4 pages APA format paper ($7 only + no plagiarism)
yuvi123
RaymondR.Panko_JuliaL.Panko-BusinessDataNetworksAndSecurity-Pearson2018.pdf
• •
ELEVENTH EDITION
BUSINESS DATA NETWORKS AND SECURITY
@Pearson
Raymond R. Panko University of Hawai'i at Manoa
Julia L. Panko Weber State University
330 Hudson Street, NY NY 10013
Vice President, IT & Careers: Andrew Gilfillan Senior Portfolio Manager: Samantha lewis Managing Producer: Laura Burgess Associate Content Producer: Stephany Harrington Portfolio Management Assistant: Madeline Houpt Director of Product Marketing: Brad Parkins P roduct Marketing Manager: Heather Taylor P roduct Marketing Assistant: Jesika Bethea Field Marketing Manager: Molly Schmidt Field Marketing Assistant: Kelli Fisher Cover Image: uschools/E+ /Getty Images
Vice President, Product Model Management: Jason Fournier Senior P roduct Model Manager: Eric Hakanson Lead, Production and Digital Studio: Heaci,er Darby Digital Studio Course Producer: Jaimie Noy Program Monitor: Christopher Rualizo, SPi Global Project Manager: l\teha Bhargava., Cenveo<O Publisher Services Composition: Cenveo Publisher Services Printer/Binder: LSC Communications Cover Printer: Phoenix Color Text font: Palatino LT Pro
Credits and acknowledgments borrowed from other sources and reproduced, with permission, in this textbook appear on the appropriate page within text or at the end of book.
Microsoft and/or its respective suppliers make no representations about the suitability of the information contained in the documents and related graphics published as part of the services for any purpose. All such documents and related graphics are provided " as is" without warranty of any kind. Microsoft and/or its respecti ve suppliers hereby disclaim all warranties and conditions with regard to this information, including all warranties and conditions of merchantability, whether express, implied or statu tory, fitness for a particular purpose, title and non-infringement. In no event shall Microsoft and/or its respective s uppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection w ith the use or performance of information available from the services.
The documents and related graphics contained herein could include technical inaccuracies or typographical errors. Changes are periodically added to the information herein . Microsoft and/ or its respective s uppliers may make improvements and/ or changes in the product(s) and/or the program(s) described herein at any time. Partial screen shots may be viewed in full w ithin the software version specified.
Trademarks Microsoft® Windows®, and Microsoft Office® are registered trademarks of the Microsoft Corporation in the U.S.A. and other countries. Th.is book is not sponsored or endorsed by or affiliated with the Microsoft Corporation.
Copyright© 2019, 2016, 2013 by Pearson Education, Inc. All rights reserved. Manufactu red in the United States of America. This publication is protected by Copyright, and permission should be obtained from the publisher prior to any prohibited reproduction, s torage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions., request forms and the appropriate contacts w ithin the Pearson Education Global Rights & Permissions department, please visit www.pearsoned.com/ permissions.
Acknowledgements of third party content appear on the appropriate page within the text, which constitutes an extension of this copyright page.
Unless otherwise indicated herein, any third-party trademarks that may appear in this work are the property of their respective owners and any references to third-party trademarks, logos or o ther trade dress are for demonstrative or descriptive pu rposes only. Such references are not intended to imply any sponsorship, endorsement, authorization, or promotion of Pearson's products by the O\mers of such marks, or any relationship between the O\mer and Pearson Education, Inc. or its affiliates, au thors, licensees or distribu tors.
Library of Congress Cataloging-in-Publication Data
Names: Panko, Raymond R.,author. I Panko, Julia L., au thor. Title: Business data networks and security / Raymond R. Panko, University of
Hawai'i at Manoa, Julia L. Panko, \>Veber State University. Description: Tenth edition. I Boston : Pearson, [2018) I Includes
bibliographical references and index. Identifiers: LCCN 20170485861 ISBN 9780134817 125 (alk. paper) I ISBN
0134817125 (alk. paper) Subjects: LCSH: Business enterprises-Computer networks-Security measures. I
Compu ter networks-Management. I Computer ner.-.,orks- Security measu res. I Compu ter secu rity.
Classification: LCC HD30.37 .P36 2018 I DOC 658.4/78-<lc23 LC record available at https:/ / lccn.loc.gov /2017048586
@Pearson ISBN 10: 0134817125 ISBN 13: 9780134817125
To Sal Aurigenuna. A great partner in cri1ne in research and teaching.
This page intentionally left blank
BRIEF CONTENTS
Preface for Adopters xx,
Preface for Students xxxv
About the Authors xii
Chapter 1
Chapter Ta
Chapter2
Chapter 3
Chapter 3a
Chapter4
Chapter 5
Chapter Sa
Chapter6 Chapter6a
Chapter 7 Chapters
Chapter Ba
Chapter9
Chapter9a
Chapter 10
Chapter 11
Appendix
Glossary 425
Index 449
Credits 469
Online Modules
Core Network Concepts and Terminology 1
Hands-On: A Few Inte rnet Tools 36
Netwo rk St andards 37
Netwo rk Management 73 Hands-On: M icrosoft Office Visio 102
Netwo rk Secu rity 107
Ethernet (802.3) Switched LANs 145
Hands-On: Cutting and Connectorizing UTP 175
W ireless LANs I 181
Hands-On: Using Xirrus W i-Fi Inspector
W i reless LANs II 223 TCP/J P lnternetworking I 255
213
Hands-On: W ireshark Packet Captu re 286
TCP/JP lnternetworking II 293
Cisco's 105 Command Line Interface (CU) 322
Carri er W ide Area Networks (WANs) 327
Netwo rked Appl ications 353
Managing the Security Process 387
Module A More on TCP
Module B More on Modulation
Module C More on Telecommunications
Module D Directory Servers
V
Th is page intentionally left blank
CONTENTS
Preface for Adopters xx,
Preface for Students xxxv
About the Authors xii
CHAPTER 1 CORE NETWORK CONCEPTS AND TERMINOLOGY 1 A State of Siege 1
Anything, Anytime, Anywhere 4
The Internet Reorgan izes to Get Commercial 4
Old Yet Always New 5
Owning and Managing t he Internet 7
The Snake in t he Garden 8
Next Steps 9 Outside the Internet 9
Client and Server Hosts 10
Networked Applications 12
The Job of the Source Host 13
The Job of the Desti nation Host 16
Inside the Internet 17
The Main Characters: IP Addresses, Packets, Routers, Data Links, and Routes 17
IP Addresses 17
IP Packets 19
Routers 20
Data Links and Rout es 21
The Transport and Internet Processes in the Network Stack 22
Supervisory Standa rds: Beyond TCP and IP 23
Single Networks, Data links, and Physical l inks 26
Point-to-Point Single Networks 26
Ethernet Single Networks 27
Frames and Packets 29
Single Network Addresses 31
Internet Routers and Personal Access Routers 32
Int ernet Core Routers 32
Residential Access Router 32
vii
viii Contents
Corporate Access Point 33
Where to Next? 33 End-of-Chapter Questions 34
Chapter 1a HANDS-ON: A FEW INTERNET TOOLS 36
Chapter 2 NETWORK STANDARDS 37 How Internet Standards Come to Be 37
• IN MORE OEPTH: April 1 and RFCs 40
Introduction 40
Standard = Protocol 4 1 What Are Network Standards? 41
The Importance of Standards 41
Creating Standards 42 Standards Agencies 42
Standards Architectures 43
The OSI Standards Arch itectu re 45
The TCP/IP Standards Architecture 46
When Do We Capitalize " Internet?" 46
The Hybrid TCP/IP-OSI Standards Architectu re 47
Message Ordering (Plus Reliability and Connection Orientation) in Standards 49
Simple Message Ordering in HTTP 49
Message Ordering and Reliability in TCP at the Transport Layer 50
Message Syntax in Standards 54 Syntax: General Message Organ ization 54
The Syntax of the Internet Protocol (IP} Packet 56
Transmission Control Protocol (TCP) Segment Syntax 57
User Datagram Protocol (UDP) Datagram Syntax 59
Port Numbers 60
Frame Syntax 63
Encoding Application Messages into Binary 64
Encod ing 64
Encod ing Text as ASCII 65
Converting Integers into Binary Numbers (ls and Os} 66
Encod ing Alternatives 68
Protocols in this Chapter 70
End-of-Chapter Questions 71
Chapter 3 NETWORK MANAGEMENT 73 Introduction 73
Network Quality of Service (QoS) 74
Transmission Speed 74
Other Quality-of-Service Metrics 78
Service Level Agreements (SLAs) 80
Network Design 82
Traffic Analysis 82
Reliability Through Redundancy 85
Traffic Requ irements versus Leased Lines 86
Momentary Traffic Peaks 87
Centralized Network Management 90
Ping 92
Traceroute 93
The Simple Network Management Protocol (SNMP) 94
Automation 96 Software-Defined Networking (SON) 96
Traditional Configuration and Its Discontents 96
Software-Defined Networking Operation 99
End-of-Chapter Questions 101
Chapter 3a HANDS-ON: MICROSOFT OFFICE VISIO 102 What is Visio? 102
Using Visio 102
Chapter 4 NETWORK SECURITY 107 The Target Breach 107
The POS Attack 108
Damages 111
Perspective 112
Introduction 112
Types of Attacks 113
Malware Attacks 11 3
Vulnerabilities and Patches 114
Social Engineering: No Vulnerabil ity Necessary 11 4
Types of Malware 115
Payloads 11 7
Human Break-Ins (Hacking) 118
Contents ix
x Contents
Den ial-of-Service (DoS) Attacks 120
Advanced Persistent Threats (APTs) 121
Types of Attackers 122
Cybercrimina ls 122
Employees, Ex-Employees, and Other Insiders 123
Business Competitors 124
Cyberterrorists and National Governments 124
Protecting Dialogues Cryptographically 125
Encryption fo r Confidentiality 125
Electronic Signatures: Message Authenticat ion and Integ rity 126
Host-to-Host Virtual Private Networks (VPNs) 127
Authentication 128
Aut hentication Terminology and Concepts 128
Reusable Passwords 129
Other Forms of Authentication 132
Firewalls and Intrusion Detection Systems 135
Dropping and Logging Provable Attack Packets 136
Stateful Packet Inspection (SPI) Fi rewalls 137
Next-Generation (Application Aware) Firewalls (NGFWs) 139
Intrusion Detection System (IDSs) 141 a IN MORE DEPTH: Antivirus Protection 142
End-of-Chapter Questions 143
Chapter 5 ETHERNET (802.3) SWITCHED LANs 145 Ethernet Begins 145
Introduction 146
Loca l A rea Networks 146
Perspective: Layer 1 and Layer 2 Standards 147
Basic Physical Layer Term inology 148
Ethernet Physical layer Standards 150
Signal ing 150
4-Pai r Unsh ielded Twisted Pair (UTP) Physical Links 152
Optical Fiber (Fiber) 155
Link Aggregation (Bonding) 159
Perspective on Purchasing Physica l Links in Ethernet 160
a IN MORE DEPTH : Fiber Modes and light Wavelength 161
The Ethernet Data Link Layer Switching and Frame Syntax Standard 162
Physical link and Data link Length Restrictions 162 Ethernet Data Link Layer Switch Operation 164
Core Fields in the Ethernet Frame 166 • IN MORE DEPTH: Secondary Fields in Th e Ethernet Frame 168
Management 169
SNMP 169
Reliability 169 Ethernet Security 170
Ethernet Security in Perspective 170 Virtual LANs (VLANs) for Network Segregation 170
Initial User Authentication Through 802.lX 171
802. 1 AE Switch-to-Switch Protection 172
ARP Cache Poisoning 172 End-of-Chapter Questions 173
Chapter Sa HANDS-ON: CUTTING AND CONNECTORIZING UTP 175 Introduction 175
Solid and Stranded Wiring 175
Solid-W ire UTP versus Stranded-Wire UTP 175
Relative Advantages 176 Adding Connectors 176
Cutting the Cord 176
Stripping the Cord 176
Working with the Exposed Pairs 177 Pair Colors 177
Untwisting the Pairs 177 Ordering the Pairs 177
Cutting the W ires 178
Adding the Connector 178
Holding the Connector 178
Sliding in the Wires 179 Some Jacket Inside the Connector 179
Crimping 179
Pressing Down 179
Making Electr ical Contact 179
Str ain Relief 180
Contents xi
xii Contents
Testing 180
Testing with Continuity Testers 180
Testing f or Signal Quality 180
Chapter 6 WIRELESS LANs I 181 Introduction 182
OSI St andards 182
802.11 = W i-Fi 182 Basic Access Point Operation 183
Radio Signal Propagation 184
Perfid ious Radio 184
Frequencies 184
Antennas 185
W ireless Propagation Problems 186
Service Bands and Bandwidth 189
Service Bands 189
Signal and Channel Bandwidth 190
Licensed and Unlicensed Service Bands 192
Channel Use and Co-Channel Int erference 193
The 2.4 GHz and 5 GHz Unlicensed Service Bands 194
Spread Spectrum Transmission 195
Normal versus Spread Spectrum Transm ission 196
Orthogona l Frequency Division Mult iplexing (OFDM) Spread Spectrum Transm ission 197
802. 11 WLAN Operation 197
From 802.11 to 802.3 197
W ireless Networks wit h Mult iple Access Points 198
Media Access Control 199 a IN MORE DEPTH: Media Access Control (Mac) 201
802. 11 Transmission Standards 203
Channel Bandwidth and Service Band Bandwidt h 203
Speed and Market Status 204 Your Service Speed W ill Vary. A Lot. 205
Mult iple Input/M ultip le Out put (MIMO) 205
Beamf orming and Mult iuser M IMO 207 a IN MORE DEPTH: 802.1 1/Wl·FI Notes 208
End-of-Chapter Questions 21 1
Chapte r 6a HANDS-ON: USING XIRRUS Wi-Fi INSPECTOR 213 Introduction 213
The Four Windows 213
The Radar Window (Read the Fine Print) 214
Connection Window 215
The Networks Window 216
Signal History 217
Other Groups on the Ribbon 218
Tests 218 Connection Test 218
Speed Test 219
Quality Test 220
Chapte r 7 WIRE LESS LANs II 223 Child's Play 223
802.11 i WLAN Security 225
802. 11 i 225 802. 11 i Stages 227
Pre-Shared Key (PSK) In it ial Authentication Mode in 802. 11 i 228 802. 1 X Initial Authentication Mode Operation 231
Beyond 802.11 i Security 232
Rogue Access Points 232
Evil Twin Access Points and Virtual Private Networks (VPNs) 233
802.11 Wi-Fi Wireless LAN Management 236
Access Point Placement 236
Centralized Management 238 • IN MORE DEPTH: Expressing Power Ra t ios in Decibels 239
Peer-to-Peer Protocols for the Internet of Things (lo T) 241
Bluetooth 243 Classic Bluetooth and Bluetooth Low Energy (LE) 243
One-to-One, Master- Slave Operation 244
Bluetooth Profiles 246
Bluetooth Low Energy 246
Other Promising loT Transmission Standards 248
Near Field Commun ication (NFC) 248
Co ntents xiii
xiv Contents
W i-Fi Direct 249
Zigbee and 2-Wave 250
Security in the Internet of Things 251
End of Chapter Questions 253
Chapter 8 TCP/IP INTERNETWORKING I 255 Introduction 255
IP Routing 257
Hierarchical 1Pv4 Addressing 257
Routers, Networks, and Subnets 260
Network and Subnet Masks 26 1
How Routers Process Packets 263
Switch ing versus Routing 263
Routing Table 265
Rows Are Routes for All 1Pv4 Addresses in a Range 265
Step 1: Finding All Row Matches 266
Step 2: Selecting the Best-Match Row 269
Step 3: Send ing the Packet Back Out 270
Cheating (Decision Caching) 27 1
Routing Tables for 1Pv6 Addresses 272 a IN MORE OEPTH: Masking When Masks Do Not Break at 8-Sit Boundaries 272
The Internet Protocol Version 4 (IPv4) Fields 273
The First Row 273
The Second Row 274
The Third Row 274
IP Options 275
IP Version 6 (IPv6) 275
Outgrowing 1Pv4 275
1Pv6 275
Writing 1Pv6 Addresses in Canonical Text Notation (RFC 5952) 276
The 1Pv6 Main Header 279
Extension Headers 281
The Transmission Control Protocol (TCP) 282
Fields in TCP/IP Segments 282
Openings and Abrupt TCP Closes 283
The Limited Maximum Length of User Datagram Protocol (UDP) Datagrams 284
End-of-Chapter Questions 285
Chapter Sa HANDS-ON: WIRESHARK PACKET CAPTURE 286 Introduction 286
Getting Wireshark 286
Using Wireshark 286 Getting Started 286
Starting a Packet Capture 287
Getting Data 287
Stopping Data Collection 288
Looking at Individual Packets 289
Options 290
Chapter 9 TCP/IP INTERNETWORKING II 293 Introduction 293
IP Subnetting 294
1Pv4 Subnet Planning 294
1Pv6 Subnetting 296
Other TCP/IP Standards 299 Network Add ress Translation (NAD 299
The Domain Name System (DNS) 301
DHCP Servers 305
Simple Network Management Protocol (SNMP) 306
Dynamic Routing Protocols 309
Contents xv
Internet Control Message Protocol (ICMP) for Supervisory Messages at the Internet Layer 310
IPsec 311
Core IPsec Principles 312
VPNs 313
Applying ESP Protections 314
Security Associations (SAs) 316
Creating Security Associations 318 SSL/TLS VPNs 319
End-of-Chapter Questions 320
xvi Contents
Chapter 9a CISCO'S IOS COMMAND LINE INTERFACE (CLI) 322 Command Line Interfaces (CLls) 322
CU Essentials 323
A More Complex Cisco IOS Interaction 324
Chapter 10 CARRIER WIDE AREA NETWORKS (WANs) 327 LANs and WANS (and MANS) 328
LANs versus MANs and WANs 328
Other Aspects of WANs 330
Carrier WAN Components and Business Uses 33 1
The Telephone System 332
Residential Wired Internet Access 333
Residential Asymmetric Digital Subscriber Line (ADSL) Service 333 Cable Modem Service 334
ADSL versus Cable Modem Service 336
Cellular Data Service 336
Cellular Service 337
Why Cells? 338
Cellular Data Speeds 339
Cellular Generations: 3G, 4G, and 5G 339
Wired Business WANs 340
Leased Lines 341
Reaching the ISP via a Leased Line 342
Leased Line Private Corporate WANs 342
Carrier WAN Services 345
Carrier Ethernet 345
Multi protocol Label Switch ing (MPLS) 347
WAN Optimization 349
End-of-Chapter Questions 351
Chapter 11 NETWORKED APPLICATIONS 353 Introduction 353
Networked Applications and Application Architectures 354
Application Security 356
Netflix Dives into the Amazon 358
Netflix 359
Virtualization and Agility 36 1
Infrastructure as a Service (laaS) and Software as a Service (SaaS) 362
Clients Move into the Cloud 364
Rain Clouds: Security 365
Networks and The Cloud 365 The World Wide Web 366
HTTP and HTML Standards 366
Complex Webpages 367
The Hypertext Transfer Protocol (HTTP) 367
Electronic Mail (E-Mail) 370
Delivery Standards 370
Receiving Standards 371
E-Mail File Format Standards 372
Cryptograph ic E-Mail Protections 373
Voice Over IP (VoIP) 375
CODEC 376
External Components 377
VoIP Signaling 377
The VoIP Transport Packet 378
Peer-to-Peer (P2P) Applications 379
Skype 381
Tor 383
End-of-Chapter Questions 385
Appendix: MANAGING THE SECURITY PROCESS 387 Failures in the Target Breach 388
The Plan- Protect- Respond Cycle 391
Security Planning Principles 392
Risk Analysis 392 Comprehensive Security 394
Defense in Depth and Weakest Links 394
Identify and Manage Single Points of Takeover 397
Least Perm issions 397
Identity Management 400
Segment the Network 402
Organ izational System Secu rity 404
Policy-Based Security Management 406
Policies versus Implementation 406
Contents xvii
xviii Contents
Oversight 407
Implementation Guidance 409
Policy-Based Centralized Management 410
Response 412
Normal Incidents 413
Majo r Incidents 414
Rehearsing for Maj or Incidents 415
Real-Time Fail-Over 416
Intr usion Detection Systems (IDSs) 417
End-of-Chapter Questions 422
Online Modules
Module A MORE ON TCP Numbering Octets
Ordering TCP Segments upon Arrival
The TCP Acknowledgment Process
Flow Control: W indow Size
Module B MORE ON MODULATION Modulation
Frequency Modulat ion
Amplitude M odulation
Phase Modulation
Quadrature Amplitude Modulat ion (QAM)
Module C MORE ON TELECOMMUNICATIONS Introduction
The PSTN Transport Core and Signaling
The Tr ansport Core
Time Division Mult iplexing (TOM) Lines
Leased Lines and Trunk Lines
Asynchronous Transfer Mode (ATM) Transport
Signaling
Communication Satellites
M icrowave Transmission
Satell ite Transmission
Geosynchronous Earth Orbit (GEO) Satell ites
Low Earth Orbit (LEO) and Medium Earth Orbit (MEO) Satell ites
VSAT Satell ites
Wiring the First Bank of Paradise Headquarters Building
Facilities
Telephone W iring
Data W iring
Plenum Cabling
PBX Services
Carrier Services and Pricing
Basic Voice Services
Advanced Services
Telephone Carriers and Regulation
PTTs and M inistries of Telecommunications
AT&T, t h e FCC, an d PUCs
Deregulation
Voice Over JP
Module D DIRECTORY SERVERS Introduction
Hierarchical Organization
Lightweight Directory Access Protocol (LDAP)
Directory Servers and the Networking Staff
Microsoft's Active Directory (AD)
Active Directory Domains
Domain Controllers
Domains in an Active Directory Tree
Complex Structures
Authentication and Directory Servers Glossary 425
Index 449 Credits 469
Contents x ix
This page intentionally left blank
PREFACE FOR ADOPTERS
SIX QUESTIONS
This p reface begins w ith six questions that adopters have \vhen considering a textbook.
• What cou rses is this book used in?
• Why all the secu rity? • Does this book have the content your students need on the job market?
• Why does it have four principles chapters followed by ch apters on sp ecific technologies?
• Does this book have the support you need?
• Does this book have the support your students need?
What Courses use this Book? • Introductory networking courses in information systems that p repare graduates
to \VOrk in corporate IT departments use this book. It has the kind of knowledge they need to m anage nel\vorking in corporations.
• It is used at both the undergraduate and graduate levels.
• Due to its extensive security content, some schools use it in a combined network- ing and security course. This requires covering the Appendix. Compared to the last edition, the Appendix considerably expands security content. Ideally, schools will have separate introductory network and security courses. Unfortunately, not all schools have that luxury.
• It does not focus on the very different needs of computer science students, \Vho \vill build routers and switches in companies such as Cisco Systems. Instead, it focuses on ho\v to manage and secure them, \vhich is what networking professionals actu- ally do in corporate IT d epartments. This still requires a lot of technical know l- edge but not at the expense of job-required content.
Why all the Security? In the last l\vo decades, the need for network security knowledge has gro\vn enor- m ously in networking departm ents. It m ust be covered p er vasively in networking courses. General security courses do not cover network-sp ecific security, such as p ro- tecting access points w ith 802.1 li security and knowing \Vays in wh ich 802.1 li security is bypassed in the real wor Id .
Too m any IS program s have h ad to choose between offering an introductory security course and an introductory networking course. This book lets the nel\vorking course serve as a decent introduction to security.
Does this Book have the Content your Students need? This book is based on discussions with networking professionals and focuses on their current and emerging needs. We are especially concerned with potentially disruptive
x:xi
xxi i Preface for Adopters
trends such as software-defined networking and high-density Wi-Fi nehvorks. Here is a sampling of this type of job-ready content.
• The Internet of Things. The IoT w ill keep nehvorking profession als very busy. Obviously, connecting lots and lots of small devices that talk to each other is going to require a lot of ,vork. More broadly, IoT transmission standards and security are pretty raw, requiring even m ore effort to m anage them . Chapter 7 deals with the standards and technologies competing for d ominance ( or at least survival) in the ne,v market for the Internet of Things.
• Nehvork management. Net wor king, like security, is more about management than it is abou t technology. Chap ter 3 focuses on n ehvor k managem en t prin - cip les t hat m ust be applied in a ll net workin g project s. It also focuses on th e p ervasive imp or tan ce of SNMP and the p oten tially d isruptive impacts ofS DN.
• Secur ity threats and protections. Sun Tzu, in The Art of War, exhorted militar y leaders to know their enemies and to also know themselves. Chapter 4 covers the threat environment facing firms today and the countermeasures that companies can put into place to p rotect themselves. However, security begins with the first paragraph of the first chap ter and continues throughout the book.
• Ethernet is covered in Chap ter 5 ,vith a holistic approach. The chap ter covers the explosion in Ethernet standards, including those driven by Wi-Fi trends.
• Chapter 6 and much of Chapter 7 deal with Wi-Fi. They again cover technology, which is m ultifaceted and complex, and they cover w ireless m anagement and security. They deal wi th the cu rrent exp losion in emerging standards, s uch as the potentially disruptive 802. l l ax standard. Importantly, they show how 802. l li security can be broken.
• Chapter 7 also covers Internet of Things transmission protocols. IoT transmission turns m any networking ideas on their heads, such as the d esirability of high speed and long transmission distance.
• Chapters 8 and 9 deal with the Internet in context. A special focus is IPv6, ,vhich has now gone well beyond its infancy in both technology and use. This m aterial is consid erably updated from the previous edition. The m aterial on IPsec is consid- erably stronger.
• Chapter 10 deals with networking beyond the customer premises. It focuses first on access technologies, then on WAN technologies that must be used beyond the Internet w ith its limited QoS abilities. The WAN technologies section focuses on leased lines, carrier Ethernet, and MPLS.
• Ch ap t er 11 deals w ith networked application s- applications t hat n eed nehvor ks to operate. It foc uses on m anagement an d secur ity. In the past, som e schools skipped this chapter because the materia l ,vas covered in in troduc- tory courses. Act ually, intro courses did not focus on the needs of nehvorking p rofess ionals, and that is even m ore true today. This chap ter brings the st u- den t in to t he ,vorlds of cloud com pu tin g, H TTP / H TML, email, VoIP, an d peer-to-peer applications, an d it d oes so in terms of the kn owledge that IT p rofession als need.
Principles Chapters:
1. High-Level M atter s
2. Stand ards
3 . Network Man ag ement
4 . Security Append ix. Secu rity M anagem ent
Applying Principles Chapters to Wi-Fi
FIG URE P· 1 Principles and Appl icat ions
Preface for Adopters xxiii
Technology Chapters:
s. Ethernet 6 -7. WI-Fi
7. lo T Transmission
8-9. The Internet
10. Wide Area Networks
11 . Networked Applications
Why have four Principles Chapters followed by Chapters on Specific Technologi es? Networking professionals wan t studen ts to be able to npply principles to real networking situations. The book begins w ith fo ur chapters that cover core neh,•ork principles. It then applies these principles in a series of chapters that d eal with Ethernet, Wi-Fi, Internet of Things transmission, the Internet, wide area networks, and networked applica tions. Figure P-1 illustra tes this logical flow fo r Wi-Fi in Chap ters 6 and 7. These chapters deal \,•ith how 802.11 Wi-Fi is used in business, how Wi-Fi operates at the physical and data link layers, Wi-Fi security threats and countermeasures, and key points in network n1anagen1ent. This app roach not only has students d eal \,•ith technologies ho listically. It also reinforces difficult core concepts such as layering.
Traditionally, networking books go "up through the layers." At the end of the course, studen ts have all the kno\,•ledge of concep ts and principles they need. However, they have linuted experience in applying then1, which is the whole point of the networking job.
Does this Book have the Support you need? Teaching is hard. Teaching neh-vorking is harder. This book tries to make it a little easier.
Pow erPoint Presentation s and t he Cent ra lity of Figu res The PowerPoint p resen tations a re fu ll lectures, no t "a fe\,v significant figures." A core d esign princip le of this book is that all key concepts are exp ressed in figures. Most of these fi gures are Illustrations. Some are "Stud y Figures," which essentially take no tes fo r the student in areas that do no t lend themselves to illustrations.
A core design principle of this book is that all key concepts are expressed in f igures.
In line with this focus, the Po\,•erPoint p resenta tions are created d irectly fro m the figures. Figures are designed for this. Font size is larger in the PowerPoint slides, and several slide builds are often used to cover a fig ure well, but m aking then1 consistent with the figures has proven to be a great help fo r bo th teachers and studen ts.
Adop ters get an annotated version of each Po\,•erPoint presentation. This can help you present the material in the slide. Som etin1es we even add a little extra information fo r you to p resent.
xxiv Preface for Adopters
The Instructor's M anua l: The Usu al Su spects with a Twist Of course, there is an Instructor's Manual with chapter teaching hints and answer keys for chapter ques- tions. There is also a n1u ltiple-choice test item file and a test generator for exams.
Test Your Underst a nding Questions No\'I' for the h,vist. Each chapter is bro- ken into fa irly sm all and highly targeted sections that end in a handful of Test Your Understanding questions. The Test Item File questions are linked to specific Test You r Understanding Questions. This n1eans that you can assign certain questions for study and exclude others fron1 exams. This lets you tailor exan1s to exactly fue content points you \,•ish your students to be responsible for.
Chapte r- Open ing Caselets Most chapters begin \Vith b rief caselets tha t students find interesting. In C hapter 1, for exam p le, the caselet deals with how KrebsOnSecurity.com was hit \vifu a denial-of-service a ttack fuat used small Internet o f Things d evices. Try assigning them for reading before the class and go over them as an interaction starter.
Does this Book have the Support your Students Need? Let's face it. Neh'l'orking a nd security are tough. They are highly conceptua l. It is not prim arily a ma tter of building c umulative skills as in progran1ming courses. There are a lot of concepts, and they are often abstract or req uire the student to understand mul- tiple steps. Neh,•orking professiona ls know fuat their careers are governed by the few things they need to kno\,, but d on't in particular situations. Students must understand a lot just to be minimally con1petent.
Guided Reading One way the book helps students is by guided read ing. There usually is a ch apter-opening caselet to get the juices flowing. The flo\'I' that follows is broken up into fairly small p ieces, with many headings. This helps the student focus on specific points. Figures show them how they fi t together in a broader frame\,•ork. In1portant concepts are displayed as key words. The index and glossary are linked to fuese key words. In ad dition, critically in1portant concep ts are often shown as callouts:
Students quickly learn to pay special attention to these ca/louts.
Fun Foot notes? Then there are fun footnotes. No, that is not an oxymoron. We limit chapter content to \,•ha t all students should be able to n1aster in an introduction to neh'l'orking course. Sometimes, it is useful for son1e students if a bit more information is available to satisfy their curiosity. We put them in footnotes. They are not required reading, so they are not d eadly d e tailed. Son1etin1es, foo tno tes are used for illustrative (semisnarky) comments.
Test Your Understanding Test Your Und erstanding questions help s tudents stop after a section and see if they understood it. The best stud ents learn that this is the best way to learn because nehvorking is so cumulative, and m oving on too fast is a capi- tal n1istake. At the end of the chap ter are integrative questions tha t provide exercises for putting the fuings the student has learned together.
Preface for Adopters xxv
Exam Study These and o ther design elements help students prepare for exan,s as well.
• It is good for students to begin their exam prep by skimn1ing for callouts and key \'l'ords a nd being sure that they know then,.
• Importantly, they should look at all of the figures and see if they can explain them. Again, figures include nearly all n1ajor content in the book.
• With this grounding, they should go over the test our understanding questions to see if they understand the detail. If they aren't sure, the text is right there to reread.
CONTENT FLOW
This section describes the flo\v of content in the book. It d iscusses each chapter briefly, giving its role in the book. It also describes ch anges from the previous ed ition. Overall, this ed ition is a 70% re\,•rite.
Chapter 1 This is the first of four "principles ch ap ters" that give the student broad grounding in core concepts and principles needed to understand and deal w ith specific networking technologies such as Ethernet, Wi-Fi, and the Internet of Things.
Chapter 1 covers basic Internet tern,inology, concepts, and architectural principles. It begins with a broad introduction to the Intern et. It then looks at the Internet from the o utside by focusing o n what hosts do to send and receive packets. It then looks inside the Internet to show how packets are delivered. O n the Internet, routers are connected by da ta links, w hich n,ay be s ing le nern•orks. The chapter ends with the distinction between Internet routers, personal access routers, and wireless access points. Studen ts tend to confuse these terms. The Internet of Things is a major then, e of the chapter.
Case let The chapter begins with a caselet to sho\'I' how KrebsOnSecu rity.com \,•as the victin1 of a distributed denial-of-service attack that used IoT d evices.
Obj ectives After mastering the chapter, the student should be able to ...
• Discuss how the Internet is changing and the security c hallenges these changes are creating.
• Explain basic concepts and terminology for the hosts (devices) that connect to the Internet.
• Explain basic concepts and terminology for the Internet itself.
• Explain basic concepts and terminology for single networks and their role on the Internet.
• Explain the distinctions between Internet routers and personal access rou ters; explain the differences between personal access routers and wireless access points.
Cha nges In the previous edition, Chapter 1 began w ith single nern•orks and then showed how they are connected to the Internet. Studen ts said th a t they \,•anted to know about the Intern et first, so tha t is ho\v \,•e \'l'rote it. Speed deta ils were n1oved
xxvi Preface for Adopters
to Chapter 3 to give a cleaner flo\,•. Students already kno\v speed basics en ough to put off details. Cloud computing was n1oved to Chapter 11 because it prin1arily deals with application architecture, \,vhich deals \,•ith the locus of processing. Application architec- ture is a n1ajor theme of that ch apter. Standards architectures were moved to Chapter 2, although the first chapter introd uces terminology tha t readies stud ents for standards architectures.
Chapter 2 Chapter 2 presents standards principles and pa tterns that the student \,•ill see throug h- ou t networking. This chapter a lso introduces the main syntax elements of IP, TCP, UDP, and Ethernet.
The chapter, like the rest of the book, is based on the hybrid standards architecture tha t companies use in rea l life. They use OSI standards a t the physical and data link layer. They prin1arily use TCP standards a t the internet a nd transport layers. They use standards from a variety of sources for applica tions. TCP /IP have no problem working with OSI standards at lo\ver layers, and nearly all applications can interface w ith TCP or UDP. Focusing only o n OSI standards makes no sense in terms of corporate realities.
Caselet The cl1apter opens with a caselet o n ho\,, Internet standards came to be and \,•h y they are sometimes weird.
Obj ecti ves After mastering the chapter, the student should be able to ...
• Explain how Internet standards are made and why this approach is va luable.
• Provide the definitions of neh,•ork standards and protocols and articulate their importance.
• Explain the OSI, TCP /IP, and Hybrid TCP /IP-OSI architectures and their stan- dards agencies.
• Explain the purpose of each s tandards layer in the hybrid TCP /IP-OSI arclutecture, w hat is standardized a t each layer, a nd w hich standards agency don1inates stan- dards a t each layer.
• Explain n1essage ordering in general and in HTTP and TCP.
• Explain message syntax in general and in IP packets, TCP segmen ts, and UDP datagran1s, and Ethernet fran1es.
• Demonstrate how application progran1s encode alpha nun1eric, decin1a l, and alternative data into bits (ls and Os) before passing their messages to the transport layer.
Changes Con1pared to the previous ed ition, standards arch itectures have been n1oved entirely from C hapter 1 to this ch ap ter. The syntax of HTTP has been n1oved entirely to Chapter 11, the Networked Applications chapter.
A specific significan t c11ange is tha t the chapter d iscusses the Ethernet II frame, not the 802.3 MAC Layer frame. The Internet Protocol standards call for IP packets to be carried inside Ethernet II fran1es, and this practice appears to be general. No\,, that IP dominates a t the Internet layer, it is Ethernet II frames that stud ents have to under- stand. Conveniently, the Ethernet II fran1e is simpler.
Preface for Adopters xxvii
Chapter 3 Chapter 3 covers core concepts and principles in network management. It introduces studen ts to the importance of centralized management and to software-defined net- working (SON), •,vhich is potentially a fundan1entally disruptive technology for chang- ing ho\,, we manage networks.
Objectives After mastering the chapter, the student should be able to ...
• D iscuss network quali ty of service (QoS) and specify service level agreemen t (SLA) guarantees.
• Design a network layout based o n required traffic volumes between pairs of sites.
• Describe options for dealing \,•ith momentary traffic peaks.
• Describe the benefits and importance of central ized network management; dis- cuss and compare three tools for centralizing network n1anagen1ent: P ing, tracer- oute, and the Simple Network Management Protocol (SNMP).
• Describe Software-Defined Networking (SON), including \,•hy it is potentially revolutionary.
Changes In the previous edition, Chapter 4 covered both network and secu- rity n1anagement. That \,•as too much to cover well. Chapter 3 in this edition has the network n1anagen1ent information. It also centralizes SON information, \,•hich was spread across n1ultiple chapters in the previous edition. The section o n neh,•ork design has additional exan1ples and exercises and introduces a ne\v tabular approach. Redun- dancy is sho\,•n, but no con1putations are made because that is for an advanced course.
Chapter 4 Chapter 4 is primarily Chapter 3 in the previous ed ition. It introduces security threats and countern1easures. It n1ay seem odd to put off security to the end of the principles chapters, but the n1aterial in the chapter requires full kno\vledge of core networking principles and concepts.
Caselet This chapter's caselet is the Target Breach, \,•hich was a complex hack. It takes severa l years before the details of such hacks are understood.
