1. HSRP
The virtual MAC addressof HSRP version1 is 0000.0C07.ACxx, where xxisthe HSRPgroup number
inhexadecimal basedonthe respective interface.HSRPversion2usesa virtual MACaddressof
0000.0C9F.FXXX. Virtual MACaddresscan be configured manually.
HSRP version1hellopacketsare sentto multicastaddress224.0.0.2 while HSRPversion2hello
packetsare sentto multicastaddress224.0.0.102. CurrentlyHSRPv1isthe defaultversionwhen
runningHSRPon Ciscodevices.
Hellotime =3 sec
Holdtime = 10 sec
HSRP consistsof 5 states:
State Description
Initial
Thisis the beginningstate.ItindicatesHSRPisnotrunning.It happenswhenthe
configurationchangesorthe interface isfirstturnedon
Listen
The router knowsbothIPand MAC addressof the virtual routerbutit isnot the active or
standbyrouter.For example,if there are 3 routersinHSRP group,the routerwhichis notin
active or standbystate will remaininlistenstate.
Speak
The router sendsperiodicHSRPhellosand participatesinthe electionof the active or
standbyrouter.
Standby
In thisstate,the routermonitorshellosfromthe active routeranditwill take the active
state whenthe currentactive routerfails(nopacketsheardfromactive router)
Active
The router forwardspacketsthatare sentto the HSRP group.The routeralsosends
periodichellomessages
Please notice thatnotall routersina HSRPgroup go throughall statesabove.Ina HSRP group,only
one routerreachesactive state and one routerreachesstandbystate.Otherrouterswill stopat
listenstate.
+ The group numbersof HSRPversion1 range from 0 to 255. HSRPdoessupportgroup numberof 0
(we docheck itand infact, it isthe defaultgroupnumberif youdon’tentergroupnumberinthe
configuration) soHSRPversion1supportsupto 256 groupnumbers.HSRPversion2 supports4096
groupnumbers.
WithHSRP, twoor more devicessupportavirtual routerwithafictitiousMACaddressandunique IP
address.There are twoversionof HSRP.
+ WithHSRP version1,the virtual router’sMAC addressis0000.0c07.ACxx , inwhichxx isthe HSRP
group.
+ WithHSRP version2,the virtual MAC addressif 0000.0C9F.Fxxx,in whichxxx isthe HSRPgroup.
Note:Anothercase isHSRP forIPv6, inwhichthe MAC addressrange from 0005.73A0.0000 through
0005.73A0.0FFF.
2. GLBP
Whenthe routersare configuredtoa GLBP group,theyfirstelectone gatewaytobe the Active
Virtual Gateway(AVG) forthatgroup.The electionisbasedonthe priorityof eachgateway (highest
prioritywins).If all of themhave the same prioritythenthe gatewaywiththe highestreal IPaddress
becomesthe AVG.The AVG,inturn, assignsa virtual MACaddressto eachmemberof the GLBP
group.Each gatewaywhichisassignedavirtual MAC addressiscalledActive Virtual Forwarder
(AVF).A GLBP group onlyhasa maximumof fourAVFs.If there are more than 4 gatewaysina GLBP
groupthenthe restwill become StandbyVirtual Forwarder(SVF) whichwill take the place of aAVF
incase of failure.The virtual MACaddressinGLBPis 0007.b400.xxyy where xx isthe GLBP group
numberandyy isthe differentnumberof eachgateway(01, 02, 03…).
To detect a gateway failure, GLBP members communicate between each other through hello
messages sent every 3 seconds to the multicast address 224.0.0.102, User Datagram Protocol
(UDP) port 3222.
GLBP supports up to 1024 virtual routers (GLBP groups) per physical interface of a router.
Load balancing algorithm
GLBP load sharing is done in one of three ways:
Round-robin load-balancing algorithm: Each router MAC is used sequentially to respond
to ARP requests. This is the default load balancing mode in GLBP and is suitable for any
number of end hosts.
Weighted load-balancing algorithm: Traffic is balanced proportional to a configured
weight. Each GLBP router in the group will advertise its weighting and assignment; the AVG
will act based on that value. For example, if there are two routers in a group and R1 has
double the forwarding capacity of router B, the weighting value of router A should be
configured to be double the amount of R2.
