blocked from assigning. You use exclusions to protect devices that require permanent static IPs, like a local printer or a server.
• Reservations: A mapping that ties a specific hardware MAC address to a specific IP address. Every time that exact device connects, the DHCP server recognizes it and hands it the exact same IP address. (Often called a “static DHCP lease”).
• Lease Time: The duration a client is allowed to keep an assigned IP address before requesting a renewal. By default, clients attempt to renew their lease halfway through its term (the T1 timer at 50% of the lease time).
• Options: Extra network configuration details handed to the client alongside the IP address. The most common options are Option 3 (Default Gateway IP), Option 6 (DNS Server IPs), and Option 15 (Domain Name).
• DHCP Relay / IP Helper: DHCP discovery messages are sent as broadcasts, which routers block by default. If your DHCP server lives on a different VLAN/subnet than your clients, you must configure the router interface with a DHCP Relay (or Cisco ip helper-address). This tool intercepts the local broadcast, packages it into a unicast packet, and shoots it straight to the remote DHCP server.

IPv6: SLAAC (Stateless Address Autoconfiguration)

• What it is: A unique feature of IPv6 that allows a device to configure its own IP address without needing a DHCP server.
• How it works: The client sends out a Router Solicitation message. The local router responds with a Router Advertisement containing the local network prefix (the first 64 bits). The client then uses that prefix to automatically generate its unique 64-bit host ID (typically derived from its hardware MAC address via EUI-64 or a randomized privacy token) to form a complete 128-bit IPv6 address.

2. Name Resolution (DNS & Security)

DNS translates human-readable domain names (like google.com) into IP addresses.

Core DNS Security Protocols

Traditional DNS is completely unencrypted and vulnerable to manipulation. Modern networks implement these three security layers:

• DNSSEC (Domain Name System Security Extensions): Adds cryptographic digital signatures to existing DNS records. This ensures that the DNS response you receive actually came from the legitimate nameserver and was not altered by a hacker in transit (prevents spoofing/poisoning). Note: It does not encrypt traffic; it only validates identity.
• DoT (DNS over TLS): Encrypts standard DNS queries by wrapping them inside an encrypted Transport Layer Security (TLS) tunnel using Port 853. It secures the connection from eavesdroppers.
• DoH (DNS over HTTPS): Encrypts DNS queries by hiding them within standard HTTPS traffic over Port 443. Because it looks identical to regular encrypted web browsing, it easily bypasses standard corporate firewalls and network censorship blocks.

DNS Record Types

You must memorize what each specific record type does for the exam:

• A (Address): Maps a hostname to an IPv4 address. (example.com \rightarrow 192.0.2.1)
• AAAA (Quad-A): Maps a hostname to an IPv6 address. (example.com \rightarrow 2001:db8::1)
• CNAME (Canonical Name): An alias record. It maps one hostname to another hostname. (e.g., pointing www.example.com directly to example.com).
• MX (Mail Exchange): Specifies the mail servers responsible for receiving email for that domain.
• TXT (Text): Holds human- or machine-readable text notes. It is heavily used for security validations, such as SPF, DKIM, and DMARC records, to prevent email phishing.
• NS (Name Server): Identifies the authoritative DNS servers responsible for holding the records of that specific domain.
• PTR (Pointer): The exact opposite of an A record. It maps an IP address back to a hostname, used exclusively for reverse lookups.

DNS Architecture and Zones

• Forward Lookup Zone: The standard database layout for resolving names to IP addresses.
• Reverse Lookup Zone: The database layout used to resolve an IP address back to a hostname (relying on PTR records).
• Primary vs. Secondary Servers: The Primary server holds the master, writable copy of the DNS database zone. Secondary servers maintain read-only copies of that database, pulling automated updates from the primary via a process called a Zone Transfer.
• Authoritative vs. Non-Authoritative: An Authoritative server is the definitive source that officially owns and manages the records for a specific domain. A Non-Authoritative server is a caching server that doesn’t own the domain but may have a temporary copy of the record in its memory from a previous search.
• Recursive Query: A DNS request where the client asks a local DNS resolver to do all the heavy lifting. If the resolver doesn’t know the answer, it will independently traverse the Internet root hints, TLD servers, and authoritative nameservers until it finds the IP address, returning the final answer to the user.

Hosts File

• What it is: A localized, plain-text file stored directly inside an operating system (e.g., C:\Windows\System32\drivers\etc\hosts).
• Why it matters: A computer always checks its local hosts file before sending a query to a DNS server. You can use it to hardcode a manual name-to-IP translation for immediate testing purposes.

3. Time Protocols (Network Synchronization)

System clocks must match perfectly across an enterprise network. If clocks drift apart, security logs cannot be accurately correlated, and cryptographic authentication systems (like Kerberos or Active Directory logons) will fail.

• NTP (Network Time Protocol): The universal standard for synchronizing device clocks over a network via UDP port 123. It uses a hierarchical design called Stratums to define accuracy. A Stratum 0 device is an atomic clock or GPS satellite; a Stratum 1 server is connected directly to a Stratum 0 device; a Stratum 2 server pulls time from a Stratum 1 server over the network, and so on.
• PTP (Precision Time Protocol / IEEE 1588): A specialized time protocol used when standard NTP isn’t sufficiently precise. While NTP synchronizes time within milliseconds, PTP achieves sub-microsecond accuracy. It is widely used in industrial automation, cell tower synchronization, and on financial trading floors, where microseconds matter.
• NTS (Network Time Security): An upgraded security mechanism for NTP. Traditional NTP traffic is unencrypted, making it vulnerable to man-in-the-middle attacks in which a hacker can feed a router a fake timestamp. NTS uses Transport Layer Security (TLS) to cryptographically verify that the time updates coming from an NTP server are authentic and unaltered.

Network Services Study Matrix

Service / Protocol	Primary Port / Focus	Core Exam Cue
DHCP Relay	Router configuration	Forwards local broadcast DHCP requests across different subnets.
SLAAC	IPv6 Autoconfiguration	Allows an IPv6 client to build its own IP using router prefixes.
DoH	Port 443	Encrypts DNS requests inside standard HTTPS web traffic.
PTR Record	Reverse Lookup	Translates an IP address back into a hostname text file.
PTP (IEEE 1588)	Microsecond Precision	Ultra-precise clock synchronization for financial or cell towers.
Hosts File	Local OS Text File	Handled before any DNS server query is sent to the network.