Objectives After mastering the chapter, the student should be able to . . .
• Describe the threat en vironn1ent, includ ing categories of attacks and attackers.
• Exp lain how to protect dia logu es by cryptography, including encryption for confiden tiality, electronic signatures, and host-to-host virtua l private neh,vorks (VPNs).
• Eva luate al ternative authentication mechanisms, including pass\,•ords, smart cards, bion1etrics, digital certificate authentication, and two-factor authentication.
• Describe fire\,•all protection, including sta teful packet inspection, next-generation firewalls, and related intrusion prevention systen1s.
• Describe the role of antivirus protection.
xxviii Preface for Adopters
Ch anges Everything has been upda ted. The statefu l inspection and next- generation fire\,vall sections have been considerably redone.
Appendix Most teachers who cover the Appendix cover it after Chapter 4, a lthough some \,•i ll wait until the end because it is a fun read. It includes n1uch of the material from Chapter 4 on security management. It goes into n1ore d epth on p lanning principles and adds a discussion of the response phase. Covering the Appendix after Chapter 4 allo\VS teach- ers to talk about defense in depth, \Veakest link thinking, and other principles throug h- ou t the discussion of security for specific technologies.
Caselet This caselet builds on the Target Breach discussed a t the beginning of Chapter 4. It describes how critical security policies were viola ted, making the breach possible.
Objectives After mastering the chapter, the student should be able to ...
• Describe the threat environment, including types of attacks and types of a ttackers.
• Explain how to protect dialogues by cryptography, including encryption for confi- dentiality, electronic signatures, and host-to-host virtual private networks (VPNs).
• Evaluate alternative authentication mechanisms, including passwords, smart cards, biometrics, digital certificate authentication, and h,•o-factor authentication.
• Describe firewall protection, including stateful packet inspection, next-generation fire\,•alls, and related intrusion prevention systems.
• Describe the role of antivirus protection.
Chapter 5 No\,, that th e studen t has mastered basic principles and concepts regarding the Intern et, standards, neh,•ork management, and security, they are ready to apply th is knowledge to key neh,•ork technologies. In Chap ter 5, this is E thernet. Ethernet is covered before Wi-Fi because it is in1possible to talk abou t Wi-Fi n1anagement \,•ith- out understanding Ethernet.
Objecti ves After mastering the chapter, the student should be able to ...
• Explain basic Ethernet tern1inology and how Ethernet is standardized.
• Describe basic physical propaga tion concepts: digital and binary signaling, full- d uplex transn1ission, and parallel transmission.
• Exp lain the technologies of 4-pair UTP and optical fiber. Con1pare their relative strengths and weaknesses, including cost and transmission distances.
• Design an Ethernet neh,vork based on knowledge of transmission requ irements a nd Ethernet physica l link stand ards, including link aggregation.
• Describe the Ethernet II frame. Exp lain basic Ethern e t da ta link layer switch operation.
• Describe security threats to Ethernet and ways to deal \,•ith them.
Preface for Adopters xxix
Cha nges Con1pared to the last edition, this chapter relegates some nice to kno\,, but advanced features to footnotes. Po\,ver Over Ethernet is one of them. There is just too much stuff to learn about Ethernet to cover everything in an introductory course. The d iscussion of UTP and fiber n1ed ia has a lso been streamlined, and single-mode fiber is moved to a box for additional information. As in Chapter 2, the focus is on Eth- ernet II frames.
Chapter 6 This chapter and most of the next dea l w ith 802.11 Wi-Fi. This chapter focuses on what students need to kno\,, about the core technologies of W i-Fi. The box at the end deals with the ongoing explosion of ne½' physical layer s tandards and their relative strengths and issues.
Objectives After mastering the chapter, the student should be able to . . .
• Explain basic Wi-Fi 802.11 tern1inology and the role of access points.
• Explain basic radio signal propaga tion concepts, including frequencies, antennas, and w ireless propagation problen1s. These are physica l layer concepts.
• Explain the frequency spectrun1, service bands, channels, bandwidth, licensed versus unlicensed service bands, and spread spectrum transmission used in 802.11 Wi-Fi LANs. These are a lso physical layer concepts.
• Describe 802.11 Wi-Fi WLAN operation with access points and a switched Ether- net distribution system to link the access points. Distinguish beh,•een BSSs, ESSs, and SSIDs. D iscuss con1munication bet\,•een access points. These are data link layer concepts.
• If you read the box "Media Access Control (MAC)," con1pare CSMA/CA+ACK and RTS/CTS for n1edia access control. These are data link layer concepts.
• Compare and contrast the 802.lln and 802.llac transn1ission standards. Discuss emerging trends in 802.11 operation, including channels \,•ith much wider band- \,•id th, MIMO, beamforming, and mu ltiuser MIMO. These are physica l layer concepts.
• If you read the box "802.11 /Wi-Fi Notes," be able to kno\,, what happens when devices folio\,, d ifferen t Wi-Fi s tandards, exp lain ho\,, devices that follow new Wi-Fi standards get released in profile waves, and describe emerging 802.11 stan- dards and \,•ha t they will bring.
Changes Con1pared to the previous ed ition, a nun1ber of top ics have been strean1lined. The n1aterial in the closing box is new. It deals n1ore specifically \Vith the current standards explosion and how products implement standards in profile waves.
Chapter 7 This chapter deals heavily w ith Wi-Fi security. A key point is tha t 802.lli security is n1andatory b u t can be defeated by evil h'l'in and rogue access point attacks. Central- ized \,•i reless LAN (WLAN) management is critical because access points are so widely d ispersed. There is a boxed section on decibel calcula tions. You can decide ho\,, n1uch, if anything, to cover. The chapter ends \,•i th a section on the \,•ireless technologies that
xxx Preface for Adopters
underpin Internet of Things transmission, including Bluetooth Low Energy, ZigBee, Wi-Fi Direct, and near-field comn1urucation (includ ing radio frequency IDs).
Caselet Ho\,, easy is it to crack an unprotected Wi-Fi hot spot? This caselet sho\'l'S how seven-year-old Betsy Davies did it in just under 11 minutes. Including read- ing a tutorial on ho\,v to do it.While drinking a milkshake.
Obj ecti ves After mastering the chapter, the studen t should be able to ...
• Explain 802.lli Wi-Fi security.
• Explain w hy 802.ll i security is not enough for WlANs. • Discuss 802.11 WLAN managemen t.
• Work with decibel representations of po½•er ra tios (if he or she reads the box o n decibels).
• Con1pare peer-to-peer loca l w ireless technologies that w ill be important for the Internet of Things.
Changes The challenging evil twin section has been broken into more p ieces and simplified to the exten t possible. The decibel section has been heavily re\vritten. The section on IoT transmission technologies is expanded considerably to refl ect today's explosion in IoT transn1ission standards and technology.
Chapter 8 Chapters 5 through 7 dealt w ith single-neh,•ork technologies that use standards a t the physical and data link layers. With this as a basis, we can now move into TCP /IP at the Internet and transport layers. This chapter looks at how routers make their routing decisions and looks at the syntax of IPv6 n1ain headers, extension headers, and higher- layer content. IPv6 is an in1portant topic in networking today because IPv6 is no longer just a percent or less of all IP traffic. Students need to know how to ½•ri te IPv6 addresses for human reading.
Some have asked w hy the book \,•a its so long to move into TCP /IP. The ans\,•er is that TCP /IP is substan tially n1ore comp lex than Ethernet an d Wi-Fi technology. Learning sin1pler technologies first makes it easier to learn TCP /IP and its many standards.
Objectives After mastering the chapter, the studen t should be able to ...
• Define hierarchical IPv4 addresses, networks and subnets, border and internal routers, and masks.
• Given an arriving packet's destina tion IPv4 address, explain \,•ha t the rou ter w ill do \,•ith the packet based o n its routing table.
• Explain the IPv4 packet header fields \,•e did not see in earlier chapters.
• Explain the IPv6 packet's main header fields and IPv6's use of extension headers.
• Convert a 128-bit IPv6 address into cano nica l text notation consistent \Vith RFC 5952.
Preface for Adopters xxxi
• Exp lain TCP segment fields, UDP datagram fields, and TCP session closings.
• Exp lain why application message fragmentation is not possible with UDP.
Changes Relatively little is nev,. to this edition, although almost all top ics have been rewritten to help student comprehension.
Chapter 9 This chapter takes the TCP / IP discussion into m anagement and security. TCP /IP uses m any supervisory protocols beyond TCP, UDP, and IP. This chapter discusses a few of them .
Objectives After m astering the chapter, the studen t should be able to ...
• Exp lain IPv4 subnet planning and do the calculations needed for ,vorking ,vith subnet and host parts and deciding on part lengths.
• Do the same for IPv6. • Explain the purposes of Nehvor k Ad dress Translation (NAT) and ho,v NAT
op erates. • Explain in more detail than you learned in Chap ter 1 abou t how the Domain
Name System (DNS) and the Dynam ic Host Configuration Protocol (DHCP) operate.
• Describe the object model in the Simple Nehvork Management Protocol (SNMP) and d escribe the enabling value of good security in the use of Set commands.
• Describe ho,v the DNS ,vas modified to deal with IPv6 addresses for host nam es.
• Describe how d ynamic routing protocols ,vork and how to select among alterna- tive dynamic routing protocols.
• Describe the Internet Control Message Protocol (ICMP).
• Exp lain central concepts in IPsec (IP security), including its s trategic importance, transport versus tunnel mode operation, ESP versus AH protection, security asso- ciations, important cryp tographic methods and options, session initiation ,vith IKE, and how IPsec compar~,s to SSL.
Changes Again, relatively few things ,vere changed, b ut there was a good deal of rewriting and streamlining. One specific change is that subnetting for IPv6 no,v fol- lows imm ediately after subnetting for IPv4. Another is that the section on IPsec has been expanded to include such things as h o,v session init iation is done. More IPv6 material is an obvious need.
Chapter 10 Th is chapter deals sp ecifically w ith w ide area networking. In WANs, companies m ust deal ,vith carriers instead of doing things themselves. They also face much higher costs per bit transmitted , so efficiency is critical. Isn 't ,vide area networking just the Internet? No, it isn't. Com panies m ust have quality of service guarantees for som e of their site-to-site traffic, and th e Internet does not provide th at. Carrier WAN ser- vices for corporations today are dominated by lease lines, carrier Ethern et, and MPLS.
xxxii Preface for Adopters
Most carriers have moved all of their Frame Relay and o ther customers to carrier Eth- ernet or MPLS. The chap ter looks a t cellular data comn1unication, ADSL, and cable n1odem services as \Veil as the carriers' local loop, which serves the pren1ises of home an d business users.
Changes After n1astering the chapter, the student shou ld be able to . . .
• Contrast LANs and WANs in tem1s of technology, diversity, economics, speed, and need for optin1ization.
• Describe the three carrier WAN components and the two typical business uses for carrier WANs.
• Describe how the telephone systen1 is organized, including its hierarchy of s\,•itches. (Most carrier WAN networks use the public switched telephone neh,•ork for some or all of their con1munication.)
• Expla in and compare the ADSL and cable n1odem residentia l Internet access services and how fiber to the home is changing the residential access n1arket.
• Discuss trends in cellular data transmission speeds.
• Distinguish between access lines and leased lines. Select a leased line for a given application speed requirement. Explain how companies use leased lines in Inter- net access.
• Explain ho\,, neh,•orks of leased lines, carrier Ethernet, and MPLS can be used for site-to-site comn1unication \'l'ithin a firm. Discuss the rela tive advan tages and d isadvantages of each.
• Explain the capabilities of WAN optin1ization devices.
Changes This chapter mostly covers the san1e topics that Chapter 10 did in the previous ed ition. However, re\,•riting and s trean1lining is very heavy. There is n1ore clarity on \,vhy the Internet does not n1eet the quality of service levels needed in most firms, requiring then1 to used technologies beyond the Internet for their much of their lo ng-distance communication
Chapter 11 This ch apter is about application architectures-where application processing is done an d ¼•hy it is done there. Falling prices for bo th con1puters and transm ission have taken us from stand-alone mainfran1es to mainframes with dumb terminals, to client/ server processing, cloud computing, and peer-to-peer con1puting. The chapter begins by noting th at n1ost computer hacks today in volve taking over an appl ication and receiving its permissions. The chapter looks a t cloud compu ting and P2P computing. In between, it looks at the behavior of today's n1ost cen tra l neh,•orked applications.
Objectives After mastering the chapter, the student should be able to ...
• Explain core concepts in networked applications and application architectures.
• Describe how taking over an application can give an attacker the ability to control the computer.
Preface for Adopters xxxiii
• Describe ho\v Netflix uses cloud computing and hov.• this illustrates the in1por- tance of host technology (and cloud computing specifically) as a driving force for neh,•orking.
• Describe the World Wide Web in tern1s of standards and explain how a \vebpage \,•ith text, graphics, and o ther elements is downloaded.
• Describe electroruc n1ail standards and security.
• Describe voice over IP (VoIP) operation and s tandards.
• Explain \,•hy peer-to-peer (P2P) computing is both desirable and dangerous.
Changes This chapter brings cloud computing from Chapter 1. The treatment of the "Big Three" business applications-the WWW, e-mail, and VoIP-is somewhat expanded. Peer-to-peer computing is reduced. It focuses on trad itional VoIP versus P2P VoIP to show \,vha t peer-to-peer con1puting changes. It a lso discusses Tor, which is a P2P tool for anonymizing IP transmission. Tor is used both by people seeking anonym- ity and by cybercriminals.
The "a" Chapters Several chapters are follo\,•ed by an "a" chapter (la, 3a, etc.) tha t provides son1e hands- on experience for students.
Chapter 1a. Hands-On: A Few Internet Tools This "a chapter" gives the stu- dent a bit of basic hands-on experience to help them make the concepts in Chapter 1 n1ore concrete while learrung a few useful tools. After mastering the chapter, the stu- dent should be able to ...
• Test his or her Internet connection speed.
• look up a host's IP address by querying a DNS server.
• Use Ping and traceroute to diagnose an Internet connection.
Chapter 3a . Hands-On: Microsoft Office Visio As the name suggests, this is a qwck tutorial on Vis io basics. Visio is widely used in neh'l'ork representation. Some schools have free versions for students. For those that do, Visio is useful in doing son1e hon1ework questions.
Chapter Sa. Hands-On: Cutting and Connectorizing UTP If students are still cutting and connectorizing w ire on a regular basis three or four years into their careers, they have probably n1ade a \'l'rong turn son1e\,•here. However, learning how to do it is a good skill, and it n1akes 4-pair UTP less abstract. It is also fun, and it gives students something to take hon1e to show their parents. After mastering the chapter, the student should be able to ...
• Cut, connectorize, and test 4-pair UTP cabling.
• Explain the difference beh'l'een solid wire and stranded-wire UTP.
• Kno\,• when to use patch cables.
xxxiv Preface for Adopters
Chapter Sa. Hands-On: Wireshark Packet capture This chapter has the stu- dent capture a stream of IP packets and then analyze their headers in some detail. This exercise m akes the syntax of IP, TCP, and UDP far more real to the student.
Chapt er 9a. Hands-On: Cisco's 105 Command Line Interface (CLI) This ch apter addition introd uces the student to the flavor of Cisco's command line interface used in S\vitches, routers, and other devices. It walks the student through a fe\v sample interactions. After th e class, some students m ay \Vish to m aster IOS in detail to help them pass valued Cisco certifications. This ch apter \Vas not in the previous edition.
Online Modules Teachers w ho want to cover m aterial not in the text m ay find it useful to look at on line mod ules that cover additional matters. These are available for both teacher and student download. The purpose is to allo\v you to cover certain additional topics without hav- ing to do more preparation . A word of caution . There is a lot of m aterial. Only small amounts of the m aterial in the Online modules are likely to fi t into cours~,s.
Module A: More on TCP This module is for teachers who \vish to cover TCP sequence and ackno\vledge numbering and flow con trol using the Windows Size field. It comes most naturally after Chapter 8.
Module B: More on Modulation The main text does not deal with m odula- tion. Cover ing this short module w ill help your students understand ho \v the m ost advanced 802.11 physical layer standards can transmit data more effici ently by sending more bits per clock cycle.
Module C: More on Telecommunications Som e courses have titles that include Telecommunications. This normally means telephony. This chapter has material for these courses.
Module D: Directory Servers Di.n.>ctory servers are a big thing in the corpo- rate world. This module looks at din.>ctory servers in more detail, including Microsoft's Active Directory and authentication using directory servers. The latter is covered briefly in the Appendix. This module adds metadirectory servers.
PREFACE FOR STUDENTS
THIS BOOK
Most textbooks start by trying to convince you that the subject matter is ilnportant. This o ne doesn't need to do so. Everybody kno\VS that the Internet is i1nportant. Ditto on security.
Networking and Security Wh y both nehvorki ng a nd security? T he reason is that security pervades professional nehvorking today. There is no "'ay to separa te them. Every nehvork project has a sizeable security content. The traditional vie"' that net\\'Orking is the moving of bits and packets is no longer sufficient. Nor is it enough to slap a secu rity chapter at the e nd of the book. Security must be deeply integrated into your kno\vledge of Ethernet, Wi-Fi, TCP / IP, applications, a nd everythi ng else. Some teachers cover the Appendix to give you an even deeper vie\v of security planning a nd response w he n secu rity failures happen.
Pri nciples and Their Application Figure 1 sho\vs ho,v this book will help you learn net\\'Orking and security. First, you \Viii learn concepts a nd principles. You ,viii learn core ideas such as ho"' the Internet operates, the nature and id iosyncrasies of net\\'Ork standards, keys to managing networking projects, and core security concepts. v\Thy does security cmne last among these core chapters? The ans,ver is simply that you can't learn network securi ty ,vithout understanding core networking ideas fi rst.
The rest of the book takes you through a series of technologies. For each, you w ill apply the concepts and principles you n,as tered in the fi rst four chapters. For instance, ,vhen you learn about Wi-Fi in Chapters 6 and 7, you "-ill understand its basic opera- tion, physical transnussion, S\\'itch operation, s tandards, 1nanagement, and, of course, security. You will do the same for the other technologies a nd applications sho"'ll in Figure 1.
Job-Relevant Knowl edge We have done everything \Ve could to fi ll this book "'ith job-relevant kno\\'ledge. You "-ill not have to learn about technologies that haven't been seen in th is century. There s imply isn't time to cover history when companies need
Principles Chapters:
1. High-Level Matters
2. Standards 3. Network Management
4. Security
Appendix. Security M anagement
Technology Chapters:
5. Ethernet
6-7. Wi-Fi
7. lo T Transmission
8-9. The Internet
10. Wide Area Networks Applying Principles Chapters to Wi-Fi
1 1 . Networked Applications
FIGURE 1 learning and Applying Security Concepts and Princi ples
XXXV
xxxvi Preface for Students
students who understand !Pv6, IPsec, the current explosion in Ethernet standards, the current exp losion in Wi-Fi standards, Internet of Things transmission protocols, and many other recent developments. You will learn all the general principles that all net- \Vorking books cover, but you \Viii learn about them in the context of today's important technologies. If you can, work through the hands-on "a" chapters that follow several main chapters. These things are kind of fun, and they will make concepts a lot more concrete.
Information Systems versus Computer Science How does an information systems book differ from computer science books? Our friends in computer science teach students how to design routers in networking and how to create ciphers in secu- rity. Our students \viii work in IT departments. They \Viii never build a router, but they \Viii buy them and need to understand ho\v to manage and secure them. Would it help to teach you how to build a router? Perhaps. But that \vould mean not teaching you ho\v to use them in real organizations because there wouldn't be time. Design your O\Vn cipher? We teach our students that doing that is stupid. You do not have to kno\v how to design a cipher to know ho\v to select a cipher to use in a project, and 99.9% of all developed ciphers are broken quickly.
STUDYING NETWORKING
Although networking and security are exciting, many find them hard to learn. It is not that they are terribly difficult inherently. The main problem is that you do not have a mental frarne\vOrk when you start, so it is hard to absorb individual pieces of knowl- edge. You need to learn frameworks and individual p ieces at the same time.
Frameworks and Individual Pieces Unfortunately, this means that you need to jump back and forth between frameworks and individual pieces until both settles into place. Once you master that discipline, you will be able to grasp major constellations of concepts. If you do not, this course is going to be very hard.
lnt ell igent Choices This class requires upper-level college thinking. In the first years of college, you are learning individual facts. In your fina l years, you need to mas- ter comparisons between concepts so that you kno\v which to apply. This is exactly what nel\vorking professionals need to do. To design a network, you need to make complex decisions requiring you to evaluate alternatives. You also need a complex mental model to troubleshoot problems, which takes up a surprising amount of professional \vork time. It has been said that artists are known for their best moments but engineers are known for their worst. Any piece you do not master comes back to haunt you.
TLAs and FLAs Then there is the problem of TLAs and FLAs (three-letter acronyms and four-letter acronyms). You \Viii see a lot of them. Why not just avoid acro- nyms? The problem again is the environment in which network professionals \VOrk. If you p ick up any trade magazine, you will see that few acronyms are ever spelled out. You will have to learn a lot of them. Think of them as abbreviations when you text people on your phone.
Preface for Students xxxvii
There is a comprehensive Glossary at the back of the book. If you aren ' t su re what a term n1eans, go to it for a qu ick definition. If that isn' t enough, the index \,•ill tell you \,•hat pages to read. If a page number in th e Index is boldfaced, look a t that page first.
No Escape By this point, you may have d ecided that networking and secu- rity are rather challenging and that progran1ming and da tabase are begiruung to seem attractive. Unfortuna tely, they \-Von't get you a\,•ay from networking and security. Today, n1ost programs in industry are \,•ri tten to work with other progran1s on other n1achines; and all of their interactions take place over neh,•orks. Database management systems and systems ana lysis also require solid neh,•orking knowledge. So learn neh,•orking as n1uch as you can. We have cute kittens to watch and alien ships to d estroy. For security, we have fascinating stories, and you are not just going up against hard\,•are reliability and software bugs. You \Vill find yourself n1atched against detem1ined attackers w ho will respond to whatever you d o.
STRUCTURE OF THE MATERIAL
If you page through the book, you \,•ill see that it is set up a little differently than other textbooks you have seen.
Fun Footn otes Fun Footnotes? Footnotes are dry and acaden1ic. O urs are little bits of kno\,•ledge that take you beyond the book. Son1e students are really turned on by then1. No, honestly. In any case, they are never required reading. If you find them inter- esting, enjoy then1. 1 If not, ignore then1. Son1e are different; they take a swipe or n,•o at w hat standards agencies do.
Sm a ll Sections Long blocks of text are daunting to read. This book breaks things into a lo t of small digestible sections \-Vi th a lot of headings.
Short Sections w it h Level Th ree Headings (Like This One) If you just read a title, you often can get the gist of what follo\-vs. This w ill make it easier to kno\v w hat the section does. Learning sn1all chunks of information also increases con1prehension.
Key Ter ms Key concepts and their acronyms are sho\,•n in boldface. That alerts you to their importance. If you forget this key term, you can ah,•ays go to the Glossary to refresh your men1ory. The index also lets you see \,•here a key tem1 appears. If a page nun1ber is shown in boldface, that is w here the concept is defined or characterized.
Ca llout s As you read a section, pay atten tion to callouts like the one below. They emphasize an important fact or idea and often things that are points of frequent confusion. Before exan1s, first go over the callouts until you have them cold.
1This is o ur way to put in some material that is good to know but that is more than an introductory course should include a nd that generally has proven difficult fo r even well-prepared undergraduates to master.
xxxviii Preface for Students
As you read a section, pay attention to ca/louts like this one. They emphasize an impor- tant fact or idea.
Comprehensive Figures Nearly every in1portant concept in the book is cov- ered in a figure. The figures are very carefully designed to show the flow of actions or ideas. As you read a section, look a t the figures carefully. See if you can teach each to an imagina ry friend. First set the stage. What are the pieces? Then step through the various parts of the figure.
Some figures end V>' ith (Study Figure). These are essentially notes on what the section covers. It gives you a view of a block of ma terial from 10,000 feet and helps link frameworks \,•i th individual facts.
Test Your Understanding Qu estions The ma terial in networking is highly cumulative, so you \,•ant to n1aster the n1aterial in a section before going on. Each sec- tion ends with Test Your Understanding questions designed to help you see if you have understood what you just read. When you reach them, you \,•an t to go on instead of testing yourself. If can get you rself to go over the questions imn1ediately, it \,•ill help you learn \,•hether you understand the n1aterial you just read. If you aren't comfortable, go back and learn the material again.2
STUDYING FOR EXAMS
If you think you won't have to study for exams, it \,•ill probably end in tears. Given this reality, son1e advice about ho\,, to study for exams is in order.
• Again, a good p lace to begin is the callouts. Go through then1 and n1ake sure you understand them all. They include a lot of the chapter's in1portant content in little chunks.
• A good place to go next is the figures. Go through them one at a tin1e, teaching them to your imaginary friend. This again packs a lot of n1aterial in sn1all packages. Let the study figures help you understand fue structure of the relevant section and its key points. To tell a story, first set the stage. What is the problen1 being solved or presented in the figure? What are the devices and programs involved? Then walk through the rest of the figure. Often, steps to do so are numbered. If you under- stand all the figures, you should do well.
• After you have done these fuings, go over your Test Your Understanding answers. If you d id fuen1 from home\,•ork, don't just s tudy your original answers. When you wrote fuem, your kno\vledge was less n1ature than it ½•ill be just before exan1s, and many of your early ans\,•ers \,•ill be science fiction. One helpful trick is to ask yourself \,•hy each question is important. Why do you have to know it?
2A key idea in answering Test Your Understanding questions is to maximize what you le.am, ask yourself, .,.Why is this question important?" Each qucsHon has a reason for being there. Sec if you can understand what it is and why it is important.
Preface for Students xxxix
• Yes, you are going to have to reread much of the text. This is especially in1portant for parts of the chapter tha t d eals with complex fran1e\-vorks \,•ith multiple parts. As discussed previous! y, you w ill learn them, forget them, learn then1 again, and so forth.
CERTIFICATIONS
In high school, you may have taken advanced placement exams. Passing AP exan1s impress college admissions comn1ittees. Analogously, IT certification exams let you demonstrate son1e in-depth knowledge and also tell con1panies that you are serious and proactive. The problen1 is tha t there are many certifications, and they offer different levels of kno\,•ledge about different topics. Many require hands-on expertise in working with networking technology. Most require two to fi ve years of \,•ork experience for full certification, altho ugh some of these allo\v you to receive associate status if you pass but have not yet acquired the \,•ork experience. All of then1 cost money, in some cases thousands of dollars.
Netw ork+ and Security+ The least an1bitious certifica tions are CompTIA's Network+ and Security+ certifications. Both are quite doable w ith some extra study. Neither impresses IT departments highly. However, they are achievable with reason- able effort. A n1ajor practical problen1 with these certifications is tha t they spend far too n1uch time on technologies and concepts that have been irrelevant for thirty years or n1ore.
Vendor Certification s Vendors offer certification exams that are prized by IT departn1ents. The introductory certifica tions show that the bearer has the knowledge to do entry-level tasks in the exam's area.
The problen1 with vendor certificatio n is that they see things only fron1 that par- ticu lar vendor's point of vie\,•. For exan1ple, C isco w ill cover a great dea l about Cisco routers, switches, and other network devices. In contrast, Microsoft \,•ill focus on net- working from the client and server point of vie\,,, including various types of network servers such as DNS servers.
Passing a vendor certification \Viii require you to learn n1ore than an introductory network course will cover. You will need to buy a book to study. Many of the concepts will be the ones you learned in this course. You will also see quite a few topics in d epth. Sadly, in our opinion, you \,•ill also have to master quite a few legacy technologies that have not been seen in this century. We understand tha t businesses must support son1e obsolete neh,•ork technologies, so learning about then1 in a vendor certification course n1akes sense. Given that o nly some students go on to neh,•orking makes it silly to cover these topics in introductory networking courses, however. It takes too much time a\,•ay fron1 job-relevan t material.
For new gradua tes, Cisco now offers the Cisco Certified Entry Network Techni- cian certifica tion. ACCENT certification va lida tes skills for entry-level \,•ork. Those who pass have th e skills to install and manage a sn1all branch office network in an enterprise. This includes relevant neh,•ork security. To be attractive to corpora tions, students should achieve the next-level Cisco certification, Cisco Certified Network Associate (CCNA).
xi Preface for Students
Professional Association Security Certifications Security has professiona l associations for people working in security. They generally offer certifica tion progran,s.
• For broad security professionals, (ISC)2 offers certifications in a nun,ber of security domains. Passing most or all of them will valida te a good level of mastery of secu- rity. For ne\,, graduates, there is the Associate of (ISC)2 certification, which allows a student \Vith no work experjence to demonstrate a good level of knowledge before obtaining the experience requirements for n1ore advanced certifica tions. In turn, the Systems Security Certified Practitioner (SSCP) certification requires one year of experience in one of eight content domains. The n1ost important initial cer- tification is the Certified Inforn,ation Systems Security Professional (CISSP). This requires five years in two or more of the eight don,ains.
• For inforn,ation systems auditors, there are more focused certifications. These are offered by ISACA, the Informa tion Systems Auditing and Control Association. ISACA offers the Certified Information Systems Auditor (CISA) and Certified Inforn,ation Systems Manager (CISM) certifications.
Advanced Cert.ification Programs and Master's Degrees At a higher level of kno\,•ledge and skills, there are advanced certification progran,s and master's degrees. The predon1inant advanced certification program in security is offered by SANS, \,•hich offers advanced courses in specific areas leading to a broad level of knowledge. These courses are quite expensive. Most SANS participants are sponsored by their en1p loyers. The first author has found then, to be great courses.
ABOUT THE AUTHORS
Ray Panko is a p rofossor of IT m anagement and a Shidler Fellow at the University of Haw ai'i's Shidler College of Business. His main cours~,s are networking and security. Before coming to the university, he was a project manager at Stanford Research Insti· tute (now SRI International), w here he worked for Doug Englehart, the inventor of the m ouse and creator of the first operational hypertext system. He received his B.S. in physics and his M.B.A. from Seattle University. He received his doctorate from Stan- ford University, where his dissertation \vas conducted under contract to the O ffice of the President of th e United States. He h as been awarded the Shidler College of Busi- ness's Dennis Ching award as the outstanding teacher among senior faculty. His e-mail is [email protected].
Julia Panko is an assistant professor on the faculty at Weber State University. She received her d octorate from the University of California, Santa Barbara. Her research interests include the twentieth- and twenty-first-century novel, the history and theory of information technology, and the digital hum anities. Her dissertation focused on the relationship betw een information culture and modem and contemporary novels.
xii
This page intentionally left blank
Chapter 1
Core Network Concepts and Terminology
LEARNING OBJECTIVES
By the end of this chapter, you should be able to: • Discuss ho\v the Internet is changing and the security challenges these changes are
creating.
• Explain basic concepts and terminology for the hosts (devices) that connect to the Internet.
• Explain basic concepts and terminology for the Internet itself.
• Explain basic concepts and terminology for single nehvorks and their role on the Internet.
• Explain the distinctions between Internet routers and personal access routers; explain the differences between personal access routers and \vireless access points.
A STATE OF SIEGE1
On September 15, 2016, criminals launched a massive cyberattack on KrebsOn&.>curity .com. This is the blogsite of Brian Krebs, \vhose posts are often the first analyses of major cybercrime incidents (such as the Target breach \Ve will see in Chapter 4).
1 Kyle York, "Dyn Statement on 10/22/2016 DDoS Attack," Dyn, April 19, 20 17, https:/ / dyn.com/blog/ dyn-statemcnt-on-10212016-ddos-attack/; Brian Krebs, "KrebsOnSecurity Hit With Record DDoS," Kreb- sOnSecurity.com, September 16, 2016, https:/ /krebsonsecurity.com/2016/09/krebsonsecurity-hit-with- record-ddos/; Brian Krebs, "Source Code for loT Botnet 'Mirai' Released," KrebsOnSccurity.com, October 16, 2016, https:/ /krebsonsecurity.com/2016/ 10/source-codc-/or-iot-botnet-mirai-released/; Brian Krebs, "Who Makes the IoT Things Under Attack?" KrebsOnSecurity.com, October 16, 2016, https://krebsonse- curity.com/2016/10/who-makes-the-iot-things-under-attack/; Brian Krebs, "Hacked Cameras, DVRs Pow- ered Today's Massive Internet Outage," KrebsOnSecu rity.com, October 16, 2016, https:/ /krebsonsecurity .com/2016/10/hacked-cameras-dvrs-powered-todays-massive-intcmct-outage/; Brian Krebs, "Akamai on the Record KrebsOnSecu rity Attack," KrebsOnSecurity.com, November 16, 2016, https:/ / krebsonsccurity .com/2016/11 I akamai-on-the-record-krebsonsecurity-attack/.
1
2 Chapter 1 • Core Network Concepts and Terminology
Botnet
VCR . Mirai Bot
Attack Commands , , " ,__, _ _,...,_
c;::j ---c::111._--C~M;essage Flood
<'1:: ::::I- ~ U.MiraiBot• - -c:: a--r=::: • t-~~ Botmaster
, Access Router
-~- .. Security Camera
KrebsOn Security.com
FIGURE 1-1 Simplified Depiction of Mirai Distributed Den ial-of-Service Attack
Cybercriminals hate him, and they had attacked his site 269 times in the previous four years.2 (This \Vas about one attack every fiv e days.) The attacks that began on Septem- ber 15, 2016, however, were unprecedented.
DDoS Attack These attacks \Vere distributed denial-of-service (DDoS) attacks. Figure 1-1 shO\VS a simplified view of a DDoS attack.3 In advance, a cybercriminal called a botrnaster installs mal\vare on hundn.>ds or thousands of computers \vithout the O\Vn· ers' knowledge. This mahvare is called a bot. Like a physical robot, a mahvare bot can be given goals, which it w ill then execute in detail. In Figure 1-1, the botrnaster co m- mands the bots to attack a certain target site. Each bot then sends a fl ood of packets at the target host. The traffic overwhelms transmission lines to the target. The particular botnet malware that attacked Krebs' site was called Mirai.
Enormous Traffic The September 2016 attack was remarkable for two rea- sons. The firs t was the d eluge of traffic it threw at Krebs' site. The Mirai bots were able to flood the site with traffic at an astounding 620 Gbps4 (billions of bits per second).5
According to Akamai, which was protecting KrebsonSecurity.com at the time, this was almost twice the volume of any DDoS attack it had ever encountered.6 Mitigating such an attack \Vas daunting, and it took considerable time.
Internet of Things (Ion Devices The second reason the attack was remark- able \vas the nature of the devices used in the attack. Normally, DDoS attacks use
2 Krebs, "Akamai on the Record KrebsOnSecurity Attack."
3 We will look at these attacks in more dep th in Chapter 4.
4 Speeds are measu red in bits per second, kilobits per second (kbps), megabits per second (Mbps), and giga- bits per second (Gbps).
5 Krebs, 11Source Code for Io T Botnet 'Mirai' Re.leased.'' 6Krebs, " KrebsOnSecurity Hit With Record DDoS."
Chapter 1 • Core Network Concepts and Terminology 3
compron1ised desktop computers, lap tops, and other traditional IT devices. In the attack on Krebs' site, however, the a ttacking computers \,•ere small nontraditional devices, including hon1e access routers, home security can1eras, and hon1e VCRs. In a trend called the Internet of Things (IoT), we are seeing explosive growth in Internet connections by devices previously too lacking in po\ver to use the internet. The size of the IoT is difficult to d iscuss because it is gro\,ving so explosively. However, Gartner, Inc. estima ted the number of active IoT devices at 5 billion and forecasts that 2020 w ill see aln1ost 21 billion.7 Even if that forecast is highly optimistic, IoT devices are a lready about as widespread as humanly used con1puters and \Vill soon be far n1ore nun1erous.
Weak loT Security The cybercrin1inals realized tha t IoT devices often have weak security. Many come \,•ith a login account paired \,•ith a well-known default pass- word. If the defau lt pass\vord is not changed, anyone can take over the device over the Internet. Users often fail to mange them. In fac t, son1e default passwords are hardcoded into IoT devices and cannot be changed by the user.8 The Mirai mah,•are jumped from one device to another by trying a mere 68 device-password con1binations.9 In many \,•ays, this attack \,•as a con1ing of age for the Internet of Things. IoT n1ay still be in its infancy overall, but it is now mature as a destructive force.
Dyn There have been many o ther M irai victims. On October 21, 2016, Dyn, Inc. was the target of a similar attack. In a postmortem on the attack, Dyn reported that it had been a ttacked by tens of n1illions of discrete IP addresses known to be part of the M irai botnet.10 Dyn is a Doma in Name System (DNS) hosting service. We \,• ill see DNS la ter in this chapter. If you kno\,, the name of a si te, such as panko. com, you cannot send it n1essages until you learn its officia l Internet Protocol (IP) address. (To g ive an analogy, if you kno\,, someone's name, you cannot call tha t person until you learn his or her telephone nun1ber.) A DNS server gives your con1- puter a nan1ed site's IP address. If a DNS server that serves hundreds or thousands of popular s ites is d isabled, the res ult can be chaos. Among the sites at least ten1po- rari ly disrupted in the Dyn attack \'Vere Amazon, Netfl ix, Twitter, Spotify, Reddit, and Tumblr. 11 Th is incident did not merely attack a s ite. It attacked a critical piece of the Internet infras tructure.
