NETWORK ANALYSIS

END TERM

END TERM QUESTIONS

1. Describe the key process components involved in network flow analysis and assess their
tac cal as well as strategic importance within communica on networks.

Network flow analysis (NFA) is essential for monitoring and managing communication
networks. The process involves three key components and is vital for both quick fixes and
long-term planning.

Key Process Components

Network flow analysis revolves around three main components that work together to track
and interpret network traffic:

1. Flow Exporter (The Sensor)

●​ What it is: A device, usually a router, switch, or firewall, that monitors passing
network packets.
●​ What it does: It groups packets that share a set of characteristics (like
source/destination IP, ports, and protocol—known as the 5-tuple) into a single record
called a flow. When a flow ends, the Exporter creates a flow record (metadata
about the traffic) and exports it.
●​ Analogy: The Exporter is like a toll booth operator who notes down details (car type,
entry/exit point, time) for every car passing by, but doesn't look inside the car.

2. Flow Collector (The Aggregator/Storage)

●​ What it is: A dedicated server or application designed to receive the flow records
from many Exporters.
●​ What it does: It aggregates (gathers) the raw flow records, processes the data, and
stores it in a database for later analysis. It is the central storage point.
●​ Analogy: The Collector is the central archive office that receives all the toll booth
slips, organizes them, and files them away.

3. Flow Analyzer (The Interpreter)

●​ What it is: The software tool that uses the data stored by the Collector.
 ●​ What it does: It processes the collected flow data, turning it into reports, alerts, and
visual graphs. This allows network operators to gain actionable insights into traffic
patterns, bandwidth usage, and security events.
●​ Analogy: The Analyzer is the data scientist who studies the organized slips to spot
trends like peak travel times, popular routes, and unusual activity.

Importance in Communication Networks

Network flow analysis offers value at two levels: Tactical (immediate and short-term) and
Strategic (long-term planning).

1. Tactical Importance (Focus: Immediate Action/Troubleshooting)

This helps network teams solve problems right now and keep things running smoothly
day-to-day.

●​ Troubleshooting & Resolution: Quickly identifies bottlenecks (slow spots) and

the exact "bandwidth hogs" (users/applications consuming too much capacity).
This reduces the time needed to fix problems (Mean Time to Repair - MTTR).
●​ Security Monitoring: Detects unusual traffic spikes or behavior, which can be signs
of malware, denial-of-service (DDoS) attacks, or a compromised internal device
(e.g., an inside threat). This allows for immediate action to block the threat.
●​ Quality of Service (QoS) Validation: Allows operators to check in real-time if
important applications (like Voice over IP or video conferencing) are receiving the
guaranteed priority bandwidth.

2. Strategic Importance (Focus: Long-Term Planning/Optimization)

This helps leadership and planners make smart decisions about future network growth and
spending.

●​ Capacity Planning: Provides historical data on traffic growth, peak usage times,
and application trends. This is critical for deciding where, when, and how much to
upgrade the network infrastructure (e.g., adding more bandwidth or new devices) to
handle future demand.
●​ Cost Optimization: Reveals traffic patterns that might lead to unexpected costs,
such as identifying inefficient routing or excessive data transfer fees in cloud
environments. This informs decisions to re-architect the network for better
cost-efficiency.
 ●​ Compliance and Reporting: Generates detailed logs and reports required by
regulatory bodies (like HIPAA or PCI-DSS) to prove that the organization is
monitoring its network activity and protecting sensitive data flows.

2. Crically discuss the risks an organization may face if network analysis is not properly
implemented.

Failing to properly implement network flow analysis (NFA) creates significant risks across
security, performance, and financial operations for an organization. The core issue is a loss
of visibility, turning a proactive network management system into a reactive and unreliable
one.

1. Major Security Risks (The Blind Spot)

Poor NFA implementation directly creates large security gaps that malicious actors can
easily exploit, especially since NFA is designed to see what firewalls often miss.

●​ Inability to Detect Threats: Without accurate flow data, the organization cannot
establish a baseline of normal traffic. Any attack traffic, such as a Distributed
Denial of Service (DDoS) attack, malware spreading, or a Command-and-Control
(C2) call-back to an attacker, is missed because it doesn't flag an alert.
●​ Encrypted Traffic Hiding Threats: Attackers often hide data theft (data
exfiltration) within seemingly normal, encrypted protocols (like HTTPS or DNS).
Proper NFA should analyze the behavior (who is talking to whom, how much data,
and for how long), but improper setup means this critical context is lost, allowing
sensitive data to be quietly stolen.
●​ Delayed Response and High Costs: When a security breach occurs, a faulty NFA
system provides no clear data, leading to a much longer Mean Time to Identify
(MTTI) and Mean Time to Contain (MTTC) the threat. This directly translates to
higher financial losses, which can reach thousands of dollars per minute for large
organizations.

2. Performance and Operational Risks (The Slowdown)

Ineffective network analysis turns network operations from a science into guesswork,
causing ongoing issues that harm productivity.
 ●​ Network Bottlenecks and Congestion: The system fails to identify where the
network is congested or who the biggest bandwidth users ("bandwidth hogs") are.
Without this visibility, problems like slow applications, high latency, and high packet
loss persist, severely degrading the User Experience (UX) and lowering employee
productivity.
●​ Ineffective Capacity Planning: NFA failure means IT teams have no reliable
historical data on traffic trends or growth rates. Decisions on network upgrades,
equipment purchases, and bandwidth allocation become based on assumptions,
leading to over-spending (buying too much capacity) or under-spending
(bottlenecks reappear immediately after an upgrade).
●​ Poor Troubleshooting: When an application fails or a link goes down, the lack of
accurate flow data prevents quick root cause analysis. Engineers waste time
checking every part of the network manually, extending downtime and service
interruption.

3. Financial and Compliance Risks (The Damage)

The indirect consequences of poor analysis can be more damaging than the immediate
technical failures, impacting the company's long-term health.

●​ Regulatory Fines and Legal Penalties: Many industries (like healthcare or finance)
have strict compliance rules (e.g., GDPR, HIPAA). Without proper NFA logs to track
network access and data movement, an organization cannot prove compliance
during an audit. This results in massive regulatory fines and potential legal action
after a data breach.
●​ Wasted Investment and Resource Allocation: Common pitfalls like data
collection errors (e.g., misconfigured flow templates) or integration issues
(especially in multi-vendor networks) mean the costly NFA tools are not providing
accurate results. This leads to wasted budget and staff resources spent correcting
bad data instead of improving the network.
●​ Reputational Damage: A network failure or a successful data breach, which
improper analysis makes more likely, damages the organization's reputation with
customers and partners. This loss of trust can lead to customer churn, lost business
opportunities, and a sustained negative impact on the company's valuation or stock
price.

3. Requirement analysis is essential for aligning network design with business objectives.
Just use this statement with examples.
Requirement analysis is absolutely essential for aligning network design with business
objectives because it acts as the translator between non-technical goals (what the
business wants to achieve) and technical specifications (how the network must be built to
support it). Without this analysis, the network becomes a costly, technically proficient
solution to the wrong problem, failing to deliver value.

Justification: The Necessity of Requirements Analysis

The justification is based on three critical functions of requirements analysis:

1. Ensures Business Value and ROI

Requirements analysis prevents costly mismatches by ensuring every dollar spent on

network infrastructure directly supports a business goal, guaranteeing a return on
investment (ROI). It moves the design from a bottom-up approach (buying hardware first) to
a top-down, business-driven approach.

●​ Example (Capacity Planning):

○​ Business Objective: "Launch a new cloud-based video conferencing service
next quarter to reduce travel costs."
○​ Technical Requirement (from analysis): The network must support
guaranteed Quality of Service (QoS) for video traffic, requiring a minimum of
5 Mbps stable bandwidth per concurrent user and less than 150ms
latency between all branch offices and the cloud provider.
○​ Alignment: The design team knows to prioritize fiber links, QoS tagging, and
high-throughput core switches, ensuring the technical design enables the
business to achieve its cost-saving goal.

2. Translates Subjective Goals into Measurable Technical Specs

Business goals are often vague, like "improve customer experience" or "enhance security."
Requirements analysis transforms these into Specific, Measurable, Actionable, Relevant,
and Time-bound (SMART) network criteria.

●​ Example (Performance and User Experience):

○​ Business Objective: "Improve customer satisfaction by speeding up online
transactions."
○​ Technical Requirement (from analysis): The network must achieve a
maximum application response time of 3 seconds for all Point-of-Sale
 (PoS) systems, which translates into a Round-Trip Time (RTT) of less than
50ms for the PoS VLAN to the central server.
○​ Alignment: The network design focuses on low-latency switching, proper
network segmentation (VLANs), and routing protocols that prioritize
transaction traffic, directly linking network performance to customer
satisfaction metrics.

3. Manages Risk and Future Growth (Scalability)

By analyzing the business's strategic plan (growth, mergers, new products), the network
design can be made flexible and scalable, avoiding expensive future rebuilds.

