TCP/IP Utilities ( Network + Chapter 4 )

Chapter 4 TCP/IP Utilities 

"Quoting one of e-books"

   Using the Address Resolution Protocol (ARP) 

             The Windows ARP Table
             Using The arp Utility 
   Using the netstat Utility 
             The –a Switch 
             The–e Switch 
             The –r Switch 
             The –s Switch 
             The –n Switch 
             The –p Switch 
   Using the nbtstat Utility 
             The –a Switch 
             The –A Switch 
             The –c Switch 
             The –n Switch 
             The –r Switch 
             The –R Switch 
             The –S Switch 
             The –s Switch 
   Using The File Transfer Protocol (FTP) 
             Starting FTP and Logging In to an FTP Server 
             Downloading Files 
             Uploading Files 
   Using the ping Utility 
   Using winipcfg , ipconfig , and ifconfig
             Using the winipcfg Utility
             Using the ipconfig Utility
             Using the ifconfig
   Utility  Using the tracert Utility 
   Using the Telnet Utility 
   Using the nslookup Utility 
   Summary 
   Exam Essentials 
   Review Questions 
   Answers to Review Questions

"Quoting one of e-books"

Read More

Design Hotspot-V1 Server Mikrotik

Design Hotspot-V1  Server Mikrotik

حمل من هنا 

رجاء تغيير بيانات الاتصال 

مع تحيات كنزى نت

Read More

Answers to Review Questions ( Network+ Chapter 3 )

Answers to Review Questions

1. D. Samba is installed on a UNIX server to allow Windows clients to be able to see the UNIX device as a server on the Windows network.

2. D. The NetBEUI/NetBIOS protocol stack does not contain a Network layer routing protocol because it was intended for LAN use only and, as such, cannot be routed.

3. B. The range of the numbers for the first octet in a Class B IP addressing scheme is 128–191. The range of 0–127 is for Class A, 192–223 is for Class C, and 224–255 is reserved for other classes
and purposes.

4. A. The purpose of a subnet mask is to separate the network portion and the host portion of an IP address. In the Internet Protocol addressing scheme, it is a group of selected bits whose values serve to identify a subnet. All members of the subnet share the mask value. Once each portion is identified using the mask, members of each subnet can be referenced more easily.

5. C. Port 80 is the TCP port number used to initiate HTTP connections between web client (browser) and web server. Port 23 is used for Telnet, port 25 is used for SMTP, and port 443 is
used for less common secure web server access using HTTPS.

6. D. The TCP port number used to initiate connections between POP3 clients and servers is 110. As previously mentioned, port 25 is used for SMTP, and port 80 is used for HTTP connections.
Port 100 is not normally used in typical Internet communications.

7. A. FTP clients connect to FTP servers using TCP port 21. As already mentioned, port 25 is used for SMTP, port 80 is used for HTTP, and port 110 is used for POP3 mail communications.

8. B. Internet e-mail servers send mail between themselves using the SMTP protocol. The SNMP protocol is used for the management and monitoring of various network devices. The POP protocol is used to download e-mail from mail servers. Telnet is used for remote terminal emulation.

9. C. 255.255.255.0 is the default subnet mask for a Class C address, 255.0.0.0 is the default for a Class A, 255.255.0.0 is the default for Class B, and 255.255.255.255 is the universal broadcast
address.

10. D. Most often, NAT is used in routers and firewalls to translate between two different IP addresses. 

11. B. All 1s in the host portion of an IP address represent the broadcast address for the corresponding subnet. All 0s in the host portion represent the identification of the network or subnet itself. Not being configured with the IP address of a DNS server or the default gateway will not completely disable network communications.

12. B. Of those listed, the only one that maintains a virtual “connection” is TCP. UDP and NetBEUI are both connectionless, and DDP is AppleTalk’s connectionless Datagram Delivery Protocol.

13. D. An extranet is basically an intranet with limited outside access granted to suppliers and affiliates. The Internet and an internet are far too broad to describe this type of network. Intranets, by definition, do not allow any outside access.

14. B. SMTP initiates connections between servers using TCP port number 25.

15. D. The correct acronym expansion for FQDN is Fully Qualified Domain Name. The FQDN is the complete name of an Internet host (e.g., www.sybex.com) that is used when referencing a host from outside that host’s LAN.