Perspective The great promise of the Internet has been to give access to "any- thing, anytin1e, anywhere." Unfortunately, crin1inals are quick to exploit new technolo- gies. The Internet has evolved with breathtaking speed, bringing both ne\,, applications and new types of attacks. Neh,vorking peop le are involved in a protracted arms race with cybercrin1inals, and the cybercriminals have been winning too often.
7 Ibid.
8 Krebs, "Hacked Cameras, DVRs Powered Today's Massive lntemct Outage." 9 Krebs, " Who Makes the loT Things Under Attack?"
10 York, " Dyn Statement on 10/ 22/ 2016 DDoSAttack."
11 Krebs, "Hacked Cameras, DVRs Powered Today's Massive Internet Outage."
4 Chapter 1 • Core Networ k Concepts and Terminology
All this does not mean that the Internet or other networks are bad. The very rea- son d enial-of-service a ttacks are so damaging is that the Internet's benefi ts have becon1e indispensable for people and organ izations. Ho\vever, every garden has snakes. Net- working cannot be managed without understand ing security, and secu rity cannot be n1an aged w ithout understand ing neh,•orks.
Test Your Understanding
1. a) What is a DDoS attack? b) In \,•ha t rn•o ways was the KrebsOnSecu rity.con1 DDoS attack unusua l? c) What do \'l'e m ean by the "Internet o f Things?" d) What happens when a host cannot reach a Domain Name System server? e) What specific security weakness did the Mirai ma lware use to propagate fron1 n1achine to machine?
ANYTHING, ANYTIME, ANYWHERE
The Internet used to be the "New Thing." It caught fire in th e public's in1agina tion in 1995 \,•hen the Internet firs t becam e con1mercial. Before then, the Internet's Acceptable Use Policy exp licitly p rohibited most comn1ercial activity. This was d one because the Intern et's transmission backbone was sup p lied by the Nationa l Science Founda tion (NSF). Using the NSF to subsid ize commercial activity was simply not in the ca rds. In 1995, ho\,•ever, the NSF pulled ou t. The rationale for the Accep table Use Policy van- ished . The Internet could be used commercially. It was, imn1ediately.
Test Your Understanding
2 . When was conm1ercial activity o n the Internet firs t allowed?
The Internet Reorganizes to Get Commercial
Internet Service Providers In 1995, commercial Internet service providers (ISPs ) took over the backbone of the Internet. They a lso becan1e the onran1ps to the Internet. An yone \,•anting to use the Internet n1ust go through an ISP. The Internet today is sin1ply a collection of ISPs that collectively d e liver traffic from source to d estina tio n con1puters. Figure 1-2 illustrates this situation.
In ternet transmission is handled by commercial Internet service providers (ISPs).
Hosts Figure 1-2 notes that all devices connected to the Internet are called hosts. You will encounter this term throughou t this book. A lapto p is a host when it connects to the Internet. So is a n1obile phone. So are the \Vebservers and o ther servers that pro- vide the services you use w hen you use the Internet.
Devices th at connect to the Interne t are called hosts.
Host A
Hawaii.edu NetwO<k
Chapter 1 • Core Network Co ncepts and Terminology 5
Panko.com Network
Internet Service Providers (ISPs)
ISP3 ISP2 HostC }
ISP 1 C ISP 4 HostB
Microsoft.com NetwO<k
ISPS IS SP 7 _J-~ - -o
ISPS HostD
Any device connected to the Internet is a host.
FIGURE 1· 2 The Internet: Internet Service Providers, Organizational Networks, and Hosts
E-commerce The year 1995 saw an immediate rush of commercial companies to ply their businesses over the Internet. Companies \,•ith such familiar names as An,azon and eBay were ready and waiting. Amazon's entry \,•as especially interesting. Jeff Bezos wanted to cre- a te a company that \,•ould sell everything over the Internet, not just books. He chose the name of the company to indicate that it \,•ould be a very wide torrent for delivering goods and ser- vices. When you look at the An,azon logo, note the arro\,, at the bottom. It points fron, A to Z.
Why start with books? Bezos realized that the book industry had almost everything needed for online sales. Publishers and distributors had huge warehouses of books and the ability to do single-item packaging. More importantly, everything was on their com- puters. An,azon could reach into those databases and provide an online sales front end, con,plete \,•ith the company's innovative one-click ordering. Many organizations and individuals developed simpler non-interactive informationa l \,•ebsites to provide infor- n,ation. Soon the Internet became the firs t place to go for information, some of it correct.
Test Your Understanding
3. a) What services do Internet service providers provide? b) In Figure 1-2, through \,vhich ISP(s) \,•ill traffic pass if a packet from Hawaii.edu goes to Panko.com? (Ans\,ver: ISP 1, ISP 2, and ISP 3) c) Through \,vhich ISP(s) will traffic pass if a packet from Microsoft.com goes to the mobile phone in the lower right of Figure 1-2? d) Through ½•hich ISP(s) may traffic pass if a packet from Microsoft .con, goes to Panko.com? (Hint: There are multiple possible answers.)
4. a) What do we call any device connected to the Internet? b) When you use a laptop to connect to the Internet, is it a host? Explain in terms of the definition of host. c) When you use the Internet, are yo11 a host? Explain in terms of tile definition.
Old Yet Always New
No Longer New? The Internet today, more than a human generation after its creation, is no longer new. Many of the young pioneers \,•ho created it are no longer with us. Both e-con,merce and informational websites tha t appeared only about l\venty years ago are also old hat.
6 Chapter 1 • Core Network Concepts and Terminology
Commercial for More than Twenty Years
In 1995, the U.S. government pulled out transmission funding Now, e-Commerce was possible
Yet Still New Applications, Even Entire Classes of Applications
Social Media, etc.
Growing Speed
High-definition and 4K video, large data transfers, full-computer backup, etc. are now possible Companies can locate servers far from expensive city locations, even rent servers "in the cloud" Back-end artificial intelligence processing for speech recognition, more
Growing Ubiquity and Reliability
Almost never out of touch with the Internet and your resources there
The Emerging Internet of Everything
Traditionally, there was a human user involved Growing technology allows devices to talk to one another, without human involvement These devices can now be very small, such as thermostats These devices now communicate by low-cost radio directly with one another
FIGURE 1-3 The Ever-Changing Internet (St udy Fig ure)
However, V>'ha t the Internet o ffers to people and organizations w ho use it is con- stantly ne\,•. Social media are relatively recent developmen ts, as a re high-quality video streaming and teleconferencing. No\,• we are beginning to see a ugmen ted reality, and not jus t to find and fi ght Pokemons. What will com e next? Based on w ha t \,•e know about the past, it \,•ill surprise us. Since the emergence of the Internet, we have a lways been shocked \,•hen new "killer app" categories emerge to create a \,•hole new set of bil- liona ires a nd addicted users.
Growing Speed Ho\,• can the Internet change so freq uen tly a nd so radically in the applications it supports? The answer is that the Inte rne t itself is changing techni- cally at a n eno rmous rate and \,•ill contin ue to do so. Simple speed is the m ost obvious change. Today, \,•ired Interne t connections can bring n1ultip le high-definition videos to hon1es. Increasing velocity a lso allows you to use programs like Box a nd Dropbox to back up you r files in real tin1e and use them immedia tely or later d espite their sizes. At the corporate level, con1panies even back up their massive transaction databases in rea l tim e. If one corpora te site fa ils, anothe r site can pick up the con1puting load a lm ost instantly. At a very broad level, ma ny compa nies have d ecided to stop buying and run- ning their o\,•n servers. They have turned to cloud computing, in which you rent just the numbe r of servers you need. If you r load varies, you can even rent servers by the hour. Netflix, w hich generates abo ut a third of the In ternet traffic going into Am e rican hon1es in the evening, va ries the n umber of servers it uses throughout the day. It even has a self-service porta l to add and d rop servers instantly. These cloud servers a re clus- tered in m assive server fam1s that each has thousands of servers under o ne roof. Where are these server fa rms? It rea lly doesn't n1a tter. The In ternet can connect comp uters anywhere \Vith minin1al delay.
Chapter 1 • Core Network Concepts and Terminology 7
Growing Ubiquity and Reliability Another con tinuing disruptive change is the ubiquity of Internet access. Initially, you need ed a d esktop or at least a lap top com - puter. It was probably sta tionary in you r home or office. When you were away from it, your access to the Internet depended on the presence of a n Internet cafe or the kindness of friends. Mobile phones changed that, b ut o nly gradually. Early n1obiles either could not access the Internet at all or v.•ere lin1ited to a stupefying slow 10 kb ps (10,000 bits per second). No mega, and certa inly no giga. Today, speeds are far greater.
O f even greater importance, \,•e can use the Internet everywhere. Our connection to the Internet is "a lways on." Our mobiles p rovide that to us nea rly all the time, and \,•e are increasingly able to plug into lower-cost (and higher-speed) Wi-Fi as we travel.
Th is a lways-on connectivity of m obile devices is used in \,vays we d o not even realize. For example, the speed recognition processing needed for voice commands is usually done on a d istant server \,•ith n1assive processing power, not on ou r puny li ttle phones and tablets. This allows far richer and sm arter interactions.
Along w ith this near ubiquity of Internet access is nearly perfect reliability. When the first auth or initia lly used the ARPANET (the forerunner of th e Internet), he \,•as astounded to see tha t he had new mail. It was from a colleague at MIT, \,•elcoming him to the 'Net. A week later, he was still a m azed, but like everybody else \,•ho \,•as using networks, he also thought, "Too bad it doesn' t work more o ften." Today, it does.
The E.merging Internet of Everything When the Internet was created in the late 1970s, con1puters were the size of rooms. Users worked at dumb tern1inals on their desks. These terminals \-Vere basically keyboards and low-quality d isplays. Micropro- cessors had just been invented, and they were too expensive for individuals to use. When the Internet was designed, it \-Vas widely assumed that o nly these large con1put- ers would connect to the Internet. However, Moore's Law forecas t that microprocessor prices would soon fall dramatically and would continue d o ing so for n1any years. Per- sonal con1puters (PCs) began to conununicate. The n came sn1artphones.
Tod ay, \,•e increasingly have residen tial therm osta ts, a ir cond itioners, and even coffee m a kers with en ough processing po\,•er to run applications and communicate over the Internet. Fur thern1ore, these d evices increasingly talk to o ne another, with no hun1an involven1ent. As noted at the beginning of this chapter, this trend is being called the Internet of Things (loT). In fact, the "devices" connected to the Internet may not even be physical. Today, a comp uter can run h,•o or m ore virtual m achines, which are progran1s and related data that act like full con1p uters when they talk to real devices and h umans on the Internet.
Tes t Your Understanding
5. a) What continuing changes in the Internet are contributing to its ability to sup- port new applications constantly? b) What are the characteristics of the Internet of Things?
Owning and Managing the Internet When the U.S. governn1ent pulled out of the Internet, the Internet needed a v.•ay to fund itself. This task was left to the ISPs. To use the Internet, you n1ust connect through an ISP. Doing this is not free. As an individual or part of a fa m ily, you probably pay about
8 Chapter 1 • Core Network Concepts and Terminology
Commercial lSPs Handle Transmission
You must have an ISP to use the Internet You pay the ISP money Corporations pay a lot more ISPs deliver packets across one another Settlements for sharing revenue from users Nobody owns the Internet. The ISPs do collectively
Nobody Controls the Internet, Either
The Internet Engineering Task Force (IETF) sets standards, but compliance is voluntary A few things are centralized, including controlling Internet addresses to prevent duplication
FIGURE 1-4 Owning a nd Managing the Internet (Study Figure)
$50 per month to your ISP for Internet access. Organizatio ns pay far more-often tens of thous,mds or even n1illions of dollars each year. Traffic must flow across ISPs, so the ISPs have financial settlement agreements an1ong themselves to compensate for cross traffic.
Under these conditions, ''Who o\,'llS the Internet?" The answer is, "nobody." Each ISP owns its own resources, and the Internet is the sun, of these resources. This n1ay seem like an odd situation, but this is exactly how the \'l'orldwide telephone network works. There are thousands of telephone companies around the world. like ISPs, they exchange traffic and use financial settlen1ents to balance costs and revenues.
An obvious related question is, "Who controls the Internet?" The answer, again, is, "nobody." A fe\,v things about the Internet are controlled. For exan1ple, the Internet Assigned Numbers Authority (IANA) controls internet addresses to avoid address duplica tion. However, remarkably little e lse is controlled.
What about s tandards? There is certainly a n eed for standards to govern ho\,• devices talk to one another. However, things are a little complicated. The organization that creates standards is the Internet Engineering Task Force (IETF). This is a volun- teer and son1etimes rowdy organiza tion that crea tes great standards. However, it has no po\,•er to impose these standards on ISPs and user organizations. In fact, quite a few of its standards have been ignored by ISPs. Keep this in mind \,•hen \,•e talk about Internet s tandards created by the IETF.
Th e internet Engineering Task Force (IETF) creates Internet standards.
Test Your Understanding
6. a) Who o½•ns the Internet? b) Who is in charge of the Internet? c) What is the role of the IETF?
The Snake in the Garden
The Internet pron1ises to give users access to aln1ost everything, anytime, an ywhere. Unfortunately, it does the san1e for crimina ls, nationa l governments, and just plain jerks. As the Internet has grown in size and con1plexity, so have th e adversaries and
Chapter 1 • Core Network Concepts and Terminology 9
Anything, Anytime, Anywhere
Works for Attackers As Well As Legitimate Users
Security Underlies Everything That Network Professionals Do
FIGURE 1-5 Security: The Snake in t he Internet Garden (Study Fig ure)
the a ttacks they use. Neh,vorking practitioners are not the only professionals \,•ho are responsible for stopping security threats, but security underlies aln1ost everything that nehvorking professiona ls do. We will hold off looking more deeply into security unti l Chapter 4. This is not because security is urumportant but because you need a solid grasp of neh,•orking concepts, standards, a nd management before you can understand secu rity threats and countermeasures.
Tes t Your Understanding
7. a) Why is the Internet's ability to give broad access a good thing? b) Wha t dan- ger d oes i t bring?
Next Steps
So far, \,•e have been looking at th e Internet at a very high level. For the res t of this chapter (and this book in general), we look a t th e In ternet and other nehvorks in the detail that professiona ls in IT, nehvorking, a nd security need to understand to enter the profess ion. In this ch apter, we focus on the core In ternet tern1s and concepts we will see throughout this term.
This introduction ends \,•ith a fundamental point. So far, \,•e have been ta lking abou t the Internet. However, the Internet is not the only nehvork. In fact, "Inter" n1eans "behveen." The Internet \Vas specifically created to link many individual net- works together. We begin \,•ith the Internet, but later in the chapter \,•e also look at hvo types of nehvorks tha t can be standalone nehvorks or parts of the Internet.
Th e Internet is not the only n etwork.
Tes t Your Understanding
8. a) What d oes "Inter" in Internet mean. b) Why is this important?
OUTSIDE THE INTERNET
We will spend m ost of this tern1 looking inside the Internet and o ther nehvorks. Ho\,•- ever, we begin by looking a t the Internet fr0111 the outside-focusing on the user devices attached to it. Figure 1-6 shows some d evices attached to the Internet. However, it dep icts th e In ternet itself as a n opaq ue cloud . The cloud indicates that th e average
10 Chapter 1 • Core Networ k Concepts and Terminology
2 Browser Application
2 ~---------------- ------------- >-
1
Any device connected to the Internet is a host.
FIGURE 1-6 Outside t he Internet
Browser-Webserver Applic ation Message
Delivered in an IP Pack et
Link
/,
Access Link
2 Webserver Application
Host
user does not have to know w hat is hap pening inside the cloud. Things (should) just work. The electrica l system \,•or ks in a \,•ay similar to this cloud . When you turn o n a light s½•itch, you d o not have to kno\,• how the e lectricity is delivered to you. It just is. Depicting the Internet and other neh,vorks as a cloud is very common.
Figure 1-6 sho\'l'S th a t the job of the Internet is to d e liver app lication n1essages fron1 app lica tion progran1s running o n hosts. As we saw earlier, a host is any d evice connected to the Internet. 12 You r n1obile p ho ne, tablet, an d PC are all hosts.
Note, ho½•ever, that the Internet is not just about connecting h osts. It is about con- necting applications running o n these hosts, and it is about connecting them by deliver- ing application messag es beh,•een then1.
Th e Internet connects hosts by deliverin g applica tion m essages between the m.
Test Your Understanding
9. a) Wh y is the Internet often depicted as a cloud? b) Why is the In ternet not about sending messages beh'l'een h osts?
Client and Server Host s
Most h osts are cl ients or servers. S erver h o s ts p rovide services to client hosts. For exan1ple, \,•hen you browse the Web on your n1obile phone, you r mobile pho ne is a client host. The server is the ½•ebserver to \,•hich you send requests. It processes you r requests an d send s you the files you specified.
12 \+\Then the Internet was first designed, it was assumed that only large computers would have enough pro-, cessing power to connect toil Typically, these computers served users at dumb tcnninals without processing power. These large computers were usualJy called hosts in standards documents. As processing power grew cheaper, PCs began to connect to the Internet directly, and today we even have lntemet coffee pots. Faced with these changes, the Internet Engineering Task Force had to rewrite its early standards with a more lnclu• sive name or broaden the name "host" to embrace smaJJer devices. Intellectual energy conservation won.
I FIGURE 1- 7 Clie nt Hosts
Chapter 1 • Core Network Concepts and Terminology 11
Client Hosts Receive Services from Server Hosts
SeNer hosts provide seNices to client hosts.
Client Hosts As a user, you are personally most fan,iliar \,•i th client hosts. Client hosts include your mobile phone, tablet, and PC. They also include your fit bit, sn,art watch, or anything else you use to access services on the Internet. Figure 1-7 shows some con,mon client hosts you may use.
Server Hosts You personally see client hosts every day. However, you may never have seen a server. If you suspect that servers are interesting to see, you w ill be d isappointed. Most servers are stored in equipn1ent racks that are 48 en, (19 inches) wide. These rack servers are installed one above another-often a dozen or n1ore serv- ers in a rack. Rack servers are usually plain-looking boxes, with a few connections on the outside, usually at the rear. Rack server heights are measured in n1ultip les or frac- tions of U, whim is 1.75 incl\es. The sn,allest are ½U tall. Larger servers are 2 to SUs in height. Figure 1-8 sho\,vs three server racks and one rack server being installed. Com- puter centers and server farn15 have hundreds or thousands of racks.
Most servers today are rack seNers that fit into 48 cm (19 inches) wide equipment racks.
Small size does not mean that rack servers have little power. For example, Netflix delivers streaming content to users via open connect appliance servers. (An appliance is something you just plug in and use, like a toaster.) Each of these appliances is about 4U tall. The fastest can stream 90 Gbps of content to users.13 This is enough to give 2,000 customers sin,ultaneous streaming high-definition video. 14
13 Michelle Clancy, "Nctflix Moves All Global Traffi c to Open Connect CON," http:/ /www.rapidtvncws .com/2016031942170/nctflix-movcs-all-global-traffic-to-opcn-conncct-cdn.html#axzz4YY30CBs8.
14 In fuct, even small rack servers arc too powerful for many uses. It is common for a single server's power to be divided into several virtual scnrcrs. Virtual servers are programs that act like physical servers.
12 Chapter 1 • Core Network Concepts and Terminology
hundreds or thousands of Equipment Racks
like these three.
0 Rack Servers a-,-e - 48 cm (19 in) w ide.
can hold several physical
Rack Servers like the one
he is holding.
-----~1 FIGURE 1-8 Rack Server Host
Test Your Understanding
Rack server height is measured
in multiples of U, which is 1. 75 inches.
10. a) D istinguish between client and server hosts. b) What type of devices are most servers?
Networked Appli cations Networked applications are simply those that reqttire a network to comn1tmicate with one another. For example, \,•hen you use th e In ternet, you have a bro\,•ser on you r device. Your browser comn1unicates with a \,•ebserver application program on a \,•eb- server. Figure 1-9 illustra tes this situation.
Client Program (Browser)
Server hosts provide services to client hosts
HTTP Request Message (Hypertext Transfer Protocol)
HTTP Response Message (The requested file)
FIGURE 1-9 Cl ient/Server Application: Webservice
Server Program
(Webserver)
0 Server Host
Client Program (Excel)
0 ODBC Query Message
Host
Chapter 1 • Core Network Concepts and Terminology 13
Server Program (Proprietary DBMS)
OOBC Response Message (Table)
0
FIGURE 1 - 10 Not Always Browsers and Webservers: Excel Querying a Propriety Database Management System (DBMS) Using the Open Database Connectivity Protocol (ODBQ
Networked applications are simply those that require a network to communicate with one another.
Your browser, which is your client p rogram, sends a request message to the \,•eb- server. This is an HTTP request message because HTTP (Hypertext T ransfer Protocol) is the standard for bro\,•ser-webserver interactions. This request n1essage asks for a file to be delivered. The \,•ebserver server program on the webserver locates the file and sends it back in an HTTP response message containing the requested file (or an error n1essage to say \,•hy it could not be delivered).
Browsers and \,•ebserver application progran1s are networked applications, but they are certainly not the only ones. Figure 1-10, for examp le, sho½'S Microsoft Excel acting as a client program. It is using the Open Database Connectivity Protocol (ODBC) to query a proprietary database. Other client/ server neh,vorked applications include Dropbox and Skype. The key point is that the client program is not al½•ays a bro\,•ser and the server application is not always a webserver program.
The client program is not always a browser, and the server application is not always a webserver program.
In general, the days of \,•riling a program to run on a single n1achine are rap- idly disappearing. Today, \'l'e usually \,•rite a program on one machine to \,•ork w ith a program on another n1achine. Ideally, networks \Vould simp ly \,•ork transparently, n1aking them irrelevant to programmers. However, reality often falls short of the ideal. Progran1mers who do not understand networking are strongly limited. So are database professionals, e-commerce professionals, and data analytics professionals.
Test Your Un derstanding
11. a) What are networked applications? b) Is the client always a bro\,vser? c) Is the server ah,vays a \'l'ebserver?
The Job of the Source Host
During transmission, a source host sends an application message to a destination host. Let's look at that process in a little more detail.
14 Chapter 1 • Core Networ k Concepts and Terminology
Network
® [I 1 Application Creates a short Software Application Message Network Stack
Transport ® [y 2 Adds a TCP header to
Process create a TCP Segment
Internet ® ~ 3 Puts the TCP Segment Process into an IP Packet Hardware and 4 Sends the IP Packet
Operating qJ to the Internet System 1:81 ), AGURE 1- 11 On t he Sourc e Ho st: Sending a Short Application Message
During tran smission, a source host sends an applica tion message to a destination host.
Sending Short Application Messages Figure 1-11 shows \,•hat the sou rce host d oes \,•hen its application creates a m essage for the applica tion on the d estina- tion host. IP packets have limited size. A short application message is one that is sn1all enough to fit into a single packet. A single packet can be u p to 65,536 by tes in size. Most are smaller.
IP packe ts have limited size. A short applica tion message is one that is small enough to fi t into a single packe t
First, the a p plication program crea tes the application message. Th is message is designed to be read by the application program on the destination host.
Second, the appl ication program sends the application m essage to the neh,•ork stack on the source host. The nehvork s tack is a small group of p rogran1s that \,•ill govern the subn1ission of the application message to the Internet and the reception o f incon1ing Internet messages.
• For short application n1essages, the transport process in the nehvork adds a short T rans mission Control Protocol (TCP) header to create a T CP segment. More o n this la ter.15
15 For many applications, the transport process creates UDP headers instead of TCP headers. We will sec the distinction between UDP and TCP in Chapter 2. Y.lc use TCP in examples in this chapter because we want to introduce application message fragmentation. UDP requires that application mcss.1gcs be short enough to fit into a single packet. [n contrast .. TCP can handle application messages short enough to fit in a s ingle packet or messages that must be sent in multiple packets.
Chapter 1 • Core Network Concepts and Terminology 15
• The transport process then passes the short applica tion n1essage do\,vn to the internet process in the neh,•ork stack. The internet process adds an IP header. Effectively, it places the TCP segn1ent in an envelope called a packet.
Point of Terminology:
We use Internet (with an uppercase I) for the global Internet that serves users and when Internet is in the name of a protocol (for instance, the Internet Protocol).
We use internet (with a lowercase i) for the internet process and other things.
The computer's hardware and opera ting system then subn1its the packet to the Internet. The Internet does the rest.
Short application messages fit into single packets.
The Final IP Packet Figure 1-12 shows the final IP packet. It begins w ith the application message. The transport process adds a TCP header. The Internet process adds an IP header. (We w ill see these headers in the next chapter.) This is the complete IP packet. When the packet is transmitted, the IP header is transmitted firs t, then the TCP header, and then the application n1essage.
Send ing Long Application M essages Things are a bit more con1plex for long application messages that are too long to fi t into a single IP packet. (As just noted, the maximun1 packet size is 65,536 bytes.) In this case, Figure 1-13 shows that the trans- port process first fragments the application message into severa l fragments, placing each in a separate TCP segment. As F igure 1-12 sho\,•s, the TCP segment header has a seq uence of numbers so the application n1essage fragments can be put back in order at the other end.
Sequence Number, etc. TCP Segment
Application Message (or Fragment)
IP Packet (Maximum Size 65,536 bytes)
TCP is the Transmission Control Protocol. IP is the Internet Protocol.
A GURE 1-12 The Fina l IP Packet
TCP Header
IP Header
Host IP Addresses: Source: 1.2.3.4,
Destination: 5,6,7 ,8, etc.
16 Chapter 1 • Core Network Concepts and Terminology
Network
@ Application 1 ;:;reates a Long Software Application Message Network Stack
[]JC]] Transport @ 2 Fragments messages into
multiple TCP segments, Process adds sequence numbers
(1, 2, etc.)
Internet @ ~~ 3 Process Pu1s each TCP Segment in its own IP Packet Hardware and 4 Sends each IP Packet
Operating qJ l><H><l to the Internet System ), FIGURE 1- 13 On the Source Host: Sending a Longer Application Message
The transport process then sends each segment do\,•n to the internet process. The internet process places each TCP segment into a separa te IP packet and submits the packets to the Internet for delivery.
Long application messages must be divided into smaller fragments, each of which is placed in its own TCP segment, which is placed in its own IP packet.
Test Your Understanding
12. a) What h,vo processes does the neh'l'ork stack provide? b) What is the maximun1 size of an IP packet? c) What does the transport process do to the application n1essage if it is short enough to fit in a single packet? d) If the application n1es- sage is too long? e) What does the transport process add to the app lication n1essage or fragn1ent? f) What is the resulting n1essage called? g) What does the internet process do with each TCP segment?
13. What are the three parts of an IP packet?
The Job of the Destination Host
Earlier, we looked at what happens on the source host. Figure 1-14 completes the pic- ture by showing what happens on the destination host. The internet process pulls each TCP segment from its packet, reassembles the TCP segn1ents in order, and passes the reassembled application message to the destination application progran1.
Freeing the Application Program from Networking Details Note that the application progran1 is not involved \,•ith neh'l'orking details. It n1erely crea tes appli- cation n1essages and receives application messages of any length. Segmentation and reassembly? Not its concern. Putting things in packets? Not its concern either. We say
Chapter 1 • Core Network Concepts and Terminology
4 Receives the Long @ Network Application Application Message Software
3 Heassembles fragments
CTCT @ by sequence numbers, Transport checks fOf errors, Process Passes original application message up Network
2 Removes segment g~ Stack
@ from each packet, Internet passes it up Prooess 1
r!eceives IP Packet
~ Hardware and
From the lntemet
I~><!- Operating System
FIGURE 1·14 On the Destination Host: Receiving a Long Application Message
that networking is transparent to applica tion programs. This means tha t application progran1mers can focus on \,•riting their applications, not worrying about how applica- tion messages will be delivered over a neh,•ork.
Test Your Understanding
14. a) What does the internet process on the destination host do \,vhen a packet arrives for it? b) What does the transport process on the destination host do \,•ith multiple TCP segments from a single application n1essage? (This answer is not short.)
INSIDE THE INTERNET
So far, \,•e have been treating the Internet as an opaque cloud, focus ing on what hap- pens on the hosts and network applications that are outside the Internet. (The discussion ¼'as also a way to begin sneaking in broader concepts, such as the distinction between application functionality, transport functionality, and internet functionality.)
The Main Characters: IP Addresses, Packets, Routers, Data Links, and Routes
No\,, we finally look inside the Internet to see ho\,, it functions at a very broad level. Figure 1-15 shows the main elen1ents \,•e see inside the Internet. These are IP addresses, packets, routers, data links, and routes.
IP Addresses
We start w ith IP addresses because they are the key to understand ing everything else. If you \,•ant to call Bob on his mobile phone, you need to know Bob's phone number. Sim- ilarly, hosts need addresses so that the Internet can deliver packets to the right hosts.
17
18 Chapter 1 • Core Network Concepts and Terminology
A packet passes through many Routers connected by Data Links. The packet's entire path through the Internet is its Route.
.-~. ''* -~ ... . ... ~ .,,.,,.,, ...... •.,J
~• R t .,.. ,..... .., .. ~ ou er .,.;,,;,,
B DL ..,,..
- i)--:::D~L ---ji'-,~- - ;::..:=-~~~ --~ ,_ :~ Router A lo • ..,_ DL - ..:.,;,
... '* '... • • • .,_. .., • • DL Router ... -~ .. .. . --. :--~~'\.-_::..~:;,,..., .. ·········· ...... .. • ~• Route ~- ..::_,- " 11.., .-•", D t Li k • ...... " , ... -a a n • .... -:, .,;.;,, ,. ···~ •
: 4 ....... - : Data Link : Route Route :
, Packet to • • 5.6.7.8
Host 1.2.3.4
-- ...... .. :.:,; ,_ .___ : L # -~ # ,..... .,.... Route .. • } "" Router .:.;,, ... .,..,.ii,,i,, ~-... - -:-, ~-· _. Data Link
Host 5.6. 7 .8
FIGURE 1-15 Inside the Internet
These are Internet Protocol (IP) addresses. The first generation o f IP addresses were IP Version 4 (IPv4) addresses.16 They \,•ere 32 bits (ls and Os) long.
Routers and hosts have no problen1 reading and writing 32-bit strings. Hun1ans have a lot of problems with them. As an aid to inferior biological entities such as ourselves, IPv4 addresses are us ually \,•ritten in dotted decimal notation. In this notation, they are written as four d ecimal integers separated by dots (periods). Each nun1ber represents a group of 8 bits. An exan1ple o f an IPv4 address is 1.2.3.4. Another is 127.171.17.13.
Each host on the Internet needs an IP address to rece ive IP packets.
For human reading and writing, IPv4 addresses are shown as four decimal integers sepa- rated by dots; this is dotted decimal notation.
Binary to Decimal Figure 1-16 sho\,•s ho\v to \Vrite32-bit IPv4 addresses in dot- ted decima l notation (DON).
• First, the 32 bits are d iv ided into four 8-bit "segments" (not to be confused with TCP segments).
• Then, each 8-bit segn1ent is treated as a binary number and converted into a deci- n1al integer. For example, 00000000 is O in decimal, 00000001 is 1 in decima l, and 11111111 is 255 in decimal. You can use Excel's bin2dec function to do the conver- sion. Most advanced calculators will do it as \,•ell.
• Next, the four segment numbers are put together and separated by d o ts. Hence the n an1e "dotted decimal n otation."
16 Thcrc were no Versions 0, 1, 2, or 3.
Chapter 1 • Core Network Concepts and Terminology 19
Devices Use 32-Bit IP Addresses Directly
32-bit 1Pv4 Address: 10101 101000101101100001010101011 This is too difficult for humans to read and write.
Humans Write lPv4 Addresses in Dotted Decimal Notation
DON is easier to read, write, and remember for inferior biological entities.
Start with 32-bit 1Pv4 Address. 10101101000101101100001010101011
Divide it into fou r 8-bit segments. 10101101 00010110 11000010 10101011
Convert each segment to a decimal integer."
Place dots between segments.
'In Excel, bin2dec(10101101) = 173
173 22 194
173.22.194.171
FIGURE 1-16 1Pv4 Addresses a n d Dotte d Decimal Notation fo r Huma ns
171
Dec.ima l t o Binary You can also reverse this p rocess to go fron1 dotted decim al notation back to na tive binary IP addresses. Ho\,•ever, keep in mind tha t Excel dec2bin and o the r calculation approaches treat the result as a binary n un1ber rather than what they are-strings of 8 bits. For example, if you use dec2bin to covert 22 to binary, you will get the ans\,•er 10110. You must add three leading zeroes 00010110 to get 8 bits.
IP Version 6 Addresses We sho\,• IP ad d resses as IPv4 add resses in dotted decima l no ta tion in fig u res a nd examp les here. Newer IP Version 6 (IPv6)17 addresses are becon1ing w idespread today. IPv6 ad d resses are 128 bits long. As \'l'e w ill see in Chap te r 8, writing IPv6 is more com p licated than dotted d ecimal notation, a nd it seem s best to avoid this add ed con1plexity until later.
Test Your Un derstanding
15. a) Ho\'I' many bits long a re IPv4 add resses? b) Con vert 00000001 00000010 00000000 11111111 to d o tted d ecimal no tation (spaces have been add ed). (Note: 00000001 is 1) c) Con vert 5.6.0.255 to a 32-bit IP add ress (add spaces between groups of 8 bits). (Note: 5 is 0000101, no t 101)
IP Packets
Fig u re 1-12 showed a final IP packet. Note that an IP head er con tains a source IP address and a d estination IP add ress. These give the IP add resses of the source host (sender) and the destina tion host (receiver). Rou ters use a packe t's IP destina tio n ad dresses to deliver the packet to its destination.
Test Your Un derstanding
16. a) Wha t are the three par ts of a n IP packet? (Yes, this is a re peat of a n ear- lier q uestion.) b) In w hich part \,viii you find the source and destination IP addresses? c) Which of these add resses \,viii routers use to deliver the IP packet?
17 Thcrc was an IPvS, but it was never made an official standard.
20 Chapter 1 • Core Network Concepts and Terminology
Routers
When a host transmits a packet, it sends the packet to a router. A router18 is like a rail- road switch yard. It receives an arriving packet, then fon,•ards it to another router closer to its destination host. An IP packet may travel through dozens of routers as it passes through the Internet to the destination host.
A router receives an arriving packet, then forwards it to another router closer to its destination host.
Routing F igure 1-17 shows how rou ters work in slightly more detail. In the figure, an IP packet arrives at Router A. The packet is addressed to destina tion host 60.3.27.46. Router A n1ust send it on to a router closer to the destination host. In the fig- ure, the router has two choices. It may forward the packet to either Router B or Router D, \,•hich are the only routers it connects to that will move the packet closer to the des- tination host. A rou ter's process for fon,•arding packets is called routing. A router's forwarding decision is called a routing decision.
A router's process for forwarding packets is called routing. A router's forwarding deci- sion is called a routing decision.
In Chapter 8, we will see ho\,, Router A makes its decision. For now, suffice it to say that Router A \-Viii make its decision intelligently, sending the packet back out in the best way for the packet to reach its destination host.
First Routing Decision: Should Router A Forward (Route) the Packet to Router 8 or Router D?
1
-1><1 IP Packet Arrives for 60.2.27.47
Router B .. . • • , -------Router C
--;" ,.. ~ "! ~ •• ---- -~ - \
.. ,. R___.ut e- --.......... ',..... o er ,,. .., Router D
Router F
FIGURE 1- 17 Routing (Router Forwarding)
60.2.27.47
18How do people pronounce "'router?" It depends where you arc from . Americans usually say '"rowtcr," with the ow being pronounced like the ow in "now." Pretty much everybody else pronounces it "rooter."
Chapter 1 • Core Network Concepts and Terminology 21
On Router B Suppose that Router A decides to send the packet to Router B. Router A \,vill then transnut the packet to Router B. When Router B receives the packet, it must make its own routing decision. Router B also has two choices. It can route the packet either to Router C or Router E. You may guess that it will fon,•ard the packet to Router C because the packet \,•ill then be only one more hop away from the destination hos t. Send- ing it to Router E will require h,vo n1ore hops. In practice, ho\,vever, a router takes n1any things into account \,•hen it makes its routing decision, not just the number of hops.
Test Your Understanding
17. a) What does a router do \,vhen an IP packet arrives? b) What is router for- \,varding called? c) In Figure 1-17, suppose that 60.3.27.4719 transn1its a packet to 128.171.17.13. When Router C receives the packet, what \,viii be its routing choices?
Data Links and Routes
Figure 1-15 sho\,'S that data links are transn1ission links that carry packets between pairs of routers. Packets travel over these data links to move beh,veen routers. Note the term "link" instead of "line." Data links often use wireless transn1ission instead of physica l lines, so the neutral (and vague) term link is used.
A data link is the transmission path of an IP packet between two routers.
We also need a nan1e for the entire path a packet takes beh'l'een the source host and the destination host, across multiple routers and transmission links. It is called a route. It is very easy to confuse data links and routes, but their distinction pervades Internet thinking, and you need to distinguish between them clearly in your mind .
The route is the packet's entire path between the source host and the destination host.
Test Your Understanding
18. a) Distinguish between data links and routes. b) In Figure 1-15, how many data links \,viii there be when the packet travels to Host 5.6.7.8? c) How many routes \,viii there be? d) In genera l, \,vhen a source host sends a packet to a destination host, w ill there probably be more data links or routes along the way? Explain. (The answer is not in the text.)
19 A professor at Pomona College "proved" that all numbers arc equal to 47. This did not catch on in math• cmatics. However, Pomona Colfcgc has produced many writers who tend to have an affinity for the number. This is especially obvious in science fi ction. Nearly every episode of the Star Trek series has the number 47 in il The second author of this book went to Pomona College, but the first author is solely to blame for the frequent use of 47 in this book.