●​ Example (Business Continuity and Security):

○​ Business Objective: "Expand into three new regional markets next year and
maintain 24/7 operations."
○​ Technical Requirement (from analysis): The network must be redundant
across all core components, achieving a Recovery Time Objective (RTO) of
less than 4 hours and incorporating modular design to add a new regional
office module without disrupting existing operations. All new data centers must
adhere to a zero-trust security model.
○​ Alignment: The designer chooses highly available (HA) router pairs and a
meshed topology between data centers (redundancy), and integrates
micro-segmentation and strong firewalls into the design from the start,
ensuring the network can grow securely and never fails completely
(supporting 24/7 business continuity).

4. Analyze the difference between throughput and bandwidth.

The core difference between throughput and bandwidth is that bandwidth measures the
potential or maximum capacity of a network link, while throughput measures the actual
amount of data successfully transferred over that link in a real-world scenario.

Bandwidth (Theoretical Capacity)

Bandwidth defines the theoretical limit of how much data a network connection can transmit
in a given time period.
 Characteristi Description
c

Definition The maximum capacity of a communication channel. It's the pipe's

size.

Nature Theoretical limit. It does not change based on network conditions.

Measureme Measured in bits per second (bps), Mbps, or Gbps.

nt

Analogy The width of a highway 🛣️ (e.g., a 6-lane road). The number of

lanes is the limit, regardless of how many cars are on it.

Key Use Capacity Planning and purchasing network links.

Factors Primarily determined by the physical properties of the connection

(e.g., the Ethernet cable type or the ISP subscription limit).
Export to Sheets

Throughput (Actual Performance)

Throughput is the actual rate at which data is successfully sent and received, taking into
account all real-world limitations.

Characteristi Description
c

Definition The actual amount of data successfully transmitted. It's the amount
of water actually flowing out of the pipe.

Nature Practical performance. It is always equal to or less than the

bandwidth.

Measureme Also measured in bps, Mbps, or Gbps.

nt

Analogy The actual number of cars passing a toll booth per hour on that
highway. This number is affected by traffic.

Key Use Performance evaluation and real-time troubleshooting.

 Factors Affected by latency (delay), network congestion (too much traffic),
packet loss, and inefficient hardware (like a slow router).
Export to Sheets

Relationship and Analysis

Bandwidth sets the ceiling for performance, while throughput reflects the current,
experienced performance.

Comparison Bandwidth Throughput

Point

What it is Potential / Maximum Volume Actual Successful Volume

Indicator Network Limit Network Health

Influencers Physical infrastructure (cable All factors in the network path

type, link speed). (latency, congestion, errors).

Goal To have high capacity (a To have throughput close to the

wide pipe). bandwidth (maximum flow).
Export to Sheets

Critical Insight: A network can have high bandwidth (a 1 Gbps connection) but
experience low throughput (only 50 Mbps actual speed) due to external factors like heavy
traffic (congestion) or a slow response time (latency). Therefore, throughput is the more
accurate measure of the user's experience and is the primary metric for network
monitoring.

5. Why might a network with high bandwidth s ll have poor throughput?

A network with high bandwidth (high potential capacity) can still have poor throughput
(low actual speed) because throughput is limited by real-world factors beyond the pipe's
size. Bandwidth is a theoretical maximum, while throughput measures success after
accounting for all problems.

Key Reasons for Low Throughput Despite High Bandwidth

1. High Latency (The Delay)

Latency is the time delay for a data packet to travel from source to destination. In protocols
like TCP, high latency forces the sending computer to wait longer for confirmation
(acknowledgement or ACK) that the previous data block was received.

●​ Impact: Even if the network pipe (bandwidth) is wide, the stop-and-start waiting
period created by high latency severely limits the speed at which the data can be
continuously pushed through, thus reducing the effective throughput.
●​ Causes of High Latency: Long physical distance to the server or a high number
of "hops" (routers) the data must pass through.

2. Packet Loss and Errors

Packet loss occurs when data packets fail to reach their destination and are dropped,
usually due to congestion or hardware failure.

●​ Impact: When packets are lost, the sending device must detect the loss and re-send
the data. This process adds significant delay, forces the network to do extra work,
and consumes time and resources, which directly reduces the amount of
successfully delivered data (throughput) over time.

3. Network Congestion (The Traffic Jam)

Congestion happens when the actual amount of traffic currently being sent exceeds the
capacity of a specific segment of the network.

●​ Impact: While the main connection may have high bandwidth (e.g., 1 Gbps fiber line
to the building), a device within the network (like an older router or switch inside a
branch office) may only handle a fraction of that, creating a bottleneck. All traffic
queues at this single point, lowering the actual speed experienced by users below
the theoretical maximum.
●​ Cause: Too many users or devices trying to access the network simultaneously
during peak hours.

4. Poor or Outdated Hardware

The network is only as fast as its slowest component. High bandwidth on a fiber line is
useless if the devices connected to it cannot handle the speed.

●​ Impact: Old routers or switches may have limited processing power or outdated
protocols, causing them to process data packets slowly. This prevents the flow from
ever achieving the maximum speed advertised by the high bandwidth connection.
5. Wireless Interference

In wireless networks (Wi-Fi), the environment itself can kill throughput, even with a fast
wireless access point.

●​ Impact: Radio signals can be weakened by physical obstructions (concrete walls)

or disrupted by interference from other nearby wireless networks (channel
overcrowding), microwaves, or Bluetooth devices. This interference forces packets to
be resent, which drops the throughput rate significantly.

6. Describe the key steps involved in requirement analysis.

The key steps in the network requirement analysis process ensure that a network design is
fully aligned with an organization's business objectives and performance needs.

1. Elicitation and Scope Definition 🗣️

This phase is about discovering the initial needs and setting the boundaries for the project.

●​ Identify Stakeholders: Determine everyone who has a stake in the network,

including end-users, management, and security teams.
●​ Define Business Goals: Translate the organization's high-level objectives (e.g.,
"Reduce operating costs") into network-related drivers.
●​ Establish Scope: Define the boundaries of the project (which locations,
applications, and user groups are included).

2. Categorization and Characterization 🗂️

Requirements are gathered and organized into technical terms.

●​ Gather Requirements: Collect detailed information through interviews, surveys, and

analysis of current processes.
●​ Categorize: Separate requirements into two major types:
○​ Functional: What the network must do (e.g., "Support Voice over IP").
 ○​ Non-Functional: How well the network must perform (e.g., Security,
Reliability, Scalability).
●​ Characterize Behavior: Detail the technical nature of the requirements, such as
data size, traffic patterns, and the frequency/duration of application use.

3. Quantification and Prioritization 📈

The team applies measurable metrics to the requirements and manages conflicts.

●​ Develop Service Metrics: Assign quantifiable targets to non-functional

requirements:
○​ Delay/Latency: (e.g., VoIP packets must have ≤150ms delay).
○​ Capacity/Throughput: (e.g., ERP system requires ≥100Mbps dedicated
bandwidth).
○​ RMA (Reliability, Maintainability, Availability): (e.g., Core network uptime
must be 99.999%).
●​ Prioritize: Rank requirements based on criticality to the business, managing
trade-offs (e.g., a highly secure solution is often more costly or complex).
●​ Model and Analyze: Use tools like Data Flow Diagrams or Network Modeling to
visualize the requirements and check for potential bottlenecks or conflicts before
design begins.

4. Documentation and Validation ✅

The final step creates the official reference document for the network design.

●​ Document Requirements: Create a formal Requirements Specification that lists

all approved and quantified requirements.
●​ Map Requirements: Show the logical and physical dependencies between users,
applications, and geographic locations (a Requirements Map).
●​ Obtain Sign-off: Get formal approval from key stakeholders. This confirms that the
documented requirements are accurate and complete, freezing the scope for the
subsequent design phase.

7. Why is each step ( involved in requirement analysis ) necessary for building an efficient
network?
Each step in requirement analysis is necessary because it reduces project risk and costly
rework, ensuring the final network is a precise, measurable tool that supports the business,
not just a collection of hardware.

Analysis Step Why it is Necessary for Efficiency

1. Identify Ensures Alignment: Without knowing who needs the network

Stakeholders & (users, departments) and why (business objectives), the
Define Goals network will be designed to solve the wrong problem. This step
ties network cost directly to business value.

2. Categorize Focuses Design: Separating Functional needs (e.g., must

(Functional & run video) from Non-Functional needs (e.g., must have
Non-Functional) 99.999% uptime, low delay) ensures the design team knows
where to dedicate resources and what high-cost equipment
(like redundant systems) is truly mandatory.

3. Quantification Makes it Measurable: Vague requirements like "The network

(Metrics) must be fast" are useless. Quantifying them with metrics (e.g.,
Latency≤100ms, Capacity=500Mbps) provides clear success
criteria and ensures the network can be tested and proven
efficient.