Host-dependent load-balancing algorithm: A given host always uses the same router.
VRRP
Object tracking is the process of tracking the state of a configured object and uses that state
to determine the priority of the VRRP router in a VRRP group. Unlike HSRP which can track
interface status directly, VRRP can only track interface status through a tracked object.
SNMP
SNMP is an application-layer protocol that provides a message format for communication
between SNMP managers and agents. SNMP provides a standardized framework and a
common language used for the monitoring and management of devices in a network.
The SNMP framework has three parts:
3. + An SNMP manager
+ An SNMP agent
+ A Management Information Base (MIB)
The SNMP manager is the system used to control and monitor the activities of network hosts
using SNMP. The most common managing system is called a Network Management System
(NMS). The term NMS can be applied to either a dedicated device used for network
management, or the applications used on such a device. A variety of network management
applications are available for use with SNMP. These features range from simple command-
line applications to feature-rich graphical user interfaces (such as the CiscoWorks2000 line of
products).
The SNMP agent is the software component within the managed device that maintains the
data for the device and reports these data, as needed, to managing systems. The agent and
MIB reside on the routing device (router, access server, or switch). To enable the SNMP
agent on a Cisco routing device, you must define the relationship between the manager and
the agent.
The Management Information Base (MIB) is a virtual information storage area for network
management information, which consists of collections of managed objects.
A TRAP is a SNMP message sent from one application to another (which is typically on a
remote host). Their purpose is merely to notify the other application that something has
happened, has been noticed, etc. The big problem with TRAPs is that they’re
unacknowledged so you don’t actually know if the remote application received your oh-so-
important message to it. SNMPv2 PDUs fixed this by introducing the notion of an INFORM,
which is nothing more than an acknowledged TRAP.
Cisco IOS software supports the following versions of SNMP:
+ SNMPv1 – The Simple Network Management Protocol: A Full Internet Standard, defined
in RFC 1157. (RFC 1157 replaces the earlier versions that were published as RFC 1067 and
RFC 1098.) Security is based on community strings.
+ SNMPv2c – The community-string based Administrative Framework for SNMPv2.
SNMPv2c (the “c” stands for “community”) is an Experimental Internet Protocol defined in
RFC 1901, RFC 1905, and RFC 1906. SNMPv2c is an update of the protocol operations and
data types of SNMPv2p (SNMPv2 Classic), and uses the community-based security model of
SNMPv1.
+ SNMPv3 – Version 3 of SNMP. SNMPv3 is an interoperable standards-based protocol
defined in RFCs 2273 to 2275. SNMPv3 provides secure access to devices by a combination
of authenticating and encrypting packets over the network. The security features provided in
SNMPv3 are as follows:
4. – Message integrity: Ensuring that a packet has not been tampered with in transit.
– Authentication: Determining that the message is from a valid source.
– Encryption: Scrambling the contents of a packet prevent it from being learned by an
unauthorized source.
SNMPv1/v2 can neither authenticate the source of a management message nor provide
encryption. Without authentication, it is possible for nonauthorized users to exercise SNMP
network management functions. It is also possible for nonauthorized users to eavesdrop on
management information as it passes from managed systems to the management system.
Because of these deficiencies, many SNMPv1/v2 implementations are limited to simply a
read-only capability, reducing their utility to that of a network monitor; no network control
applications can be supported. To correct the security deficiencies of SNMPv1/v2, SNMPv3
was issued as a set of Proposed Standards in January 1998.
The two additional messages are added in SNMP2 (compared to SNMPv1)
GetBulkRequest The GetBulkRequest message enables an SNMP manager to access large
chunks of data. GetBulkRequest allows an agent to respond with as much information as will
fit in the response PDU. Agents that cannot provide values for all variables in a list will send
partial information.
InformRequest The InformRequest message allows NMS stations to share trap information.
(Traps are issued by SNMP agents when a device change occurs.) InformRequest messages
are generally used between NMS stations, not between NMS stations and agents.
NETFLOW
NetFlow traditionally enables several key customer applications including:
+ Network Monitoring – NetFlow data enables extensive near real time network monitoring
capabilities. Flow-based analysis techniques may be utilized to visualize traffic patterns
associated with individual routers and switches as well as on a network-wide basis (providing
aggregate traffic or application based views) to provide proactive problem detection, efficient
troubleshooting, and rapid problem resolution.