22 Chapter 1 • Core Networ k Concepts and Terminology
The Transport and Internet Processes in the Network Stack
When the designers of the Internet considered moving packets over their budd ing cre- a tion, they knew tha t they faced h,•o conflicting requiren1ents.
• First, as \,•e w ill see in Chapter 8, the rou ters \,•ould have to do considerable \,•ork on each packet. To keep router costs reasonable, this \,•ork should be linuted as n1uch as possible.
• Second, to p rovide ad equate q uality of service, the Internet \,•ould have to pro- vide error d etection and correction, so that app lication progran1s got "clean" data. In add ition, packets \,•ould sometimes arrive out of order. A n1ethod would be needed to put them back in ord er. Also, n1ost a p p lica tion messages would be fragmented to fi t in packets. These wou ld each create significan t cost. Th is \,•as particularly true for error d etection and correction, \,•hich involves considerable n1athematica l processing.
To n1eet these conflicting requ iren1en ts, the Internet's d esign ers d ecided to d ivide the work of In tern e t transm issio n into two par ts. Figure 1-18 sho\,•s ho½' they did th is.20
• They \,•ould create a standard tha t would be used for the source host to transnut a packet to the Internet, to m ove packets between routers, and for the final router to
Client PC
' ' ' ' ' ' ' '
Trans port Processes End -to-End (Host- to-Host)
Pac ket assembly and d isassembly with TCP (no t with UDP) Error correction, packet sequenc ing, and
congestion control with TCP (not with UDP)
' ' ~
Internet Processes Hop-by-Hop (host-router or router-router)
Packet organization and forwarding
.. ... 111"'. .. ... .. . _______ ., - . -------.. ... . Router 1 Router 2 Router 3
FIGURE 1-1 8 The Transport and Internet Processes
Server
- ~ /
/ /
.( /
/ /
/ /
/ /
20 A historical note may aid your w,dcrstanding. (Or may not. That is why it is in a footnote.) lnitialJy, there was only a single Internet transmission standard, the Trans mission Control Protocol (fCP). lt handled both what we now caJJ transport and internet funcHonality. Before the Internet was finalized, however, the JETF decided that the standard was becoming too complex, so they divided the standard into hvo smaller parts. The Internet Protocol was created to govern internet matters, and TCP was restricted to transport matters. This division also allowed a second transport standard to be created, the User Datagram Protocol, which we will see in Chapter 2 and following chapters.
Cn the next chapter, we will see that error correction is done only once, by the transport processes on the source and destination hosts. lf it were done by the internet process, it would have to be done on each router hop along the way. That would slow delivery whHe pladng a greater processing burden on eac-h router, rais• ing router prices substantially. There are a lot of routers on most rou tes, so the internet process in general is stripped down to do as little as _possible with each packet while stilt getting it across the Internet.
Chapter 1 • Core Network Concepts and Terminology 23
deliver the packet to the destination host. This \,vould be the Internet Protocol (IP). The IP would have to be executed on every router along the route, so it was kept as simple as possible.
• The Internet Protocol would not handle diffic ult work like error correction. That \,•ou ld be done by a transport protocol, such as the Transn1ission Control Proto- col (TCP). Note in Figure 1-18 tha t unlike IP, which would be executed on each hop, transport protocols \,•ould only be done on the source and destination hosts. This n1eant that heavy processes such as error correction \,•ould only have to be handled once, on the two hosts.
Overall, several internet processes on the source host, the destination host, and inter- mediate routers are involved in JP packet transmission, but only the two transport processes on the two hosts are active.
Tes t Your Un derstanding
19. a) There are six routers between the source and destination host. How many transport processes w ill be involved? Explain. b) How n1any internet processes \-Viii be involved? Exp lain.
Supervisory Standards: Beyond TCP and IP
We have seen tha t packet transm ission among routers is governed by the Internet Protocol. The transport process \,•as governed by the Transmission Control Protocol (TCP) in our examples. In the next chapter, we will see that the transport process a lso has an al terna tive protocol, the User Datagram Protocol (UDP). These three standards govern most Internet activity because they are all that is necessary to deliver a packet, and delivering packets is the main work of the Internet.
Supervisory Protocols However, from the beginning the Internet \,•as created to be a worldwide network. This required the creation of supervisory protocols beyond the IP, TCP, and UDP delivery protocols. To give you a sense of what supervisory proto- cols do, let's look at two supervisory protocols that users deal w ith extensively, DHCP and DNS.
IP, TCP, and UDP are sufficient to deliver IP packets between hosts, which is the main job of the Internet. However, these three protocols must be supplemented by many supervisory protocols to do the additional work that is needed beyond what IP, TCP, and UDP do.
Tes t Your Understanding
20. Why does the Internet need supervisory protocols?
24 Chapter 1 • Core Network Concepts and Terminology
1 Client boots up , realizes that it does not have an IP address.
2 .;11ent broadcasts a OHCP request message. "I need an IP address, please!
3 OHCP Server
~ -- - ------------- 4 "Use 128.171 .17.13"
3 fhe OHCP server selects 128.171 .17.13 from tts database of available IP addresses.
4 The server sends this IP address to the client in a OHCP response message.
5 The client's IP address is now 128.171 .17.13.
FIGURE 1-19 Dynamic Host Configuration Protocol (OHCP)
Database of Available IP Addresses,
Including 128.171.17.13
Dynamic Host Configuration Protocol {DHCP) The host you use to surf the Web or do other tasks needs an IP address. How does it get its address? The answer is that client hosts get their IP addresses using the Dynamic Host Configuration Proto- col (DHCP). As Figure 1-19 illustrates, \,vhen a client device boots up, it realizes that it does not have an IP address. It broadcasts a DHCP request message to its local DHCP server.21 This n1essage asks for a ten1porary IP address to use. The server finds an avail- able IP address in its database and responds by sending the client a DHCP response n1essage that includes the IP address. For s ubsequent packets sent by the client, this is the packet's source IP address. This type of address is called a dynamic IP address.
When the client shuts do\,•n, it forgets the IP address. The next time the client boots up, it contacts the DHCP server for a new IP address to use. It typically receives a different IP address each tin1e it does this.
DHCP servers typically give a client a different JP address each time it boots up.
What about servers? Servers need stable IP addresses, which are called static IP addresses. (Imagine trying to shop at a business that keeps moving so that it has a dif- feren t address each day. Hn1m, sounds a bi t illega l.) A network techrucian types the static IP address into the server host's configuration file, and DHCP is not used at all.
21 Broadcas ting is necessary because the client docs not know anything about the network, including the IP address of the local OHCP server. To broadcast the DHCP request message, the client makes the destination IP address thirty-two ls. When a router receives a packet with an all-ls dcstinaHon IP address, it broadcasts the W address to all nearby hosts. All hosts read all broadcast packets. Only the OHCP server responds. [f more than one DHCP server responds, the client selects one of them..
\+Vhat source JP address does a client host use to send the packet containing the DHCP request message? It docs not have one yet, so it places thirty-two Os in the source IP address field of the packet.
Chapter I • Core Network Concepts and Terminology 25
Test Your Understanding
21. a) What type of host gets a dynamic IP address? b) v\That type of host gets a static IP address? c) Wh y is a static IP address needed for this type o f host? d) Does a DHCP server give a host the same JP address each tin,e?
Domain Name System (DNS) IPv4 addresses are difficult to "'rite and reme,n- ber, even in dotted decimal nota tion. In Chapter 8, "'e ,viii see that iPv6 addresses are even longer, and it is rare to write o ne of these addresses correctly in the first attempt, much less ren,ember it. To address human limitations, the Internet allo\\'S host O\\'flers to create host names for their servers. In Figure 1-20, the host name of server 128.171.17.13 is Voyager.shilder. ha\\•aii.ed u. Th is is s till long, but it is far easier to reme,nber and "'rite. \,Vhen you use a host, you probably kno"' its host name. You rarely kno"' its IP address.
Ho\\•ever, routers can o nly "'ork ",jth IP addresses. They know nothing about host names. If you type in a host name, your con,pu ter needs to resolve it, that is, determine the IP address associated "'ith that host name.
(1) In Figure 1-20, a host wishes to send packets to Voyager.shidler.hawa ii.edu. The host wishing to do so is the origi nating host. Voyager is the target host.
(2) To fi nd the host's IP address, the orig inating host sends a DNS request 1nessage to a Doma in Na me Systen, (DNS) server. This n,essage gives the target host's host nan,e a nd asks for its IP address.
(3) The DNS host looks up Voyager.shidler.ha,-vaii.edu in its DNS Table. In notes that the IP address for Voyager is 128.171.17.13.
(4) The DNS server sends back a DNS response message to the origi nating host. This response message gives the IP address of Voyager.
(5) Finally, the originating host can send packets to Voyager by addressing the,n to 127.171.17.13. Now tha t it knows the IP address, it has no n,ore need for the DNS
1 The originating host wants to send ONS Table packets to Voyager.shidler.hawaii.edu. Host Name It must learn Voyager's IP address.
IP Address
Voyager.shidler.hawaii.edu 128.171.17.13 Originating 2
Host ONS Request Message
Gf "I wa: ua_:m: o : = e~ oy: r : le:_aw_:e: ~ '-._ 4 ONS Response Message
5 '-.,, "The IP address is 128.171 .17.13" Packets to
128.17 1.1 7.13
FIGURE 1-2 0 Domain Name System (DNS)
DNS .---~ Host
3 Looks up IP address
for Voyager.
26 Chapter 1 • Core Network Concepts and Terminology
host. The originating host continues to send packets to the target host \vithout subsequent calls to the DNS server.
Although not sho\vn in the figure, \vhen the originating host learns the IP address of a host name, it stores this information in its local DNS cache. If it wants to reach Voyager.shidler.h a\vaii.edu a few days later, it looks up the IP address from its DNS cache. There is no need to use the DNS server.
Test Your Understanding
22. a) Distinguish between the originating host, the DNS server, and the target host. b) What is the purpose of a DNS lookup? c) Does the originating host need to contact the DNS host each time it sends a packet to the target host? Explain.
SINGLE NETWORKS, DATA LINKS, AND PHYSICAL LINKS
We saw earlier that transmission data links connect h osts to routers and routers to other routers. We \viii nO\V see that although data links sound simple, the way they provide these connections is som etimes complex.
Point-to-Point Single Networks
To understand data links, you need to understand a concept called the single net- \VOrk. A single network is a network that uses a single set of standards for all devices. There are many single network standards, and they are deeply incompatible. If Host A is on one single nehvork and Host B is on another of a differen t type, they cannot comrnunicate.2:r
A single network is a network that uses a single set of standards for all devices.
If one host is on one single network and another is on a single network of a different type, they cannot communicate.
Figure 1-21 sh ows the simplest type of single n etwor k technology. This is a point-to-point network. It wor ks on a direct point-to-point p hysical connect ion behveen two hosts. Not much of a network, you are probably saying. This is true, but its simplicity makes it a good place to begin talking about single network standards. In addition, it is used in many connections behveen pairs of routers on the Internet.
At the heart of the point-to-point network is the d in.>ct physical connection. This is defined by a physical standard. A physical standard covers three things: the trans- mission medium (op tical fiber, radio transmission, etc.), a physical connector on each device, and hO\V l s and Os are transmitted over this physical link.
22 In fact, even if two net\vorks use the same single neho/ork standard., they still may not be able to communi- cate because the same single network address may be used in both single networks,
Chap ter 1 • Core Network Concepts and Terminol ogy 27
.,.
Router A
Data Link Standard (PPP)
I . Frame _] PPP Frame
Physical Standard {copper wire, optical fiber, etc., signaling)
Router B
FIGURE 1-21 Point-to-Poi nt Sin g le Network Usi ng t h e Point-t o-Point Protocol (PPP) Data Link Standard
A physical standard covers three things: the transmission medium (optical fiber, radio transmission, etc.), a physical connector on each device, and how 1 sand Os are transmit- ted over this physical link.
A single network also needs standards for data links. For data links, the bits of each message are organized into a message called a frame. It is not a packet. The data link standard governs ho\v the frame is organized. In addition, data link standards gov- ern how switch t-'S, access points, and other single nehvork forwarding devict'S forward frames. We \Viii see more about data link standards in the next subsection when \Ve look at Ethernet switched nehvorks.
A message in a single network is a frame, not a packet. The data link standard governs how the frame is organized.
The data link standard in this point-to-point network is the appropriately named Point-to-Point P rotocol (PPP). There are other data link standards for point-to-point networks, but PPP dominates. In particular, PPP is almost always used when point-to- point networks are used to connect pairs of routers.
The Point-to-Point Protocol (PPP) is the most common data link protocol for point-to- point single networks.
Test Your Understanding
23. a) Distinguish between physical links and data links. b) In a point-to-point sin- gle network, how many physical links \Viii there be when a packet is transmit- ted ? c) How many data links?
Ethernet Single Networks Another w idely used single network standard is Ethernet, which was created for S\vitched local area networks. Figure 1-22 illustrates an Ethernet LAN w ith three switches, two routers, two hosts, and six physical links between switches, routers, and hosts \Vhen Router A sends a frame to Router B through this network.
28 Chapter 1 • Core Network Concepts and Terminology
Ethernet Switch 2
Physics/ Unk 1 ~
Router ~
Physical Unk
2
A Ethernet Frame Server Host
X
Physical Link
3
Router B
FI GURE 1-22 Ethernet Switched Single Networ k
) Client Host y
Ethernet Fram es a nd Data Lin ks In the figure, this sn1all Ethernet network connects h-vo routers, Router A and Router B.
• Router A sends an Ethernet frame to Router B. The router transn1its this frame over Physical Link 1 to Ethernet S\,•itch 1.
• Switch 1 forwards (switches) the fran1e over Physica l Link 2 to Ethernet S\vitch 2.
• Switch 2 forwards the fran1e over Physical Link 3 to Switch 3.
• This fina l switch forwards the fran1e over a fourth physical link. The frame then arrives a t Router B.
The path that the frame travels through this single network is a data link. In fact, a frame's path from the source device to the destination device through a single neh,•ork of any type is called its data link.
A frame's path from the source device to the destination device through a single network of any type is called its data fink.
Ethernet Ph ysical Links (versus PPP Physical Lin ks) In PPP, there ah,•ays is a single physical link and a single data link \,•hen a frame is transmitted. In Ethernet, there is also a single data link, but there usually are multiple physical links.
By definition, there is always a single data link when a source device sends a frame to a destination device through a single network.
The number of physical finks the frame travels over ranges from one with PPP to many for Ethernet.
Tes t Your Und erstanding
24. a) In Figure 1-22, ho\,• many physical links \-Viii there be \'\'hen Router A sends a Packet to Router B? (Answer: 4) b) How many data links will there be? (Ans\-ver: 1) c) When Clien t Host Y sends a packet to Router B, ho\,v n1any physical links w ill there be? d) Data links? e) When Client Host Y sends a packet to Server Host X, how many physica l links will there be? f) Data links?
Chapter 1 • Core Network Concepts and Terminology 29
- 1 Goal: Send a Packet from Host A to Host B - 2 Host A encapsulates
the Packet in Ethernet Frame X, Sends the frame to Router 1.
4 Host B decapsulates the Packet from Wi-Fi Frame Y. The packet ,s now delivered
Host A
fi41 FrameX -
Single Network X (Ethernet)
,. ... .. . Router 1
3 t
FrameY -
Router 1 decapsulates the Packet from Frame X, Reencapsulates It in Frame Y and sends It to Host B
FIGURE 1-23 Packets Are Carried Inside Frames in Single Networks
Fra mes and Packet s
In single neh,•orks, messages are frames. On the Internet, they are packets. These h,•o concepts are not separate. They are deeply interh,•ined, and the way they are related is the key to ho\,• the Internet functions.
Figure 1-23 shows two single neh,•orks. Single Network Xis an Ethernet network. Neh,•ork Y is a Wi-Fi neh,•ork. These two networks use different frame forwarding n1ethods. (A Wi-Fi nern•ork uses an access point to forward Wi-Fi fran1es \,•ithin the network.) A single frame could not travel from the source host to the destina tion host across these two very different network technologies.
This is where packets come in. A single packet n1ust travel all the \,•ay from the source host (Host A) to the destination host (Host B). However, this packet must a lways be carried inside a frame \,•hen it travels through a single neh,•ork. Single networks understand frames and \,•ha t to do with them. They have no idea \'\'hat a packet is.
A packet must always be carried inside a frame when it passes through a single net- work. Single networks understand frames and what to do with them. They have no idea what a packet is.
• In Network X, the source host places the packet in an Ethernet fran1e (Frame X) and sends this fran1e to Router 1.
• The router takes the packet out of Frame X. It places the packet in a ne\,• frame, Frame Y. This is a Wi-Fi frame. It transn1its this Wi-Fi fran1e containing the packet to the destination host over Network Y.
• The destination host takes the packet out of Frame Y. The packet has reached its destination.
In this example, there were only two single neh,•orks. There \,•as a single packet (there always is a single packet), and there were two fran1es. What if the packet
30 Chapter 1 • Core Networ k Concepts and Terminology
IP Packet from Host A to Host B
Ethernet Application Message TCP IP
Ethernet Frame Frame Trailer
or Fragment Header Header Header
Frame X from Host A to Router 1
FIGURE 1- 24 Packet Encapsula ted within the Ethernet Frame Tha t Host A Sends to Ro uter 1 (in Figure 1-23)
had to travel through 100 networks? There \,•ould s till be a sing le packet (there is ah,•ays a single packet). (Note the statemen t in parenthesis. It's a big dea l.) Ho\,•ever, the packe t \,•ould be carr ied in 100 different fra m es along the way, one in each net- wor k.23 This p rocess of encapsu lating the packet into a frame in each single network n1eans th at the Internet can conta in millions o f s ingle networks w ith many d ifferen t technologies. 24
The encapsulation of packets inside frames is o ne o f the central concep ts o f how the Internet wor ks. To reinforce this, Figure 1-24 illustrates the Ethernet fran1e that Host A sends to Router 1 (Frame X). As we sa\v earlier, a packet contains an IP head er, a TCP header (or UDP header), and an application n1essage or fragn1ent of an application mes- sage. The Eth ern et frame begins \,•ith a n Ethernet Header and ends \,•ith a n Ethernet Tra iler. We \,•ill see these in Chapter 5.
Test Your Understanding
25. a) Are packets carried inside fran1es, or are frames carried inside packets? b) A host sends a packet to an other host. There a re ten single neh-vorks along the way. Ho\,v n1an y hosts will there be? c) How n1any data links? d) Ho\,, many routes? e) Ho\,v many fram es? f) How n1any packets? g) To \'l'hat device \'l'ill the first host send a frame? h) To w hat d evice w ill the final router send a frame?
23 A historical note may help you understand why packets arc carried inside a frame. Initially, frames carried application messages, pure and simple. There were no packets. The genius of Cerf and Kahn, who created the prindples behind the lntcmct, was realizing that they could lie. When the source host transmitted Frame X, it expected the frame to go to another host to deliver its application message. Cerf and Kahn saw that they could place a router there instead. The router would pretend to be a host. However, the router knew that the frame contained a packet, not an appUcation message. The router dccapsulatcd the packet, put it into a frame on Nehvork Y, and sent the frame on to the destination host. Note that this required the router to act Uke a host on NehvorkX and a different host on Network Y. This isa lot of lying, but routers arc shameless that way.
For this to work, hosts have to be in on the deception. Each has a network stack of software that inter- cepts the application message to be put into a frame, puts it into a packet (or several packets), and passes the packet to the data link process that handles frames. The nehvork stack on the destination host reverses the process. The data link processes have no idea that what they receive is a packet instead of an application message. 24 \+Vhat if the two single nehvorks in Figure 1-23 arc both Ethernet networks? Will the single frame simply be passed on? The answer is no. Even if a packet travels through a hw,drcd single networks using the same technology, the whole decapsulatcd-cncapsulate-send process will be used on each router. It is s impler to have one rule that is always followed than to have exceptions for various pairs of single networks that follow the same standards.
Chapter 1 • Core Network Concepts and Terminology 31
Single Network Addresses Packets a re deliv ered to IP addresses. The sou rce and destination IP addresses a re placed in the pa cket h eader. Frames are d elivered to data link addresses \vi thin a sing le network. For instance, Ethernet frames are deliven.'<I to Ethernet addresses. The source and d estination Ethernet addresses are placed in the frame header.
Ethernet data link addresses follow the Extended Unique Identifie r-48 (EUI-48) standard. An identifier is an address. Th~,se address~,s must be unique. Extended means, well, never mind. You m ay have heard that Ethernet uses Media Access Control (MAC) addresses. It u~'<I to. Recen tly, the name MAC w as changed to EUI-48. There w as prob- ably a good reason for this. In any case, you need to know what Ethernet address~,s are called today. By the way, Wi-Fi also uses EUI-48 addresses. And yes, they too used to be called MAC a d dresses.
IP add resses a re 32 bits lon g and are written for humans as four integers sepa- rated by dots. An example might be 1.2.3.4. EUI-48 add resses are 48 bits lon g. As we will see in Chapter 5, Ethernet addresses are w ritten for humans to look something like Al-BB-DE-19-C3-4F.
Each host is on both a sing le neh vork and the Internet. Therefore, e ach h ost needs to h ave two addresses. For a h ost on an Ethernet network, its add ress is its EUI-48 address. Its address on the Internet is its IP address. For a rou ter, if the router connects to two nehvorks, it w ill have a different EUI-48 address on e ach nehvork it connects to.
Figure 1-25 adds addresses to Figure 1-23. Host B has the IP a ddn.,ss 5.6.7.8. The packet that Host A sends to Host Bis addressed to 5.6.7.8.
The frame th at travels through Single Network X goes as fa r a t the router. The frame's destination data link ad d n.>SS is therefore the data link address of the rou ter on Nehvork X. This is the EUI-48 a d dn.,ss Al -BB-DE-19-C3-4F. The packet it carries, aga in, is ad d n.,ssed to the IP ad d ress 5.6.7.8.
In turn, the frame that the router sends to the d estination host is addressed to the EUI-48 address of the destina tion h ost. This is B2-23-FF-9F-CA-DE. The packet is still addressed to the IP address 5.6.7.8, the IP ad d n.,ss of the destination h ost.
Packet to 5.6.7.8 - Frame to A 1-BB-DE-19- C3-4F
Packet to 5.6.7.8 -----, - ---+-
Single Network X (Ethemet) ·-.....
Frame to 8 2-23-FF-9 F-CA-DE
Packet to 5.6.7.8 -
Host A / Router 1
Router 1 's Address on Network X is a Data Link Address 7
Host B IP Address:
5.6.7.8
Host B 's Address on Network Y EUl-48 Address: A1-88-DE-19-C3-4F is a Data Link Address
EUl -48 Address: 82-23-FF-9F-CA-DE
FIGURE 1-25 Packet Transmissi on Through Two Single Networks w ith Addresses Added (Based on Fig ure 1-23)
32 Chapter 1 • Core Network Concepts and Terminology
Ethernet Frame Traile,-
IP Packet from Host A to Host B (5.6.7.8)
Application Message TCP o r Fragment Heade,-
IP Header
Frame X to Router 1 (A 1-BB-DE-19-C3-4F}
/ ...
Dest ination IP Address:
56 7 8
Ethemet Frame Heade,-
"'
"' Destination Data Link Address A1-88-DE-19-C3-4F
FIGURE 1-26 Frame and IP Header Showing Data Link (EUl-48) and IP Desti nation Addresses for the Frame Sent from Host A to the Router
Test Your Understan ding
26. a) Are all data link addresses EUI-48 addresses? b) In which header are source and d(>Stination IP addn.>SSl'S found? c) In which header are source and destina- tion data link addresses found? d) What kind of data link address do Ethernet networks use? e) What kind of data link address do Wi-Fi networks use? f) Why do hosts need two addresses?
INTERNET ROUTERS AND PERSONAL ACCESS ROUTERS
It is common for students to confuse Internet core routers, corporate access points, and r<.>Sidential access routers, the last of which contains both a trivial router and a consumer- grade access point. Figure 1-27 contrasts these three important but easy-to-confuse devices.
Internet Core Routers The routers in the core (central part) of the Internet are designed to fit into stan dard equipment racks, but they are not merely 1 U or 2U tall. Internet C!c)re routers range from the height of dorm room refrigerators to full-size refrigerators.20 That isn't terrifically large, but they are powerhouses that can route high volumes of traffic and do complex routing to deliver packets along different routes to large numbers of destinations. They are also remotely manageable.
Residential Access Router We call them resid ential access routers, but these little boxes are multifunction devices with surprising utility. They con tain an In ternet s,vitch, a DHCP server, at least a simple fire,vall, and a limited consumer-grade access point. Routing is one of
25 The routers at the edge of the Internet are smaller but vary considerably in size, A branch office router, for example, may indeed be only !U or 2U tall.
Chapter 1 • Core Network Concepts and Terminology 33
Internet Core
Rout1/ . .. _,.. ·-,- ..... Internet Core Router
Pure Router High Traffic Volume Complex Routing
Remotely Manageable
Broadband Modem
• Residential 4i
Access 'f.c Router ,,, ,,. ,, "
I ,. .J - -- "
Residential Access Route r Multifunction Device
Trivial router Ethernet s witch
Consumer-grade access point DHCPserver
Simple firewall
/
o;'
, Corporate 1 J ~cess ~ ints/
_," ~
Corporate Access Point Pure access point
But very good access point Rem otely manageable
Acc,ess points work together etc.
FIGURE 1-27 Internet Core Routers, Residentia l Access Rout ers, and Corpor ate Access Points
their functions, but it is the most trivial. Everything coming from the access router's connection to your devices is sent out to the Internet, and everything from the outside is sent inside.
Corporate Access Point Corporate access points are usually smaller than home access routers, but they are pure access points, and they are very good commercial-grade access points w ith several capabilities that can be configured remotely. For instance, the network administrator can adjust the relative po\ver of nearby access points to adjust for changing numbers of wireless devices throughout a section of a building. We will see in Chapter 7 that they also participate in collecting data for and implementing network security. Larger corporate access points have multiple radios and antennas, each of which can focus on a different direction, allo\ving more devices to share their area of service.
Test Your Understanding
27. a) Compare Internet core routers with home access routers in terms of function- ality. b) Compare them in terms of routing complexity. c) Compare corporate access points and Internet access routers w ith w ireless access point capabilities.
WHERE TO NEXT?
In this chapter, we looked at core Internet (and nehvorking) concepts and principles.
• Chapter 2 looks in more depth at standards. • Chapter 3 \Vill teach you the core elements of network management. (These things
do not manage themselves.) • Chapter 4 looks at security tools and concepts. We do not put security off to the
fourth chapter to indicate that it is unimportant. We do so because it is impossible
34 Chapter 1 • Core Network Concepts and Terminology
to discuss security until you understand the networking concepts and tools in the first thn.oe chapters. Your teacher may cover Appendix after Chapter 4. This deals with security management. This may be covered in other courses instead.
With this information about concepts, tools, and management, you will then apply your kno,vledge to specific standards and technologies.
• Chapter 5 takes a 360-degree view of Ethernet switched LAN standards, discuss- ing them in terms of standards, technology, management, and security.
• Chapters 6 and 7 do the same for local wirek,ss technologies, such as Wi-Fi.
• Chapters 8 and 9 look at the TCP /IP Internet standards in the same integrated way. You may ,vonder why ,ve do not start w ith the Internet first. The answer is a pragmatic one. Ethernet and Wi-Fi are very familiar to you and are simpler than the Internet. Learning them first will give you a stronger set of base information to take on the Internet, which ,vas designed from the ground up to be a full ,vorld- wide network.
• Chapter 10 takes you outside the local environment to discuss ,vide area nehvork- ing. You might say, "Hey, isn't that the Internet?" To a large degn.,e it is, but corpo- rations cannot rely on the Internet completely because the Internet is only a best effort nehvork, and corporations need to have tighter control over long-distance performance. In addition, there is the matter of accessing the ISP. You are probably generally familiar with mobile telephony, cable moderns, and ADSL, and we will look at them in more depth. Corporations use another access technology for most of their connections; this is leased lines.
• Finally, Chapter 11 takes us to applications. Many teachers skip this chapter because their programs cover applications in other chapters. Chapter 11 gener- ally looks at applications from a nehvorking perspective rather than on the great things they can do. (You already know about that.)
END-OF-CHAPTER QUESTIONS
Thought Questions
1-1. In Figure 1-28, when Host A transmits a packet to Host B, how many physical links, data links, and routes will there be along the way? How many packets and frames? How many switches and routers? (Hint: The answers are in the figure, but work it out yourself.)
Perspective Questions
1-7. What was the most surprising thing you leamed in this chapter?
1-2. Repeat for Host C sending a packet to HostE.
1-3. Repeat for Host A to Host C. 1-4. Repeat for Host E and Router 3. 1-5. Repeat for Router 1 and Router 3. 1-6. Repeat for Router 1 and Router 2.
1-8. What was the most difficult thing in this chapter for you? Why was it difficult?
Chapter I • Core Network Concepts and Terminology 35
Switched Network X
Frame X
( Packet ( I
, Data link HostA ' A-R1
~ Physical ' ; Link • (A-X1) • • • • • • • • •
''~ Switch X3
~~ "'
... ... ... ' ... Switch X4
' ... ...
HostC
Switched Network Y
...... " - - - RouterR1 ;;.· -,,._ ___ +<I-- Switch X2
... . -• • ••••••••••• • • ••• • • Route A-8 ••••••• •• •••••• •••••••••••••
Switched Network Z
HostB
Data link R2-B
Host D Host E
Route A- 8 3 Networks (X, Y,Z) 1 Packet & Route
3 Frames & Data links 7 Physical links
--'"' '- Switch Z3 /
• • • • •
--~ Router R3
S : z - -- ,..,, witch 4 J/11 ._
FIGURE 1-28 An Exercise in Physical. Links, Data Links. and Routes
Data link R1 -R2
ac et Frame Y
Chapter 1a
Hands-On: A Few Internet Tools
LEARNING OBJECTIVES
By the end of this chapter, you should be able to: • Test your Internet connection speed.
• Look up a host's IP address by querying a DNS server.
• Use ping and traceroute to diagnose an Internet connection.
HANDS-ON EXERCISES
1. How fast is your Internet connection? See with one of the following websites. If you are asked to download a program for the test or run a program to see why your computer is running slowly, do not do so. Sites offering speed testing include www.zdnet.com/broadband-speedtest/, testymy.net, k-'Stinternetspeed. org, W\Vw.speedtest.net, and www.speakeasy.net/speedk>St/. Report download speed, your upload speed, and your access technology (home DSL connection, school lab, 3G mobile phone, 4G mobile phone, etc.). Use two of these tools on one device or a single tool on two different devices.
2. Look up the IP address for panko.com. Tools for doing DNS lookups include ping .eu and networktools.com. If you are asked to do,vnload a program for the test or run a program to check your computer, do not do so. What result do you get?
3. Ping looks up whether an IP address or host name represents an active host and what delay there is in reaching the host. Traceroute is similar but sho,vs all routers along the way. Tools for pinging and traceroute include ping.eu and networktools. com. If you are asked to download a program for the test or run a program to check your computer, do not do so. Try ping and traceroute for panko.com. If ping fails or if traceroute cannot get all the ,vay to the host, a fin.~ wall may be prohibiting ping and traceroute. What results do you get?
4. Repeat the previous question for yahoo.com.
36
Chapter 2
Network Standards
LEARNING OBJECTIVES
By the end of this chapter, you should be able to:
• Explain ho,v Internet standards are made and why this approach is valuable.
• Provide the definitions of network standards and protocols; articulate their importance.
• Explain the OSI, TCP /IP, and Hybrid TCP /IP-OSI architectures and their standards agencies.
• Explain the purpose of each standards layer in the Hybrid TCP /IP-OSI architecture, what is standardized at each layer, and ,vhich standards agency dominates standards at each layer.
• Explain message ordering in general and in HTTP and TCP. • Explain message syntax in general and in IP packets, TCP segments, UDP
datagrams, and Ethernet frames.
• Demonstrate how application programs encode alphanumeric, decimal, and alternative data into bits (l s and Os) before passing their messages to the transport layer.
HOW INTERNET STANDARDS COME TO BE
Those who love sausage and revere the law should never see either being made.
Attributed to German Chancellor Otto von Bismarck
Standards are detailed and precise. You might expect that standards creation ,vould be orderly and pn.>cise as well. For most standards agencies, this is true. For the Internet, things are a little different.
37
38 Chapter 2 • Network Standards
Dumb ... Terminals ~
FIGURE 2-1 The Early ARPANET
SRI ARC IMP
56 kbps Line
University of Utah
IMP
IMP = Interface Message Processor
Host
The ARPANET The Internet grew out of the ARPANET research network funded by the Defense Ad vanced Research Projects Agency (DARPA).1 DARPA fund ed it to explore the then-new technology of packet switching (,vhat we would now call frame switching). Figure 2-1 shows that when the ARPANET began in 1969, it had four sites: UCLA, the Stanford Research Institute's Augmentation Research Center, UCSB, and the University of Utah. Each site had a s,vitch called an interface message processor (IMP). IMPs exchanged packets (what ,ve now call fram es) through 56 kbps lines, ,vhich seemed blazingly fast at the time.
The Need for Standards Bolt, Beranek, and Newm an (BBN) built the IMPs and designed protocols for IMPs to exchange messages (the blue lines and IMPs in Fig- ure 2-1). That ,vas all they did. At meetings during the ARPANET's development phase, n.,searchers from the four sites met with BBN to discuss the network. They realized that the ARPANET would be useless ,vithout many additional standards. There had to be standards for hosts to communicate ,vith their IMPs. Far m ore fundamentally, there h ad to be application standards if the network was to be useful.
The Network Working Group and Requests for Comments (RFCs) Know- ing the importance of stand ards, and knowing that a vacuum existed in standards setting, the participants decided to do it themselves. They called their small team the Network Working Group and asked others to join them. When they came up with a
1 Was it ARPA or DARPA? It depends on the year. It was born ARPA in 1958. In 1972, it became DARPA to emphasize il~ s tatus as a Department of Defense agency. In 1993, it went back to ARPA. Then it went back to DARPA in 1996. Source: DARPA," ARPA-DARPA: The Name Chronicles," undated, last viewed in August 2009. http:// www.darpa.gov/ arpa-darpa.html.
Chapter 2 • Network Standards 39
standard, they did not call it a standard because they felt that they lacked the author- ity to do so. Steve Crocker, w ho led the group and wrote the first d ocument, called it a Request fo r Comments (RFCs). Today, ne,v standards are s till RFCs, as are other types of docurnents.2
Group members quickly d eveloped key application standards. In 1971, Ray Tom- linson realized that e-mail could wo rk across sites. He was already ,vorking on e-mail for users of a single host. Mail systems on single hosts used usernames as add resses fo r delivering m ail. Tomlinson saw that an ARPANET address ,vo uld have to include both a username and the host name. Looking at his keyboard, he saw that the @ sign did not seem to be used very much.3 He assigned it to separate the username from the host name. (The firs t auth or ,vas Ra3y@Officel.) It took him a ,veekend to write the sofhvare. E-m ail quickly dominated use of the ARPANET.
Internet Engineering Task Force Born in the late 1960s, the Netwo rk Work- ing Group reflected its times. There ,vas a strong focus on egalitarian participation and the n.>cognition of technical mer it. A few years later, the Internet Engineering Task Force (IETF) took over Internet standards development. Like the Netw ork Working Gro up, the IETF has no formal membership. Anyone can participate in the IETF Work- ing Groups that develop individ ual standards in specific areas.
Describing ho,v the IETF w orks, Dave Clark wrote, "We reject: kings, presidents, and voting. We believe in: rough consensus and running code."4 Rejecting kings and presidents refers to the IETF' s strong egalitarian culture. In general, anyone w ith a good idea stands a fa ir chance of being hear d. By not suppressing ne,v ideas, this cultu re accounts for much of the r apid develo pment pace of Internet standards . The rejec- tion of voting and going forward if there ,vas rough consensus also made the IETF action-oriented . 5
The impo r tance of "running code" is not as obvious. Most standards agencies develop full standards before d evices and sofhvare are ever built. When vendors imple- ment these standards, they often find unforeseen ambiguities and even contradictions. When they build their products to these standards, they often find that their products do not ,vork with p rod ucts from differen t vendors who supposedly follo,v the same standard. In addition, committees tend to design standards that are so complex that prod ucts take extensive resources to develop and are therefore expensive and slo,v to
2 All standards are RFCs, but not all RFCs are standards. Even for s tandards-track RFCs, there are pro posed s tandards, draft standards, and Internet s tandards. Only RFCs that are Internet s tandards are official stan- dards. RFCs a lso can be listed as best current practice, informational_, experimental, historical, and even unknown. How do you know which RFCs are curren t lntemet s tandards? The IETF occasionally publishes an RFC that lists them. Wikipedia has a listing as well, although it shou ld not be accepted as definitive witl,ou t the official lis t in the relevant RFC.
:; Personal communication with Ray Tomlinson, May 1986.
·• Dave Clark," A Goudy Crystal Ball- Vis ions of the Fu ture," in Proceedings of the Twenty-Fo11rtl, In ternet Engi- neering Task Force (Cambridge, Mass.: Massachusetts Institute o f Technology NEARnet, July 13-17, 1992), 539-43. 5 At meetings, the audience is asked to hum on agreement. Humming allows more anonymity than voice or hand vo ting, and it is probably less precise. Unlike traditional voting, the item being hummed is dropped or sent back for more work unless there is strong consensus for going further.