4. Prioritization & Manages Budget & Complexity: Since not all needs can be
Conflict met perfectly, this step forces trade-offs between cost, security,
Resolution and performance. Resolving conflicts (e.g., high security vs.
low latency) prevents the design from being over-engineered
or impractical.

5. Documentation Freezes Scope & Reduces Rework: The final, signed

& Sign-Off document is the blueprint and contract. It prevents "scope
creep" and ensures that if requirements change later, the
associated cost and schedule impact is understood and
 officially agreed upon, minimizing expensive last-minute
changes.

Export to Sheets

8. Analyze why individual flows are best suited for forensic investigations, while composite
flows are more effective for long-term trend analysis.

Network flows are classified based on the level of detail aggregated by the collector.
Individual flows are detailed summaries of single conversations, while composite flows
group many related conversations together.

Individual Flows for Forensic Investigation 🔎

Individual flows are records of a single session or conversation, defined by the specific
Source IP/Port to Destination IP/Port and Protocol.

●​ Necessity for Forensics: Forensic investigations need high granularity to trace the
exact steps of an incident. Individual flows provide the "who, what, and exactly
when" for a single suspicious activity.
○​ Traceability: They can track a single user's connection to a malicious
command-and-control server, identifying the precise time, port, and IP address
of the attack communication.
○​ Evidence: In a data breach, filtering by individual flow records shows the
exact volume of data moved from a compromised server to an external host,
providing essential evidence of data exfiltration.
●​ Analogy: An individual flow is like a single flight manifest, detailing one traveler,
their destination, departure time, and baggage weight.

Composite Flows for Long-Term Trend Analysis 📈

Composite flows are aggregations (summaries) of many individual flows, often grouped by
a large network segment, application type, or entire geographical site over a long
period.

●​ Necessity for Trend Analysis: Trend analysis and capacity planning look at
big-picture patterns over weeks or months. Composite flows are necessary
because they are storage-efficient and less computationally heavy to process.
 ○​ Scalability: Storing millions of individual flow records for a year is impractical.
Composite flows condense this data (e.g., summarizing all HTTP traffic for an
entire office for an hour), making it manageable for long-term historical
comparison.
○​ Capacity Planning: They effectively show aggregate usage patterns (e.g.,
"The London office's total video conferencing traffic grew by 20% this quarter")
which is the information needed to plan future bandwidth upgrades.
●​ Analogy: A composite flow is like a monthly airport operations report,
summarizing the total number of flights, overall passenger volume, and peak travel
hours.

9. Compare uniflow and bi-flow in terms of advantages, limitations, and suitable

applications.

Flows are records of network conversations. The difference between uniflow and bi-flow
lies in how many directions of traffic between two endpoints are recorded in a single flow
record.

➡️⬅️
➡️
Feature Uniflow (Unidirectional Flow) Bi-flow (Bidirectional Flow)

Definition A flow record containing A single flow record containing

packets sent from one packets sent in both directions
endpoint to another (A→B and B→A).
(A→B).

Data Efficiency Lower Efficiency. Higher Efficiency. Condenses an

Duplicates key flow entire conversation into one record,
information (IPs, Ports) for significantly reducing storage
the forward and reverse space and export bandwidth.
directions, requiring two
separate records.
 Context/Analysi Limited Context. Requires Rich Context. Provides immediate
s the collector to stitch two data to calculate metrics like Round
separate records together to Trip Time (RTT) and separate
understand the full answered from unanswered
conversation. requests.

Routing More Resilient. Works fine Less Resilient. Requires the flow
Resilience even with asymmetric metering device to see both
routing (where A→B and directions of the traffic to create a
B→A use different physical complete bi-flow record; it fails
paths) because it only under asymmetric routing.
measures one direction.

Suitable Network Scanning or Quality of Service (QoS)

Applications monitoring protocols that are monitoring, security analysis (for
inherently unidirectional complete session visibility), and
(e.g., NetFlow v5, simple Voice over IP (VoIP) diagnostics.
UDP streams).

10. Analyze the strengths and weaknesses of composite flow in detecting cyberattacks.
Distinguish between attacks that can be detected and those that cannot, with examples.

Composite flow analysis refers to a high-level detection technique that correlates

multiple network events or low-confidence alerts from different sources (e.g., flow data,
log data, security alerts) over a long period to identify a larger, multi-stage attack. It looks for
a sequence of unusual actions that form a "story," rather than just a single malicious event.

Strengths of Composite Flow Detection 👍

1.​ Unmasks Multi-Stage Attacks: Its primary strength is revealing the full attack chain
that individual rules would miss. It links an initial low-level compromise (e.g., a
phishing click) with a later high-level action (e.g., a large outbound data transfer).
2.​ Reduces Alert Fatigue: It combines many noisy, low-priority alerts into a single,
high-confidence incident. For example, instead of receiving 50 individual "failed
 login" alerts, the composite flow triggers one "User X exhibiting suspicious privilege
escalation" alert.
3.​ Enhanced Accuracy (Lower False Positives): By requiring several conditions to be
met across different systems, the final alert is more likely to be a genuine threat.

Weaknesses of Composite Flow Detection 👎

1.​ High Computational Complexity: Correlating data across numerous sources and
long time windows (e.g., 14 days) requires massive storage and processing
power, increasing operational cost and complexity.
2.​ Sensitive to Data Gaps: If the data streams feeding the composite analysis (e.g.,
security logs, flow records) are incomplete, the composite detection will fail to
connect the dots, resulting in a false negative (missed attack).
3.​ Detection Lag: Because the system waits for a sequence of events to complete
before alerting, the attack may have already finished or done serious damage by the
time the composite flow is fully built and triggered.

Detectable and Undetectable Attacks

Attack Type Detectable by Why

Composite
Flow

Multi-Stage YES (The most The flow links a low-level event (e.g., a single
Attack Chain suitable scan attempt) to a high-level event (e.g., lateral
application) movement using a stolen account → data
exfiltration).

Example: Data YES Composite Flow Logic: (Initial access →

Exfiltration Internal system scan → Large volume of data
sent from internal server to external unusual IP).

Distributed YES (Best used The flow can track a large number of seemingly
Denial-of-Servi for identifying distinct connections from many sources
ce (DDoS) botnets) converging on one target simultaneously, which is
the definition of DDoS traffic.
SQL Injection / NO (Often These attacks involve malicious code or
Cross-Site undetectable) commands hidden inside the data payload of a
Scripting single, valid flow (e.g., a web request). Flow data
(XSS) only sees the metadata (IPs, ports, volume), not
the content, making the attack invisible.

Man-in-the-Mid NO (Often These attacks often involve subtly modifying

dle (MitM) undetectable) packet content (which flow data ignores) or
Attacks leveraging encryption breaks that maintain
normal-looking flow metadata.

11. An e-commerce company reports frequent checkout failures during peak sales.
Compare the possible role of throughput, latency, and reliability in this problem.

The frequent checkout failures during peak sales are caused by the system's inability to
handle the sudden surge of demand, manifesting as problems in all three performance
components.

Component Role in Checkout Failure Comparison to Others

Throughput Primary Cause of System Throughput is the

(Transaction Volume) Overload. If the maximum quantity problem; it
transaction throughput (e.g., causes the failure.
transactions per second) is Latency and Reliability
lower than the demand during describe the effect of
peak sales, the system queues that failure.
requests until its processing
components (servers,
databases) overload and crash
or time out.
Latency (Delay/Lag) Primary Cause of Cart Latency is the time
Abandonment/Timeout. High problem; the delay it
latency means the time for a introduces often
customer's payment request to triggers the actual
reach the server and receive a failure or causes the
confirmation is too long. If the customer to quit,
delay exceeds a pre-set leading to a lost sale.
threshold (e.g., 15 seconds), the
payment gateway or the
browser will time out,
registering a failed checkout.

Reliability Primary Cause of Data Error Reliability is the

(Consistency/Correctne Failure. Reliability ensures integrity problem.
ss) every step of the checkout While low throughput
process works correctly without slows the sale, poor
bugs, packet loss, or third-party reliability breaks the
outages (e.g., shipping API sale, often due to a
crashes). A reliable system has single point of failure
redundancy and (SPOF) or a software
error-checking. bug that wasn't
load-tested.

Conclusion: Poor throughput is the fundamental capacity limit exposed by peak sales.
High latency is the symptom that frustrates the customer and triggers system timeouts. Low
reliability ensures that when the system is stressed, minor software glitches become major,
hard failures.

12. A university suffers from a Distributed Denial of Service (DDoS) attack. Apply
Performance Component Architecture to show which components (throughput, latency,
availability) are affected and how administrators can respond.
A Distributed Denial of Service (DDoS) attack aims to consume a target's resources,
directly impacting all three components of network performance: throughput, latency, and
availability.