+ Application Monitoring and Profiling – NetFlow data enables network managers to gain
a detailed, time-based, view of application usage over the network. This information is used
to plan, understand new services, and allocate network and application resources (e.g. Web
server sizing and VoIP deployment) to responsively meet customer demands.
+ User Monitoring and Profiling – NetFlow data enables network engineers to gain detailed
understanding of customer/user utilization of network and application resources. This
information may then be utilized to efficiently plan and allocate access, backbone and
application resources as well as to detect and resolve potential security and policy violations.
5. + Network Planning – NetFlow can be used to capture data over a long period of time
producing the opportunity to track and anticipate network growth and plan upgrades to
increase the number of routing devices, ports, or higher- bandwidth interfaces. NetFlow
services data optimizes network planning including peering, backbone upgrade planning, and
routing policy planning. NetFlow helps to minimize the total cost of network operations
while maximizing network performance, capacity, and reliability. NetFlow detects unwanted
WAN traffic, validates bandwidth and Quality of Service (QOS) and allows the analysis of
new network applications. NetFlow will give you valuable information to reduce the cost of
operating your network.
+ Security Analysis – NetFlow identifies and classifies DDOS attacks, viruses and worms in
real-time. Changes in network behavior indicate anomalies that are clearly demonstrated in
NetFlow data. The data is also a valuable forensic tool to understand and replay the history of
security incidents.
+ Accounting/Billing – NetFlow data provides fine-grained metering (e.g. flow data includes
details such as IP addresses, packet and byte counts, timestamps, type-of-service and
application ports, etc.) for highly flexible and detailed resource utilization accounting.
Service providers may utilize the information for billing based on time-of-day, bandwidth
usage, application usage, quality of service, etc. Enterprise customers may utilize the
information for departmental charge-back or cost allocation for resource utilization.
What isan IPFlow?
Each packet thatis forwardedwithinarouterorswitchis examinedforaset of IP packetattributes.
These attributesare the IPpacketidentityorfingerprintof the packetanddetermine if the packetis
unique orsimilartootherpackets.
Traditionally,anIPFlowisbasedon a setof 5 andup to 7 IP packetattributes.
IP PacketattributesusedbyNetFlow:
+ IP source address
+ IP destinationaddress
+ Source port
+ Destinationport
+ Layer 3 protocol type
+ Classof Service
+ Routeror switchinterface
Flowmonitorsare the Flexible NetFlowcomponentthatisappliedtointerfacestoperformnetwork
trafficmonitoring.Flowmonitorsconsist of arecordand a cache. You add the recordto the flow
monitorafteryoucreate the flowmonitor.The flow monitorcache isautomaticallycreatedatthe
time the flowmonitorisappliedtothe firstinterface.Flow dataiscollectedfromthe networktraffic
duringthe monitoringprocessbasedonthe keyandnonkeyfieldsinthe record,whichisconfigured
for the flowmonitorandstoredinthe flow monitorcache.
For example,the followingexample createsaflow monitornamedFLOW-MONITOR-1andenters
Flexible NetFlowflow monitorconfigurationmode:
6. Router(config)#flowmonitorFLOW-MONITOR-1
Router(config-flow-monitor)#
etFlowfacilitatessolutionstomanycommonproblemsencounteredbyITprofessionals.
+ Analyze newapplicationsand theirnetwork impact
IdentifynewapplicationnetworkloadssuchasVoIPorremote site additions.
+ Reductionin peak WANtraffic
Use NetFlowstatisticstomeasure WAN trafficimprovementfromapplication-policychanges;
understandwhoisutilizingthe networkandthe networktoptalkers.
+ Troubleshootingandunderstandingnetwork pain points
Diagnose slownetworkperformance,bandwidthhogsandbandwidthutilizationquicklywith
commandline interface orreportingtools.
+ DetectionofunauthorizedWAN traffic
Avoidcostlyupgradesbyidentifyingthe applicationscausingcongestion.
+ Securityand anomaly detection
NetFlowcanbe usedforanomalydetectionandwormdiagnosisalongwithapplicationssuchas
CiscoCS-Mars.
+ ValidationofQoS parameters
Confirmthatappropriate bandwidthhasbeenallocatedtoeachClassof Service (CoS) andthatno
CoS isover- or under-subscribed.