40 Chapter 2 • Network Standards
IN MORE DEPTH April 1 and RFCs
The IETF has a sense of whimsy. In the United States and some other countries, April 1 is April Fool's Day- a day to play jokes on people by telling them something completely false. A robust tradition in the IETF is the publishing of a facetious RFC or two on April Fool's Days. One of the most popular is RFC 2549, IP over Avian Carriers. W ritten in 1990, this RFC describes how to transmit IP packets using carrier pigeons. This RFC was updated twice, in 1999 (to add qual- ity of service) and in 20 11 (so that the protocol w ill work w ith t he new 1Pv6 protocol). Another April 1 RFC warned of a serious authent ication problem at IETF meetings. There were so many heavily bearded guys that it was impossible to tell them apart. RFC 3093 introduced the Firewall Enhancement Protocol, which allows all t raffic to pass through firewalls while leaving the firewall in place (and useless). An April 1 RFC from 1998, the Hyper Text Coffee Pot Cont rol Protocol, was created as RFC 2324. In justifying the HTCPCP, the RFC said that "there is a strong, dark, rich requirement for a protocol designed espressoly for the brewing of coffee." One limitation in the protocol was t hat decaf coffee was explicitly excluded. The explanation was, "What's t he poin t ?" A lthough this RFC was a joke, a serious protocol on remote brewing w ill almost certainly be seen as the Internet of Things unfolds.
come to m arket. In the IETF, alm ost all standards are created based on running dem- onstration systems. Experience identifies unforeseen p roblems and solves them before standards are m ade.
More subtly, demonstration code is simple. This leads to simple standards. Many IETF RFCs even have "simple" in their name; for instance, the Simple Mail Transfer Pro- tocol standardizes communication among m ail servers. We will see in Chapter 3 that the Simple Network Management Protocol is now the core tool for rem otely managing nehvork n.>Sources. Simple products emerge quickly, so while OSI development plod- ded along slo,vly, simple TCP / IP p roducts appeared fast, at low prices. As something of an insult (although it ,vas not intended to be), the IETF sometimes took bloated OSI standards and created simpler versions of them . These simplified versions often became dominant. Over time, simple IETF standards usually evolve to becoming full-featured, but each step along the way is based on real-world experience.
Test Your Understanding
1. a) What are IETF standards called? (Spell o ut the name and give the acronym.) b) What factors in the Internet's informal development p rocess lead to rapid standards development and low-cost products?
INTRODUCTION
In Chapter 1, you saw a handful of standards. In the n.>St of this book, you ,viii see many more. Fortunately, if you master some core standards concepts, you ,viii be able to see a new standard and immediately understand a lot about it. (If you do not m aster these concep ts, the stand ards you see ,viii become confusing masses of d etail.) This chapter covers tht>Se core standards concep ts.
Chapte r 2 • Network St a ndards 41
Standard = Protocol In this book, ,ve use the tem,s standard and protocol to mean the same thing. In fac t, stan- dards often have protocol in their names. Important exa n,ples are the Hypertext Transfer Protocol that governs communica tion o n the World Wide Web, the Internet Protocol, the Transmission Control Protocol, and the User Da tagran, Protocol.
In this text, we use the terms stan dard an d protocol to mean the same thing.
What Are Network Standards'?
Nehvork standards are ru les of operation that specify how hvo hard\\'are o r sofl\,,are processes work together by exchanging messages. As Figu re 2-2 illus tra tes, nel\vork standa rds govern the exchange of n,essages behveen hvo hardwa re o r sofhva re p ro- cesses. To give a h uman analogy, in the a uthors' classes, the standard language is An,er- ica n English. Not all of these students a re native English s pea kers, b u t we are able to communica te because "'e use a standa rd langu age.
Network standards are rules of operation that specify how two hardware or software processes work together by exchan ging messages.
The Importance of Standards
Figure 2-2 notes that nehvork standards allow products fro m d ifferent vendors to inter- operate (\\'Ork together effectively). The clie n t progra m is fron, Apple, and the server progra m is fron, Microsoft. These companies often d islike each other, but their prod ucts "'ork together because they exchange m essages using the Hypertext Trans fer Protocol (HTTP) net\\'Ork s tanda rd.
Apple Browser Hypertext Transfer Protocol (HTTP)
message exchanges permit ,nteroperability
Netw ork Standards (Protocols) are rules of operation that specify how two
hard ware or software p rocesses wo rk together by exchanging m essages.
M.crosoft Webserver Apphcation
S tandard s permit interoperability among vendors. This creates comp etitio n.
Co mpetition lowers prices. Competition encourages growth in functionality.
FIG URE 2- 2 Netw ork Standards
42 Chapter 2 • Network Standards
To interoperate is to work together effectively.
Standards are important for three reasons.
• Standards increase competition. With network standards, it is impossible for any company to maintain a monopoly by closing out competitors.
• With no monopolies, competition driv~,s down prices.
• Standards also i.-pur companies to add new features to their products. Adding new features p revents their products from being undifferentiated commodities that can only compete on price. These ne\v featuK-'S often appear added to the next version of the standard, K'<juiring a ne\v round of innovations to create competitive advantages.
Network standards are the key to nehvorking in general. To work in nehvork- ing, you need to understand individual standards so that you can design networks, set up nehvo rk components, and troubleshoot problems. Learning networking is heavily about learning standards.
Test Your Understanding
2. a) Distinguish between standards and protocols. b) What is a network stan- dard? c) What is interoperability? d) What are the benefits of standards?
CREATING STANDARDS
Standards are d eveloped by standards agencies. At the beginning of this chapter, we looked briefly at one important standards agency, the IETF. No\v we look more broadly at standards agen cies and their standards architectuK-'S, including the hybrid TCP /IP- OSI standards architecture that most organizations actually use today.
Standards agencies are organizations that create standards.
Standards Agencies It would make things simpler if there were only a single standards agency in nehvork- ing, but there are many. Two are broadly important.
• Again, Internet standards come from the Internet Engineering Task Force (IETF). These standards are used especially by internet processes, transport processes, and Internet supervisory standards.
• There is also another important pair of standards agencies, the International Orga- nization for Standardization (IS0)6 and the International Telecommunications
6 No, the standard acronym and the standard name in English do not match. In fact, ''150 " does not translate into the organization's standard name in any language. ISO is based on the Greek word for true. ISO sepa- rately standardizes its name in every language. Try not to think abou t this too much. It will hurt your head. A lot of things do that in standards.
Chapter 2 • Nehvork Standards 43
Union-Telecommunications Standards Sector (ITU-T).7 Their collabora tion began \,veil before the IETF started. ISO and ITU-T create a variety of network standards, especially for physical and data link processes. We will use the abbre- viations for these h,•o organizations in this book.
Test Your Understanding
3. a) What standards agency creates Internet standards? b) What other two stan- dards agencies \'l'ork together to create neh,vork standards? c) Which standards agency(ies) is(are) especially important for internet processes? d) For physical transn1ission processes? e) For data link processes? f) For transport processes? g) For Internet supervisory processes?
Standards Architectures
When we are faced with big jobs, we naturally break then, into sn1aller pieces that will collectively get the job done. We then assign individual parts to people with the most relevant skills.
Similarly, a standards agency begins its work by creating a standards archi tecture. Standards architectures specify everything needed for two different programs on two different hosts on different single neh,•orks to interoperate. Standards architectures are collectively exhaustive.8
Standards architectures specify everything needed for two applications on two hosts on different single networks to interoperate.
Layering In network standards architecture, the overall architecture is divided into layers. Collectively, the layers in a standards architecture specify everything that n1ust be standardized for h,•o different application programs on two different hosts on two different neh,•orks to interopera te.
Internet Engineering Task Force (IETF) ISO and IT\J-T
Standards for the Internet, especially internet processes, transport processes, and Internet supe,visory standards
A variety of network standards, especially for physical and data link processes
FIGURE 2-3 Major Standards Agencies in Networking (Study Figure)
7 No, the name and abbreviation do not make sense. Again. 8 Standards architccrurcs are created within a year or two after a standards agency fonns. From then on, the job is to c-reatc a series of individual s tandards at each layer.
44 Chapter 2 • Netwo rk Standards
Collectively, the layers in a standards architecture specify everything that must be standardized for two different application programs on two different hosts on two different networks to interoperate.
Each layer provides services to the next-higher layer. Consider an ana logy, driv- ing between n,•o locations. The lo\,•est layer is the road. It provides services to the next higher layer, the \,•heels. Specifically, the road provides a supportive and adequately smooth surface for the \,•heels to \,•ork on. The wheels, in turn, support the car's body. The body supports the driver (Figure 2-4).
Each layer in a standards architecture provides services to the next-higher-layer.
Spec.ializati on in D esign Layering pern1its specialization in design. Road designers do not have to worry abou t tires, car bodies, or drivers (at least at a low level). Instead, they can focus on soil analysis, the strength of paving n1a terials, and things of that ilk. Wheel designers, in turn, can specia lize in \,•heel tensile s trength, wear for different tire compounds, and sin1ilar things.
Changin g a Singl e Layer If layering is done \,•ell, a change can be n1ade at one layer \'l' ithou t requiring other layers to change. For instance, if a car is given auto parking abil ity, the driver can ignore it, and there is no in1pact on wheel or road standards. However, if one layer is in1proved, the layer above it can be in1proved if desired. In this example, the driver can decide to do auto park. Because changes can be made in d ifferent layers a t different times, there is no need to change everything every time there is a change at one layer.
Driver Layer
Chassis Layer
Tires Layer
Road Layer
Each Layer p rovides services to the layer above tt.
• FIGURE 2-4 Layering i n Automobi le Travel
•
Chapter 2 • Network Standards 45
Specialization In Design
For the road layer, soil analysis, strength of paving materials, etc.
For the wheels layer, tensile strength, wear for different compounds, etc.
The Ability to Change One Layer While Not Changing Others
If add auto parking at the car body level, need not adopt It at the driver level
However, the driver layer can change to take advantage of it If desired
Upgrade layers as desired
It would be too expensive to upgrade all standards every time a standard changed
FIGURE 2-5 Layering Benefits (Study Figure)
Test Your Understanding
4- a) Why do standards architectures have multiple layers? b) To what does a standards layer provide services? c) If you change a standard at one layer, do standards at other layers need to be changed? d) Why may it be advantageous to change a standard if the standard at the layer below it is upgraded?
The OSI Standards Architecture As Figure 2-6 sho\vS, different standards agencies have different standards architec- tures. For example, ISO and ITU-T created the Reference Model of Open Systems Interconnection. Thankfully, this nearly unpronounceable name is always shortened to OSI. Not thankfully, OSI the architecture is easy to confuse \Vith ISO the organization.9
The first column shows that the OSI architecture has seven layers.
OSI Arch itecture (ITU-T and ISO) Layer Number and Name
7. Applicat ion
6. Presentation
5. Session
4. Transport
3. Network
2. Data Link
1. Physical
TCP/IP Architecture (IETF) Layer Number and Name
4. Applicat ion
3. Transport
2. Internet
1. Subnet Access Protocol
Hybrid TCP/IP-OSI Standards Arch itectu re Standards Come Layer Number and Predominantly Name From
5. Application Various Standards Architectures
4. Transport TCP/IP (IETF)
3. Internet TCP/IP (IETF)
2. Data Link OSI (ITU-T and ISO)
1. Physical OSI (ITU-T and ISO)
FIGURE 2-6 Standards Agencies and Layered Standards Archit ectures
9 I believe that this was done deliberately to confuse students.
46 Chapter 2 • Network Standards
OSI the architecture is easy to confuse with ISO the organization.
Note that the bottom two OSI layers have nam es that should be familiar to you . The physical layer is for standards that deal with p hysical processes-transmission media, connectors, and signaling. The data link layer standardizes d ata link processes-- frames, switches, \vireless access points, and data links.
By the late 1970s, quite a few OSI standards at these two layers were solid. In gen- eral, OSI standards quickly dominated at the physical and data link layers. Above the data link layer, ho\vever, ISO and ITU-Tran into trouble. They did not have clear ideas about internetworking and took time to develop their understanding in this area. This left the door open fo r the architecture created by the IETF.
The TCP/IP Standards Architecture
In contrast, the IETF began with a laser focus on internetworking. It knew that internet and transport layer standards were needed to build the Internet. The IETF standards architecture is nam ed after its two main initial standards. It is called TCP/IP.10 This makes sense, but it can cause some confusion. TCP /IP is the architecture, and TCP and IP are standards within the architecture.
TCP/IP is the architecture, and TCP and IP are standards within the architecture.
Good single-nehvork standards \Vere already available from ISO and ITU-T, so the IETF simply decided to use them.11 For the physical and data link layers, the TCP /IP architecture specifies the Subnet Access Protocol (SNAP). This basically says, "Use OSI standards here." Subnet is the IETF's name for a single nehvork. Its job is to create a data link between hosts and routers and between routers and other routers.
Above the Subnet Access Protocol is the internet layer. This is for internet pro- cesses, including packets, routers, and routes. The transport layer, then, is for transport processes. This includes application message fragmentation and reassembly. As we will see in this chapter, transport layer standards also d o error correction.
When Do We Capitalize "Internet?" When we refer to the global Internet, \Ve capitalize the name. Ho\vever, we do not capi- talize internet w hen referring to the internet layer or when we refer to an internet other than the global internet. Yes, there are some.
10Toe IETF architecture also has an official name. HO\\'ever., it is almost never used. It is kind of like Voldemort. 11 O ccasionally, the IETF creates data link layer standards. ~ost notably, it created the point-to-point protocol that we saw in Chapter 1 and also will see later in this chapter. Point-to-point OSI s tandards did not have all of the functionality needed to directly connect two routers.
Chapter 2 • Network Standards 47
When we refer to the global Internet, we capitalize the name. However, we do not capitalize internet when referring to the internet layer or when we refer to an internet other than the global internet.
The Hybrid TCP/IP- OSI Standards Architecture
Real organizations care nothing about architectural purity. They just want to get their work done. As Figure 2-6 shows, \vhat most firms actually use is a Hybrid TCP/IP--0S1 Architecture, ,vhich combines OSI standards at the physical and data link layers ,vith TCP /IP standards at the internet and transport layers.
The hybrid TCP/IP-OSI Architecture combines OSI standards at the physical and data link layers with TCP/IP standards at the internet and transport layers and (usually) stan- dards from any architecture at the application layer.
Application Standards At the application layer, things are messier. No stan- dards agency dominates at this layer, al though both IETF and OSI standards are popu- lar a t this layer. Adding to the confusion at this layer, the IETF and ISO frequently work together to create application layer standards.
Fortunately, it normally does not matter what standards agencies create appli- cation protocols. Most application layer standards can work \vith IETF standards at the transport layer. Consequently, companies that use the Hybrid TCP / IP-OSI archi- tecture have no problem using applications from different standards agencies and architect ures.
Most application layer standards can work with IETF standards at the transport layer. Consequently, companies that use the Hybrid TCP/IP-OS/ architecture have no problem using applications from different standards agencies.
Test Your Understanding
5. a) What are the standards agencies for OSI? Just give the abbreviations. b) Dis- tinguish between ISO and OSI. c) What is the standards agency for TCP /IP? (Give both the name and the abbreviation.) d) What standards architecture do most organizations actually use in practice? e) At which layers of this archi- tecture are IETF standards dominant? f) At ,vhich layers a re ISO and ITU-T standards dominant? g) Why does it usually not matter ,vhat standards agency creates an application layer standard?
The Five Layers Figure 2-7 recaps the five layers of the Hybrid TCP /IP-OSI architecture. The first column looks at standards more broadly, grouping them into three broad functions. These are application program interoperability, transmission across an internet, and transmission across a single nehvork.
48 Chapter 2 • Network Standards
Broad Function Layer Name Specific Function
Interoperability 5 Application Application layer standards govern how two of application applications work w ith each other, even if they programs are from different vendors.
Transmission across 4 Transport Transport layer standards govern aspects o f an internet end-to-end commun ication between two end
hosts that are not handled by the internet layer, including reliability and application message frag- mentation. These standards allow hosts to work to gether even if the two computers are from dif - feren t vendors or have different internal designs.
3 Internet Internet lin k layer standards govern the trans- mission of packets across an internet-typically by sending them t hrough several routers along a route. Hosts and routers can be from different vendors. Internet layer standards govern packet organiza tion and routing.
Transmission across 2 Data Link Data link layer standards govern the t ransmission a single network of frames across a single switched network-typ -
ically by sending them through several sw itches along t he data lin k. Data link layer st andards also govern frame organizat ion, t iming constrain ts, and reliability. As in all other layers, t he devices can come from different vendors.
1 Physical Physical layer standards govern t ransmission between adjacent devices connected by a trans- mission medium, regardless of who the two vendors are.
FIGURE 2- 7 Layers Recap
Test Your Understanding
6. a) What layer or layers govern(s) transmission media? b) Application pro- grams? c) Transmission through a single network? d) Transmission through the Internet? e) Application message fragmentation?
Repeated Concepts at Layers 2 and 3 A common source of confusion is that concepts are repeated at the data link and internet layers but \vith different terminology. This occurs because internetworking required the creation of a second layer of forward- ing standards to those used for transmission through single networks. Figure 2-8 shows ho\v terminology differs bel\veen the data link and internet layers.
Packets Are carried Inside Frames Recall that packets are carried inside frames. When a source host sends a packet to a destination host, the packet travels \Vithin a frame in each network along the \Vay. If there are 19 single networks on the route bel\veen the source and destination hosts, a single packet \Viii travel in 19 different frames.
Chapter 2 • Nehvo rk Standards 49
Layer 2 Layer 3
l ayer Name Data link Internet
Message Frame Packet
Forwarding Device Switch Router
Forward Occu rs W ithin A Single Network The Internet as a whole
Path of Messages' Travel Data Link Route
Destination Address in Data link l ayer (DLL) address; IP addresses Header often, but not always EUl-48
addresses
FIGURE 2-8 Re peated Co ncepts a nd Different Terminology in Layer; 2 a nd 3
Test Your Understanding
7. a) At w hat layer \,viii you fin d s tanda rds for rou ters? b) Wireless access points? c) Packets? d) S\,•itches? e) Fran1es? f) IP addresses? g) Rou tes? h) EUI-48 addresses? i) Data links?
8. a) If h,vo hosts are connected by fi ve neh'l'orks, how ma n y packets will there be \,•hen one host sends a packet to the o ther h ost? (Hint: Draw a picture.) b) How many fram es? c) How ma n y routers? d ) If every h ost and router connects w ith a po int-to-point connection, h o\,• man y physical links will there be?
MESSAGE ORDERING (PLUS RELIABILITY AND CONNECTION ORIENTATION) IN STANDARDS
One thing that standards govern is messag e order, w hich is a fancy way of saying that they govern when each o f the h,•o processes may transn1it m essages. Writing progran1s on d ifferent m achines tha t must work together is nearly impossible without firn1 con- trol over the ord e r in \,•hich processes n1ay send n1essages. (In classes, you n1ay not talk an y tin1e you wan t.)
Simple Message Ordering in HTTP Figure 2-9 illustrates an HTTP request-response cycle. The client sends a request, an d the server sends a response. The cycle is always initia ted b y the client, never by the server. The server cannot transmi t unless the client has sent it an HTTP request m essage. This is a very simple type of message ord e ring.
In an HTTP request-response cycle, the cycle is always initiated by the client, n e ver by the server.
Alth o ug h HTTP m essage order is very sin1ple, there are h,•o things to note. Net- working p rofessionals ca tegorize it as a connectionless p rotocol. This n1eans that there
SO Chapter 2 • Networ k Standards
Browser HTTP Request Message
Webserver Program
HTTP Response Message
Client PC
The webserver program may not transmit until it receives an HTTP request message.
Webserver
FIGURE 2-9 Simple HTTP Request-Response Cycle That Is Connectionless an d Unreliable
is no need to have son1e sort of live connection before transmi tting. The client m ay send a packet an y tim e it wishes. In add ition, HTTP is unreliable. There is no provision for the retransn1ission of lost or dan1aged messages. It is like sending a text n1essage.
Test Your Understanding
9. a) In HTTP, which a pplication program initia tes an interaction? b) Is HTTP a connectionless protocol? c) Is HTTP a re liable pro tocol?
Message Ordering and Reliability in TCP at the Transport Layer
Man y p rotocols have m uch more complex rules for message ord ering. We look at Trans- n'lissio n Contro l Protocol (TCP) a t the transport layer to see an exan1ple o f this complexity.
Connection.s Figure 2-10 sho\,'S the trans port layer p rocesses on Host A and Host B. They a re comn1unicating v ia HTTP at the app lication layer. The Hypertext Transfer Protocol requires the use of TCP at the transport layer. The fi gure shows a san1- ple con1munication session, \Vruch is called a connection because before the two sid es begin to con1municate, they first agree that they will con1municate. At the end, they for- n1ally stop con1municating. This is like talking on a pho ne. At the beginning, there is at least a tacit agreen1en t that both sides are \,•illing to talk. At the end of a telephone call, both sides usually agree to end the conversa tion. Gust hanging u p is consid ered rude.) Technically, we say that TCP is a connection-oriented protocol.
In a con nection-oriented protocol, the two sides first agree that they will comm unicate an d formally stop communicating at the end.
TCP Segm ents In TCP, messages are called TCP segments because each carries a segment (fragment) of an a pplication message if the message is long. We will see that it can a lso be a contro l segmen t tha t does not carry application d a ta.
TCP messages are called TCP segments.
Host A Transport Process
ree-Th s 0
tep pen
F H
Req
irst TTP uest
a Res Messa (no
nd ponse
ge error)
Se H
Req a
Res Mes
(E
oond TTP uest nd ponse sage
rror)
rmal ur-
tep lose
No Fo s C
A l
- A2
A3
-- --< -
A4 ,_ - AS
AS
-
AG
A7
- ,(
AS - - A9
Chapter 2 • Nehvo rk Standar ds 51
Time Host B port Process t Trans
SYN - SYN/ACK(A1) 81
ACK(B1) .
Data = HTTP Request . -
ACK(3) B2
Data = HTTP Response B3 - - - - - - - -
ACK(B3) - - - - - - - - :,...
Data = HTTP Request (ERROR!}
Data = HTTP Request (no ACK so retransmit)
ACK(AS) 84
Data = HTTP Response BS
ACK(BS)
- FIN
ACK(A7) B6
Data B7 - - - - - - - -
ACK(B7) - - - - - - - ->-
FIN BS
ACK(BS)
FIGURE 2- 10 M ore Complex TCP Session w it h a Connection and Reliab ility
The Three-Step Open ing The communication begins with a three-step o pen- ing handshake to establish a connection.
• Host A, which is the client in the HTTP exchange, initiates the con1m unication. It transmits a TCP SYN (synchronization) segment to Host B. This indica tes that Host A \,•ishes to begin a connection.
• Host B sends back a TCP SYN/ ACK segn1ent. The SYN indica tes that it also is \,•illing to begin the con1munication . The ACK part is an ackno\,•ledgmen t of
52 Chapter 2 • Networ k Standar ds
Host A's SYN m essage (Al ). In TCP, a ll segn1ents a re ackno\,• ledged , with th e primary excep tion of pure ACKs. (If pu re ACKs had to be ackno\,•led ged , there wou ld be an endless series of ACKs.)
• Host A sends back a pure TCP ACK segn1ent. This acknowledges Host B's SYN/ ACK segment.
In TCP, all segmen ts are acknowledged, wit h the primary exception of pure ACKs.
Control Segments These three TCP segm en ts a re note\,•orthy because they do not con tain data. They are pu re TCP headers, as \Ve \,•ill see later. They are control seg- n1ents.
Test Your Understanding
10. a) What d o we call TCP messages? b) Describe the three-step o pening in TCP. c) Is every TCP segment acknowledged? d ) What is no teworthy abo ut control segn1ents?
Sequence Numbers In a connection-oriented protocol, each n1essage is given a sequence n u n1ber, \,•hic h specifi es the order in which it \'l'as sen t. This a llows the receiver to ensu re that no n1essage is missing a nd allows the receiving process to dea l with duplicate segments. (It simply d iscards duplicates.)
In a connection -orien ted p r otocol, each message is given a sequence number, w h ich specif ies the or der in which it w as sent.
Sequence nun1bers in TCP are important because a pplication n1essage fragn1ents are d elivered in separa te packets. Sequence nun1bers allow the receiver to place the seg- n1ents in o rder and reassen1ble then1.
Note in Figure 2-10 tha t each side numbers its o\,•n sequence n umbers. For sin1- plicity, we have called Host A's sequence numbers Al, A2, A3, and so forth. We have done the same with Host B's n1essages. So Host A's SYN segment is Al, Host B's SYN/ ACK is Bl, and Host A's acknowledgment of the SYN/ ACK is A2.12
Test Your Understanding
11. a) Is TCP connection-orien ted or connectionless? b) What benefi ts do sequence n un1bers bring? c) Ho\,v many segmen ts does each side transn1it?
Carrying Application Dat a The next fo ur segn1ents (A3, B2, B3, and A4) con- stitute an HTTP request-response cycle.
12 ActuaUy, sequence numbers increase w ith successive segments but in a complex way instead of increasing by one each time.
Chapter 2 • Nehvork Standards 53
• A3 carries an HTTP request message.
• B2 is an ACK of A3.
• B3 carries the HTTP response message.
• A4 acknowledges the receipt of 83.
Usually, HTTP request messages are small enough to fit in a single TCP segment. Ho\,•ever, most HTTP responses contain files tha t must be segmented and sent in a nun1ber of TCP segments. This does not change the basic picture, ho\vever. There would sin1ply be several n1ore exchanges like B3 and A4.
Reliability TCP is a reliable protocol. This means that it corrects errors. The sec- ond HTTP request-response cycle demonstrates how HTTP handles an error.
A reliable protocol corrects errors.
• Segment AS is sent, but it never reaches Host B. An error has occurred.
• Host B does not send an ackno\,•ledgn1ent, because as just noted, ACKs are only sent \,•hen a segment is received correctly.
• Host A realizes that AS has not been acknowledged. It retransmits AS. Note that it has the san1e sequence number as the TCP segn1ent that had an error during transn1ission. This allows the receiver to put it in order in case other segn1ents had been transmitted before the retransmission.
• This time, the segment arrives correctly at Host B. Host B sends 84, which is an acknowledgment of AS.
• Finally, Host B sends an HTTP response message (BS) and receives an ACK (A6). Again, sending an HTTP response n1essage tends to take several TCP data/ acknowledgment cycles.
In this example, Segment AS never reached the receiving transport process. There would be no way to acknowledge it in this case. What would have happened if AS had reached the transport process but was merely damaged during trans miss ion? In th is case, the receiving transport process would discard the segment. It \,•ould not send an ACK. Note that there is a sin1ple rule for ACKs. Unless a transport process receives a segn1ent correctly, it does not send an acknowledgment.
There is a simple rule for ACKs. Unless a transport process receives a segment correctly, it does not send an acknowledgment.
Test Your Understanding
12. a) What kind of n1essage does th e destination host send if it receives an error- free segment? b) What kind of message does the destination host send if it does not receive a segn1ent during a TCP connection? c) What kind of mes- sage does the destination host send if it receives a segn1ent that has an error during a TCP connection? d ) Under what conditions w ill a sou rce host TCP process retransmit a segment?
54 Chapter 2 • Netwo r k Standar ds
The Four-Step Closing Host A has no m ore HTTP request n1essages to send, so it formally begins a close for the connection.
• It does so by sending a FIN segment (A7), \,•hich Host B acknowledges (B6). • This means that Host A will not send new da ta. However, it \,•ill continue to send
ACKs to segn1ents sent by Host B. A FIN segment is a control segn1ent consisting only of a header. The FIN bit is set in the header.
• In this case, Host B d oes have one more data segment to send, B7. When it sends this segmen t, Host A's transport process responds \Vith an ACK (A8).
• After that exchange, Host B is finis hed sending d ata. It sends its own FIN segmen t (BS) and receives an acknowledgment (A9).
• The connection is closed.
Test Your Understanding
13 . a) What are the four steps in the four-way close? b) When the side that initiates the close sends its FIN segn1ent, does it stop transmitting more TCP segn1ents? Explain.
MESSAGE SYNTAX IN STANDARDS
We have just looked at n1essage ord ering. Now \'l'e wi ll turn to message s yntax, w hich is how n1essages are o rganized . Messages are sim ply long strings of bits (ls and Os). logica lly, ho½•ever, m essages have severa l components, and the receiv ing p rocess needs to know \,•hat these components are and \,•here they are located in the bit s tream. To give you a feeling for m essage syntax, \,•e wi ll look at the syn tax o f three im portant n1essage typ es: IP packets, TCP segn1ents, and UDP datagrams.
Syntax describes how messages are organized.
Syntax: General Message Organization
Before looking at the syntax of IP, TCP, and UDP n1essages, however, we need to look at syntax m ore generally. Figure 2-11 illustra tes basic syntax elen1ents.
Data Fi elds, Headers, a nd Tra ilers In Chapter 1, we saw several types of n1es- sages. In general, messages have three basic parts. The data field contains the information being d elivered in the m essage. The d efinition of the header is simply everything that comes before the data field. Trailers? Everything that con1es after the d ata field.
Th e header is everything t hat comes before the data f ield.
Th e trailer is everything t hat comes after t he data field.
Frame Trailer
IP Data Field
IP Packet
TCP Data Field
IP Header
Frame Header
TCP Header
Chapter 2 • Nehvork Standards 55
IP packet with header and data field
Frame with frame header, IP pocket, and frame trailer
TCP header with data field
[::;gJ TCP segment with only a header The header is defined as everything that comes before the data field.
The trailer is defined as everything that comes after the data field.
The header and trailer are d ivided into smaller parts called fiel ds.
FIGURE 2 -11 Headers, Data Fields, and Trai lers
• We saw in Chap ter 1 that an IP packet has a header and a d a ta field. • We saw that fra m es, in turn, often have a header, a data fi eld, a nd a trailer.
Fran1es are the only m essages that typ ically have trailers, and not all of them have tra ilers.
• In Chapter 1, we also saw that TCP segm e n ts typically con ta in app lication m essage da ta in their da ta fields.
• We w ill see later in this section that son1e TCP segn1en ts a re pure head ers, \,•ith no data fi eld . SYN, ACK, and FIN n1essages are exam ples of TCP segments \,•ithou t d ata fields. The supervisory information is contain ed en tirely in the header.
Fields Headers and trailers are then1selves divided into smaller parts called fields. In this sectio n on message syntax, enumerating these fi elds and explaining son1e of then1 will be our focus in this section.
Headers and trailers are themselves divided into smaller parts called fields.
Test Your Understanding
14. a) What are the three general parts of messages? b) Wha t does the d a ta field contain? c) What is the d efinition of a head er? d ) Is there always a data field in a n1essage? e) What is the definition of a trailer? f) Are trailers common? g) Distinguish between headers and header fie lds.
56 Chapter 2 • Networ k Standar ds
The Syntax of the Internet Protocol {IP) Packet
Having looked at message syntax in general, we now look at the syntax of a few indi- vidual standards. Figu re 2-12 illustrates the syntax of an Internet Protocol (IP) version 4 (IPv4) packet.
32 Bits per Row An IP packet is a long string of bits (ls and Os). Drawing the packet this way \,•ould require a page one line tall and several n1eters \,•ide. Instead, Figure 2-12 sho\'l'S tha t we usually depict an IP packet as a series of ro\VS \,•ith 32 bits per row. This is the norma l way to sho\,• syntax in TCP /IP stand ards, so you need to be familiar \,•ith it. In binary counting, the first bit is zero. Consequently, the firs t row sho\,•s bits O through 31. The next row sho\,•s bits 32 throug h 63.
Each ro\,• is subdivided into fields. For example, the first field is 4 bits long. This is the Version Number Field. In IPv4, it has the value 0100, whlch is the binary number for 4. As you might guess, value of thls field in IPv6 is 0110, \,•hlch is the binary nun1ber for 6.
Fields ar e distinct pieces of information in t he bit stream o f a m essage.
Sou rce and Destination IP Address Fi elds We look at the IPv4 packet in n1ore detail in Chapter 8, ho\,•ever, \,•e note three fi elds in this chapter. Note that each IPv4 packet has a Source IP Addres s Field and Des tination IP Addresses Field in the fourth and fifth rows. Each is 32 bits long, so each has a con1plete row. Routers use destina- tion IP add resses to decide how to forward packets so that they \Vill get closer to their destina tion.
Bit 0 Bit 31
Version Header Oiff-Serv Total Length Number Length (8 b its) (1 6 bits) (4 b its) (4 bits)
Identification (1 6 bits) Flags Fragment Offset (3 bits) (13 bits)
Time to Live (8 bits) Protocol (8 bits) Header Checksum (16 bits) If an error is found, the packet is discarded by the receiver. If it is correct, no acknowledgement is sent. IP does error checking and discarding; it is not reliable.
Source IP Address (32 bits)
Destination IP Address (32 b its)
Options (if any) Padding
Data Field (dozens, hundreds, or thousands of bits) Often contains a TCP segment or UDP datagram
FIGURE 2-1 2 The Interne t Prot ocol (IP) Packe t Syntax in 1Pv4
Chapter 2 • Nehvork Standards 57
Unreliabilit y The IPv4 Header Checksum Field is used for error detection. The sender computes a number based on all the o ther bits in the IP header. It places this value in the Header Checksum Field. The receiver redoes the calculation on the bits in the arriving IP packet header. If the numbers match, there have been no errors in trans- n,ission. The receiving internet process accepts the packet. If they do not n,atch, then there has been an error. The receiver discards the packet.
Although the receiver checks for errors, it does not send an acknowledging packet if the packet is received correctly. The sending internet process has no way to kno\,, if the packet has been received correctly, so it cannot retransmit lost or damaged packets based on \,•hether or not they have been received correctly. IP does error detection but not error correction. IP is an unreliable protocol.
IP does error detection and discards a packet containing an error. However, there is no retransmission of the lost message. IP is unreliable because reliability requires both error detection and error correction.
A Connectionless Protocol The Internet Protocol is a connectionless protocol. There is no need to forn,ally agree to comnnmicate or forn,ally end the communication. It is like sending an e-mail. You just send it.
A connectionless protocol does not formally establish and then formally end commu- nication sessions.
Test Your Understanding
15. a) List the first bit number on each IPv4 header row in Figure 2-12, not includ- ing options. (Ren,ember that the first bit in Row 1 is Bit 0.) b) What is the bit number of the first bit in the Destination IP Address Field in IPv4? c) Describe hov, the internet process checks an arriving packet for errors. d) What does the receiving internet process do if it finds an error? e) What does it do if it does not find an error? f) Is IP reliable or unreliable? Explain. g) Is IP a connectionless or connection-oriented protocol?
Transmission Control Protocol (TCP) Segment Syntax
Earlier, ½'e saw message ordering in the transnussion of TCP segments. No\,, we will look at the syntax of TCP segn,ents in a little more detail. We \-Viii see the rest of the TCP header syntax in Chapter 8. Most notably, this section describes ho\,v the TCP does what is necessary to be a reliable protocol.
Fields in TCP/IP Segments Figure 2-13 shows the organization of TCP seg- n,ents. As in the case of IP packets, there are 32 bits on earn line. This is the standard way in \,•hich the Internet Engineering Task Force shows syntax in its documents.
58 Chapter 2 • Network Standards
Bit 0
Source Port Number (16 bits) Destination Port Number (16 bits)
Sequence Number (32 bits)
Acknowledgment Number (32 bits)
Data Reserved Flag Field s' Offset (3 bits) (9 bits) (4 b ~s) 000
Checksum (16 bits)
Options (if any)
Data Field
'Flag fields are 1-bit fields. They include SYN, ACK, and FIN bits.
FIGURE 2 - 13 TCP Segment
Window Size (16 b ~s)
Urgent Pointer (16 bits)
Padding
Bit 31
Flag Fields TCP has nine single-bit fields. Single-bit fi elds in general are called flag fie lds. If a fl ag fi eld has the value 1, it is said to be set. If it has the va lue 0, it is said to be not set. In TCP, flag fi elds allow the receiving transport process to identify the kind of segn1ent it is receiving. We will look at three of these flag bits:
• If the ACK (ackn owledgm ent) bi t is set (h as the value 1), th en the segn1en t acknowledges another segment. When the ACK bit is set, the Acknowledgment Number Field also mus t be filled in to indicate \,•hich message is being acknowl- edged. If the ACK bit is not set, the TCP segment does not con tain an acknowledg- n1ent. The receiver ignores the Acknowledgn1ent Number Field.
• If the SYN (synchronization) bit is set, then the segmen t req uests a connection operung.
• If the FIN (finish) bit is set, then the segment requests a normal connection closing.
Single-bit fields are called flag fields. If a flag field has the value 1, it is said to be set. (If it has the value 0, it is said to be not set.)
Earlier, \,•e ta lked about TCP SYN segn1ents, ACK segn1ents, a nd FIN segn1ents. These are simply segments in \,•hich the SYN, ACK, or FIN bits in the header are set, respectively. SYN and FIN segments have no data fields. ACK segments sometimes have no data fi elds.
Chapter 2 • Nehvork Standards 59
An ACK segment is one in which the ACK b i t is set (ha s the value 1).
Sequen ce Numbers Earlier, \'l'e mentioned the TCP Sequence Number Field. This fie ld is 32 bits long.
A cknowledgm ent N u mbers Earlier in this chapter, we noted th a t TCP uses acknowledgments (ACKs) to ach ieve reliability. The 32-bit Acknowledgment Number Field indicates \,•hich segmen t is being ackno\,•ledged.13
The acknowledgment number indicates which segment is being acknowledged.