Performance Component Architecture Impact

Compon Impact of DDoS Attack Effect on University Users

ent

Throug Severely Reduced. The Students and staff cannot send or receive data,
hput massive flood of resulting in failed file uploads, dropped video calls,
malicious traffic (often and unusable online learning tools.
SYN floods or HTTP
requests) consumes all
the network's capacity
(bandwidth). This leaves
zero or very little
actual throughput for
legitimate traffic.

Latency Drastically Increased. The campus network feels unresponsive or

When network links and "laggy." Simple tasks like loading a webpage or
devices (routers, logging into the student portal take minutes or time
firewalls) become out completely.
congested with fake
traffic, legitimate packets
are queued
indefinitely. This results
in huge delays and
extremely high Round
Trip Time (RTT).
Availabi Catastrophic Failure. Critical services like the university website, email
lity The ultimate goal of a system, and virtual learning environment (VLE)
DDoS is Denial of become completely inaccessible (outages).
Service. By
overwhelming the
network or exhausting
the server's limited
resources (CPU,
memory, connection
tables), the system
crashes or becomes
incapable of accepting
any new connections.

Administrator Response (Mitigation Steps)

1.​ Traffic Scrubber/Cloud Mitigation: The most critical first step is to divert the
attack traffic away from the university's local network using an upstream
scrubbing service (often provided by the ISP or a cloud security provider). This
defense "absorbs" the attack's volume.
2.​ Rate Limiting and Filtering: Implement immediate rate limiting on the university's
edge devices to block traffic that exceeds suspicious thresholds (e.g., 500 requests
per second from a single IP). Configure Access Control Lists (ACLs) to drop
packets that conform to common DDoS signatures (e.g., spoofed IPs).
3.​ Resource Prioritization (QoS): Use Quality of Service (QoS) policies to prioritize
mission-critical traffic (e.g., DNS resolution, administrator SSH access) over
general web traffic. This maintains a bare minimum of connectivity for incident
response.
4.​ Forensic Logging and Alerting: Ensure security tools are logging and alerting on
the DDoS traffic patterns. This intelligence helps the administrator understand the
attack vector (UDP flood, SYN flood, etc.) to refine filtering rules and prevent future
attacks.
13. Analyze the relationship between design inputs (requirements, constraints, resources)
and design outputs (products, blueprints, prototypes) in network analysis. Explain how
mismatched inputs affect the final network performance.

The relationship between design inputs and design outputs is fundamental to network
analysis: Inputs determine the quality and success of the Outputs. Network analysis
uses a top-down approach where the stated business needs (Inputs) are transformed into
the physical and logical network elements (Outputs).

Component Description

Design Inputs The initial set of information that guides the entire design
(The 'Why' and process: Requirements (functional/non-functional needs),
'What If') Constraints (budget, time, security policies), and Resources
(existing hardware, personnel skill level).

Design Outputs The tangible and intangible deliverables resulting from the design
(The 'How') process: Network Blueprints (topology, addressing scheme),
Prototypes (test environments), Product Specifications (list of
hardware/software).

Export to Sheets

The Transformation: Network analysis is the process of translating subjective inputs

(e.g., "The network must be fast and cheap") into objective outputs (e.g., "Use Category
6A cabling, Cisco 9300 switches, and a 10 Gbps backbone"). If the translation is flawed, the
output is flawed.

How Mismatched Inputs Affect Final Network Performance

Mismatched inputs occur when a Constraint (limitation) directly contradicts a Requirement

(need). This forces the designer to compromise the technical specifications (Outputs),
leading to a network that cannot meet its goals.

1.​ Requirement vs. Constraint (e.g., High Capacity vs. Low Budget):
 ○​ Mismatch: The requirement is to support 4K video streaming (high capacity),
but the budget constraint forces the use of older Category 5e cabling and 1
Gbps switches (low output).
○​ Performance Effect: The final network suffers from severe bottlenecks. The
high bandwidth potential cannot be realized, leading to low throughput and
poor user experience, especially during peak load.
2.​ Resource vs. Constraint (e.g., Complex Architecture vs. Low Staff Skill):
○​ Mismatch: The design calls for a complex, software-defined network (SDN)
architecture (high output) to meet a flexibility requirement, but the IT staff
resource input has low expertise in SDN.
○​ Performance Effect: The network will be misconfigured and poorly
maintained. The complexity leads to low reliability, frequent errors, and long
Mean Time to Repair (MTTR), resulting in low availability.
3.​ Conflicting Requirements (e.g., High Security vs. Low Latency):
○​ Mismatch: The security requirement demands deep packet inspection (DPI)
and firewalls at every segment, while the application requirement demands
ultra-low latency (e.g., <5 ms for trading).
○​ Performance Effect: Security devices introduce processing delay (high
latency). The final network may be secure but will fail to meet the
performance needs of the time-sensitive application, rendering the core
business function unusable.

14. Analyze how mismatched design inputs (e.g., small budget but high user demand) can
lead to network performance issues.

Mismatched design inputs are a leading cause of network failure because the resulting
design is compromised from the start.

Case Study: Small Budget but High User Demand

Mismatched Design Compromise (Output Flaw) Performance

Input Issue
Resulting

Input Small Budget (Constraint) vs. High User Demand

Mismatch (300 users, heavy cloud use - Requirement)
 Design The designer selects lower-end switches with low
Compromis backplane capacity, uses fewer wireless access
e points (APs), and opts for a less redundant ISP link.

Performanc DDoS is unmitigated by cheap firewalls. Latency Low

e Impact spikes and application time-outs occur frequently. Reliability
and
Availability

Impact on The bottleneck shifts from the ISP line to the internal Low
Throughput switching fabric. Users compete for limited resources Throughput
within the building, resulting in extremely low per-user
throughput (e.g., 10 Mbps per user on a shared port).

Impact on The insufficient number of APs leads to weak signal High

Latency strength and wireless collision issues. The network Latency
often forces data retransmissions.

Export to Sheets

Additional Mismatch: High Growth vs. Rigid Architecture

Mismatched Design Compromise (Output Flaw) Performance Issue

Input Resulting

Input High Growth Projection (20% growth per

Mismatch year - Requirement) vs. Legacy Hardware
(Resource/Constraint)
Design The designer must reuse the existing,
Compromise non-modular, flat network topology because
replacing the core switch is too expensive.

Performance When the network grows, adding new users Low

Impact requires re-addressing and reconfiguring Maintainability
large sections of the network. (Unscalable)

Impact on The flat structure means a single broadcast Catastrophic

Reliability storm or a loop created by one faulty switch Failure Risk
can take down the entire network.

15. Compare the effects of weak foundations in a building with poor basic infrastructure in a
network. Show the risks in both cases.

The effects of a weak foundation in a building and poor basic infrastructure in a

network are comparable because both create invisible, systemic vulnerabilities that lead to
costly and catastrophic failures when the system is stressed.

Feature Weak Foundation in a Poor Basic Infrastructure in a Network

Building
What it is The unseen structural base The basic, core hardware/cabling (routers,
(footings, load-bearing switches, cabling, IP addressing scheme) is
walls) is inadequate for the outdated, misconfigured, or low-quality.
building's size or load.

Initial The exterior walls and roof The network may seem fast for simple email
Appearanc may look new and strong. or basic browsing.
e

Failure Extreme stress: an Extreme stress: a traffic surge, DDoS attack,

Trigger earthquake, heavy or deploying a new cloud application.
snowstorm, or adding extra
floors.

Failure Catastrophic collapse of Network outage (downtime), complete

Result the entire structure. collapse of services, and data breaches.
Export to Sheets

Risks in Both Cases

Risk Category Building: Weak Foundation Network: Poor Infrastructure

Safety/Security Walls crack, support Security devices (firewalls) are

beams fail, leading to overwhelmed and fail, leading to
physical danger and data theft or system compromise.
collapse.

Maintenance/Co Continual minor repairs Constant troubleshooting for slow

st (patching cracks, fixing speeds and dropped connections.
leaks) that do not address Requires complete, costly
the core structural flaw, replacement (rip-and-replace)
leading to escalating instead of simple upgrades.
costs.

Growth/Scalabilit Cannot support additional Cannot support new users,

y weight or floors; any high-demand applications
expansion causes (VoIP/Video), or cloud integration;
immediate instability. any change leads to system-wide
failure.
 Reliability Guaranteed failure when Guaranteed low Availability and
faced with expected unpredictable performance during
long-term stress (e.g., known peak load periods.
aging, natural shifting).

16. “Tactical insights ensure reliability, while strategic insights ensure sustainability.” Justify
this statement with reference to network flow analysis.

The statement "Tactical insights ensure reliability, while strategic insights ensure
sustainability" is justified because network flow analysis (NFA) provides two distinct
views of network performance, each serving a different business goal.

1. Tactical Insights: Ensuring Reliability (The Now)

Tactical insights focus on the immediate, operational status of the network. They use flow
data to identify and resolve existing problems quickly.