16. D. The refresh value in the SOA record of a zone file indicates how many seconds the secondary DNS server will wait before asking the primary server if the zone file has changed. Increasing this value will cause the secondary server to contain invalid information longer, but decreasing the refresh value, as in option A, by too much will generate unnecessary traffic. Option B would
occur by increasing the minimum TTL value in the SOA record and will simply cause resource records to expire less frequently, also increasing the likelihood that cached information will be
invalid. However, decreasing this value does not necessarily trigger a zone transfer for updated information, as decreasing the refresh value would.

17. A, C. Any time the IP address of a server that needs to be accessible from the Internet changes or is added, the entity responsible for maintaining the authoritative zone file for the domain that the server is on must be contacted to make changes to such records as the A record, the MX record, and the SOA record. Changing cabling or adding devices that do not need to be accessed
by name from the Internet are not situations that require a change to the DNS zone file.

18. D. The proper expansion of FTP is File Transfer Protocol. The abbreviation is more commonly used when referring to file-transferring protocols. There can be several protocols for transferring files between machines and/or networks. For example, FTAM provides file-transfer service for networks that use the OSI reference model, and FTP provides these services for TCP/IP protocols.

19. D. Proxy servers act on behalf of clients to provide Internet access and other Internet services. Generally speaking, however, a proxy server does not convert a nonroutable protocol to a
routable protocol.

20. C. Virtual LANs allow a network to be segmented virtually, inside a network switch, so that several ports are grouped together and function collectively as a network segment, possibly by
departmental or other logical groupings.

Read More

Exam Essentials ( Network+ Chapter 3 )

Exam Essentials

Be able to recognize the different protocols within TCP/IP and be able to define their purpose and function. The TCP/IP stack is made up of several protocols, which perform such functions as protocol transport, file access, file transfer, and mail transfer. These protocols include TCP, SMTP, IP, NNTP, HTTP, and FTP.
Be able to differentiate between the Internet, an internet, an intranet, and an extranet. When Internet is capitalized, it refers to the worldwide TCP/IP internetwork that we all know and love or hate, whereas internet is a more generic term referring to a network in which routers or other layer 3 devices are present. An intranet is an internetwork with well-defined administrative boundaries, while an extranet expands the intranet to include trusted outside networks. Be able to define the function of common TCP and UDP ports. You should know how to coordinate protocol name and function with port number. (Refer to Table 3.1 for specific examples.) Know how to identify IP addresses (IPv4, IPv6) and their default subnet masks. IPv4 =xxx.xxx.xxx.xxx, where xxx is a number from 0 to 255. The default subnet mask is 255.0.0.0
for a Class A address (IP range is 0.x.x.x to 127.x.x.x), 255.255.0.0 for a Class B (IP range is 128.x.x.x to 191.x.x.x), and 255.255.255.0 for a Class C (192.x.x.x to 223.x.x.x).
IPv6 = xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx, where x is a hexadecimal digit. IPv6 has no address classes and thus no default subnet mask. Know how to identify the purpose of subnetting and of default gateways. The purpose of subnetting is to divide a network into two or more segments, gaining more addressable segments from a single address space and reducing congestion. Default gateways are configured so that a host has an address to send an encapsulated packet to when it doesn’t know a specific
route to the destination address. Know how to identify the difference between public and private networks. Public networks
are networks that are open to the general public and, as such, use valid IP addresses that can be “seen” by the general public. The Internet is an example of a public network. Private networks,
on the other hand, use addresses that cannot be seen by the general public and are not available for public use or allowed onto the Internet in any way. Your company’s LAN is an example of
     a private network. These addresses must be translated to public addresses in order to allow the internal devices to communicate on the Internet. Identify the purpose, benefits, and characteristics of using a proxy service. A proxy server keeps a LAN somewhat separated from the Internet. Doing so increases security and filtering control and has the tendency to speed up Internet access through caching of recently used web pages. Be able to describe the main characteristics of VLANs. Virtual LANs (VLANs) are a feature of network switches that allow machines on different physical network segments to be organized into a virtual segment, or VLAN.

Read More

Review Questions ( Network+ Chapter 3 )

Review Questions

1. Where should Samba be installed to allow a Microsoft operating system access to a UNIX operating system?
A. On the Microsoft client
B. On the Microsoft server
C. On the UNIX client
D. On the UNIX server

2. Which feature is not available in NetBEUI/NetBIOS?
A. It is self-tuning.
B. It is fast in small networks.
C. It requires little configuration.
D. It is routable.