Dual-Purpose Segments Note that TCP segments can contain both new infor- mation (usually an application message in the data field) and the ackno\,•ledgm ent of a received segment. This is done to minimize the nun1ber of TCP segmen ts that are trans- mitted by the two internet processes.
Test Your Understanding
16. a) What are 1-bit fi elds called? b) If someone says that a flag fi eld is set, what does this n1ean? c) If the ACK bit is set, w hat other field must have a value? d) Why a re sequence numbers good? e) What is the purpose of the Acknowledg- ment N umber Field? f) Do SYN segn1ents have d a ta fi elds? g) Can a single TCP segment both send infom1ation and provide an acknowledgment?
User Datagram Protocol (UDP) Datagram Syntax
Applications that cannot use the high functionality in TCP or th a t do not need this functionality can use the User Datagram Protocol (UDP) at the transport layer instead of TCP. UDP does not have openings, closings, or acknowledgments, and so it produces substantially less traffic than TCP.
UDP messages are called datagrams. Because of UDP's sin1ple operation, the syn- tax of the UDP datagram sho\, '11 in Figure 2-14 is very simple. Beside h,•o port number fields, \,•hich \,•e w ill see next in this chapter, there are only h,•o header fi elds.
• There is a UD P Length Field so that th e receiving transport process can kno\,, ho\,, long the datagram is. The packet in the datagram's data field has variable length, so the UDP datagram has variable length.
• There also is a UD P Checksum Field that allows the receiver to check for errors in this UDP datagram .14 If an error is found , ho\,•ever, the UDP datagram is merely
13 One m..ight expect that if a segment has sequence number X, then the acknowledgment number in the seg• mcnt that acknowledges it would have acknowledgment number X. The situation is actually more complex. The acknowledgment takes into account both the sequence number of the received TCP segment and its length. TCP docs not have segment length information in its header. 14 I r the UDP Checksum Field has 16 zeroes, error checking is not to be done at aJJ.
60 Chapter 2 • Network Standards
B tt 0 Bit 31
Source Port Number (16 bits) Destination Port Number (16 btts)
UDP Length (16 b tts) UDP Checksum (16 bits)
Data Field
FIGURE 2· 14 UDP Datagram
d iscarded. In contrast to TCP but like IP, UDP has no mechanism for retransmis- sion. like IP, UDP is not reliable.
Test Your Understanding
17. a) What a re the four fields in a UDP header? b) Describe the third. c) Describe the fourth. d ) UDP does error detection and discarding but does not do the retransmission of dan,aged or lost datagran1s. Is UDP reliable? Explain.
Port Numbers
Both TCP and UDP headers begin with hvo port number fields. The Source Port Number Field specifies the sender's port number, and the Destination Port Number Field gives the receiver's port number. Servers and clients use these port number fields differently.
Server Port Numbers Con1puters are n1ultitasking machines, w hich means that they can run several applica tion progran1s at the same tin1e. F ig ure 2-15 shows a server rurming SMTP (the Simple Mail Transfer Protocol), HTTP, and FTP (th e File Transfer Protocol) applica tion progran1s.
Server Programs use SMTP HTTP FTP
Well-Known Port Numbers Application Application Application
(0 to 1023) @ @ @ Packet contain ing
t ~rt Ports a TCP segment with Port 20and Destinatio n Port 80 25 21
( Packet ) Muttitasking Server
FIG URE 2- 15 Server Port Numbers
Chapter 2 • Nehvork Standards 61
If a packet arrives, how does the TCP or UDP process know which application program to give the message? This is \'\'here TCP and UDP port nun1bers come in. A server's port number specifies a particu lar application running on the server. Port 20 or 21 specifies the FTP (Fi le Transfer Protocol) program , Port 25 s pecifies the SMTP (e-mail) program, and Port 80 specifies the HTTP (World Wide Web) application. These are well-kn own p ort numbers, which means that they are norn1ally associa ted with particular app lication protocols.15 Port 80 is norn1ally used for HTTP, so if you see Port 80, you know that it probably is HTTP. The well-known port numbers have a port num- ber range reserved for their use--0 through 1023. To send a TCP or UDP n1essage to the application program on a server, the sender puts the appropriate port number in the Destination Port N umber Field.
Well-known port numbers for server applications are normally associated with particu- lar application protocols. The well-known port number of HTTP is 80.
Client Port Numbers Clients use port numbers differently. For every conver- sation a cl ient initiates, it randon1ly generates an ephemeral port number. Ephemera l n1eans that the port nun1ber is temporary. It is discarded \,•hen a conversation beh'\'een the client and a particular webserver ends. If the client communicates with the same server program later, tile client's transport process \,•ill generate a new ephen1eral port nun1ber. On Windo\,vs con1puters, tllis is the range from Port 1024 to Port 4999.
Ephemeral port numbers on client computers are only used for a single set of interac- tions between the client and a server.
Figure 2-16 shows a client host (60.171.18.22) comn1unicating \,•i th a blue server host (1.33.17.13). The server port nun1ber is Port 80, ind icating that the client is com- n1unicating with the HTTP progran1 on the server. The client has generated ephemera l Port 2707. When the client trans n1its to the server, tile Source Port Number Field has the va lue 2707 and the Destination Port Number Field is 80. When the server replies, the source port nun1ber is 80 and the destina tion port nun1ber is 2707.
The client is simultaneously connected to an SMTP application on a server (123.30.17.120), which uses the well-known port nun1ber 25. For this conversation, the client randon1ly generates ephemeral Port 4400. When the client transn1its, the source port nun1ber is 4400 and the destina tion port nun1ber is 25.
Sockets Figure 2-16 sho\,'S tha t a conversation always involves a source IP address and a source port number, plus a destination IP address and a destination port nun1ber. It is common to represent earn IP address and port number as a socket, \,•hich
15 An operating system does no t have to use well-known port numbers for appUcations. For example, some s ys tems administrators a ssign a different port number to wcbscrvcr applications, believing that attackers wiJJ not be able to identify them as wcbscnrcrs. lt doesn't work, an d it tends to cause confus ion for Jcgitimatc users and systems personnel.
62 Chapter 2 • Netwo rk Stand ar ds
Client 60.1 71.18.22
Source: 60.171 .18.22:2707 Destination: 1.33.17.13:80
Webserver 1.33.17.13
Port 80
Source: 1.33.17 .13:80 ,_ Destination: 60.171 .18.22:270 7
Source: 60.171.18.22:4400 Destination: 123.30.17.120:25
2 C lient Uses Ephemeral Port Number 2700 with the Webserver
4400 with the SMTP Server
SMTP Server 123.30.17.120
Port 25
FIGURE 2 -16 Cli ent Port Number.; and Sockets
1 Server Programs use
Well-Known Port Numbers (0 to 1023)
Clients use Ephemeral Port Numbers
(usually 1024 to 4999)
is simply the IP address, a colon, and the port nun1ber (Figure 2-17). When the client transmits to the \,•ebserver, the source socket is 60.171.18 .22:2707 and the destination socket is 1.33.17.13:80. When the \,•ebserver reflies, the source socket is 1.33.1 7.13:80 and the destination socket is 60.171.18.22:2707.1
Test Your Understanding
18. a) Wha t type of port numbers do servers use for common server programs? b) What type of port numbers do clients use \'l'hen they corrununicate with server progran1s? c) What is the range of port numbers for each type of port? d) How are ephemeral port numbers generated? e) Why are they called ephen1eral?
19. a) What is the syntax of a socket? b) In Figure 2-16, \'l'hen the client transmits to the n1ail server, \,•hat is the source socket? c) What is the destination socket? d) When the SMTP server transmits to the client host, what is the source socket? e) What is the destination socket?
IP Address Port Number Socket
60.1 7 1.18.22 2707 60.171. 18.22:2707
12 3.30.1 7.120 80 123.30.1 7. 120 80
60.1 71.18.22 4400 60.171 .1 8.22:4400
1. 33.17.1 3 25 1.33 .1 7.13:25
FIGURE 2 -17 A Socket Is an IP Address, a Colon(:), and a Port Number
16 Note that the IP address and the port number arc not even in the same header. The rP add ress is in the packet header, and the port number is in the TCP or UDP header.
Chapter 2 • Network Standards 63
Frame Syntax
A t Layer 2, the da ta lin k layer, we have frames. Recall that a frame carries a packet through a s ingle network. In Chapter 1, "'e looked b riefly at the Point-to-Point Protocol and Ethernet. In this s ubsection, ive look very b riefl y at the syntax of Ethernet fram es. The ma in purpose is to illustra te how packets are encapsu lated in frames.
Octets Field lengths are often measured in bits. Another comn,on ,neasu re for field le ngths in net\\'Orking is the octet. An octet is a group of 8 bits. Isn't tha t a byte? Yes, exactly. Octet is just another name for byte. The term is "'idely used in networking, ho,,vever, so you need to become fa miliar \Vith it. Octet actually ,nakes more sense than byte, because oct means "eight." We have octopuses, octagons, and octogenarians.
17
Octets are usually encountered in data link layer syntax.
An octet is a group of 8 bits.
Octets are usually encountered in data link layer syntax.
The Eth ernet II Frame Figure 2-18 sho,,vs another fram e, an Ethernet 11 frame. For Ethernet, the fields are not sho,,vn 32 bits on a li ne. Instead, the fields are sho,vn in order, o ne after another. The source and destination EUI-48 addresses that we saw in Chapter 1 have 48-bit fie lds to hold then,, as you would expect. Other field sizes are given in octe ts.
Note that th is is the syn tax of the Ethernet II frame. The IEEE 802.3 Working Group actually defines a different frame, which is generally called the 802.2 Ethernet
Fields in Order of Arrival
1 .. Oeler' is
-~121 Destination EUl-48 Address (48 b tts) Source EUl-48 Address (48 bits)
48 ls and Os. For Humans, Expressed in Hexadecimal Notation. another name
for ·Byte."
Data FieldI 4 Containing an
IP Packet
Tag Protocol ID (Optional) (2 octets) Tag Control Information (Optional) (2 octets)
EtherType (2 octets)
IP Pack et (variable length)
PAD
Frame Check Sequence (4 octets)
FI GURE 2· 18 Ethernet II frame
I
3 EtherType Field ~ tells the contents
of the Data Field ; 0800 for 1Pv4 8600 for 1Pv6
5 Error
._ Checking
17 \+Vha l is th~ eighth month? (Careful. The Romans added months to honor Ju lius and Augustus Caesar.)
64 Chapter 2 • Network Standards
frame. The Ethernet II frame is actually the version that existed before the 802 LAN/ MAN Standards Committee took over the standardization of Ethernet. In past editions of this text, \Ve described the 802.2 frame syntax, which is arguably more "standard." Ho\vever, the IETF has specified that IP packets should be encapsulated in Ethernet II frames, and this is usually done in practice. Given that IP packets are the dominant types of messages sent through corporate Ethernet nehvorks, \Ve focus on the Ethernet II frame in this edition of the book.
Ethernet frames can carry many types of information in their data fi elds. How does the receiver knO\V if the data field contains an IPv4 packet, an IPv6 packet, or something else? That is the job of the EtherType Field. If there is an IPv4 packet in the data field, the EtherType Field has the value 0800 in the hexadecimal notation \Ve \Viii see in Chapter 5. In binary, this is 0000 100000000000. For an IPv6 packet, the EtherType Field has the hexadecimal value 860D, which is 1000011011011101 in binary. Figure 2-19 shO\VS an IPv4 packet in the data fie ld.
Both the PPP frame and the Ethernet frame have a Frame Check Sequence Field. These fields allow the n.>ceiver to check an arriving frame for errors. The sender does a calculation based on the bits in the frame and p laces the n.>Sult in the Frame Check Sequence Field. When the frame arrives, the receiver repeats the calculation and com- pares its calculated n.>Sult w ith the transmitted value in the arriving frame. If the hvo are different, an error has occurred.
In Ethernet, the receiver simply discards any frame w ith errors. This is error detection w ithout ret ransmission, so Ethernet is an unreliable protocol. It is also connectionless.
Test Your Understan ding 20. a) How is the syn tax of Ethernet II frames depicted? b) In what fi eld is the
IP packet in carried Ethernet II frames? c) Why does this version of the book deal with Ethernet II frames? d) Ho\v does the receiving data link layer process know what is in the data field of an Ethernet II frame? e) Why is Ethernet unre- liable despite having a Frame Check Sequence Field that is used to check for errors?
ENCODING APPLICATION MESSAGES INTO BINARY
Encoding Application messages include letters, numbers, pictures, video streams, and other typ~,s of information. Lower-layer messages, as w e saw earlier, consist of ls and Os. The appli- cation program itself must convert its various types of information into bit streams. This conversion of rich application data into binary is called encoding.
Encoding is the conversion of application messages into bits.
It is done by the application program.
Chapter 2 • Network Standards 65
Test Your Understanding
21. a) What is encoding? b) At what layer is the encoding of application messages done?
Encoding Text as ASCII
To encode alphanumeric information (text, numbers, and other keyboard characters), applications normally use the ASCII code,18 whose individual symbols are each 7 bits long. Seven bits give 128 possibilities, as we w ill see later. This is enough for all keys on the keyboard p lus some extra control codes.
Alphanumeric information consists of text numbers, and other keyboard characters.
Figure 2-19 sho\vS a fe\v ASCII codes. Note that uppercase letters and lo\vercase letters have different ASCII codes. This is necessary because the destination application program must know whether to convert the encoded character into uppercase or lo\v· ercase. ASCII also encodes the digits from O through 9, as well as punctuation and other special characters. There are even ASCII control codes that tell the n.>ceiver \Vhat to do. For example, a carriage return is 0101110.
For transmission, the 7 bits of each ASCII character are p laced in a byte. The 8th bit in the byte is not used today.19
Category Example 7-Bit ASCII Code 8th bit in Transmitted Byte
Upper-Case Letter; A 1000001 Unused
Lower-Case Letter; a 1100001 Unused
Digits (O through 9) 3 01 10011 Unused
Punctuation Period 0101110 Unused
Punctuation Space 0100000 Unused Control Codes Carriage Return 0001101 Unused Control Codes Line Feed 0001010 Unused
FIGURE 2-19 Encoding Text as ASCII
18 ASCII is not the only system for encoding alphanumeric data. The A in ASCil stands for "American,# It does not represent diacritical marks, so there are variations for different languages. The better choice for international communication is UNICODE, which can represent any language-at the cost of more complexity. 19 F.arly systems used the 8th bit in each byte as a " parity bit'' to detect errors in transmission. TI,e total num- ber of bits in all bytes was made a whole odd (or even) number by selecting the parity bit. This could detect a change in a single bit in the byte. At today' s high transmission speeds., however, transmission errors normally generate multibit errors rather than single-bit errors. Consequently, parity is useless and is ignored.
66 Chapter 2 • Network Standards
Test Your Understanding 22. a) Wha t is alphanumeric information? b) Explain ho\,, many bytes it will take to
transmit "Go team" w ithout the quotation marks. (Ans\,ver: 7) c) Explain how n1any bytes it \'l'ill take to transmit "Hello World!" without the quotation marks. d) Go to a search engine and find a converter to represent characters in ASCII. Wha t are the 7-bit ASCII codes for "Hello \'l'orld! " without the quotation marks? (Check: H is 1001000) Show this in a table \'l'ith two columns. The first will show letters or other keyboard characters. The second \,•ill show the ASCII code for that character.
Converting Integers into Binary Numbers (1s and Os)
Son1e application data consists of integers, which are who le numbers (0, 1, 2, 3, . .. 345, etc.). Humans write these as decima l nun1bers, in \,•hich each symbo l is a digit from 0 through 9. The sending a pplication progran, encodes integers as binary numbers (ls and Os).
In decimal numbers, each symbol is a digit from O through 9.
In binary numbers, each symbol is a 1 or a 0.
Encoding Small Dec.imal Integers to Binary Using Your Brain Figure 2-20 sho\,•s how you can encode (convert) decin1al integers to binary. Decin1al is our normal number system. Integers are \,•hole nun1bers.
0
1
2
2
3
4
s
• The decimal number to be converted to binary is 11.
• (1) Next, \,•rite the bit positions, from O through 6, writing then, right to left. The first bit position on the right is 0, no t 1.
• (2) Under each write the position value. Thls is 2 ra ised to the power of the posi- tion nun1ber. For bit position 5, this is 25 or 32.
Decimal number to be converted 11
Bit position, b (begins wit h O from right) 6 s 4 3 2 1 0 Posit ion Exponent 2• 2s 2' 2' 2' 2' 2•
Position value, 2• 64 32 16 8 4 2 1 (Acts as the alternative in a = 2°)
Available positions for the conversion of - - - Yes Yes Yes Yes 1 1. (less than or equal to 11)
Combination t hat produces 11 - - - 1 0 1 1 (Try combinations in your head)
The number in binary 101 1
FIGURE 2- 20 Encod ing (Converting) a Small Decimal Number to Binary
Chapte r 2 • Nehvor k Standar ds 67
B2 =DEC2B1N(A2)
1 I D~i~al ,....' ___ 8
__:B:.:.:in.:.:a:..:.ry¥
: J l 247 11110111 C
A2 FIGURE 2· 21 Conve rti ng Decimal to Binary in Exce l
• (3) Now note which positions are relevant for encoding 11 . The largest value that \,•ill fi t into 11 is 8, so only the first fou r bit positions are relevant.
• (4) Now, look at the va lues 8, 4, 2, and 1. Decide how to get 11 from then1. The answer turns out to be 8 + 2 + 1. Put l s in the 8, 2, and 1 positions. Another relevant position adds no value, so it gets a 0.
• The answer, then, is 1011.
Encoding Decimal Integers to Binary Using a Computer This works fine for sma ll decimal numbers . For la rger n u mbers like 247, Excel offers the dec2bin fu nction (Figu re 2-21). If you com p u te d ec2bin(11), you wi ll get 1011. If you com - p u te dec2bin (247), you get 11110111 . Most other s preadsheet programs have sim ilar functionality. You can also use a search engine to find a n online decin1a l to binary converte r.
Converting Binary to Decimal Using Your Brain You should also know how to convert binary numbers that you come across back to decim al. Figure 2-22 shows how to d o this for the binary nun1ber 1010. It is obviously the reverse of the encoding process. Excel offers bin2dec, and there are many binary to decimal converters on the Internet.
Binary number to be converted 1010
Bit position, b (begins w ith O from right) 4 3 2 1 0
Position exponent 2' 2' 2' 2' 2•
Position value, 2• 16 8 4 2 1 (Acts as the alternative in a = 2•)
Binary number to be converted 0 1 0 1 0
Decimal Equivalents 0 8 0 2 0
Decimal Representat ion 1010= 1*8+ 1*2= 10
FIGURE 2-ll Converting Binary Num bers t o Decimal
68 Chapter 2 • Networ k Standar ds
Test Your Understanding
23. Ans\,•er the fo llowing questions w ithou t using a calcu lator or a con1puter. a) What is a n integer? b) Is 4,307 an integer? c) Is 45.7 a n integer? d) Is the first bit position on the righ t O or 1? e) Convert the d ecin1al nun1ber 6 to binary w ith- ou t using a con1puter. (Answer: 110) f) Convert O to binary. g) Convert 15 to binary. h) Convert 62 to binary. i) This tin1e us ing Excel or a decin1al to binary con verter, con vert 128 to binary. (Answer:10000000). j) Also using Excel o r a decimal to binary converter, con vert 255 to binary. k) Con vert the binary n un1- ber 100 to decima l. (Answer: 4) 1) Convert the binary n umber 1111 to decima l. n1) Convert the binary n umber 10110 to decim a l. n) Convert the binary number 100100 to decima l.
Encoding Alternatives Son1e a pplication d ata can be expressed as a lternatives, such as North, South, East, or West. The a pplication layer p rocess \,•ill create a fi eld in the a pplication layer n1essage and rep resen t each alternative as a group of bits. For instance, the four card inal con1- pass points can be rep resented by a 2-bit fie ld within the a pplication message. North, South, East, and West can be represen ted as 00, 01, 10, and 11, respectively. (These are the bina ry nun1bers for 0, 1, 2, and 3.) There is no ord e r to the alternatives, so any choice can be represented by any pair of bits.
We just saw tha t having four a lterna tives req uires a 2-bit fie ld. More gener- ally, if a field has b bits, it can re present 2b alterna tives. This gives us the follo\ving equation :
Equation 1: a = zb, where a is t he number of alternat ives and b is t he number of bits
We have just seen that a 2-bit fie ld can rep resent 22 alterna tives, o r 4. Here, b is 2, son is 4. Wha t if you need to represent six alternatives? Two bits \,•ill not be enough, because 22 is only 4 and we need 6. A three-bit field will g ive us 23 alternatives, or 8. This gives us eno ugh alternatives. Two al ternatives w ill go unused .
If a field h as b bi ts, it can rep rese nt 2b al ter natives.
Figure 2-23 illustra tes how alternative encoding is d o ne for field s that have 1, 2, 4, 8, 16, and 3 2 bits. It shows that with 1 bit you can e ncode yes o r no, connec- tion-o riented o r connectionless, or a n y o ther dichotom y. Two bits, as we jus t sa\,•, are good for the fo u r cardina l compass poin ts. Wi th 4 bi ts, you can have u p to 16 al te rna tives.
As noted in a previous exam ple, not every set of ca tegories \Vill have exactly two- to-son1e-power items . Fig u re 2-23 shows that to represen t the top 10 security threats, you need 4 bits, which can encod e u p to 16 alte rnatives. (Three bits will encode only eight alternatives.) Using 4 bits to represen t 10 threa ts \,•ill "waste" six alterna tives, b ut this is necessary.
Chapter 2 • Nehvo rk Standar ds 69
Number of Alternatives (a) Bits in f ield (b) that can be Encoded (a =2") Possible Bit Sequences Examples
1 2' = 2 o. 1 Yes or No, Connection-oriented or connectionless. etc.
2 22 =4 00, 0 1, 10, 11 North, Sout h, East, West; Red, Green, Blue, Black
4 2' = 16 0000, 000 1, 0010, . . . Top 10 security threats. 3 bits would give 8 alternatives. Not enough. 4 bits works. 6 values go unused
8 2• = 256 00000000, 00000001, . .. One byte per color gives 256 possible colors levels.
16 216 = 65 536 • 0000000000000000, Two bytes per color gives 000000000000000 1, ' . . 65,536 color levels.
32 2" = 4 294 967 296 • • • 000000000000000 Number of Internet Protocol 0000000000000000, etc. Version 4 addresses
FIGURE 2-23 Binary Encoding to Represent a Certain Number of Alternatives
You shou ld n1emorize the nun1ber of alterna tives that can be represented b y 4, 8, and 16 bi ts, because these are common field sizes. Each added bit doubles the number of possible alternatives, a n d each bit s ubtracted cuts the n un1ber of possible alternatives in ha lf. So, if you ren1en1ber th a t 8 bits can represent 256 alternatives, 7 bits (one less) can represent 128 a ltern a tives (half as many), and 9 bits (one n1ore) can represent 512 alternatives (twice as many). Ho\¥ m a n y alternatives can 6 and 10 bits represent?
Test Your Understanding
24. a) How many alternatives can you represent with a 4-bit field? (Answer: 16) b) For each bit you add to an alternatives field, how many additional a lterna- tives can you represent? c) How many alternatives can you represent with a 10-bit field? (With 8 bits, you can represent 256 alternatives.) d) If you need to represent 129 alternatives in a field, how many bits long must the field be? (Answer : 8) e) If you need to represent 18 alternatives in a field, how many bits long must the field be? f) Con1e up w ith three exan1ples of things that s hould be encoded with 3 bits.
24. a) In TCP, port number fields are 16 bits long. Ho\¥ many possible port nun1- bers are there? b ) IPv6 addresses are 128 bits long. How n1any IPv6 addresses are there? Just represent the formula for calcula ting the value. c) The IP version number field is 4 bits long. Ho\,v n1any possible versions of IP can there be? d) UDP length fields are 16 bits long. This field gives the number of bytes in the data field. How many bytes long n1ay a UDP data field be? e) ASCII has a 7-bit code. How many keyboard characters can it represent?
70 Chapter 2 • Network Standards
PROTOCOLS IN THIS CHAPTER
Figure 2-24 lists information o n several protocols we saw in this chapter, includ ing layer nun1ber, w hether the protocol is connectionless or connection-oriented, and w hether the s tandard is reliable or unreliable. Note a very s in1ple pattern. Only TCP among these n1ajor protocols is reliable and connection-oriented.20 Al though reliab il- ity appears to be a good thing, it is con1plex and resource-consuming. Connection orientation, in tu rn, is u sually done to n1ake reliability possible through n1essage retransn1ission. Making all layers reliable would be extren1ely expensive.
Only TCP among these major protocols is reliable and connection-oriented.
Test Your Unders tanding
25. a) What protocols that we sa\,v in this rnapter are reliable? b) Why aren't all protocols reliable?
Connection -Oriented Layer Protocol Reliable or Unreliable? o r Con nectionless
5 HTTP Unreliable Connectionless
4 TCP Reliable Connection-Oriented
4 UDP Unreliable Connectionless
3 IP Unreliable Connectionless
2 PPP Unreliable Connectionless
2 Ethernet Unreliable Connectionless
FIGURE 2- 24 Protocols in th is Chapter
20 \'Vhy make TCP the reliable protocol? Recall that lower layers usually do error discarding. This means that if there has been an error at the layers below TCP, the TCP segment will not reach the transport process on the receiver. There will be no acknowledgment, so the source transport process wiU retransmit the TCP segment. TCP, then, automatically corrects errors at lower layers by retransmitting a discarded segment. TCP, further-- more, lies right below the application layer, so error correction at the transport layer gives the applkation program dean data. The appUcation program should not have to deal with transmission errors.
END-OF-CHAPTER QUESTIONS
Thought Questions
2-1. How do you think TCP would hand le the prob lem if an acknowledgm ent were lost, so that the sender re trans- mitted the unacknowledged TCP seg- ment, there fore causi ng the receiving transport process to recei ve the same segmen t hvice?
2-2. a) Com pute the minimum number of TCP segments required to open a con- nection, send an HTTP request and response message, and close the con- nection. Justify this nu mber by creating a table showing each message and its sequence number. b) Repeat the ques- tion, this time if the HTTP respanse mes- sage is damaged during transmission.
2-3. Compu te the minim u m nu mber of TCP segments required to open a con- nection, send an HTTP request and response message, and close the con- nection if the HTTP response message mus t be fragmented across ten packets. Jus tify this numbe r by creating a table s howing each message and its sequence number.
2-4. a) In Figure 2-16, what w ill be the va lue in the destination por t number field if
Internet Research: April 1 RFCs
2-8. Consu lt the Wiki pedia Webpage April Fools' Day Requ est fo r Comments (h ttps : //en. w i ki ped ia .org / w i ki / Apri l_Fools %27 _Day_Reques t_for_
Perspective Questions
2-9. What was the most s urpr isi ng thing you lea med in this chapter?
Chapter 2 • Nehvor k Standards 71
a packet arrives for the e-ma il applica- tion? b) When the HTTP program on a webserver sends an HTTP response message to a client PC, in what field of what message w ill it p lace the va lue 80?
2-5. Do the following w ithou t using a cal- cu lator or computer, bu t check your answers with a calcu la tor o r a com- puter. a) Convert 6 to binary. (Answer: 110) b) Convert 47 to binary. c) Convert 100 to binary. d) Con,•e rt 110100 to deci- mal. (Answer: 52) e) Con,•ert 001100 to decimal.
2-6. Do the following w ithou t using a cal- culator or a computer, but check your answers with a calcu la tor o r a com- puter. You need to represent 1,026 d if- ferent city names. How many bits w ill this take if you give each city a d ifferent binary number? Explain your answer.
2-7. a) The port number fields i n TCP and UDP are 16 bits long. How many port numbers can they represent? b) In IP, the Time to Live Field is 8 bits in s ize. How m any val ues can it represent? c) How many values can a flag fie ld represent?
Comments). Select one o f the RFCs listed on the page and write a para- graph on its claimed purpose. (Don't just pick the first few.)
2-10. What was the most difficult material for you in this chapter?
Th is page intentionally left blank
Chapter 3
Network Management
LEARNING OBJECTIVES
By the end of this chapter, you should be ab le to: • Discuss nehvork q uality of service (QoS) and specify service level agreement (SLA)
guarantees.
• Design a nehvork layout based on req uired traffic volumes behveen pairs of sites. • Describe options for dealing \vith m omentary traffic peaks.
• Describe the benefits and importance of centralized nehvork m anagement; discuss and compare three tools for centralizing nehvork m anagement: Ping, Traceroute, and the Simple Nehvork Managem ent Protocol (SNMP).
• Describe Sofhvan.~ Defined Networking (SDN), including why it is potentially revolutionary.
INTRODUCTION
Technology means nothing unless a company m anages n etworks very well. In this chap- ter, we look at core issues and tools for network man agemen t. These concep ts apply to everything networking professionals do at every level.
Today, we can build much larger nehvorks than we can m anage. Even a rnidsized bank is likely to have 500 Ethernet switches and a similar number of routers. Further- more, nehvork d evices and their users are often scattered over large regions-some- times internationally. Although network technology is exciting to talk about, it is chaos w ithout good management.
73
74 Chapter 3 • Network Management
A pervas ive issue in network management is cost. In networking, you never say, "Cost doesn't matter." Nehvork budgets are a lways stretched thin. Net\vorki ng a nd security professionals ahvays need to solve proble,ns with n1inimum budgets. One way to do this is to automate as m uch ne t\\'Ork managen,ent work as possible.
NETWORK QUALITY OF SERVICE (QoS)
In the early days of the Internet, net\\'Orked applications an1azed new users. However, the next impression ,vas, "Too bad it doesn't work better." Today, networks a re mission- critical for corpora tions. If the net\vork b rea ks do"'11, 1nuch of the organization co1nes to a n expensive halt. Today, net\,,orks must not o nly "'ork, they n,ust ,vork well. Compa- nies are increasingly concerned "'ith network quality-of-service (QoS) metrics, that is, quantitative measures of net\\'ork performance that define " 'ha t ""'orking ,veil" 1neans and ,neasure how well the net\vork is providing its serv ices. Fig11re 3-1 s ho\\'S that con1- panies use several QoS metrics. Collectively, these metrics track the service qua lity that users receive.
Test Your Understanding
1. a) What are QoS metrics? (Do not just s pell ou t the acronyn,.) b) Why are QoS metrics important?
Transm ission Speed 1
The fi rst question people have about a ne,vbom baby is, "Is it a boy or a girl?" For a network, the usual question is, "How fast is it?" The ans\\'er is important, but it is a little co,nplicated.
Speed: Transmission Speed in B~s per Second (bps)
Availabihty: Percentage o f Time Network Is Available
to Users
FIGURE 3-1 Quality-of-Service (QoS) Metrics
Errors: Percentage of Incorrect Bits or Packets
latency: Time Delay in Packet Delivery, Measured in M illiseconds (m s)
1 Strictl)' speaking, speed mca1,s velocity. But a host tha t transmits faster docs not send its bits with higher velocity when it trans mits fos ter. It me.rely transmits mon:- bits each st-cond. Speed is rcall)' about transmis.~ion rate, not trans mission velocity. lt is like talking faste r, not running fostc.r.
Chapter 3 • Network Management 75
Without a Metrk Designation Abbreviation Meaning Example Prefix
Kilobits per kbps 1,000 4.5 kbps 4,500 bps Second 93.047 kbps 93,047 bps
Megabits per Mbps 1,000,000 251 .62 Mbps 251 ,620,000 bps Second
Gigabits per Gbps 1,000,000,000 8 Gbps 8,000,000,000 bps Second
Terabits per Tbps 1,000,000,000,000 12 Tbps 12,000,000,000,000 bps Second
FIGURE 3-2 Speeds i n Metric Notat ion
Bits per second (bps) First, network speed is measured in bits per second (bps). Note that this is not bytes per second. IS students and professionals tend to think in terms of bytes because of their file, database, and programming background. However, it is traditional to deal with bits in transmission systems. For things like file downloads, you occasionally do see speeds measured in bytes p er second. In this case, the speed should be sho\vn as Bps, not bps.
Speed is normally measured in bits per second (bps), not bytes per second (Bps).
High speeds are \Vritten in metric notation. As Figure 3-2 shows, transmission spe<.-'ds are measun.-'d in kilobits per second (kbps), Megabits per second (Mbps), Giga- bits per second (Gbps), and Terabits per second (Tbps). Notice an oddity in the metric system. Mega, Giga, and Tera have uppercase metric prefixes, but kilo is a lov,ercase k.2
Kilo is abbreviated with a lowercase k (kbps).
Application Requirements How much speed is necessary? That depends on the application that needs to be supported. Figure 3-3 shows do\vnload times for vari- ous applications at various download speeds. Note that for messaging and e-mail, any speed is fine. At the other extreme, high-definition video and full-disk backups need higher speeds than we generally get today.
Test Your Understanding
2. a) Is transmission speed usually measun.-'d in bits per second or bytes per sec- ond? b) For the HDTV program in Figure 3-3, which of the speeds sho\vn w ill allow real-time streaming?
2 In the metric system., up percase K is the abbreviation for Kelvins_, a measure of temperature,
76 Chapter 3 • Network Management
Application 100 kbps 1 Mbps 10 Mbps 100 Mbps 1 Gbps
E-M ail M essage (250 word s) 0 sec 0 sec 0 sec 0 sec 0 sec
Photograph 5 MB 7 min 40sec 4 sec 0 sec 0 sec
1-h r HDTV Program (7 Mbp s) 3 da 7 hr 42 min 4min 25 sec
Backup, 1 TB Hard Drive 31 mo 3 mo 7 da 22 h r 2 hr
FIGURE 3- 3 Application Download Times at Various Transmission Speeds
Rated Speed and Throughput It is importan t to understand that the re is a dif- ference between rated speed and throug hput. The rated speed is the s peed the standard or the carrier s pecifies. T hroughput is the s peed you actually receive, which is lower, sometim es much lower. For \,•orking ne h,•orking professio nals, throug hput is the o nly thing that is relevant.
The rated speed is the speed the standard or the carrier specifies.
Throughput is the speed you actually receive.
Shared Speed : Aggregate and Individual Throughput Thi ngs get even n1o re confusing if the s peed being d eli vered by the nel\-vork is shared by several people. For examp le, if you a re at a coffee shop that has a n access ro ute r w ith a built-in access point, it w ill provide a certain aggregate throughput tha t is shared by everyone w ho is sending and receivin g. Figure 3-5 sho\,•s this in an exan1ple. In the coffee sho p, the re a re 5 users. Two are actively sending or receiving a t this mo men t. The rated s peed of the access po int is 6 Gbps. Its aggrega te throug hput is 5 Gbps. This aggrega te throug hput is sha red by the 2 users actively sending an d receiving, no t by all 10. Each has a n individ ual throughput of 2.5 Gbps.
In a shared system, the aggregate throughput is the throughput available to all users.
The individual throughput is the aggregate throughput divided by the number of active users at the moment.
Rated Speed The speed stated in the standard or t he speed you are quoted by your provider.
Throughput The speed you actually get. (Almost always lower, sometimes substantially.)
AGURE 3-4 Rated Speed a nd Throughput (Stu dy Figure)
~ The router's rate<l speed is 6 Gbps. tts current throughput is 5 Gbps. There are five Wi-Fi Hosts. Two are transmitting or receiving curren tly. How much speed will each host receive?
Chapter3
-~- • Net work Management
)iJ J
FIGURE 3 -5 Shared Th roughput and In divid ual Thro ug hput in a Coffee Shop
Test Your Understanding
3. a) Distinguish between rated speed and throughput. b) Distingu ish ben,,een ind i- vidual and aggregate throughput. c) You are working at an access po int "'ith 20 other people. Three are doing a download a t the same time you are. The rest are looking at their screens or sipping coffee. The access point you sha re has a rated s peed of 150 Mbps and provides a thro ughput of 100 Mbps. How much speed can you expect o n average fo r a download? (Answer: 25 Mbps) d) In a coffee sho p, there a re 10 people sharing an access point with a rated speed o f 2 Gbps. The throughput is half the ra ted speed. Several people are do,,vnloading. Each is getting an average of 100 Mbps. Ho,v ,nany people a re using the Internet a t that mome nt?
Transmission Capacity on Multiplexed Transmission Links The transmis- sion links that connect pairs of routers in the Internet ,nay multiplex (combine) the traffic of tho usands or millions of con versations. Multiplexing is sho" 'n in highly sin1plified fo rm in Figure 3-6. In the fi gu re, the n1ultiplexed transmission link shares the tra ffic of only two connections. Hosts A and B genera te 4 Gbps of traffic. For Hosts C and D, the traffic is 5 Gbps. Access links tha t connect each host to the ne t\\'Ork a re not shared , so these dedicated links need to be able to ca rry the traffic of their individ ual hosts.
HostC
Oedicate<l (Unshared)
Access link
Mulbplexe<l (Shared)
Trunk link
Required Capacity: 7 Gbps
...... ,., '
Router
Host B
Packets
FIGURE 3-6 Traffic Capacity Requirement on a M ultip lexed Transmission Link
77
78 Chapter 3 • Network Management
Multiplexing transmits the traffic of multiple conversations over a shared trunk link, as opposed to unshared access links. This saves money.
Why Multiplexing? Why multiplex th e traffic of many individual conversa- tions on trunk links? The answer is that multiplexing reduces cost. It is cheaper to mul- tiplex many conversations on a single lin e than to give each a line. Th ere a re economies of scale in transmission lines, so one big trunk link w ill b e cheaper than having separate unshared links to give each pair its required capacity. In addition, hosts do not transmit constantly. They normally transmit in bursts separated b y relatively long s ilences. Mul- tiplexing packs frames or packets onto the line more efficiently, a llowing a slo\ver trunk line to be used. To give an analogy, although it might be nice for each car to h ave its O\Vn lane during rush hour, they n eed to share a few lan es to minimize cost.