●​ How it Works: NFA tools analyze real-time or very recent flow records to detect
anomalies, spikes, and errors.
●​ Ensures Reliability: This is achieved by rapidly identifying and mitigating factors
that immediately threaten service:
○​ Detecting Bottlenecks: Real-time flow reports show exactly which link is
saturated and which user or application is the current bandwidth hog.
Immediate Response: Admin can throttle the user or temporarily re-route
traffic.
○​ Troubleshooting: By tracing the flow path and examining error flags (like
TCP retransmissions) in the flow data, Admins can instantly diagnose the root
cause of a service degradation. Result: Fast Mean Time to Repair (MTTR).

2. Strategic Insights: Ensuring Sustainability (The Future)

Strategic insights focus on long-term trends and capacity planning. They use historical
flow data (composite flows) to make decisions about future investments and network
architecture.

●​ How it Works: NFA aggregates and analyzes flow data over months or years to see
growth rates, trending applications, and peak usage periods.
●​ Ensures Sustainability: This is achieved by forecasting needs and allocating
resources effectively, ensuring the network can support the business's future vision:
 ○​ Capacity Planning: Flow data reveals that cloud application traffic has grown
by 40% year-over-year. Strategic Decision: Justify a budget to upgrade the
WAN link from 1 Gbps to 10 Gbps before the next fiscal year.
○​ Cost Optimization: Flow data might show that a certain cloud provider is
generating unusually high egress fees during off-peak hours due to backup
traffic. Strategic Decision: Re-architect the backup schedule to save money
over the long term.

Insight Time Horizon Flow Data Ensures...

Type Used

Tactical Current Individual Reliability (Fixing problems quickly to

(Real-time/Immed Flow keep services available now).
iate) Records

Strategi Future Composite Sustainability (Investing wisely to meet

c (Months/Years) Flow future capacity and business goals).
Reports

17. Differences between bandwidth and throughput with suitable examples.

The fundamental difference between bandwidth and throughput is that Bandwidth is the
maximum potential capacity of a network link, while Throughput is the actual
successful data transfer rate observed in a real-world environment.

Feature Bandwidth Throughput

What it The theoretical limit of data The actual amount of data that
Measures that can pass over a link at successfully moves over a link in a
once (the "pipe size"). specific time (the "real flow").
Nature Static/Theoretical. It is set Dynamic/Practical. It changes
by the service provider or constantly based on network conditions
physical medium and does (latency, congestion, packet loss).
not change based on traffic.

Relationshi Throughput is always less Throughput is limited by the bandwidth

p than or equal to bandwidth. but is heavily influenced by other
factors.

Primary Capacity Planning Performance Monitoring and

Use (determining necessary Troubleshooting (diagnosing the current
infrastructure). user experience).

Export to Sheets

Suitable Examples

Scenario Bandwidth Throughput

Internet You pay your ISP for a 100 You run a speed test and get 85
Connection Mbps plan. This is your Mbps download speed. This is your
maximum bandwidth. actual throughput (lower due to
network overhead).

Data Center The cable connecting two core During peak load, the link only moves
Link switches is a 10 Gigabit 6 Gbps of data due to high
Ethernet (10 Gbps) fiber optic congestion and server processing
link. delays.
Highway The highway has six lanes An accident occurs on the road,
Analogy (maximum capacity of cars). limiting the actual traffic flow to the
speed of the three open lanes.

18. Apply the concept of flow analysis to show how composite flows can be used for billing
or departmental cost allocation

The concept of composite flows is perfectly suited for billing and departmental cost
allocation because they allow network teams to summarize and categorize traffic usage,
assigning a measurable cost to specific business units.

The Process Using Composite Flows

1.​ Flow Data Collection: Network devices (routers, switches) export raw flow records
(NetFlow, IPFIX). These records contain metadata like Source IP, Destination IP,
Byte Count, and Time.
2.​ Composite Flow Aggregation: The flow collector aggregates millions of individual
flow records into larger composite flows. This aggregation is done based on key
business indicators:
○​ Grouping by Department: All flows originating from the IP address range
assigned to the "Marketing Department" are grouped into one composite flow.
○​ Grouping by Application: All flows using the specific ports/protocols of a
costly service (e.g., Cloud Backup Service on port 443) are grouped.
3.​ Cost Assignment: A monetary value is assigned to the total Byte Count within each
composite flow.
○​ Billing Logic: If the company pays $5 per Gigabyte of external traffic, the
total Gigabytes consumed by the Marketing Composite Flow is multiplied by
$5.
4.​ Reporting and Allocation: The composite flow analysis application generates a
report that shows: "Total WAN cost for March was $5,000. The Engineering
Department consumed 40% of the data, so their allocated cost is $2,000."

Necessity of Composite Flows

●​ Individual flows are too granular for billing. Tracking every single web session or
VoIP packet is computationally overwhelming and provides an unreadable report.
●​ Composite flows provide the necessary high-level summary. By grouping traffic
by Source Subnet (Department) or Destination IP (Cloud Service), the analysis
 directly supports the business requirement of cost accountability and fair
allocation. This ensures that the departments that use the most costly network
resources are charged accordingly.

19. A small business no ces abnormal traffic caused by malware. Compare how throughput
and latency are affected in this situation

When a small business network is infected with malware, both throughput and latency are
negatively impacted, though in slightly different ways, reflecting a decline in both the
quantity of successful data transfer and the speed of that transfer.

Performanc How Malware Affects It Consequence

e Metric

Throughput Reduced Quantity of Usable Data. Lower Effective Speed:

Malware often generates a high Legitimate user traffic (emails,
volume of abnormal background file transfers) must compete with
traffic (e.g., botnet activity, the malicious traffic, resulting in
spamming, data exfiltration). This significantly lower successful
traffic consumes a large portion of throughput. The network is
the available bandwidth. "full" of junk data.

Latency Increased Delay. The abnormal Higher Lag: The delays in

traffic leads to network congestion, processing and re-transmission
causing queues to form at routers dramatically increase latency.
and switches. Devices also spend Simple actions feel sluggish, and
processing power re-transmitting time-sensitive applications like
packets lost due to congestion or VoIP or video conferencing
errors caused by the malware. become unusable.

Export to Sheets

In summary: Malware reduces throughput by stealing bandwidth, and it increases

latency by causing congestion and adding processing overhead for dropped and
retransmitted packets.
20. A small office wants reliable Wi-Fi for 50 employees. Apply the concept of design inputs
(budget, bandwidth, security) to explain how the network should be planned

Planning a reliable Wi-Fi network for a small office requires translating the business's
design inputs (requirements and constraints) into a resilient and efficient physical
design.

1. Requirements and Goals (Reliability for 50 Users)

The core requirement is reliable Wi-Fi for 50 employees. This translates to the
following technical needs:

●​ Coverage: 100% signal strength in all working areas to eliminate dead zones.
●​ Capacity: Sufficient bandwidth to support multiple devices per user (e.g.,
laptop and phone, totaling ∼100 devices) simultaneously, especially for
common office apps like cloud storage and VoIP.
●​ RMA (Reliability): Minimal downtime and low packet loss for stable
performance.

2. Design Inputs and Planning Decisions

Design Input Explanation and Planning Decision Impact on Efficiency

Budget Decision: Must select a cost-effective, Ensures

(Constraint) reliable brand (e.g., commercial-grade cost-effectiveness
$\text{AP}$s, not consumer ones). and avoids Wi-Fi
Avoid installing too many cheap instability from
$\text{AP}$s, which causes signal interference.
interference.

Bandwidth Decision: Determine the required speed Guarantees high

(Requirement) per user (e.g., 20 Mbps sustained). throughput and
Purchase an ISP link that can handle prevents the network
the aggregate peak load and select from congesting
$\text{AP}$s supporting the latest during all-hands
standard ($\text{Wi-Fi 6/6E}$) for higher meetings or peak
throughput. usage.
Security Decision: Implement WPA3 encryption, Ensures data
(Requirement) separate the employee network from a protection and
guest network using a VLAN (Virtual network integrity by
LAN), and integrate a centralized isolating trusted
firewall for unified policy enforcement. traffic from guest or
risky traffic.

Export to Sheets

3. Physical Planning (Topology)

●​ Site Survey: Conduct a basic physical survey to determine the optimal

placement of $\text{AP}$s, avoiding physical obstructions ($\text{metal,
concrete}$).
●​ AP Placement: Instead of placing one powerful AP, place several
$\text{lower-power AP}$s strategically to provide better coverage and reduce
interference.
●​ Wired Backbone: Ensure all APs are connected to the main switches via
Gigabit Ethernet cables (Category 6 or higher) to prevent the wired part of the
network from becoming a bottleneck.