3. The Class B address range for the first octet is ________.
A. 1–127
B. 128–191
C. 192–223
D. 224–255

4. What does a subnet mask allow a TCP/IP device to differentiate?
A. Network ID and host ID
B. Workgroups from each other
C. Host IDs
D. All the above

5. HTTP usually connects to a web server on port number __.
A. 21
B. 25
C. 80
D. 443

6. The port number for POP3 mail is ___________________.
A. 25
B. 80
C. 100
D. 110

7. FTP usually connects to the server on port number ________.
A. 21
B. 25
C. 80
D. 110

8. Internet mail is sent between mail servers via which protocol?
A. SNMP
B. SMTP
C. POP
D. Telnet

9. What is the default subnet mask for a Class C address?
A. 255.0.0.0
B. 255.255.0.0
C. 255.255.255.0
D. 255.255.255.255

10. Network Address Translation, or NAT, is found in ______.
A. Hubs
B. Transceivers
C. NIC protocol drivers
D. Routers

11. Joe’s computer has been configured with an IP address in which the host bits are all binary 1s. Joe can’t seem to communicate on the network at all. What is the most likely problem?
A. Joe’s computer is configured with an IP address that conflicts with another device.
B. Joe’s computer is configured with the broadcast address for his subnet.
C. Joe’s computer needs to be configured with the IP address of a DNS server.
D. Joe’s computer needs to be configured with the address of the default gateway.

12. Which protocol is considered connection-oriented?
A. DDP
B. TCP
C. NetBEUI
D. UDP

13. What type of network includes limited outside access to internal corporate resources?
A. The Internet
B. An internet
C. An intranet
D. An extranet

14. SMTP normally operates through port number __________.
A. 21
B. 25
C. 80
D. 110

15. FQDN is an acronym for ___________________.
A. Fully Qualified Division Name
B. Fully Qualified DNS Name
C. Fully Qualified Dynamic Name
D. Fully Qualified Domain Name

16. What is the result of increasing the refresh value in the SOA record of a zone file on a primary DNS server?
A. The secondary DNS servers will be updated with changes to the zone file more quickly and more often.
B. The minimum time to live for resource records without a TTL setting will be increased.
C. The time after a secondary DNS server receives a zone transfer when it considers the zone information to be invalid increases.
D. The secondary DNS servers will be updated with changes to the zone file less quickly and less often.

17. Which of the following changes would require an administrator to contact the service provider that hosts the primary DNS server for the administrator’s DNS domain? (Choose all that apply.)
A. The company changed IP addressing schemes, and the web server’s address changed as a result.
B. The company added 15 new client PCs to the network.
C. The company added a new mail server.
D. The company upgraded from Category 3 cabling to Category 5e.

18. FTP is the abbreviation for ___________________.
A. Formal Transfer Protocol
B. Full Transfer Protocol
C. Final Transfer Protocol
D. File Transfer Protocol

19. Which of the following is not a feature of a proxy server?
A. It can reduce Internet traffic requests.
B. It can assist with security.
C. It can reduce user wait time for a request.
D. It can convert a nonroutable protocol to a routable protocol.

20. What is the primary purpose of a VLAN?
A. Demonstrating the proper layout for a network
B. Simulating a network
C. Segmenting a network inside a switch or device