SYSLOG
By default, switches send the output from system messages and debug privileged EXEC
commands to a logging process. The logging process controls the distribution of logging
messages to various destinations, such as the logging buffer (on RAM), terminal lines
(console terminal), or a UNIX syslog server, depending on your configuration. The process
also sends messages to the console.
Note: Syslog messages can be written to a file in Flash memory although it is not a popular
place to use. We can configure this feature with the command logging file flash:filename.
The Message Logging is divided into 8 levels as listed below:
Level Keyword Description
0 emergencies System is unusable
1 alerts Immediate action is needed
2 critical Critical conditions exist
3 errors Error conditions exist
7. 4 warnings Warning conditions exist
5 notification Normal, but significant, conditions exist
6 informational Informational messages
7 debugging Debugging messages
The highest level is level 0 (emergencies). The lowest level is level 7. If you specify a level
with the “logging console level” command, that level and all the higher levels will be
displayed. For example, by using the “logging console warnings” command, all the logging
of emergencies, alerts, critical, errors, warnings will be displayed.
ETHER CHANNEL
EtherChannel Load-Balancing
EtherChannel load-balances traffic among port members of the same channel. Load balancing
between member interface is based on:
+ Source MAC address
+ Destination MAC address
+ Source IP Address
+ Destination IP Address
+ Combinations of the four
Note: Some old switch/router flatforms do not support all the load-balancing methods above.
To configure load-distribution method, use the command port-channel load-balance under
global configuration mode. For example to load-balance based on destination MAC use the
command:
Router(config)#port-channel load-balance dst-mac
BASIC QUESTIONS
ModernEthernetnetworksbuiltwithswitchesandfull-duplex connectionsnolongerutilize
CSMA/CD.CSMA/CD isonlyusedinobsolete sharedmediaEthernet (whichusesrepeaterorhub).
The followinglocationscanbe configuredasa source forthe IOSimage:
+ Flash(the defaultlocation)
8. + TFTP server
+ ROM(usedif noothersource isfound)
When you turn the router on, it runs through the following boot process.
The Power-On Self Test (POST) checks the router’s hardware. When the POST completes
successfully, the System OK LED indicator comes on.
The router checks the configuration register to identify where to load the IOS image from. A
setting of 0×2102 means that the router will use information in the startup-config file to
locate the IOS image. If the startup-config file is missing or does not specify a location, it
will check the following locations for the IOS image:
1. Flash (the default location)
2. TFTP server
3. ROM (used if no other source is found)
The router loads the configuration file into RAM (which configures the router).
CISCO BOOT SECQUENCE
9. In some seriesof routers,the RAMinformationisdisplayedby2parameters(inthiscase
60416K/5120K). The firstparameterindicateshow muchRAMis inthe routerwhile the second
parameter(5120K) indicateshowmuchDRAMisbeingusedforPacketmemory.
SWITCHING
Microsegmentationisanetworkdesign(functionality) whereeachworkstation ordevice ona
networkgetsitsowndedicatedsegment(collisiondomain) to the switch.Eachnetworkdevice gets
the full bandwidthof the segmentanddoesnothave toshare the segmentwithotherdevices.
Microsegmentationreducesandcaneveneliminate collisions because eachsegmentisitsown
collisiondomain ->.
Note:Microsegmentationdecreasesthe numberof collisions butitincreasesthe numberof collision
domains.
TRUNKING
The showvlan commandonlydisplaysaccessports, the trunkportsare notshownin thiscommand
(we can use the “showinterface trunk”commandto see trunkedports)
STP
SpanningTree Protocol convergence (Layer2convergence) happenswhenbridgesandswitches
have transitionedtoeitherthe forwarding orblockingstate.Whenlayer2isconverged,rootbridge
iselectedandall portroles(Root,DesignatedandNon-Designated) inall switchesare selected.
RSTP
There are only three port states left in RSTP that correspond to the three possible operational
states. The 802.1D disabled, blocking, and listening states are merged into the 802.1w
discarding state.
10. * Discarding – the port does not forward frames, process received frames, or learn MAC
addresses – but it does listen for BPDUs (like the STP blocking state)
* Learning – receives and transmits BPDUs and learns MAC addresses but does not yet
forward frames (same as STP).