MID TERM QUESTIONS

1.​ Design a process components for implementation of network analysis and

architecture.
Network Analysis and Architecture Process Componen

Designing a network involves a structured process to ensure it meets current and future
needs. The key components for implementing network analysis and architecture are:

●​ Requirements Analysis: This initial phase involves gathering information about the
organization's needs. This includes understanding business goals, user
requirements, and technical constraints. You'll determine what the network needs to
do, who will use it, and what applications it needs to support.
●​ Logical Design: This component focuses on the conceptual layout of the network. It
defines the logical topology (e.g., star, mesh), IP addressing scheme, and routing
protocols. This is the blueprint that outlines how the network will function before any
physical devices are selected.
●​ Physical Design: This phase translates the logical design into a tangible, physical
layout. It specifies the actual hardware components, their physical placement,
cabling, and connections. This is where you decide on specific routers, switches,
servers, and the type of cables to use.
●​ Implementation: This is the process of building and deploying the network according
to the physical design. It involves installing hardware, configuring devices, and
connecting all the components.
●​ Monitoring and Optimization: Once the network is operational, it must be
continuously monitored for performance, security, and potential issues. This
component involves using tools to track key metrics and making adjustments to
optimize performance and reliability.
●​ Documentation: Thorough documentation is crucial throughout the entire process. It
includes network diagrams, IP address plans, device configurations, and contact
information. This ensures that the network can be easily maintained, troubleshooted,
and upgraded in the future.

2)performance characteristics of different device types

Performance Characteristics of Different Device Types

The performance of network devices is critical for overall network efficiency. Here's a
breakdown of the key performance characteristics for common device types:
 ●​ Routers: Routers operate at Layer 3 (Network Layer) and are responsible for
connecting different networks and forwarding data packets. Their performance is
primarily measured by:
○​ Throughput: The rate at which data can be forwarded from one interface to
another. Measured in packets per second (PPS) or megabits per second
(Mbps).
○​ Latency: The time it takes for a packet to travel from the input interface to the
output interface.
○​ CPU Utilization: How much processing power is being used to handle routing
and other tasks. High CPU utilization can lead to packet drops and increased
latency.
○​ Memory (RAM): Used to store routing tables and packet buffers. Insufficient
memory can cause performance bottlenecks.
●​ Switches: Switches operate at Layer 2 (Data Link Layer) and are used to connect
devices within the same network. Their performance is judged by:
○​ Switching Capacity (Backplane Speed): The maximum amount of data that
can be processed by the switch's internal bus. This determines how many
ports can operate at full speed simultaneously.
○​ Forwarding Rate: The speed at which the switch can forward packets,
measured in packets per second (PPS). A high forwarding rate prevents
packet loss.
○​ Port Speed: The maximum data transfer rate for each individual port (e.g., 1
Gbps, 10 Gbps).
●​ Firewalls: Firewalls are security devices that control incoming and outgoing network
traffic. Their performance is evaluated by:
○​ Firewall Throughput: The maximum amount of data that can pass through
the firewall while security policies are being enforced.
○​ Concurrent Connections: The number of simultaneous connections the
firewall can handle.
○​ Connection Setup Rate: The number of new connections the firewall can
establish per second. A low rate can slow down web access and other
applications.

3)performance characteristics of networks

Performance Characteristics of Networks

Network performance is a holistic measure of how well a network delivers data. Key
characteristics include:
 ●​ Bandwidth: The maximum amount of data that can be transmitted over a network
connection in a given amount of time. Often measured in bits per second (bps).
●​ Throughput: The actual amount of data successfully transferred over the network in
a specific period. It is always less than or equal to the bandwidth due to factors like
protocol overhead and latency.
●​ Latency: The delay experienced by data as it travels from source to destination.
High latency can severely impact real-time applications like video conferencing.
●​ Jitter: The variation in the delay of received packets. It is particularly important for
real-time applications where a consistent flow of data is necessary. High jitter can
cause choppy audio and video.
●​ Packet Loss: The percentage of data packets that fail to reach their destination.
High packet loss can degrade performance, as dropped packets must be
retransmitted.
●​ Reliability: The probability that the network will function correctly over a given
period. It is often measured by the mean time between failures (MTBF).

4)user requirements for network analysis

User Requirements for Network Analysis

Effective network design starts with understanding the needs of its users. User
requirements for network analysis typically fall into several categories:

●​ Application Requirements: This is the most critical area. You must understand
which applications users need to access and what their performance demands are.
For example, a video conferencing application requires low latency and jitter, while a
file transfer application is more sensitive to throughput.
●​ Geographic Requirements: Where are the users located? Are they in a single
office, multiple branch offices, or working from home? This determines the network's
topology and the type of wide area network (WAN) links needed.
●​ Security Requirements: What level of security is required? This includes access
control, data encryption, and protection against malware and external threats.
●​ Availability and Reliability: How critical is network uptime? Some users may
require 99.999% uptime for mission-critical applications, while others can tolerate
occasional outages. This dictates the need for redundancy and failover mechanisms.
●​ Future Growth: How many users and applications are expected to be added to the
network in the next few years? The design must be scalable to accommodate future
growth without major overhauls.
5) application groups and depict any 4 application

Application Groups and Depiction of 4 Applications

Network applications can be grouped based on their traffic characteristics and performance
requirements. These groups help in designing a network that can handle a diverse range of
traffic effectively.

●​ Application Groups:
○​ Real-time Applications: These are time-sensitive and require low latency
and jitter. Examples include voice over IP (VoIP), video conferencing, and
online gaming.
○​ Transactional Applications: These applications involve short, bursty data
transfers. Performance is measured by the speed of response. Examples
include web browsing, database queries, and e-commerce transactions.
○​ Bulk Data Applications: These applications involve large, continuous data
transfers. They are less sensitive to latency but require high throughput.
Examples include file transfers, software updates, and data backups.
○​ Multimedia Applications: These applications involve streaming audio and
video. They require consistent bandwidth and are sensitive to jitter. Examples
include streaming video services like Netflix and YouTube.

Here are four specific application depictions:

1.​ Voice over IP (VoIP):

○​ Application Group: Real-time
○​ Traffic Characteristics: Small, constant-rate packets.
○​ Performance Requirements: Very low latency (<150ms), low jitter (<30ms),
and minimal packet loss (<1%).
○​ Depiction: A constant stream of small data packets traveling between two
endpoints with minimal delay.
2.​ Web Browsing:
○​ Application Group: Transactional
○​ Traffic Characteristics: Short, bursty requests (HTTP GET) followed by a
burst of data (the web page).
○​ Performance Requirements: Low latency for quick page load times. High
throughput is beneficial but not as critical as for bulk data.
○​ Depiction: A series of quick requests and responses, with the majority of data
flowing from the server to the client.
3.​ File Transfer Protocol (FTP):
 ○​ Application Group: Bulk Data
○​ Traffic Characteristics: A single, large, continuous data stream.
○​ Performance Requirements: High throughput is the primary concern.
Latency and jitter are less important.
○​ Depiction: A steady, uninterrupted flow of a large volume of data from a
source to a destination.
4.​ Streaming Video (e.g., Netflix):
○​ Application Group: Multimedia
○​ Traffic Characteristics: A continuous, high-volume data stream.
○​ Performance Requirements: A consistent, high bandwidth to prevent
buffering. Low jitter is important to ensure smooth playback. Latency is less
critical unless it's a live stream.
○​ Depiction: A constant stream of data packets arriving at a user's device,
where the packets are buffered and played back sequentially.

IMP TOPICS

🌐
A network topology is the physical or logical arrangement of the nodes and connections in
a computer network. It defines the layout of a network and how data flows between
devices. There are two main types:

●​ Physical topology: Refers to the physical layout of the network, including the
location of devices and how cables are run.
●​ Logical topology describes how data signals travel through the network, which may
differ from the physical layout. For example, a token ring network uses a logical ring
to pass a token, even if the physical wiring is a star.

Common Topologies

1. Bus Topology

In a bus topology, all devices are connected to a single central cable, or "bus." Data
travels along this bus and is available to all devices, but only the intended recipient accepts
it.
2. Star Topology

A star topology connects all devices to a central hub, switch, or router. All data must pass
through this central device before reaching its destination.

3. Ring Topology

In a ring topology, devices are connected in a circular fashion. Data travels in one
direction around the ring, with each device acting as a repeater to boost the signal.

4. Mesh Topology

A mesh topology connects every device to every other device in the network. There are
two types: full mesh and partial mesh. In a full mesh, every device has a dedicated link to
every other device, while in a partial mesh, some devices are connected to every other
device, and others are only connected to the devices they communicate with most often.
5. Tree Topology

A tree topology combines aspects of bus and star topologies. It has a central root node,
with branches extending to other nodes, forming a hierarchy.

Hybrid Topologies

A hybrid topology combines two or more different topologies. The goal is to leverage the
strengths of each individual topology while mitigating their weaknesses. For example, a
hybrid star-ring topology could have a star-shaped network where the central hubs are
interconnected in a ring.
SDLC (Software Development Life Cycle)

In the context of networking, SDLC is the structured process for designing, implementing,

👷‍♂️
and maintaining a network. It ensures that the network is built correctly and meets all
requirements.

