Name:______________________________     Alpha:________________________________ 

1. [10pts] Consider a three-way handshare that initiates a TCP connection. Fill out the seq and ack numbers below:

     [client]                                                                         [server]
                -->    SYN        seq: 1234567      ack: ___________        --> 
     
                <--    SYN+ACK    seq: 4567890      ack: ___________        <--
   
                -->    ACK        seq: __________   ack: ___________        -->
     

2. [10pts] TRUE/FALSE questions.
   • TRUE/FALSE: The UDP flooding attack takes advantage of broadcast messages.
   • TRUE/FALSE: The Smurf attack takes advantage of broadcast messages.
   • TRUE/FALSE: Security of SYN Cookies will be broken when the server hash key is revealed.
   • TRUE/FALSE: IP Spoofing is often used with DOS attacks.
   • TRUE/FALSE: Packet filtering firewalls are effective in preventing the SYN flooding attack.
3. [30pts] Give firewall rules for the incoming packets that should work for the following scenario:
   You are a network administrator for the network 200.10.20.0/24. There are three severs in the internal network: an HTTP server at 200.10.20.8, a DNS server at 200.10.20.16, and a SMB file server at 200.10.20.32.

   • The file server is used for storage of important documents and should not be accessible to external IP addresses.
   • The web server hosts the organization web site, which must be accessible to all IP addresses.
   • The DNS server provides name resolution for the organization's domain, which must be available to all IP addresses.
   • IP address 100.100.100.100 is prohibited from accessing any host on your network due to suspected hacking activity.
   Assume the protocols use the following ports: HTTP (TCP 80), DNS (UDP 53), SMB (TCP 445). You don't need to fill all the rows in the table below.

   Rules for incoming packets
   Action (allow or block)	Source address	Destination address	Source port	Destination port	Type (TCP or UDP or both)