* Forwarding – receives and sends data, normal operation, learns MAC address, receives
and transmits BPDUs (same as STP).
STP State (802.1d) RSTP State (802.1w)
Blocking Discarding
Listening Discarding
Learning Learning
Forwarding Forwarding
Disabled Discarding
Although the learning state is also used in RSTP but it only takes place for a short time as
compared to STP. RSTP converges with all ports either in forwarding state or discarding
state.
RSTP Quick Summary:
RSTP provides faster convergence than 802.1D STP when topology changes occur.
* RSTP defines three port states: discarding, learning, and forwarding.
* RSTP defines five port roles: root, designated, alternate, backup, and disabled.
NAT
NAT terms:
* Inside local address – The IP address assigned to a host on the inside network. The address
is usually not an IP address assigned by the Internet Network Information Center (InterNIC)
or service provider. This address is likely to be an RFC 1918 private address.
* Inside global address – A legitimate IP address assigned by the InterNIC or service
provider that represents one or more inside local IP addresses to the outside world.
* Outside local address – The IP address of an outside host as it is known to the hosts on the
inside network.
* Outside global address – The IP address assigned to a host on the outside network. The
owner of the host assigns this address.
11. VLAN
Whena switchcannot finda destinationMACaddresslistedonitsMACAddressTable,itwill flooda
frame to everysingle portexceptthe one itcame infrom – thisframe iscalledunknownunicast
frame.It’sa broadcast mac addressFF:FF:FF:FF:FF:FF
FRAME RELAY
The PVC STATUS displays the status of the PVC. The DCE device creates and sends the
report to the DTE devices. There are 4 statuses:
+ ACTIVE: the PVC is operational and can transmit data
+ INACTIVE: the connection from the local router to the switch is working, but the
connection to the remote router is not available
+ DELETED: the PVC is not present and no LMI information is being received from the
Frame Relay switch
+ STATIC: the Local Management Interface (LMI) mechanism on the interface is disabled
(by using the “no keepalive” command). This status is rarely seen so it is ignored in some
books.
In general, BECN is used on frames traveling away from the congested area to warn source
devices that congestion has occurred on that path while FECN is used to alert receiving
devices if the frame experiences congestion.
12. BECN also informs the transmitting devices to slow down the traffic a bit until the network
returns to normal state.
IP ROUTING
Whenthere ismore than one way to reacha destination,itwill choosethe bestone basedona
couple of things.First,itwill choose the route thathasthe longestmatch;meaningthe most specific
route.So,in thiscase the /24 routeswill be chosenoverthe /16 routes.Next,fromall the /24 routes
it will choose the one withthe lowestadministrative distance.Directlyconnectedroutes have anAD
of 1 so thiswill be the route chosen.
Routers treatment with incoming packet
Whereasswitchescanonlyexamineandforwardpacketsbasedonthe contentsof the MAC header,
routerscan lookfurtherintothe packetto discoverthe networkforwhicha packetis destined.
Routersmake forwardingdecisionsbasedonthe packet'snetwork-layerheader(such asan IPX
headeror IPheader).These network-layerheaders containsource anddestination network
addresses.Local devicesaddresspacketstothe router'sMAC addressinthe MAC header.After
receivingthe packets,the routermustperformthe followingsteps:
1. Checkthe incomingpacketforcorruption, andremove the MAC header. The routerchecks the
packetfor MAC-layererrors.The routerthenstripsoff the MAC headerandexaminesthe network-
layerheadertodetermine whattodowith the packet.
2. Examine the age of the packet.The router mustensure thatthe packethas not come too far to be
forwarded.Forexample,IPXheaderscontainahopcount.By default,15 hopsisthe maximum
numberof hops(or routers) thata packetcan cross. If a packet hasa hopcount of 15, the router
discardsthe packet.IP headerscontainaTime to Live (TTL) value.Unlike the IPXhopcount, which
incrementsasthe packetisforwardedthrougheachrouter, the IP TTL value decrementsas the IP
packetis forwardedthrougheachrouter.If an IPpackethas a TTL value of 1, the routerdiscardsthe
packet.A routercannotdecrementthe TTL value to 1 and thenforwardthe packet.