Multiplexing reduces cost.
The multiplexed trunk link between the p airs of routers or switches must be siz<.>d to the average traffic of all conversations. Although both Host A and Host B generate a good deal of traffic, they do so b y sending short bursts of packets separated by silences. So, although Host A and Host C collectively generate 9 Gbps of traffic, the multiplexed transmisl>ion line might only n eed to be, say, 7 Gbps to carry their combined traffic. Multiplexing, then, saves money by allowing multiple con versations to share multiplexed transmission links efficiently.
The Downside of Sharing Your mother probably told you that sharing is good. As you soon le arned, she was \vrong. Bad things h appen w h en you share. Your indi- vidu al throughput will vary \vith traffic, especially if the system is near capacity.
Test Your Understanding
4. a) Distingu ish between dedicated and multip lexed trans mission links. b) If 100 conversations averaging 50 Mbps are multiplexed on a transmiss ion line, will the required transmission line capacity b e less than 5 Gbps, equa l to 5 Gbps, or more than 5 Gbps? c) What is the business benefit of multiplexing?
Other Quality-of-Service Metrics Although network speed is important, it is only one element in n etworking quality of service. Figure 3-1 sho\ved th ree other QoS categories. We look briefly at each .
Availability One is availability, \vhich is the percentage of time that the net- \VOrk is a vailable fo r use. Ideally, n etworks would be available 100% of the time, but that is impossible in reality. No\v that n etworking is embedded in almost every aspect of business, a breakdown in availability quickly becomes intolerable.
Error Rates Ideally, all packets would arrive inta ct, but a few will not. Th e error rate is the p ercen tage o f bits or packets th at are lost or d amaged during delivery. (At the
Chapter 3 • Network Management 79
physical layer, it is common to measure bit error rates. At the internet layer, it is com- mon to measure packet error rates.)
When the network is overloaded, error rates can soar because the nehvork must drop the packets it cannot handle. Consequently, compank,s must measure error rates when traffic levels are high to have a good understanding of error rate risks.3
Latency When packets move through a network, they ahvays encounter some delays. The amount of delay is called latency. Latency is meas'l.ll'ed in milliseconds (ms). A millisecond is a thousandth of a second. When latency reaches about 125 milliseconds, tum taking in telephone conversations becomes difficult You think the other person has finished speaking, so you begin to speak-only to realize that the other party is still speaking.
The amount of network delay is called latency. Latency is measured in milliseconds (ms).
Jitter Figure3-7 illustrates another time-related QoS concept, jitter. Jitter is the aver- age variability in the latency benveen successive packets. Some packets will arrive farther apart in time, others closer in time. Jitter doc,s not bother most applications, but voice over IP (VoIP) and streaming media are highly sensitive to jitter. If the sound is played back without adjustment, it will speed up and slow down. These variations often occur over mil- lis<.>cond times. As the name suggests, variable latency tends to make voices sound jittery.4
Jitter is the average variability in arrival times (latency).
Engineering for Latency and Jitter Most nehvorks were engineered to carry traditional data such as e-mail and database transmissions. In traditional applications,
j ~
Low Jitter (Low Variability in Latency)
D D CJ D D
,,_~ __ l _ • _H-ig_h_J-it-te_, _(H-ig-~- v-~-ria- b-il-ity_i_n -La_t_en-~-~)-• __ ~ __ ~,..i FIGURE 3 -7 Jitter
:;The impact of even small error rates can be surprisingly large. TCP tries to avoid network congestion by sending TCP seginents slowly at the beginning of a connection. If these segments get through without errors, TCP sends the following segments more quickly. However, if there is a single error, the TCP process assumes that the network is overloaded. It falls back to its initial slow start rate for sending TCP segments and builds speed slowly. This can produce a major drop in throughput for applications.
'1 The technical term for jitter is "IP packet delay variation," but jitter is almost always used to designate the phenomenon. RFC 3393 describes how jitter can be measured, Do not attempt to read it unless you have strong headache medicine immediately available,
80 Chapter 3 • Network Management
latency was only slightly important, and jitter \Vas not important at all. However, as VoIP, video, and interactive applications have grown in importance, companies have begun to worry more about latency and jitter. They are finding that extensive nehvork redesign may be needed to give good control over latency and jitter. This may include forklift upgrades for many of its S\vitches and routers.
Test Your Understanding
5. a) What is availability? b) When should you measure error rates? Why? c) What is latency? d) In what units is latency measured? e) What is jitter? f) Why may adding applications that cannot tolerate latency and jitter be expensive?
Service Level Agreements (SLAs)
When you buy some products, you receive a guarantee that promises that they \Viii \vork according to specifications and that lays out \Vhat the company must do if they do not. In networks, service providers may provide service level agreements (SLAs), \vhich are contracts that guarantee levels of performance for various metrics such as speed and availability. If a service does not meet its SLA guarantees, the service pro- vider must pay a penalty to its customers.
Service level agreements (SLAs) are contracts that guarantee levels of performance for various metrics such as speed and availability.
Service Level Agreements (SLAs)
Guarantees tor performance Penalties if the network does not meet its service metrics guarantees
Guarantees Specify Worst cases (No Worse than)
Lowest speed (e.g., no worse than 100 Mbps) Maximum latency (e.g., no more than 125 ms) SLAs are like insurance policies-take effect when something bad happens
Often Written on a Percentage Basis
E.g.: No worse than 100 Mbps 99% of the time As the percentage increases, cost of engineering Increases in order to achieve it
To specify 100% of the time would cost an Infinite amount of money
Residential Services Are Rarely Sold with SLA Guarantlles
Engineering SLA-compliant networking would be too expensive
FIGURE 3-8 Service Level Agreements (SLA) (Study Figure)
Chapter 3 • Network Management 81
Worst-Case Specification SLA guarantees are exprl'SSed as worst cases. For example, an SLA for speed would guarantee that speed will be no lower than a certain amount. If you are downloading webpagl>S, you \Vant at least a certain level of speed.
You certainly \VOuld not \Vant a speed SLA to specify a maximum speed. More speed is good. Why would you \Vant to im pose pen alties on the nehvork provider for exceeding some m aximum speed? That \vould give them a strong incentive not to increase speed! Making things better is not the SLA's job.
SLA guarantees are exp ressed as worst cases. Service will be no worse than a specific number.
For latency, in turn, an SLA specifying a worst case \VOuld require that latency will be no higher than a certain value. You might specify an SLA guarantee of a m aximum of 65 ms (milliseconds). This means that you w ill not get \VOrse (higher) latency.
Percentage-of-Time Elements Most SLAs have p ercentage-of-time elements. For instance, an SLA on speed migh t guarantee a speed of at least 480 Mbps 99.9% of the time. This means that the speed will nearly ahvays be at least 480 Mbps but m ay fall below that 0.1 % of the time \vithout incu rring penalties. A smaller exception percent- age might be attractive to users, but it would p robably requ ire a substantially more expensive network. Nothing can be guaranteed to work properly 100% of the time, and beyond some point, cost grows very rapidly \Vith increasing p ercentage guarantees. SLAs must always balance quality level and cost.
Corporations versus Individuals Companies that use commercial networks expect SLA guarantees in their contracts despite the fact that engineering nehvorks to meet these guarantees w ill raise costs and prices. Businesses need thl>Se performance levels to d o their work. Consumer services, ho\vever, rarely have SLAs because consum- ers are m ore price sensitive. For example, residential Internet access providers using a digital subscriber line (DSL), cable m odem, or cellular nehvork rarely offer SLAs. This keeps the p rice of residen tial services d own, but there w ill be more instances of less- than-advertised performance.
Test Your Understanding
6. a) What are service level agreements? b) Does an SLA measure the best case or the worst case? c) Would an SLA specify a highest speed or a lo\v(>St speed? d) Wou ld an SLA specify a highest availability or a lowest availability? e) Would an SLA specify highest latency or Jow(>St latency? f) Would an SLA guarantee specify a highest jitter or a lowest jitter? g) What happens if a carrier does not meet its SLA guarantee? h) If carrier speed fa lls belO\V its guaranteed speed in an SLA, under what circumstances \Viii the carrier not have to pay a penalty to the customers? i) Does residential ISP service usually offer SLA guarantees? Why or w hy not? j) A business has an Internet access line w ith a maxim um speed of 100 Mbps. What two things are wrong with this SLA?
82 Chapter 3 • Networ k Management
NETWORK DESIGN
Network d esign is a core skil l. The more you kno\,v about neh,•orking and your corpo- ration's situation, the better your d esign will be. Ho\,•ever, if there is son1ething you do not kno\,• or think abo ut, your d esign is likely to be a poor o ne. Network designers are governed by their worst m on1e nts.
Traffi c An alysis Network d esign ah,•ays begins \,•ith tra ffic requirements. Traffic analysis asks how n1uch traffic must flow over each of the neh,vork's many individual transmission links.
Traffic analysis asks how much traffic must flow over each of the network's many indi- vidual transmission Jinks.
Tw o-Site Anal ysis Figure 3-9 sho\'l'S a trivial traffic ana lysis. A con1pany only has two sites, A and B. They need to comnn micate at 1 Gbps. Obviously, the company needs a transmission link that can handle 1 Gbps.
Three-Site Analysis As soon as the number of sites gro\'l'S beyond h,•o, how- ever, traffic analysis becomes challenging. Figure 3-10 sho\,•s a three-site traffic analysis. The figure shows that Site Q attaches to Si te R, w hich attaches to Site S. There are two links: Link Q-R and Link R-S.
Site Q is west of Site R. Si te S is east of Site R. Site Q needs to be a b le to con1- n1unicate \,•ith Site Rat 45 Mbps. Site R need s to be able to comn1unicate w ith Site S at 2 Gb ps. Site Q needs to be ab le to con1mu nicate wi th Site Sat 300 Mbps.
Are you overwheln1ed by the last paragraph? An yone \'l'ou ld be! In traffic analy- sis, it is critica l to draw the pic ture. Figure 3-10 shows ho\,• the three sites are laid out and \,•hat links connect them.
After laying out the sites and links, it is stra ightforward to dra\,• the three required traffic flows between each pair of sites. When you d o tha t, you can see that son1e traffic flows are limited to a single transnussion link, \,•hereas traffic between Q and S must travel over both links.
Site A
II(
Required Transmission Line Speed (1 Gbps)
Required Traffic Speed (1 Gbps)
FIGURE 3-9 Two-Site Traffic Analysis
)
Chapter 3 • Network Management 83
SiteR
UnkQ-R Link R-S
SiteQ Sites 45 Mbps Requ red (0-R) 2 Gbps Required (R-S)
. 1300 ~b= Required (0-S)
345 Mbps Required on Link 0-R (300 Mbps + 45 Mbps)
FIGURE 3- 10 Three-Site Traffic Analysis
2.3 Gbps Required on Unk R-S (2 Gbps + 300 Mbps)
Now, you add up all the traffic flowing over each link.
• The link between Q and R must hand le both Q-R traffic (45 Mbps) and Q-S traffic (300 Mbps). It does not handle any of the traffic ben,•een Rand S, however. Conse- quently, Link Q-R must be able to handle 345 Mbps.
• Similarly, Link R-S must be able to handle R-S traffic (2 Gbps) and Q-S traffic (300 Mbps). This means that the transn1ission link between R and S must be able to handle 2.3 Gbps.
This problem can be handled \,•ell \,•ith the figure alone. Ho\,vever, Figure 3-11 shows a more general tabular ¼'ay to do the ana lysis, a traffic table.
• The first colunm shows all possible con1binations of pa irs of sites tha t must com- municate. The genera l ru le is that if there are N sites, you \,•ill have N•(N-1)/2 site pairs. In this case, \,•e have three sites, and 3•(3-1)/2 is 3. These three site pairs are Q-R, R-S, and Q-S. Each ro\,, shows traffic flowing between each possible site pair.
• The rows a lso show which links this traffic flows over. This requires you to see ho\,, traffic between each site pair \,•i ll travel over the network. Again, you need the figure to let you understand the situation. Traffic between Q and R only flows over Link Q-R. Similarly, traffic flowing ben,veen Rand Sonly flo\,'S over Link
Traffic goes over a single link.
2 Gbps Traffic goes over a single link.
300 Mbps Traffic goes over both links.
2.3 Gbps Required speed for link.
FIGURE l - 11 Traffic Table for Figure 3-10
84 Chapter 3 • Network Management
R-S. However, traffic flowing between Q and S needs to travel over two links: Q-R and R-S.
• Once you set up the table and enter the site-to-site traffic requirements for each row, you can simply total down each column to compute total traffic flowing over the link.
The traffic table looks like more work than just examining the figure and solving the totals visually. For more complex situations, ho\vever, the traffic table is the on ly approach that leaves you reason ably sane after the calculations. One reason the calcula- tions are easy to do visually \vith the picture is that the sites are all laid out in a single line. As you might suspect, that doesn't often happen in the real world.
Four-Site Analysis Here is another, slightly m ore complex example. (Mas- ter the previous example before doing this one.) A company h as offices in Honolulu, Seattle, Ogd en, and Dublin, Ireland. There are three transmission links: Honolulu and Seattle, Seattle and Ogden, and Ogden and Dublin.
Seattle needs to communicate at 1 Gbps \Vith each other site. Honolulu and Dublin only need to communicate with each other at 1 Mbps. Ogden and Dublin need to com- municate at 2 Gbps. Honolulu and Ogden need to communicate at 10 Gbps. How m uch traffic \viii each transmission link have to carry? The analysis in Figure 3-12 shows how to calculate this.
• The first step, again, is to draw a picture sho\ving the sites and transmission lines. Figure 3-12 shO\VS this information at the top.
• Second, draw traffic requirements for each link behveen sites. The figure has also done that.
• Third, using the picture and no traffic table, find the total traffic that m ust flow over each link. Figure 3-12 does this for the link behveen Honolulu and Seattle. Note that the traffic flo\ving over the Honolulu-Seattle Link includes 1 Gbps flow- ing between Honolulu and Seattle, 1 Mbps (0.001 Gbps) behveen Honolulu and Dublin, and 10 Gbps behveen Honolulu and Ogden .
• Therefore, the total traffic fl o\ving over the Honolulu-Seattle Link is 11.001 Gbps.
Honolulu- Seattle- - Ogden-Seattle Ogden Dub lin Honolulu Seattle Ogden Dublin • 1 Gbps )I, 1 Gbps
1 Gbps 1 Mbps
10 Gbps
2 Gbps
11.001 Gbps
FIGURE 3-12 A Four-Site Traffic Analysis
Chapter 3 • Network Management 85
Transmission Unk Traffic Requirement for Ead, Pair of Sites
Honolulu- Seattle Seattl&-Ogden Ogden-Dublin
Honolulu-Seattle
Honolulu-Ogden
Honolulu-Dublin
Seattl&-Ogden
Seattl&-Dublin
Ogde~ubl in
FIGURE 3 -13 Traffic Table for Figure 3-12
1 Gbps
10 Gbps 10 Gbps
The corresponding t raffic table is shown in Figure 3-13. To make a traffic table, firs t note that there are three transmission links betw een sites to analyze. This means that there \Vil! be three columns of data. In add ition, there are nO\v four sites, so there are 4•(4-1)/2 possible combinations. This is six site pairs for t raffic analysis . In Figure 3-13, the first two rows have been filled in . Your job is to fill in the rest of the table.
Test Your Understanding
7. a) Complete the traffic table in Figure 3-13. b) In Figure 3-12, add 392 Mbps of traffic for Seattle-Ogden communication. Using a picture like the one in the figure, show your \VOrk. c) Do it again w ith a traffic table. d) In Figure 3-10, remove the link between Q and R but add a link between Q and S. Using a pic- ture, calculate requirem ents, showing your work. (Do not add the 392 Mbps in Part a.) e) Now use a traffic table to do the calculations. f) If you have 10 sites connected by seven transmission links, how many rows of traffic data \Viii you have in your traffic table? g) How many columns?
Reliability Through Redundancy Transmission lines sometimes fail, of course. The failure of even a single transmission line can wreak havoc \Vithin a network. Figure 3- 14 repeats the four-site analysis in Figure 3-12. Actually, it repeats it twice.
Failed Transmission Line The top of Figure 3-14 shows what happens \vhen the transmission line behveen Seattle and Ogden fails. Honolulu can still talk to Seat- tle, and Ogden can still talk to Dublin. However, Honolulu and Seattle cannot talk to Ogden or Dublin.
Adding Redundancy The lo\ver half of the figure repeats the situation. This time, however, there is an extra transmission line. This line connects Honolulu and
86 Chapter 3 • Network Management
Honolulu
Honolulu- Seattle ..
Seattle
Seattle- Ogden
·----x----· Line Failure
Redundant Transmission Line Honolulu-Ogden
Honolulu- Seattle
Seattle- Ogden
-Ogden
Honolulu Seattle -----X----- Ogden Line Failure
FIGURE 3-14 Rel iabil ity Through Redundancy
Ogden- Dublin
----- Dublin
Ogden- Dublin
Dub lin
Ogden . Now, the failure in the Seattle-Ogden link is not a problem. Honolulu can still talk to Ogden din.>ctly, and through Ogden, Honolulu can still talk to Dublin. The added transmission link gives redundancy; if a link fails, there can still be transmission among at least some sites that would not be able to communicate after the failure.
Redundant transmission links ensure that if a fink fails there can still be transmission among at feast some sites that would not be able to communicate after the failure.
The situation for Seattle is a little more complicated. If Seattle wants to talk to Ogden, it must do so through Honolulu. Seat tle fi rst transmits to Honolulu, which lies in the opposite direction to Ogden. The traffic then passes from Honolulu through Ogden over the redundant transmission line.
With multip le ways for traffic to get behveen sites, computing required transmis- sion line capacities by hand becom~,s impractical, growing impossible if there are many transmission lines and redundant transmission lines. Fortunately, software is available to do the calculations and make tradeoffs while still leaving spare capacity to achieve target levels of service if certain transmission lines failed.
Test Your Understanding
8. a) If the backup line in Figure 3- 14 were to connect Seattle and Dublin instead of Honolulu and Ogden, list the path that traffic would take between Honolulu and Dublin if the line benveen Seattle and Ogden failed. b) Repeat for traffic between Seattle and Ogden. c) In the network in the lower half of Figure 3-14, what sites cannot communicate if the link between Ogden and Dublin fails?
Traffic Requirements versus Leased Lines If the sites are miles apart, they will be connected by leased lines from a telephone car- rier. Leased lines are point-to-point links between pairs of sites. They are "ahvays on," so they are always available. Figure 3-15 shows the most common leased line speeds in
Chapter 3 • Network Management 87
Une Transmission Speed
T1 1.544 Mbps
T3 44.7 Mbps
OC-3 155.58 M bps
OC-12 622.08 M bps
OC-48 2,488 Mbps
OC-192 9,953 Mbps
FIGURE 3-15 Leased Line Speeds in the United States
the United States.5 If you need a transmission speed of 30 Mbps benveen t\vo sites, you cannot lease a 30 Mbps line. You \vould need a T3 line, with a speed of 44.7 Mbps.
Here is another example. In Figure 3-10, the link bet\veen Q and R needs to have a capacity of 345 Mbps. An OC-3 leased line of 155.58 Mbps \VOuld be too slow, so the company \VOuld need an OC-12 line running at 622.08 Mbps. This is a lot more capacity than the link need s, but there is nothing between OC-3 and OC-12.
In tum, Link R-S in Figure 3-10 requires a speed of 2.3 Gbps. In this case, it is easy to see that an OC-48 line at 2.488 Gbps will do the job with little \vasted capacity. (Ho\v· ever, when things are so close, it would be wise to ask if 188 Mbps is enough room for gro\vth. Line requirements are based on growth forecasts for several years. Forecasts are never perfect.)
A very similar situation exists w ithin local area networks that use Ethernet. We will see in Chapter 5 that Ethernet transmission also comes at a limited number of stan- dard speeds.
Test Your Understanding
9. a) What leased line do you need if you have a capacity requirement for 2 Gbps? b) For 500 Mbps? c) For the situation in Figure 3-9, \Vhat leased line would the link require? d) Repeat for Figure 3-12. Do this for all links regardless of \vhether their capacity is shown in the figures.
Momentary Traffic Peaks Traffic volume varies randomly (Figure 3-16). Consequently, there w ill inevi tably be occasional momentary traffic peaks that exceed capacity. These only persist for mil- liseconds or a second or two, but they can be disruptive. Traffic will be delayed, creating latency. Some traffic may even be discarded because switches and routers have only
5 To g ive more flexibility a t the low end of s peeds, one can purchase fractiona l Tl and T3 lines that give a fraction of the s peed for a fraction of the cost. (The cost fraction is always bigger than the speed fraction., of cowsc.) Fractional offerings vary by carrier. For example, the lowest fractional TI line might be 128 kbps for one carrier, w hereas for another it might be 256 kbps. Some might not offer fractiona l Tl services at all because demand for services below 1.544 Mbps is small today.
88 Chapter 3 • Network Management
2 Random variations in traffic occasiona lly
produce momentary traffic peaks (fractions of a second or a bit longer). ~
Capacity
1 / On average. traffic is far below capacity.
Traff~
FIGURE 3-16 Momentary Tra ffic Peaks
3 Some messages will be
delayed and. if cache memory is exceeded, discarded.
a s mall amount of memory to s tore delayed messages. O nce this "cache me,nory" is exceeded, fra n,es or packets need to be dropped.
Adding M ore Ca pacity Figure 3-17 sho\\'S three techniques for addressing n1on1entary traffic pea ks. The first is to add more capacity. Ideally, one \Vould add enough n,ore capacity to eliminate n,omentary traffic peaks entirely. G iven the nature of randomness, ho,vever, ,nomentary traffi c peaks will s till occur, but they "'ill be rarer a nd far shorter in duration. Adding n,ore capacity is expensive in terms of transmission
Lack of Capacity Amelio ration Description Considerations
Momentary (milliseconds to a few seconds)
Add more capacity
Prioritize traffic
Momentary traffic peaks will become extremely rare and brief
Send higher-priority traffic through first.
Give QoS guarantees QoS guaranteed capacity for certain traffic
FIGURE 3-17 Addressing Momentary Traffic Peaks
Expensive in terms of transmission cost. But requires no ongoing management labor.
Delay-intolerant high-priority traf- fic such as voice gets through immediately.
Delay tolerant traffic such as e-mail will get lower priority, so if it is delayed briefly, harm is minimal.
Requires ongoing management labor.
Like reseived seating in a sports stadium.
Traffic w ith a QoS guarantee will abso- lutely get through, up to the amount of capacity reserved .
Other traffic only gets what is left over-even if the guaranteed traffic is not using its capacity.
Chapter 3 • Network Management 89
facilities, but it adds no ongoing n1anagen1ent labor. Given the cost of labor, this is often a good tradeoff.
Priority A second approach to dealing \,•ith mon1entary traffic peaks is to assign a priority level to frames or packets, based on their tolerance for latency and loss.
• VoIP is extremely latency intolerant. Any noticeable delay \,•ill compromise the user experience substantially. It should be given very high priority.
• On the other hand, e-mail can easily tolerate a delay of several seconds. Conse- quently, e-mail gets lo\,, priority because a delay of a fe\,v seconds is not a problem in e-ma il.
All con1mercial s\,•itches and routers in corporations con1e w ith the ability to use priority, so priority does not increase capital expense. Priority makes momentary traffic peaks tolerable to all types of uses, unless the peak is quite long. On the negative side, assigning priority to different applications and managing priority on switches and rout- ers requires considerable ongoing managen1ent labor, which is expensive.
Momentary traffic peaks can be addressed by assigning a priority level to frames or packets, based on their tolerance for latency and loss.
Quality-of-Service Guarantees An extren1e approach is to give QoS guaran- tees to certain traffic flows such as VoIP. Regardless of momentary traffic peaks, th is traffic \-Viii always get through. It is like having season ticket seats for a sports team. To provide QoS guarantees, the company must allocate reserved capacity on each s\,•itch, router, and transn1ission line. This is great for traffic flows with QoS guarantees. How- ever, it n1eans that all other traffic only gets what is left over, even if the reserved capac- ity is not being used.
QoS guarantees reserve capacity for certain traffic flows such as VoIP. Regardless of momentary traffic peaks, this traffic will always get through.
Traffic Shaping The three coping mechanisms in Figure 3-17 only dea l with ways to handle traffic after it has entered //,e network. A more fundamental way to deal \,vith congestion is to limit what traffic enters //,e network in //,e first place. As Figure 3-18 shows, this is ca lled traffic s h aping. Traffic enters the nel\-vork through an edge router, that is, a router at the edge of the nel\'\'ork. This edge router has an access control list (ACL) that specifies \'\'hat to do w ith different kinds of traffic. To in1plement this ACL, the edge router has the ability to recognize the types of applications that have generated the traffic.
Son1e applications are approved. These n1ight include e-mail, database, \,•eb bro\,•sing, and other norn1al business applications. Approved applications are pern1it- ted to enter the nel\'\'ork.
Other applications are forbidden by the access control list. These are sin1ply blocked fron1 entering the nel\'\'ork. Still other applications may have son1e utility. An example n1ight be YouTube. Ho\,•ever, they cannot be permitted to take up n1uch of the nel\'\'ork's
90 Chapter 3 • Networ k Management
1 Approved Application
(E-Mail, Database, etc.) PERMITTED
.i--2 ;o~~:~~1::::~--->- Apphcat10n
(YouTube, Bi!Torrent, etc.) BLOCKED or RATE LIMITED
FIGURE 3- 18 Traffic Shapi ng
4 With undesired traffic blocked or limtted , c orporate network has sufficient capacity for permitted traffic.
ACL
3 Edge Router
with Application Control List (ACL)
Non-Overloaded Corporate Network
capacity. These 1111/n-vored a p p lica tions are rate-limited, mearung that they are limited to a certain sn1all percentage of the neh,•ork's traffic.
Tes t Your Unders tanding
10. a) D istinguish beh-veen chronic lack of capacity a nd mon1e n tary traffic peaks. b) How long do n1omentary traffic peaks last? c) Wha t h'l'o p roblems do they create? d ) What three choices do you have for red ucing the in1pact o f delays on latency-intolleran t traffic? e) Wha t is the ad va ntage of each con1pa red to the others? f) Con1pared to e-m ail and VoIP, what priority would you give to neh'l'ork con trol messages sen t to S\'l'itches and rou ters? (The answer is not in the text.) Exp lain your reasoning. g) Is traffic shaping done before or after the traffic e n ters the neh-vork? h) What h'l'o ch oices does traffic shaping present for forbidden or undesirable traffic submi tted to the neh,•ork? i) If there is a ch ronic lack of capacity, \'l'hich of the m echanisms described in these sections can help? j) What n1ust be done if this is not possible or not sufficient?
CENTRALIZED NETWORK MANAGEMENT
Given the con1p lexity of neh'l'orks, ne h,•ork n1anagers use neh'l'ork management p ro- grams to reduce th eir \,•ork. These progran1s allo\v n1anagers working in centralized network operation centers (N OCs) to com prehend (and change) w ha t is going o n throughout their nehvorks. Figure 3-19 sho\'l'S the basic func tions o f an NOC.
N etw ork Vi sibility The n1ost im portant goa l of neh'l'ork n1anagen1ent is net- work visibility-the ability of the neh'l'ork manager to see what is going on thro ughout the neh'l'ork. This makes problem d iagnosis possible even when the neh'l'ork has thou- sands of d evices spread natio nally o r even world\,•ide. It also provides an understand ing of ne h,•ork traffic trends and errors needed for planrung. To achieve neh'l'ork visibility, every device n1ust frequently send information about its configuration, traffic d ata, and error d a ta.
Chapter 3 • Network Management 91
Network Operat,ons Center
Data: Configuration, Traffic, Errors
~ Change Command ~ ------~---- Remote ,U
Alarm Managed Devices
Goal: Manage the network from a single location: Obtain visibility over the entire network for diagnosis and planning .
Change the network's operation anywhere.
Reduce travel for diagnosis and change.
FIGURE 3-19 Cent ral ized Network Management at a Network Operatio ns Center (NOC)
Network visibility is the ability of the network manager to see what is going on through- out the network.
Network management tools are critica l in large and distributed networks. If a net- work administrator had to travel to each device and transmission line to collect operat- ing data for d iagnosis when problems occurred or because he or she \,•ished to optimize the network, the cost would be prohibitive.
Ne twork managemen t tools in general are cos tly to purchase and require considerable labor to operate, but they reduce labor expenses n1ore than they cost. Beyond that, these tools enable network adm inistrators to fix problen1s far n1ore rapidly and to quickly make net\,•ork changes that \'l'ou ld be prohibitively d ifficult othenvise.
Sending Commands Of equal in1portance, network n1anagement progran1s allow net\,•ork adn1inistrators to send comn1ands to individual devices to change the way they operate. For exan1ple, the network adn1inistrator can tell a device to test the operation of a specific port and report its results. The administra tor can a lso tell a device to turn off a port to change network traffic patterns or to shut do\,•n a malfunctioning port. This allows the network administrator to route traffic around congestion, to turn off expensive transmission lines when they are not needed, and to do many other things that affect overall network operation.
Alarms Ind ividual devices sometimes take the initiative in con1munication. If they detect something wrong or a t least suspicious, they can send messages called alarms to the network n1anagement software. Alarms get the net\,•ork managen1ent software's attention and provide as much informa tion on the situation as possible.
92 Chapter 3 • Networ k Management
4
Network Administrator
Ping 10.1.2.6 and reply.
... .... --------
1 Ping 10.1.2.3 and reply.
Round-Trip Latency: 37 ms.
2 Ping 10.1.2.4 and reply.
RT Latency: 849 m s.
RT Latency: 230 ms. .... 3 ',,
Ping 10.1.2 .5. '',,.,i.
IP Address: 10.1.2.6
FIGURE 3 -20 Ping
Test Your Understanding
No reply. ~
IP Address: 10.1.2.5 Crashed
Not in operation.
IP Address: 10.1.2.3
IP Add ress: 10.1.2.4
11. a) What do ne twork visibility tools allow a n1anager to d o? b) Do they cost n1ore m oney than they save? Exp lain .
Ping The o ldest network vis ibility tool is the Ping conunand available in all operating sys- ten1s. If a network is having problems, a network administrator can sin1ply Ping a wide range of IP addresses in the company. When a host receives a Ping, it should send back a rep ly. If it replies, it is reachable. If it d oes not, there is a problen1. In F igure 3-20, host 10.1.2.5 does not respond to th e Ping, signa ling that it is either d o\,'11 or unreachable due to a nother p roblen1 in the nel\vork.
Reachability By analyzing ½•hich hosts and routers respo nd or do not respo nd, then drawing the unreach able d evices on a m ap, the administrator is likely to be able to see a pattern tha t indica tes the root cause of the problem . O f course, n1anually Pinging a wide range of IP addresses could take a prohibitive an1o unt o f time. Fortuna tely, there are n1any programs that Ping a range of IP addresses and portray the results.
Latency Problem s Even if a host respo nds, there n1ay still be a problem . Ping also reports the round-trip latency between the transmissio n o f the Ping and the recep- tion of the response. If the round-trip la tency is su bstantial, there n1ay be commuruca- tion problen1s th a t need to be solved. This appears to be the case w ith Host 10.1.2 .4, which has a two-\,•ay latency of 849 ms.
Round-trip latency is the time between sen ding a m essage an d getting a response.
Chapter 3 • Network Management 93
Traceroute
A related neh,•ork vis ibility tool, Traceroute, gives you more granularity by reporting the round-trip la tency for each hop beh,•een routers along the route. This can help you determine w here a latency problem lies. Figure 3-21 shows how.
The first column shows the sequen ce nun1ber of each router a long the rou te. Th ere are 17 rou ters along th e way, follo\,ved by the destination host. (Tracerou te will actually sho\,• you the names of th e routers and the host instead of just a nun1- ber.) This w ill often help you identify who owns a particular rou ter tha t seen1s to be causing problems.
The second colunm gives the round-trip la tency to each particular device. For example, 18 has the value 670. This n1eans tha t the round-trip latency to the d estina tion host is 670 n1s. This latency is about h'l'o-thirds of a second.
The third colunm sho\VS ho\,• much latency each data link adds to the transmis- sion time. In this figure, the jump to Router 12 adds the most to latency. The la tency to Router 11 is 38 n1s. The latency to Router 12 is 560 ms. Therefore, the d a ta link beh'l'een
Round-Trip Latency Router (ms) Difference
1 1 N.A .
2 7 6
3 7 0 4 7 0
5 8 1
6 10 2
7 12 2
8 13 1
9 29 16
10 34 5
11 38 4
12 560 522 13 563 3 14 567 4 15 590 23
16 603 13 17 620 17
18 670 so Total 670 N.A.
FIGURE 3 -2 1 Traceroute
94 Chapter 3 • Network Management
Router 11 and Router 12 adds 522 seconds of round-trip latency-far more than any other jump between routers. This n1ay indicate a problen1.
Test Your Understanding
12. a) If you Ping a host and it does not respond, what can you conclude? b) What two things does Ping tell you about a host that rep lies? c) What types o f la tency do Ping and Traceroute give you? d) If a router causes problems, how can you diagnose this w ith Ping? e) D istinguish between Ping and Tracerou te. f) In Figure 3-21, \,•hat jump causes the second n1ost la tency?
The Simple Network Management Protocol (SNMP)
P ing and Tracerou te can tell you if a host is reachable and, if so, the latency in reach- ing th a t host. This is useful informa tion, but it is extren1ely limited . For examp le, they do not let you query Router 12 in F ig u re 3-21 to look for indications of a problen1. Fu ll neh,•ork n1anagement progran1s do.
Network management progran1s are b uilt by many different vendors. So are rout- ers, S\vitches, access points, firewalls, and other network d evices. A standard to govern their comn1unica tion and what data they collect is necessary. This s tandard exists. It is the Simple Network Management Protocol (SNMP), which Figure 3-22 illustra tes. In the network operations center, a con1puter runs a progran1 called the SNMP man- ager. The n1anager communicates w ith a large nun1ber of managed devices, such as s\,•itches, routers, access points, firewalls, servers, and PCs.
Network Administrator
Network Visualization
Program
Command (Get, Set, etc.)
Response
Trap
~ t SNMP NetwOfk Management Agent (Agent)
0 ~ Management Protocol (SNMP)
_.. - Message Exchanges
SNMP Management Information Base (Ml B)
FIGURE 3 ·22 Simple Network Management Protocol (SNMP)
Chapter 3 • Network Management 95
SNMP Agents The manager do~,s not talk din.'<=tly with the managed devices. Rather, each managed device has an SNMP agent, which is hardware, software, or both. The manager talks only to the agent. To give an analogy, recording stars have agents who negotiate contracts w ith studios and performance events.
SNMP Get Commands The network operations center constantly collects data from the managed devices using SNMP Get commands. The Get command specifies what data is to be provided. A response message delivers the data.
SNMP Management Information Base (MIB) When the data from a device arrives, the manager stores it in its SNMP management information base (MIB). Data in the MID allo\vS network administrators to understand the traffic flowing through the network. It is the basis for network visibility.
Databases have schema, which specify the particular types of data they can store. There are different SNMP schemas for different types of devices, such as Eth- ernet switches and routers. The MIB stores them separately but can integrate some of their information. The schemas for each type of device are extremely rich and specific. For example, if a router is failing and then rebooting frequently, this can make it difficult to diagnose. Ping commands, for instance, may not indicate a prob- lem if they arrive \vhen it is up. Ho\vever, one element of a router's SNMP schema is the time since last reboot. A short time since last reboot will indicate an in termit tent failure. The MIB also can contain data for various types of errors to help pinpoint a problem.
SNMP Set Commands and Security In addition, the manager can send SNMP Set commands to managed devices. The agents of these devices send response mes- sages to confirm that they have made the changes.
Many companies do not use Set because an attacker can do infinite mayhem w ithin the network unless Set messages are highly secured. Forgoing Set is safe, but it is extremely costly because it requires a great deal of more costly nehvork management labor. Companies that have good security, however, can use Set safely. This is an example of how good security can be a money-saving enabler, not simply a cost.
SNMP Trap Earlier, \Ve Sa\v that managed devices can send alarms if they detect an issue. SNMP calls these alarms SNMP traps.
Network Visualization Program There is one more program in the figure- the network visualization program. This program takes n.>Sults from the MIB and inter- prets the data to display results in maps, find root causes for problems, and do other tasks. Note that this functionality is not included in the Simple Nehvork Management Protocol. SNMP simply collects the data in a \Vay that network visualization programs can use. This lack of specification allows nehvork visualization program vendors to innovate without being constrained by standards. The network visualization program also can issue commands to the SNMP manager to query a managed device for data or to change the \Vay a device operates.
96 Chapter 3 • Network Management
Test Your Understanding 13 . a) List the main elements in SNMP. b) Do~,s the SNMP manager communicate
d irectly with the managed device? Explain. c) Distinguish between SNMP Get and SNMP Set commands. d) Where do~,;; the SNMP manager store the infor- mation it receives from Get commands? e) Why can good security save money in net\vork management? f) What kind of message can agents initiate? g) What is the relationship between the network visualization program and the SNMP manager?
Automation Many other network management chOK-'S can be automated to reduce the amount of work that network administrators need to spend on minutia. For example, many routers are given a standard oorporate configuration \vhen they are installed. This greatly reduces the time na-'ded to configure each router and reduces configuration errors. However, it is possible to create a standard oonfiguration, store it, and simply download it onto new routers. These router configurations must then be adjusted for their devices' particular roles in the net\vork.