The phases of network SDLC are:

1.​ Planning and Requirements Analysis: Defining business goals, user needs, and
technical constraints. What problem are we solving?
2.​ Design: Creating a blueprint of the network, which includes the logical design (IP
addressing, routing) and the physical design (hardware selection, cabling).
3.​ Implementation: The actual building of the network, including installing hardware
and configuring devices.
4.​ Testing: Verifying that the network functions as designed and meets performance
and security requirements.
5.​ Operation and Maintenance: Ongoing monitoring, troubleshooting, and upgrading
of the network.

Pitfalls in Network Design

⚠️
A pitfall is a common mistake or a potential problem that can derail a network project. For
an exam, you should be able to identify these to show you know what to look out for.

●​ Underestimating Bandwidth: Failing to properly calculate current and future data

traffic needs, leading to network congestion.
●​ Ignoring Scalability: Designing a network that can't easily grow with the
organization, which results in costly and difficult overhauls later on.
●​ Poor Security: Treating security as an afterthought rather than integrating it into the
initial design. This can leave the network vulnerable to attacks.
●​ Lack of Redundancy: Not having backup components or links, creating a single
point of failure that can cause significant downtime if a component fails.
●​ Inadequate Documentation: Skipping or providing incomplete documentation,
which makes it incredibly difficult to troubleshoot and maintain the network in the long
run.

Mapping SDLC with Network Analysis and Architecture Process

This topic connects the general SDLC framework to the specific steps of network design.
You can map the phases like this:

SDLC Phase Network Process Explanation

Component

Requirements Requirements This is the initial step of understanding

Analysis Gathering user and business needs.

Design Logical & Physical The blueprinting phase where network

Design topology, addressing, and hardware are
planned.

Implementation Implementation The physical installation and configuration

of the network.

Testing Testing Verifying connectivity, performance, and

security before going live.

Maintenance Monitoring & The ongoing process of keeping the

Optimization network running efficiently.

SNR (Signal-to-Noise Ratio)

👂
Signal-to-Noise Ratio (SNR) is a crucial metric in data communication. It's the ratio of the
power of a desired signal to the power of background noise.

●​ The formula is often expressed in decibels (dB): SNRdB​=10⋅log10​(Psignal​/Pnoise​)

●​ A high SNR means the signal is strong and clear relative to the noise, which allows
for higher data transfer rates and fewer errors.
●​ A low SNR means the signal is weak and corrupted by noise, leading to slower
speeds and higher error rates.

Buffer Size

💾
A buffer is a region of memory used to temporarily store data while it's being transferred
from one location to another. The buffer size is the capacity of this memory.
 ●​ Function: Buffers help manage data flow between devices operating at different
speeds. For example, a router's buffer holds incoming packets when a network link is
congested, preventing packet loss.
●​ Too Small: A small buffer can lead to buffer overflow and packet loss if data
arrives faster than it can be processed.
●​ Too Large: An excessively large buffer can cause increased latency because
packets wait longer in the queue before being sent. The optimal size is a balance
between these two extremes.

Shannon Capacity

Shannon Capacity, also known as the Shannon-Hartley theorem, determines the

🚀
theoretical maximum data rate for a noisy communication channel without error. It's the
upper limit of a channel's capacity.

●​ The formula is: C=B⋅log2​(1+S/N)

●​ C is the channel capacity in bits per second (bps).
●​ B is the bandwidth of the channel in Hertz (Hz).
●​ S/N is the signal-to-noise power ratio (the non-decibel value).
●​ Significance: This theorem shows that channel capacity is a function of both
bandwidth and signal quality. It proves that you can increase data rate by either
increasing bandwidth or improving the signal-to-noise ratio.

Real-time Example Scenario for Implementation

Let's consider a company moving to a new office and needing a completely new network
infrastructure.

Scenario: A tech startup with 50 employees is moving to a larger office and needs a new
network. They rely heavily on real-time applications like video conferencing and VoIP for
client communication, in addition to standard web browsing and cloud-based file sharing.

1.​ Requirements Analysis: The team meets with department heads to understand
their needs. They determine that high-quality video conferencing is a top priority,
requiring low latency and jitter. They also need reliable Wi-Fi for all 50 employees
and guests.
2.​ Logical & Physical Design: The network architect designs a star topology with a
central switch. They plan the IP addressing scheme and routing protocols. They
 select a powerful router with Quality of Service (QoS) features to prioritize real-time
traffic and choose high-speed Ethernet switches. They also decide on the physical
placement of wireless access points to ensure full coverage and minimize
interference.

3.​ Implementation: The IT team installs the new routers, switches, and cabling. They
configure VLANs to segment different types of traffic (e.g., guest Wi-Fi, internal
network). They implement security policies and firewalls from the start.
4.​ Testing: Before the move, they run tests on the new network. They use a network
testing tool to simulate a full load of 50 users, checking for latency, jitter, and
throughput, especially for the video conferencing application. They test the security
configurations and check that the failover link works.
5.​ Maintenance: After the move, they continuously monitor network performance. They
analyze traffic patterns to optimize bandwidth allocation and regularly update firewall
rules and device firmware. They document all changes and configurations for future
reference.

ASSIGNMENT QUESTIONS
Que} Why SNR is important in wireless communication systems ?

Importance of SNR in Wireless Communication Systems

Signal-to-Noise Ratio (SNR) is a fundamental metric in wireless communication because it
directly determines the quality, reliability, and speed of a wireless connection. It's the ratio
of the power of the desired signal to the power of the background noise.

1. Signal Clarity and Reliability

A high SNR means the signal is strong and clear relative to the noise. Think of it like a
conversation in a quiet room: it's easy to hear and understand what's being said. In a
wireless network, a high SNR allows the receiver to accurately decode the transmitted data
without errors. Conversely, a low SNR is like trying to have a conversation in a loud,
crowded room—the noise interferes with the signal, leading to garbled data and a higher Bit
Error Rate (BER). This forces the system to perform retransmissions, which slows down
the connection and wastes bandwidth.

2. Data Rate and Modulation

SNR is a key factor in determining the maximum data rate a wireless channel can support.
This relationship is described by the Shannon-Hartley Theorem, which states that channel
capacity (C) is directly proportional to bandwidth (B) and a function of the SNR (S/N).
C=B⋅log2​(1+S/N) Higher SNR allows for more complex modulation schemes. For
example, a low SNR might only support simple schemes like BPSK (Binary Phase Shift
Keying), which transmits a small amount of data per symbol. A high SNR, however, can
handle more complex schemes like 64-QAM (Quadrature Amplitude Modulation), which can
pack significantly more data into each symbol, leading to much higher data rates.

3. Connection Stability and Range

SNR is dynamic and fluctuates based on environmental factors like distance, obstacles, and
interference. As a device moves farther from the access point, the signal weakens, and the
SNR drops. Similarly, interference from other devices, such as microwaves or cordless
phones, can increase the noise floor and lower the SNR. A low SNR can cause frequent
disconnections or force a device to switch to a lower, more reliable data rate, which
negatively impacts user experience.

In summary, a high SNR is essential for a robust wireless network. It ensures clear data
transmission, enables higher data rates through advanced modulation, and contributes to a
stable, reliable connection. Without a sufficient SNR, a wireless system's performance will
be severely degraded
Que } The study says low SNR only affects speed not error is it right ? identify your answer

👎
The statement that a low Signal-to-Noise Ratio (SNR) only affects speed and not the
error rate is incorrect.

In reality, a low SNR primarily increases the error rate in wireless communication. Modern
wireless systems, however, are designed with a built-in mechanism called Adaptive
Modulation and Coding (AMC) to mitigate this effect. This is why you often experience a
drop in speed when your signal is weak.

How Low SNR Causes Errors

A low SNR means the received signal is weak and difficult to distinguish from background
noise. This directly leads to an increase in Bit Error Rate (BER), which is the number of
erroneous bits received per unit of time. When the receiver cannot correctly decode the
transmitted data, it results in corrupted packets. This is like trying to have a conversation in
a loud, crowded room—the noise makes it difficult to understand the words, leading to
mistakes.

The Role of Adaptive Modulation and Coding (AMC)

Modern wireless technologies (like Wi-Fi and 4G/5G cellular) don't simply allow errors to
happen. Instead, they constantly monitor the SNR and dynamically adjust their data rate
to maintain a low error rate.

●​ High SNR: When the signal is strong, the system uses a complex modulation
scheme (e.g., 64-QAM), which packs more bits into each symbol, resulting in high
speeds.
●​ Low SNR: When the SNR drops, the system automatically switches to a more
robust, but less efficient, modulation scheme (e.g., QPSK). This scheme transmits
fewer bits per symbol, which makes the transmission more resilient to noise and
reduces the error rate, but it comes at the cost of a lower data rate.