3. Determine the route tothe destination.Routersmaintainaroutingtable thatlistsavailable
networks,the directiontothe desirednetwork(theoutgoinginterfacenumber),andthe distance to
those networks.Afterdeterminingwhichdirectiontoforwardthe packet,the routermustbuilda
newheader.(If youwantto readthe IProutingtablesona Windows95/98 workstation,type ROUTE
PRINTin the DOS box.)
4. Buildthe newMAC headerandforwardthe packet.Finally,the routerbuildsanew MACheader
for the packet.The MAC headerincludesthe router'sMACaddressandthe final destination's MAC
addressor the MAC addressof the nextrouterin the path.
13. Syntax fordefaultroute is:
iproute <Remote_Network><Netmask><Next_Hop_Address>.
DHCP
An addressconflictoccurswhentwohostsuse the same IP address.Duringaddressassignment,
DHCP checksfor conflictsusingpingandgratuitousARP.If a conflictisdetected,the addressis
removedfromthe pool.The addresswill notbe assigneduntil the administratorresolvesthe
conflict.
OSPF
In ospf these entries must match on neighboring routers:
- Hello and dead intervals
– Area ID (Area 0 in this case)
– Authentication password
– Stub area flag
14. EIGRP
The followinginformationmustbe matched soas to create neighborhood. EIGRProutersto
establish,mustmatchthe followinginformation:
1. AS Number;
2. K value.
TROUBLESHOOTING
From the output we see the Serial0/0 of RouterA is in “status up/protocol down” state which
indicates a Layer 2 problem so the problem can be:
+ Keepalives mismatch
+ Encapsulation mismatch
+ Clocking problem
IPv6
Below is the list of common kinds of IPv6 addresses:
Loopback address ::1
Link-local address FE80::/10
Site-local address FEC0::/10
Global address 2000::/3
Multicast address FF00::/8
15.
16. Question 5
What is SNMPv3 authentication protocol?
Answer: HMAC-MD5 or HMAC-SHA (Maybe either of them will appear in the exam)
Question 1
Etherchannel question: You are given sw1 and sw2. The output of show etherchannel
summary and show interface fa0/1. What is the cause of the problem? in exhibit, switch a
cable is 100mb/s speed and b is 10mb/s. If you can look very carefully, there is speed
mismatched to cause that problem. I selected “speed mismatch”
Question 2
Q2 (Etherchannel Questions that goes like this)
Refer to the exhibit. Etherchannel has been configured on Switch1 as shown.
Switch1# conf t
Switch1(config)# interface range gigabitethernet 1/1
Switch1(config)# Channel-group 5 Mode “AUTO”
Switch1#
Switch1(config)# interface range gigabitethernet 1/2
Switch1(config)# Channel-group 5 Mode “AUTO”
Which is the correct command set to configure etherchannel on Switch2?
A.
Switch2# configure terminal
Switch2(config)# interface range gigabitethernet3/1 -2
Switch2(config-if)# channel-group 5 mode auto
B.
Switch2# configure terminal
Switch2(config)# interface range gigabitethemet3/1 -2
Switch2(config-if)# channel-group 5 mode passive
C.
Switch2# configure terminal
17. Switch2(config)# interface range gigabitethernet3/1 -2
Switch2(config-if)# channel-group 5 mode desirable
D.
Switch2# configure terminal
Switch2(config)# interface range gigabitethernet3/1 -2
Switch2(config-if)# channel-group 5 mode ACTIVE
Answer: C
Good resource:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/c
onfiguration/guide/swethchl.html#wp1028480
Question 3
Which OSPF command turn OSPF on all interfaces of a router?
Answer: network 0.0.0.0 255.255.255.255
Question 4
Network admin creates a layer 3 Etherchannel, bounding 4 interfaces into channel group 1.
On what interface is the IP address configured?
A. the port-channel 1 interface
B. the highest number member interface
C. all member interfaces
D. the lowest number member interface
Answer: A
Question 5
3. What is the authentication type of SNMPv2?
Answer: Community string
Question 6
What parameters can be different on ports with an Etherchannel?
18. A. speed
B. trunk encapsulation
C. DTP negotiation setting
D. duplex
Answer: C
Question 7
Which is true about OSPF router-id? (Choose two)
A. It is used for type 1 router LSA
B. Highest IP address of the loopback is used
C. router-id needs to be matched on ospf neighbors
D. router-id is 16 bit
Answer: A B