Read More

Understanding Subnets

Understanding Subnets

 The IP addressing scheme provides a flexible solution to the task of addressing thousands of networks, but it is not without problems. The original designers did not envision the Internet growing
as large as it has; at that time, a 32-bit address seemed so large that they quickly divided it into different classes of networks to facilitate routing rather than reserving more bits to manage the
growth in network addresses. To solve this problem, and to create a large number of new network addresses, another way of dividing the 32-bit address was developed, called subnetting. An IP subnet modifies the IP address by using host ID bits as additional network address bits. In other words, the dividing line between the network address and the host ID is moved to the right, thus creating additional networks but reducing the number of hosts that can belong to each network. When IP networks are subnetted, they can be routed independently, which allows a much better use of address space and available bandwidth. To subnet an IP network, you define a bit mask, known as a subnet mask, in which a bit pattern of consecutive 1s followed by consecutive 0s is ANDed with the IP address to produce a network address with all 0s in the host ID.
Working out subnet masks is one of the most complex tasks in network administration and is not for the faint of heart. If your network consists of a single segment (in other words, there
are no routers on your network), you will not have to use this type of subnetting, but if you have two or more segments (or subnets), you will have to make some sort of provision for distributing
IP addresses appropriately. Using a subnet mask is the way to do just that. The subnet mask is similar in structure to an IP address in that it has four parts, or octets, but it works a bit like a template that, when superimposed on top of the IP address, indicates
which bits in the IP address identify the network and which bits identify the host. In binary, if a bit is on (set to 1) in the mask, the corresponding bit in the address is interpreted as a network
bit. If a bit is off (reset to 0) in the mask, the corresponding bit in the address is part of the host ID. The 32-bit value may then be converted to dotted decimal notation for human consumption.
Sometimes, you will use only one subnet mask to subnet your network. Variable Length Subnet Masking (VLSM) is the practice of using more appropriate varied subnet masks with the same
classful network for the different subnet sizes. A classful network is one subnetted to the default boundaries of network and host bits, based on the class of IP address. A subnet is only known and understood locally; to the rest of the Internet, the address is still
interpreted as a classful IP address (and maybe even as a group of classful addresses) if an entity has administrative control over a contiguous block of such addresses. Table 3.2 shows how this
works for the standard IP address classes. Routers then use the subnet mask to extract the network portion of the address so that they can compare the computed network address with the routing table entry corresponding to the mask used and send the data packets along the proper route on the network.

TABLE 3 . 2 Default Subnet Masks for Standard IP Address Classes

Because pretty much all the Class A and Class B networks are taken, you are most likely to encounter subnet-related issues when working with a Class C network or with any private address space. In the next section, you’ll get a detailed look at how to subnet a Class C network.

Why Subnet?

When faced with the choice of whether or not to subnet your network, you must remember several of the advantages to subnetting. The following list summarizes the advantages of the subnetting solution:

• It minimizes network traffic, decreasing congestion.
• It isolates networks from others.
• It increases performance.
• It optimizes use of IP address space.
• It enhances the ability to secure a network.

Read More

Simple Mail Transfer Protocol (SMTP)

Simple Mail Transfer Protocol (SMTP)

Simple Mail Transfer Protocol (SMTP) allows for a simple e-mail service and is responsible for moving messages from one e-mail server to another. The e-mail servers run either Post Office
Protocol (POP) or Internet Mail Access Protocol (IMAP) to distribute e-mail messages to users.

Read More

Summary ( Chapter 3 )

Summary

In this chapter, you learned the basics of the Transmission Control Protocol/Internet Protocol (TCP/IP) suite. First of all, you learned how TCP/IP works and about the various parts that
make up TCP/IP. Then you learned about the Transport Control Protocol, the first part of TCP/IP, and how it is used to transport data within TCP/IP. Following that, you learned how the Network
layer protocol IP is used.
     In addition to these two protocols, you learned of the various application protocols (like SMTP, FTP, and HTTP) and how they work. Relating very closely to that was the idea of ports and sockets for each protocol and how each port is mapped to a specific protocol or is specified for each.
One concept that gives many people trouble is the concept of TCP/IP addressing, which was covered in this chapter for both IPv4 and IPv6. Also, those addresses must be resolved into “friendly” names, a detail which was covered in the section “Name Resolution Methods.” Also in this chapter, you learned how to configure TCP/IP on a Windows-based workstation.
Finally, you learned about Virtual LAN (VLAN) technologies and how they work within a network.

Read More

Zero Configuration (ZeroConf)

Zero Configuration (ZeroConf)

As anyone who’s ever tried to hook their laptop to someone else’s to use TCP/IP to play video games, transfer files, or whatever, will tell you…it’s a pain. Even though computer manufacturer’s
and software programmers will tell you that networking is supposed to be simple, it really isn’t. You need to configure several parameters (IP address, DNS or host name, etc.) properly
or you won’t be able to communicate. These parameters are usually no problem for network technicians, but what about the average person? Configuring peer-to-peer or small network networking usually involves a game of “What should my IP address be?” between the people that want to network.
Enter the Internet Engineering Task Force (IETF) and the Zero Configuration (ZeroConf) initiative. The primary goal was to make networking via TCP/IP extremely easy and “hands off” for small networks. Ideally, two computers could be connected through Ethernet jacks with only a crossover cable and be able to communicate without any further configuration. In order
to accomplish this, the ZeroConf working group of the IETF had four main areas of focus:

1. Automatic Interface address configuration
2. Automatic Multicast address configuration
3. Translation of addresses to names and names to addresses
4. Service location

In order for the ZeroConf initiative to be successful, each of these components must be implemented in the ZeroConf protocol.