In essence, the system sacrifices speed to ensure the data is transmitted correctly,
preventing a high error rate. This is why you experience a slowdown in speed rather than a
flood of errors when your connection is weak. The system is proactively responding to the
high error potential caused by the low SNR. If the system did not do this, a low SNR would
result in both a high error rate and a slow connection due to constant retransmissions.
Que } difference between low SNR and high SNR with the help of real life communication
example

Signal-to-Noise Ratio (SNR) is the measure of the strength of a desired signal relative to the
level of background noise. The difference between high and low SNR fundamentally affects
the quality and reliability of communication.

High SNR (Good Connection)

A high SNR means the desired signal is significantly stronger and clearer than the
surrounding noise.

●​ Characteristics: The signal is distinct and easy for the receiver to decode.
●​ Performance: High data rates, low error rates, and a stable, reliable connection.
This allows for the use of more complex and efficient modulation schemes (e.g.,

🤫
64-QAM), which transmit more bits per symbol.
●​ Real-Life Example: A face-to-face conversation in a quiet library . The sound of
your voice (the signal) is very clear and distinct, with minimal background noise. You
can easily understand every word, and the conversation flows smoothly without any
need for repetition.

Low SNR (Poor Connection)

A low SNR means the desired signal is weak and is being interfered with by noise.

●​ Characteristics: The signal is difficult to distinguish from the noise, and it can be
easily corrupted.
●​ Performance: Lower data rates and a higher potential for errors. To combat errors,
the system must switch to a simpler, more robust modulation scheme (e.g., QPSK),
which sacrifices speed for reliability. This also leads to frequent retransmissions,

☕
further slowing down the connection.
●​ Real-Life Example: A phone call in a busy, noisy cafe . The sound of the other
person's voice (the signal) is faint and constantly being interrupted by the noise of
other people talking, clattering dishes, and music. You have to ask the person to
repeat themselves often (retransmissions), and the conversation is slow and choppy.
Que } Capacity factors in terms of network analysis

In network analysis, capacity factors are the key metrics and attributes that determine the
maximum amount of data a network can handle over a specified period. These factors help
network engineers assess the current performance and plan for future growth and demand.
The theoretical maximum capacity is limited by the physical characteristics of the network,
but the actual usable capacity is affected by many other factors.

Key Capacity Factors

●​ Bandwidth: This is the most fundamental capacity factor. Bandwidth is the

theoretical maximum amount of data that can be transmitted over a network
connection, typically measured in bits per second (bps). It represents the size of the
"pipe." A higher bandwidth allows for more data to be transmitted simultaneously.
●​ Throughput: Throughput is the actual amount of data successfully transferred from
one point to another in a given timeframe. It is almost always lower than the
theoretical bandwidth due to various real-world factors.
○​ Latency: The time delay for data to travel from source to destination. High
latency reduces the effective throughput, as it increases the time it takes for
data to be acknowledged and for the next transmission to begin.
○​ Packet Loss: The percentage of data packets that fail to reach their
destination. High packet loss forces retransmissions, which uses up available
bandwidth and reduces effective throughput.
●​ Network Equipment: The capabilities of the physical hardware, such as routers,
switches, and firewalls, directly influence network capacity. Outdated or
underpowered equipment can become a bottleneck, regardless of the available
bandwidth.
●​ Network Architecture: The topology and design of the network (e.g., star, mesh)
and the presence of redundancy or failover mechanisms also play a role. A
well-designed architecture can distribute traffic more efficiently.
●​ Protocol Overhead: The communication protocols (like TCP/IP) add extra data to
each packet for addressing and control. This "overhead" reduces the amount of
space available for the actual data, lowering the effective capacity.
●​ Traffic Patterns and User Demand: The type of traffic (e.g., real-time video vs. bulk
file transfers) and the number of users accessing the network at peak times are
crucial factors. A network must be designed to handle these peak loads without
degrading performance
Que } Make list of all factor and explain that is considered when we analyse network
capacity

📊
When you analyze network capacity, you're evaluating the total amount of data a network
can handle and how efficiently it can do so. This isn't just about a single number; it
involves a list of interconnected factors that determine real-world performance.

1. Bandwidth

Bandwidth is the maximum theoretical data rate of a network connection. It's the size of
the "pipe" and is measured in bits per second (bps). A 1 Gbps fiber optic link has a higher
bandwidth than a 100 Mbps copper Ethernet cable, meaning it has the potential to carry
more data.

2. Throughput

Throughput is the actual amount of data successfully transmitted over the network in a
given period. It's the real-world performance, which is almost always lower than the
theoretical bandwidth. Throughput accounts for all the real-world factors that slow things
down.

●​ Analogy: If bandwidth is the size of a water pipe, throughput is the actual amount of
water coming out of the faucet. The pipe's size might be large, but if there's a clog
(congestion), the amount of water coming out will be less.

3. Latency & Jitter

●​ Latency is the time delay for a data packet to travel from its source to its destination.
It's measured in milliseconds (ms). High latency can make applications feel slow and
unresponsive, even on a high-bandwidth network.
●​ Jitter is the variation in latency over time. This is critical for real-time applications
like video conferencing or VoIP. If some data packets arrive with a long delay and
others arrive on time, the audio or video will be choppy.

4. Network Hardware & Architecture

The capacity of a network is limited by the capabilities of its equipment. 🛠️
Outdated or
low-quality routers and switches can create bottlenecks, where data backs up and slows
down, regardless of the bandwidth. The network's topology (e.g., star, mesh) also plays a
role in how traffic is managed and how resilient the network is to failures.

5. Traffic Patterns & Protocol Overhead

●​ Traffic Patterns: The type of data being transmitted and the time of day it's sent
matter. A network must be analyzed based on its peak usage periods and the
demands of its applications. For instance, a network needs to handle a massive
number of concurrent video streams during business hours.
●​ Protocol Overhead: Communication protocols (like TCP/IP) add extra data to each
packet for addressing, error correction, and control. This overhead consumes a
portion of the available bandwidth, reducing the effective throughput.

6. Packet Loss & Congestion

●​ Packet Loss: This occurs when data packets are dropped or fail to reach their
destination. It can be caused by network congestion or faulty equipment. Lost
packets must be retransmitted, which reduces efficiency and increases latency.
●​ Congestion: This is the state where a network node or link is overloaded with too
much data, causing a slowdown. It's a key factor that directly impacts throughput and
can be a sign that network capacity is being exceeded.

Que } Imagine you are sending an mail how osi layer would handle the process

When you send an email, the process is handled by the OSI (Open Systems
Interconnection) model, a conceptual framework that breaks down network communication
into seven distinct layers. The data (your email) starts at the top layer on your computer and
moves down the stack, getting prepared for transmission, and then moves back up the
stack on the recipient's computer.

The Sender's Journey 🚀

Layer 7: Application Layer
This is the layer you directly interact with. Your email client (like Outlook or Gmail) uses
protocols like SMTP (Simple Mail Transfer Protocol) to send your email. It takes the text,
images, and attachments you've prepared and turns it into data that can be sent over the
network.

Layer 6: Presentation Layer

The presentation layer handles data formatting and encryption. It makes sure the data is in
a common format so the recipient's email client can understand it, regardless of what
software they're using. If you have an HTML email, it ensures the formatting is preserved. It
also encrypts the email content for secure transmission.

Layer 5: Session Layer

This layer establishes, manages, and terminates the communication session between your
computer and the email server. It's responsible for the "dialogue" between the two
applications, making sure the connection remains open long enough to send the entire
email and then properly closing it.

Layer 4: Transport Layer

The transport layer takes the data from the upper layers and divides it into smaller chunks
called segments. It adds a header to each segment with information like the source and
destination port numbers. For a reliable connection, it uses a protocol like TCP
(Transmission Control Protocol) to ensure every segment is delivered in the correct order
and without errors.

Layer 3: Network Layer

The network layer is all about routing. It takes the segments from the transport layer and
packages them into packets. It adds a header that includes the source and destination IP
addresses. This layer is what allows the email to be sent across different networks on the
internet, as it determines the best path for the data to travel.

Layer 2: Data Link Layer

The data link layer handles communication between devices on the same network
segment. It takes the packets from the network layer and encapsulates them into frames. It
adds the sender's and receiver's MAC addresses to the frame header. This is the last layer
that uses a logical address before the data is physically transmitted.

Layer 1: Physical Layer

This is the physical medium. It takes the frames from the data link layer and converts them
into raw binary bits (0s and 1s). It then transmits these bits as electrical signals (over a
copper cable), light signals (over a fiber optic cable), or radio waves (via Wi-Fi) to the first
network device.

The Recipient's Journey 📧

Once the bits are received by the recipient's device, the process happens in reverse, from
Layer 1 up to Layer 7. Each layer strips away the header added by the sender's
corresponding layer, and the data is reassembled until it can be read by the recipient's
email client. This process, called de-encapsulation, ensures the email arrives in its
original, readable form.