Note:

Apple Computer has been a large participant in the design of the ZeroConf protocol.
It has its own protocol, called Rendezvous, which itself is an open Zero-Conf protocol that has been submitted to the IETF for approval.

Automatic Local Interface Configuration
As you may already know, a computer must have a local IP address in order to communicate. Instead of relying on static addressing (too much work and too much to know) or dynamic addressing (other hardware required), ZeroConf allows for automatic configuration by the two communicating entities themselves. In the absence of a manually configured address or a DHCP server, the communicating entities will “figure out” their own local IP addresses (known as linklocal addresses) as follows: First, for each interface, each computer chooses a random TCP/IP address somewhere in the address space 169.254.1.0 to 169.254.254.255 (that is 169.254.0.0/ 16 with the top and bottom 256 addresses reserved for future use). Then, the computer configures its local interface with this address. Of course, it wouldn’t do any good if both computers chose the same address. So, two things happen to prevent that. First of all, the random number used to select the IP address is based on several computer-specific items (including the MAC address, real time clock, etc.) so that each computer is guaranteed a unique address. In addition, after the unique address is selected, it must be tested to ensure that no other device is using the same link-local address. To do this, the computer uses ARP to tell the other computers on the network segment connected to the interface being configured what IP address it intends to use. If no devices respond that they are already using that address, the interface is configured with the chosen address and communication
can take place.

Note:

 Windows has had this capability since Windows 98. Microsoft calls it Automatic
Private IP Addressing, or APIPA. The basics of this capability have been
incorporated into the ZeroConf proposed standard.

Multicast Address Selection
Another requirement of the ZeroConf initiative is that there is a mechanism for automatically choosing multicast addresses for the network. The IETF has defined the standard for the Zero- Conf Multicast Address Allocation Protocol (ZMAAP). This protocol is used to allocate multicast addresses among the various peers in small, peer-to-peer networks.
This protocol is the polar opposite of the multicast address assignment protocol known as MADCAP, which stands for Multicast Address Dynamic Client Allocation Protocol. Where
MADCAP is a client-server multicast address allocation scheme, ZMAAP is a peer-to-peer allocation scheme. Essentially, each node on a ZeroConf network is running its own little multicast 
allocation service (called a mini-MAAS in ZeroConf parlance). Any entity that needs a multicast address will make a request to its local mini-MAAS, which will then select an address and, before permanently allocating it, inform the other local mini-MAASs of its choice. If there are any objections, the originating mini-MAAS will rechoose the address. Otherwise, it will go ahead and allocate the address.

Name Resolution
You might think that there isn’t a way around name resolution, apart from constantly exchanging HOSTS files or some other silliness. In actuality, ZeroConf relies on standard TCP/IP protocols, including one known as Multicast DNS. Traditional DNS relies on centralized servers to answer DNS queries. But the addresses of these servers must be configured (and the goal is zero
configuration), so the designers of ZeroConf decided to use Multicast DNS. Multicast DNS was a little-used protocol until ZeroConf came along. 
       Traditional name resolution works much like asking the host at a party to introduce you to the people in the party you don’t know. Let’s say you wanted to know which person in the room was named John. With the traditional DNS model, you would ask the party host (the “DNS server” in our scenario). If you were to use Multicast DNS in the same scenario, you would simply
shout in the room, “Hey, is there a John in here?”
       Multicast DNS essentially puts out a multicast transmission that asks for the address of the network name being requested. This works great in small networks, but the amount of traffic required and the introduced delays make Multicast DNS impractical for larger networks, such as the Internet.

Service Location
The final aspect of ZeroConf is service location. It is important on networks to be able to locate services. AppleTalk is the master of finding services on a network without configuration. Apple
designed it so that whenever you plugged a printer into an AppleTalk network, it would advertise itself on the network and you could just choose it. This traditionally has been difficult on
TCP/IP networks. Furthermore, the chatty nature of such services would not be welcome on large networks.
       The IETF has designed a protocol specifically for locating services on a ZeroConf network.
That protocol is known as DNS Service Discovery, or DNS-SD. DNS-SD allows clients to use regular DNS queries, without the need for a new DNS message structure, to find a list of names

of particular types of services provided within a particular domain.

Read More

The Windows Registry

The Windows Registry

All of this TCP/IP configuration information is stored in the Windows Registry database, along with lots of other hardware and software configuration information. You can change most of the
TCP/IP parameters by using the Network applet in Control Panel as you have just seen. Certain parameters, however, such as Time to Live and the default Type of Service, can be changed only by using the Registry Editor (regedit.exe or regedit32, depending on your preference). If you change some of these Registry parameters without detailed knowledge of TCP/IP configuration, you may affect the performance of TCP/IP on your system in an adverse and unexpected way.

Top:

If you are configuring TCP/IP on a Windows NT or 2000 device and you want to
know more, check out the Microsoft Knowledge Base article 120642 on the
Microsoft website at www.microsoft.com. This article covers all the standard,
optional, and nonconfigurable TCP/IP parameters and describes which parameters
are updated by using the Network applet in Control Panel and which are
changed using the Registry Editor. If you want to see the equivalent article for
Windows XP, check out article 314053.

In the next chapter, you’ll get a look at some of the utilities in the TCP/IP toolkit that you can use to view and troubleshoot your TCP/IP network. All of these tools are based on the original
UNIX tools, but these days they are available in one form or another for all operating systems, including all versions of UNIX, Novell NetWare, and Microsoft Windows. 

Read More

Virtual LANs (VLANs)

Virtual LANs (VLANs)

With the introduction of Ethernet switches, and their subsequent replacement of Ethernet hubs in corporate LAN environments, came the power to manage traffic flow much more efficiently
and in many different ways. One of those ways was to allow users on different switch ports to participate in their own network separate from, but still connected to, the other stations on the
same or connected switch. This “network-within-a-network” concept became known as Virtual LAN (VLAN) technology.
       Let’s say, for example, that you have a 24-port Ethernet switch. If you have a group of users that constantly use a particular server and produce very large amounts of broadcast traffic, you might want to separate them into their own segment. But, with VLAN-capable switches, you are able to modify the segmentation within the switch itself regardless of geographical proximity of the VLAN members, thus saving you the expense of additional network hardware or recabling. To do this, you would use the switch management software to assign the ports on which those users and their server were working to their own VLAN. The VLAN for this group could be VLAN #2, for example, and the VLAN everyone else is assigned to could be the default management VLAN #1. Users would still be able to communicate with each other and their respective servers (assuming a router was installed), but broadcast traffic would be isolated. With large, enterprise-capable switches, this benefit is realized even more so. With hundreds of ports, you can segment the network any way you’d like, even on-the-fly and into many different segments.
       Let’s say, for example, a company’s network is divided into VLANs based on the departmental affiliation of the users. Bob transfers from the finance department to the accounting
department but keeps his same office. Susan moves from one building to another but remains in the marketing department. The administrator needs simply to configure Bob’s switch port to
be in the Accounting VLAN and Bob immediately enters the Accounting broadcast domain. Of course, Bob’s computer must be reconfigured for the subnet related to the Accounting VLAN,
which can be done centrally by rescinding his DHCP lease. Once his system requests a new DHCP lease, the DHCP server with the scope for his new subnet will offer him the proper IP information. The administrator can then configure the new port on the new switch that Susan is now plugged into for the marketing department, and regardless of her physical move, Susan never notices that she is connected to different switch hardware and her IP configuration can remain the same.

Note:

In practice, each VLAN corresponds to a different IP subnet, which is why a router is required to change the VLAN affiliation of a frame. The underlying packet has to be routed to the destination subnet, even if the intended recipient happens to be connected to the switch port right beside the port leading from the source device.

Read More

The Options Tab

The Options Tab

The Options tab allows you to adjust IP security and TCP/IP filtering settings (see Figure 3.10).

FIGURE 3 . 1 0 The Options tab of the Advanced TCP/IP Settings dialog box

Highlighting the IP Security option and clicking the Properties button leads to the ability to turn off IPSec functionality or set it to one of three modes of varying aggressiveness, beginning with simply responding to requests for IP security, then progressing to requesting IP security, and finally to requiring it.
       The TCP/IP filtering option allows you to exercise quite a bit of control over which protocols are allowed to communicate with the computer. Filtering may be performed on any combination

of TCP and UDP port numbers and IP protocol number.

Read More