Test Your Understanding
1 4. a) Why is the automation of network management tasks important? b) Why are standard configurations d~,sirable?
SOFTWARE-DEFINED NETWORKING (SON)
We close with a ne\v trend that may redefine net\vork management. Software-Defined Networking (SDN) is a radically ne\v \Vay to oonfigure 1>,vitches, routers, access points, and other devices. Even a medium-s~-'d bank has hundreds of S\Vitch~,s and hundK'<iS of rout- ers. As just noted, many companies have "standard configurations" that are downloaded to new S\vitch~,s and routers. Aftenvard, however, net\vork engineers may have to modify this configuration \Vhen conditions change, and these changes have become increasingly fK~ quent, making the traditional way we have configuK'<i d evices a limiting factor in control agility- the ability to rapidly change how the net\vork operates when oonditions change.
Control agility is the ability to rapidly change how the network operates when condi- tions change.
Traditional Configuration and Its Discontents Figure 3-23 shO\VS that network administrators have traditionally modified each device's configuration file individually and manually. Often, the administrator must travel to the switch or router and work with it physically. Sometimes, it can be reached from the net\vork operations center via the network, but even this only saves some of the K,quired time to K'C'Onfigure individual routers, S\vitch~,s, access points, fire\valls, and other network devices.
Manual I Configuration 'f
Control Function
Forwarding Function
Traditional Switch
Chapter 3 • Network Management 97
Traditionally, each device had to be configured individually and manually.
Configuration is done on the control function, which is t he policy-based rule set that determines how forwarding should be done.
The forwarding function executes forwarding decisions for individual frames and packets. It forwards based on the control function's rule set.
Traditionally, the rule set rarely changed, so changing devices manually was inconvenient but unfrequent.
Today, control function rule set changes are frequent. A new way to configure many devices is needed.
FIGURE 3-23 Tradit ional Individual Manual Device Configuration and Reconfiguration
The Forwarding Function Figure 3-23 shows that the managed device nor- mally has hvo functions. The obvious one is the forwarding function, \vhich consists of switching arriving frames back out or routing arriving packets back out. This forward- ing function consumes nearly all of a switch's or router's resources.
The forwarding function consists of switching arriving frames back out or routing arriv- ing packets back out.
The Control Function There is also the control function, which is not as obvi- ous. The control function is the policy-based reconfiguring of network devices. For example, S\vitches forward frames based on information in a switching table, which tells the S\vitch which port to use to send the arriving frame back out. Part of the con- trol function on a switch is creating these S\vitching tables. More broadly, the control function embraces configuration in general. One element in a router's configuration is whether the routing parameter is set to on or off. If it is off, the router will not route packets. One of the first steps in diagnosing a problem is determining whether the router is routing. In general, the configuration of switches, routers, access points, fire- walls, and other devices is a complex process. Fonvarding consumes most of a device's time, but control consumes most of the administrator's time in dealing with the devices.
The control function is the policy-based reconfiguring of networ k devices.
Forwarding consumes most of a device's time, but control consumes most of the admin- istrator's time in dealing with the devices.
Policy-Based Configuration Note that the control function uses policy-based configuration. Policies are broad mandates for network management.
98 Chapter 3 • Net work Management
• For a com pa ny tha t manages servers for severa l different cus to n1ers, a policy migh t be that the servers of o ne customer n, ust never be able to communica te wi th the servers of o the r cus tomers.
• Another n, ight be that expensive transmission links be t\veen the cOJnpany's s ites sho uld be shut do,vn at night so tha t less expensive transm ission li nks a re used to handle the lower traffic at nigh t.
Policies typ ica lly mus t be a pplied to multi ple d evices a nd the ma nage,n e nt o f n1ultiple transmission links. Th is means that multiple devices ,nust be configu red w hen po licies change.
In itially, it made sense to do configu ration o n ind ivid ua l s\\•i tches and routers. This wa y, a fi rm ,vith only one or two s,vitches or routers did not have to use a sophis- ticated set of tools to ,nanage the ro uters. As the n tnn ber of network d evices gre" ', how- ever, the cost of ma king control function changes gre, v proportionally. So d id the cost of d evices, " 'hich depend considerably on con trol system require ments. Fig u re 3 -24 emphas izes the b u rdenson,e natu re of doing configu ra tion on each d evice.
Control Agil ity Tradi tionally, the control function d id not change much or freq ue n tly. H a ving to c hange it manua lly a nd perhaps loca lly w as no t too much of a burden . That is no longer the case. For exa mple, conside r , vha t happens in a cloud co1nputer server fa rn1 "'i th tho usands of servers managed by a cloud service provide r s uch as An1azon .con1. Every tin,e a new server is added, the cloud service provider's configu ration po licy may mand a te changes so that other corp ora te users o f the server fa rm ca nnot get access to the new customer server. This ",j [I require reconfigu ring each router's Access Control Lis t i,nmediately to s pecify m anges in w hich servers w hich cus tomers ca n reach fro m their servers. Fig11 ring o ut ho, v to change the ACLs of hun- d reds or tho usands of routers is time consu,ning. Ac tually making the cllanges adds to the required time. As noted ea rlier, co,npanies today need control agili ty-the ability to ta ke po licy-based con trol ac tio ns rapidly " ' he n cond itions require change.
Policy
4
r ~- r
~
t Manual t
Configuration Manual t
Configuration Manual t
Configuration
Control Function Control Function Control Function
Traditional ,,, Traditional , .. Traditional • Sw itch "' Router
4" ... Access Point
Control is the p olicy-based configuration of devices. Policies often must be applied to multiple devices.
Control Agility: Ability to make rapid p olicy-based control actions when conditions require it.
FIGURE 3-24 Traditional Configurati on fo r M u lt iple Devices
Chapter 3 • Network Management 99
How often d oes reconfigu ra tion happen today? To give an examp le, the cus- ton,ers of Amazon VVeb Services frequently add servers as thei r needs increase and release servers "'hen their needs decrease. For exan,ple, Netflix uses Amazon Web Services fo r its recommendation software to s uggest television shows and movies to individuals based on wha t other users \Vith similar viewing p ro fi les have "'atched. The CPU cycles and storage needed by the soft\vare s pike d u ring p r ime time view- ing hours in the evening and plunge at night. Netfl ix changes the number of servers it uses fo r this fun ction severa l tin,es a day. Ea ch change req u ires reconfigu ration. If Netflix adds 300 servers that were used b y other custome rs n,inutes or hou rs earlier, many swi tches and ro uters need to be reconfigu red to c hange ,vhich serve rs each cus ton,er can reach.
Software-Defined Networking Operation
Figure 3-25 shows ho"' Soft\vare-Oefined Networking changes the picture. Most obvi- o usly, each device is stripped of its control function. This considerably reduces the cost of a switch, router, or other device. The fi gure shows that the control function is instead centralized in an SON controller. When changes are made on the controller, ne"' for- "'arding ru le sets are sent to the affected devices.
Wi th centra liza tion, the ad,ninistra tor si mply gives a high-level command. This might be to add a new c ustomer's server. Th is b road cmnmand is converte d into ACL rules appropriate for ind ividual devices, and these control ntles are sent to the affected devices.
Figure 3-26 illustrates that this requ ires SON application programs that run on the SON controller. These applications allow the administrator to d o complex tasks "'ith SON d oing remarkably little work compared to manual configuration. For exan,- ple, o ne of the applications in the figure is a traffic segmentation program that manages changes in access "'hen ne"' servers are added or re leased by a c uston,er.
Figu re 3-26 s hows APls, which a re application progran, interfaces. APis are s tan- dardized interfaces bet\veen programs. For exan,p le, the SON controller has a set of APis that a pplication p rograms use to talk to it in a standardized way. This n,eans that
SON moves the control function to an SON server. This reduces the hardware cost of each router. tt permits almost instant reconfiguration. even if a change affects multiple devices. r
Detailed forwarding rule sets for a control change
Forwarding Function
Traditional Switch
Forwarding Function
Tradrtional Router
.... , ...
Control Function Centralized
SON Server
Forwarding Function
Trad itional Access Point
FIGURE 3-25 Configuration t hroug h Software-Defined Networki ng (SDN)
100 Chapter 3 • Network Management
Traffic Segregation
Northbound APls
Southbound APls
Load Balancing
l
SON Applications
SNMP
SON Controller
Switches, Routers,
etc.
l
Troub leshooting
l
FIGURE 3·26 SON Appl icatio ns and Application Program Interfaces (APls)
a ny sofhvare con1pany can write application programs to work ,vith the SON control- ler. It also means that these applications can ru n on SON controllers from other vendors if these vendors follo\v the san1e APis. This is a classic example of ho\v s tanda rds enable teclmology competition.
Figure 3-26 shows that SON controllers have two sets of APls. Northbound APls govern con1munication behveen application progra,ns and the controller. Southbound APl s are d ifferent. They standardize comn1unication beh,veen the SON controller and the individ ual switches, routers, a nd other devices they configure.
Unfo rtuna te ly, today there a re severa l SON API fam ilies. Com plica ting m at- te rs greatly, Cisco Systems, which d on1i nates sales in rou ters and n1a n y s\vitch categories, has its own app roach that is designed to keep its ro uters and swi tc hes expens ive by not strippi ng the con trol function out of them but o ffering m any of the benefits o f SON.
Although this unsettled ,narket e nvironment is ,naking n1ost firms "'ary o f SON, some finns have hnpleme nted it on a large scale a nd have reaped extensive benefits. One is Ainazon Web Services, ,vhich hosts servers for other companies. AWS has even created a nd used its o"'n SON routers, ,,vhicl1 are far cheaper than cmnmercial routers because their control functions have been removed. Soft:i,vare-Defined Net:i,vorking has done more than reduce costs, ho"•ever. It has brought extreme control agility to Amazon's vast ne t- work of hosted servers. This agility has allo"'ed AWS to implement net:i,vork changes that could no t have been imagined before Sofh,•are-Defined Nehvorking.
Test Your Understanding
15. a) What are the benefits of Software-Defi ned Neh,•orking? b) Dis tingu is h bet:i,veen the control func tion and the forward ing function. c) Where ,,vas the con trol fu nction placed tradi tionally? d ) Where is it placed in SON? e) What do northbound APis connect? f) What d o southbound APls connect? g) Which type of API must router and swi tcl1 designers support? h) W hy are applications necessa ry for SON to be successful? (The answer is not m the text.)
END-OF-CHAPTER QUESTIONS
Thought Questions
3-1. Your home is connected to the lntemet. You get to create SLAs that the ISP must follow. Being reasonable, write SLAs you would like to have for the following things: a) Write an SLA for speed. b) Write an SLA for availability. c) Write an SLA for latency. Do not just say what each SLA should include. Actually write the SLAs as the ISP would write them in the form of specific guarantees. Failure to do this will result in a s u bstantial grading penalty.
3-2. Redo the analysis in Figure 3-12. Remove the link between Ogden and Seattle but add a link between Seattle and Dublin. On each link, what traffic capacity will be needed, and what leased line would you select for it? Use a traffic table to do the analysis.
3-3. Figure 3-27 shows four sites communicating. Each site needs to communicate with each other site at 2 Mbps, except for Paris. Paris needs to communicate with each other site at 5 Gbps. Create a traffic table and solve it. (Partial Answer: For London- Munich, the total traffic is 5.004 Gbps.)
FIGURE 3 -27 Layout for Thought Question 3-3
3-4. Figure 3-28 has data from a Traceroute analy- sis. a) Add a third column showing the change in latency between the router in that row and the router in the preceding row. (Check figure: The change for Router 2 from Router 3 is zero.) Shade the row for any large latency problem
Perspective Quest ions
3-6. What was the most surprising thing you teamed in this chapter?
Chapter 3 • Network Management 101
Router Latency (ms)
1 1
2 7
3 7 4 7
5 8
6 10
7 12
8 13
9 29 10 34
11 38 12 52 13 75 14 567 15 590
16 603 17 1002
18 1017
FIGURE 3-28 Data for Thought Question 3-4
or problems you find. b) For the first problem you find, state whether the problem might be in the router in the row, in the previous router, or something else.
3-5. a) Why must the forwarding function remain on the network device? (The answer is not in the text.) b) What might be holding back SON in many firms?
3-7. What was the most difficult part of this chapter for you?
Chapter 3a
Hands-On: Microsoft Office Visio
LEARNING OBJECTIVE
By the end of this chapter, you should be able to:
• Create a simple Visio diagram.
WHAT IS VISIO?
Microsoft Office Visio is a dra\ving progran1. The professional version has special sym- bols for dra\,•ing network d iagran1s. Vis io is w idely used by network professionals to visualize networks they are d esigning.
USING VISIO
Visio is part of th e Microsoft Office fa mily. Installing Visio is like installing any o ther Office prod uct.
Figure 3a-1 shows how to s tart a Visio dra\,•ing. Of course, this begins by selecting File and then Ne½'. In the fi gure, Neh,•ork has been selected for the type of drawing. Deta iled Network Diagram has been selected.
As Figure 3a-2 shows, this brings up a w indow \'l'ith a canvas o n \,•hich you can d rag shapes. In the figure, the sha pe of a generic server has been dragged o nto the screen. As you can see, m any o ther network diagramming shapes can be dragged onto the screen.
After you have added the devices you need, it is tin1e to begin showing how they are connected. As Figure 3a-3 sho\,•s, there is a connector icon at the top of the screen.
102
Chapter 3a • Hands-On: M icrosoft O ffice Visio 103
i file i fd1t ~teW Jnsert j J liew
f grmat 1006 .Qata ~ ape JOr'.indow t;lelp Adol2e POF
f J Qpen ... Ctrl·O ~
Sa A>-
"' .a~ WebP1,. For X
f f rm.at
S.~To
"' -• Gening Started.- .. A .. r;, I---"----'--.... J
J
~ ...J
...J
...J
...J
• ...J ...J
...J
...J
Htw Orawino {VS units) Ctt1•N
Ntw Or awing (Mettic)
New Drawing from Iemplate_
Business
Eng. neering
Flowchan
General
Maps ~ fl.oor Pl1ns
r-.~twork
Schtcfule
• • • • •
Office Visio
> ~ Active Directory (Metnc) > © Active Directory (US oorts)
Software and Database > ~
· ,~ o ·~ ~ 0 ·1'~ EJ,t '() ~ ~ < ~
-u- ~~~-.,-.----~-ra-b-.-~-----' I~
Bask Networli: Diagram (Metric)
Basic Netwonc Diagram (US l.l"lits)
Conceptual Web Site {Mettic)
Conceptual Web Site {VS uni ts)
De1a 1eo Network D'agram (Mettle)
Oeta 11eo NetwOf'k C><ag, am (VS unitS) 83,s.ic Networ1e 0,19ram SM,< Netwofl< o,a{ ~
FIGURE 3a-1 Starting a Visio Drawing
.J • J .. ,.J ~ .l .,, '1 ... , • 12pc. ,, ~ • ,._ • ~erdl fOf Shlptt;
Typt)'Olll'tt.Wtllh- r:- Ill 1l
<)Modffll ., Ttltp~• ia
&Jc,,om,r,e tJ =
• -..I 11 )< • r
" m
'f Vh, .. r.,., - 0 .cm ... 'l{I) ~ ... 1• • • HLh9~1
J ., . • -I g • • • ·- ., ,,
.. ' ., . .,.,.-... _,._ .. ~s,,..~ --'
~ • i., • A • CJ .. .. .A . -', • lw I
FIGURE 3a-2 Drawing Canvas wit h Icon Being Dragged
<> " "
0
104 Chapter 3a • Hands-On: Microsoft Office Visio
fil ble fdtt ~ )nSM FQrmal !OOIS c.au Sha~ Window l:t~I> Ad()Qt PDF U • .J M ...J ;) ~ ~ f,i i. -.J ~ X / -, • • ~ ,c .,. "I .. · IA • (j ~ 42% ..,,., • 12pt. • 8 I g • • • ~: Of i •,. ConM<10tTOOI 113 'l<I' ; X Conn&tJon Po<nt Tool -· • " " 1 ! ., s.e,,dl fo, Sh~t$; i T)"Pt )'OIJr St~ 11,e:rt ~ ~
El ~tOl.llldS (Mt1JW;~ fd ªfl 01'4 TdK (MfO'IC)
8 9 CompU:er, ...S Montots (MMe:) g [I littwcrt Ind ~Is (li&lb1c)
e~~a~., § ~ Pm:tr ~-- ~ ~""'"' !!I}-. f/Jhx ©-- f ' -· § ~ =.«or l;;J krttft ~ ..... (;;) ..... 2 ~Hub ~ 9,trtdl a
s
0
' Pag~ l/1
FIGURE 3a-3 Adding Connections
Select the connector tool. Then drag beh,•een the hvo icons to connect them. After you have connected them, try dragging one of the connected devices. You w ill see that the connectors move \,•i th them.
Not sho\,•n in the figure, you can double-click on an icon. This adds text below the icon. Visio is not fussy about preventing lines fron1 overlapping text. Overall, Visio cliagran1s are easy to create bu t not extremely pretty.
Chapter 3a • Hands-On: M icrosoft O ffice Visio 105
HANDS-ON EXERCISES
In Microsoft O ffice Visio, create something like the drawing in Figure 3a-4.
Internet Service Provider
DSL Modem
Access Router with Built-In
Firewall
0 -.... ..,.p,;./.·n,....t Laser Printer
Server
FIGURE 3 a-4 Sam ple Drawing
Ethernet Swttch
This page intentionally left blank
Chapter 4
Network Security
LEARNING OBJECTIVES
By the end of this chapter, you should be able to: • Describe the threat environment, including types of attacks and types of attackers.
• Explain how to protect dialogues by cryptography, including encryption for confidentiality, electronic signatures, and host-to-host virtual private nehvorks (VPNs).
• Evaluate alternative authentication mechanisms, including passwords, smart cards, biometrics, digital certificate authentication, and two-factor authentication.
• Describe firewall protection, including stateful packet inspection, next-generation firewalls, and related intrusion prevention systems.
• Describe the role of antivirus protection.
THE TARGET BREACH
Near the end of the 2013 holiday season, Target announced that thieves had stolen data from 40 million credit cards scanned at Target stores in preceding weeks.'1 The attack- ers had done this by downloading malware to nearly all point-of-sale (POS) systems in American Target stores. It capt ured magnetic strip e information and sent it to data thieves.2 Target initially did not reveal the fact that thieves \Vere already committing fraud \vith the stolen card data. A month later, Target announced that a separate but
1 Alastair Jamieson and Erin McClam, "Millions of Target Customers' Credit, Debit Card Accounts May Be Hit by Data Breach," NBC News, December 19, 2013. http:/ / www.nbcnews.com/busincss/ consumer/ millions-targct-customcrs-crcdit-debit-card-accounts-may-bc-hit-f2Dll775203. 2 Jaikumar Vijayan, "Secu rity Firm IDs Malware Used in Ta,gct Attack," Compu terworld.com. http:/ /www .computerworld.com/ s/ article/9245491 /Security ..firmJDs_malware_used_in_ Target_attack.
107
108 Chapter 4 • Network Security
related theft had occurred d u ring roughly the same period. Attackers had stolen per- sonal info rmation o n roughly 70 million Target customers.3 Consumers were shocked and worried by these thefts. Many canceled their charge cards and demanded new cards from their banks. Within \veeks, a barrage of lawsuits began.
The POS Attack Target released lit tle information about either compromise, but analysts gradually constructed a likely picture of how the credit card number theft had occurred. Ne\vS reports naturally focused o n the POS systems, but th e th eft involved a complex ser ies of steps inside an d outside Target. Figure 4-1 shows the most important of these steps.
The theft did not begin with a din.>ct attack on Target. Rather, it began \vith an attack on Fazio Mechanical Services, which p rovided services to Target in th e mid- Atlantic region.4 Fazio had credentials on a vendor server that handled electronic bill- ing and other matters. The attackers probably sent an employee a spear phishing e-m ail that tricked the employee into loading malware on to his or her machine. The malware captured the Fazio credentials on the vendor server and sent it back to the attackers. The attackers then used th~,se credentials to get access to the vendor server. From this initial foothold, they \Vere able to move more d eeply into the Target network.
No\v insid e the Target nehvork, thieves installed POS m alware, which they had purchased from an online crimeware shop, to a mahvare d ownload server within
Crimeware Shop
Attackers SeNlces
FIGURE 4-1 The Target Breach
Extrusion Serve,-
Target Network
t carol
Counterleitert
Mules l,l,6
l-rarget, "Target Provides Update on Data Breach and Financial Performance," January 10,2014. http:// pressroom .target.com/ncws/target-provides-update-on.-data-breach-and-financial-performance. 4 Fazio Mechanical Services, "Statement on Target Data Breach," accessed Ap ril 26, 2014. http:/ /faziome- chanical.com/Target-Breach-Statement.pdf; Brian Krebs, "Target Hackers Broke in Via HVAC Company,'' KrebsOnSecu rity.com, February 5, 2014. http :/ / krebsonsecurity.com/ 2014/02/target -hackers-broke-in- via-hvac-company.
Chapter 4 • Network Security 109
Target. There is susp icion th at the thieves actually too k over Target's internal server that d ownloaded updates to the POS systems.5 In any case, the malware was do\vn- loaded to a fe\v POS systems initially and then to nearly all Target POS systems in the United States.6
The malware w as a variant of the BlackPOS malware that had been in existence for almost a year.7 It was readily available at online crime\vare shops for about $2,000.8
The attackers probably modified the software to attack Target's specific POS terminals.9
They probably also modified it so that existing antivirus programs \VOuld not detect it.10 It is co mmon for hackers to m aintain small server farms to test malware against popular antivirus products.
The mahvare collected magnetic stripe data fro m every card swiped at the termi- nal. This occurred before the information was encryp ted and sent over the Target net- w ork. Most sources called the malware a RAM scraper, indicating that it sen t everything in the POS terminal's memory to the attackers.11 Actually, it was more selective, stealing only data on the magnetic stripes of swiped cards.12 This included the primary account number, the expiration date, the name of th e card O\vner, and optional information. Stolen data did IWt include the card security code, \Vhich is a 3-digit or 4-digit number printed on a credit card. Companies ask you for this number when you cannot present yo ur card physically. For credit cards, there was sufficient information on the magnetic stripe to create counterfeit credit cards. Fo r debit cards, the theft included encryp ted personal identification numbers (PINs), but there is no indication that these PINs were decoded.13
Data collected at the POS termin al went, as usual, to legit imate Target servers. H owever, the malw ar e also sent th e d ata to a co mpromised h olding server w here th e d ata from all of the POS terminals \Vas stored temporar ily.14 For d ata extru- sio n, the attackers compromised another ser ver that would d eliver the data to the
5 Brian Krebs, "These Guys Battled BlackPOS a t a Retailer," KrebsonSecurity.com, February 14, 2014. http:// krebsonsecurity.com/2014/02/ these-guys-battled-b lackpos-at-a-retailer / . 6Krebs, "Target Hackers Broke in Via HVAC Company." 7 Vijayan, "Security Firm IDs Malware Used in Target Attack." 8 1bid .
9 1bid .
!Olbid.
11 Target, "Target Provides Update on Data Breach a nd Fin ancial Performance," January 10, 2014. http:// pressroom.target.com/news/target-provides-updatc-on-data-brcach-and-financial-performance . 12 Krebs, "These G uys Battled BlackPOS a t a Re ta iler." 13 Adam Greenberg, "Hackers Seek to Decrypt PIN Codes Likely Stolen in Target Breach," SC Magazine, January 8, 2014. h ttp:/ /www.scmagazine.com/hackers-seek-to-decrypt-pin -codes-likely-stolen-in-target- breach/ article/328529 /.
H Keith Jarvis and Jason Milletary, '1nside a Targeted Point-of-Sale Data Breach," Dell SecureWorks, Jan uary 24, 2014. http:/ /krebsonsecurity.com/wp-content/uploads/2014/01/lnside-a-Targeted-Point-of-Sale-Data- Brcach.pdf.
110 Chapter 4 • Network Security
attackers outside the Target n et work.15 This extrusion server p ulled batches of car d data sets from the holding server and transmitted them to landing ser vers in Russia, Brazil, Miam i, an d o th er locations .16 The th ieves cou ld not conceal the Internet pro- tocol (IP) addresses of the landing servers, so they p robably m oved the data q u ickly to other servers.
No\v th e attackers monetized their st olen d ata . Th ey w h olesaled batch es of data to on!ine card shops that then sold the data to counter feiters. These card shop s held stripe informa tion in a searchable d atabase. This allo\ved counterfeiters to p ur- chase card stripe in fo rmation select ively. For exam ple, thieves know that using a credit card in a city that is no t the owner 's m ay result in a credit freeze. Conse- q uently, card sh ops allo\ved custom ers to search by zip code. Counterfeiters also refined their p urchases in other ways, based on such factors as \Vheth er the card had a high debt lim it. Based on the characteristics of each card, counter feiters paid fro m $20 to mo re than $100 p er card . The first custo mers received a m oney-back guar an- tee that 100% of th e card data \vas useable.17 Over tim e, the g uaranteed percentage fell, and pr ices declin ed.
The counterfeiters used the card d ata to create fake credit cards that looked legitimate do\vn to the graphics used by individ ual ban ks. They then copied d ata from a single legitimate card onto the mag netic stripe of each co unterfeit card . This allowed them to purch ase high-end m erchandise and then sell the m erchandise to trad itional fences. However, the coun terfeiters d id n ot make the p urchases them- selves. Instead, they hired a small corps of "mules" to make the act ual p urchases or take cash out of ATMs.
One thing is missing from the figure. The attacks needed to transmit control messages frequently into the Target network in order to compro m ise servers and take actions to direct actions on these servers d u ring the attack. All of these m essages had to go through Target's firewal ls. Sh o\ving this information in Figure 4-1 \VOuld create an unintelligib le spiderweb of arrows. However, it \Vas critical for the attackers to maintain a hole in the victim's fi rewalls d uring the entire attack process.
Test Your Understanding
1. a) How did the attackers gain access to Target's network? b) List the internal Target servers the attackers compromised. c) How did the attackers exfiltrate the card data? d) List the criminal groups, besides the main attackers, w ho were involved in the overall process. e) What benefit did the attackers seek to obtain from their actions? f) Critique (p ositively o r negatively) th e fact that Target knew that fraud was already occurring with the stolen card d ata but did not reveal this w hen it announced the breach .
15 Ibid. 16 Brian Krebs, "Non-US Cards Used at Target Fetch Premium," KrebsonSecurity.com, December 13, 2014. http:/ /krebsonsecurity.com/2013/12/non-us-cards-used-at-target-fetch-premium /. 17 Brian Krebs, "Cards Stolen in Target Breach Flood Underground Markets/' KrebsonSecurity.com, December 20, 2014. http:/ /krebsonsecurity.com/ 20 13/ 12/cards-stolen-in-target -breach-Oood-u nder- ground-markets/. ·
Chapter 4 • Network Security 111
Damages It may take years to fully understand the damage from the Target breach. However, it is easy to identify victims. One was Target itself. In the period from the breach revelation to February 2014, Target sales fell 5.3% from the previous year, and profits fell 46%.18
This profit decline was roughly $500 million. In addition, Target has probably paid out several hundred million dollars due to lawsuits brought by commercial and govern- ment or?anizations. The company's chief technical officer resigned fairly soon after the breach,1 and the company's CEO resigned in May 2014.20
Consumers are protected against fraudulent credit card purchases- but only if they notify their credit card company quickly of fraudulent charges on their bills. Credit card companies will drop these transactions from bills. Ho\vever, this process is time-consuming and frustrating. It sometimes even involves disagreements about whether charges are truly fraudulent. There is even more time lost if the consumer can- cels the credit card and gets a ne\V card to get peace of mind. Finally, the prospects of credit card fraud and identity fraud created psychological costs for many cardholders.
Surprisingly, banks and credit card processors usually do not lose money in the case of reported fraudulent purchases. Just as the customer does not pay them, banks and credit card processors do not pay the retail stores in which the fraudulent pur- chases were made. Beyond this, financial services companies face substantial costs in the replacement of compromised cards. However, they are likely to recover these costs successfully in la\vsuits.
Fraud hits retailers the hardest. They rarely recover merchandise purchased fraudulently. Ho\vever, there is one thing that physical retailers can do to reduce these losses. Counterfeiters normally only create a single card master from \Vhich all counterfeit cards in a batch are made. All counterfeit cards in the batch have the same printed name, credit card number, expiration date, and other informat ion . The magnetic stripe data, ho\vever, \Viii be specific to a single compromised credit card. This is \vhy store clerks look at the last four digits of the card number on the physi- cal credit card. If this is different from information on the magnetic stripe, the card is fraudulent.
Test Your Understanding
2. a) How \Vas Target damaged by the breach? b) Were banks and credit card bureaus damaged by the breach? c) How were consumers damaged by the breach? d) Ho\v were retailers damaged by the breach? e) What can retailers do to defend themselves against counterfeit credit cards? f) What individual victim or group of individual victims suffer<.>d the most harm?
18 "Target Profits Plunge 46% after Holiday Security Breach," BBC.com, February 26, 2014. http:/ /www.bbc .com/news/ business-26358556. 19 Anne O'Innocenzio, ''Ta,get's Chief Information Officer Resigns," Associated Press, March 5, 2014. http:/ / www.nytimes.com/2014/03/ 06/business/targets-chiel·information-offic=resigns.html?_r=O.
2.0 Clare O'Connor, "Target C EO Gregg Steinhafel Resigns in Data Breach Fallout," Forbes, May 5, 2014. http://www.forbes.com/ sites/ clareoconnor / 2014/05 /05 / target-ceo-gregg-steinhafel-resigns·in ·wake· of-<la ta-breach-fallout/.
112 Chapter 4 • Network Security
Perspective The Target breach was not an isolated incident. Surveys have found that most firms suffer at least one compromise each year. Successful attacks are becoming ever more fn.,quent, sophis- ticated, and damaging. In 2012, the clirector of the Federal Bureau of Investigation Robert Mueller made the following statement: "Terrorism remains the FBI's top priority. But in the not too distant future, we anticipate that the cyber thn.,at \viii pose the number one threat to our country."21 In 2014, the Center for Strategic and International Studies ~,stirnated global damage from cybercrirne.22 It concluded that cybercrirne reduced the entire world's gross dom~>Stic product by almost 1 %. Cybercrirne is not a small or distant threat, and it is growing explosively. In 2015, British insurer Lloyds estimated that cybercrirne was costing businesses $400 million a year.
"Terrorism remains the FB/'s top priority. But in the not too distant future, we anticipate that the cyber threat will pose the number one threat to our country."
Robert Mueller, Director of the FBI
INTRODUCTION
Nehvorks give us access to almost anything, anytime, anywhere. Unfortunately, they give the same access to criminals, national governments, terrorists, and just plain jerks. Wherever there has been opportunity, there has been crime and vandalism. Nel\vorks are no exception. Security is the snake in the nel\vork garden.
Nehvork thinking focuses on software bugs and mechanical breakdowns. In con- trast, security thinking must anticipate the actions of intelligent adversaries \vho will try many things to succeed and adapt to the defenses you put in place.
Network thinking focuses on software bugs and mechanical breakdowns. In contrast, security thinking must anticipate the actions of intelligent adversaries who will try many things to succeed and adapt to the defenses you put in place.
Giving you even a broad view of security is too much for one chapter. The appendix looks more broadly at ho\v to manage security as part of overall nel\vork management. As security expert Bruce Schneier has said in many of his \vritings, "&=ity is a process, not a product."
Test Your Understanding
3. Ho\v doc,s security thinking differ from nel\vork thinking?
21 Federal Bureau of Investigation, Speech by Robert S. Mueller III, Director, Federal Bureau of Investigation (Press release), RSA Cyber Security Conference, San Francisco, California, March I, 2012.
22 Center for Strategic and International Studies, "Net Losses: Estimating the Global Cost of Crime," June 2014. http:/ /www.mcafee.com/us/resources/reports/rp·economic·impact-cybercrime2-summary.pdL
Chapter 4 • Network Secur ity 113
TYPES OF ATTACKS
We begin by looki ng at the threat e n vironmen t that corporations face. The th r eat environment consists of the types of attacks th at companies face and the types of attackers who engage in these attacks. We begin by looking at types of attacks.
The t hreat environ ment consists of the types of attack s t hat companies face an d t he types of attack ers who en gage in t hese attacks.
Malware Attacks
Mahvare is a generic nan1e for evil software. It includes viruses, wom1s, Trojan horses, and o ther d angerous attack software. Malware attacks are the most frequent problen1s that con1panies face. Nearly every firm has o ne or n1o re significant n1alware compromise each year.
Ma/ware is any evil softw ar e.
Test Your Understanding
4. a) What is malware? b) What are the most frequent types of attacks o n companies?
Malware
A general name for evil software
Vulnerabilities and Patches
Vulnerabilities are security flaws in specific programs
Vulnerabilities enable specific attacks against these programs to succeed
Software vendors release patches to close vulnerabilities
However, users do not always install patches promptly or at all, so continue to be vulnerable
Also, zero-day attacks occur before the patch is released for the vulnerability
Social Engineering
For when there is no vulnerability
Trick the user into doing something that will compromise security, such as opening an e-mail attachment
Phishing involves e-mail messages that appear to be legitimate to a group of people (e.g., customers of a particular bank)
Spear phishing is aimed more selectively at individuals or a few individuals (more effective because it is personal)
Going to a websi te and being tricked into downloading malware
FIG URE 4-2 Malwa re and Vulnerabilit ies
114 Chapter 4 • Networ k Security
Vulnerabilities and Patches
Most types of m alware can o nly succeed if a p rogran1 under attack has a security vul- nerability. A vulnerability is a fla\,• in a program tha t permits a specific attack or set of a ttacks to succeed against the progran1. Vulnerabilities are fo und freq uen tly in pop ular application programs.23
A vulnerability is a fla w in a progra m that permits a specifi c a ttack or set o f attacks against t his p rogram to succeed.
When a software vendor discovers a vu lne rability, th e company issues a patch, which is a sm a ll p rogram design ed to fix the secu r ity vul nera b ility. A fter patch installation, the program is safe from attacks based on that particular vu lnerability. Too often, however, users fail to install pa tc hes, so their p rograms con tin ue to be vulnerable. Even if they d o ins tall patches, they may delay, giving the attacker a long windo\,• of opp ortunity.
Of course, if attacks begin before the program vendor creates a pa tch (or even learns about fue attack), fuen all a ttacks aga inst vulnerable comp uters will succeed . A vu lnerability-specific attack that occurs before a patch is available is called a zero-day attack. In such cases, there \,•ou ld be no signature to check fo r yet. On the security black n1arket, \,•ell-fund ed adversaries can often p u rchase inforn1ation that a llo\VS then1 to create zero-d ay attacks.
A vu lner ability -specific attack t hat occu rs b ef or e a p atch is available is called a zero-day attack.
Test Your Understanding
5. a) What is a vulnerability? b) How can users eliminate vulnerabilities in their progran1s? c) Wha t name do \'l'e g ive to attacks th a t occur before a pa tch is available?
Social Engineering: No Vulnerability Necessary
Even if t he so ftware bei ng attacked has no vu lnerabi lities, attackers can succeed if they ca n get the user to take an actio n that con1promises secu rity. This is called social eng ineeri ng. A pr ime exam ple of social e ngineering is an e-n1ail phish ing attack. A phishing attack p retends to be from a con1pany the user does business with or fron1 an o the r seemingly trustworth y sou rce. Th e text of the e-m ail m essage is also con vincing. Using HTML, it may look exactly li ke e-n1a il m essages the sou rce usua lly sends.
23 A 20 14 study by Ccnzic found that 96% of all applications tested had at leas t one vulnerability. The median number of naws per application was 14. Andy Patrizio, "Nearly All Apps Are Vulnerable in Some \~a y," NctworkWorld, March 3, 2014. http:/ / www.nctworkworld.com/ artido/ 2226448/ microsoft-subnct/ ncarly- aU-apps·are-vulnerablc--in•somc,.way- report .. says.htm.l.
Chapter 4 • Network Security 115
Social engineering consists of tricking the user into taking an action that compromises security. An e-mail phishing attack involves sending a message that pretends to be from a company the user does business with or from another seemingly trustworthy source. However, it is really from an attacker.
Spear phishing is even n1ore specific. The attacker persona lizes the e-ma il n1es- sage to a particular person, such as the chief executive officer of the company. Spear phishing e-n1ails are even n1ore convincing because they typically appear to con1e from a specific trusted person and contain information tha t only that person is likely to know. For exan1ple, it may mention specific projects or locations while traveling.
In some cases, a social engineering attack entices the user to click on a link that will take the victim to a site that asks the person to download a program to view a par- ticu lar attachment. This do\,'11loaded progran1 \,•i ll actually be n1ah,•a re. In other cases, the e-n1ail may contain the n1ah-vare d irectly, in the form of an a ttachn1ent.
Test Your Understanding
6. a) What kind of attack may succeed agains t a system w ith no techn o logical vul nerabilities? b) What is the goa l of socia l engineering? c) Distingu ish beh,•een phis hing and spear p hishing attacks.
Types of M a lware
There are many types of malware. Figure 4-3 lists three con1mon types.
Viru ses The first cornn1on type of n1ah,•are is the virus. A virus attaches itself to a legitin1ate program, just as a human virus a ttaches itself to a person's cells. If the victin1 runs the program, the virus will spread to o ther programs on the computer.
Typically, the v irus will then try to propagate to o ther con1pu ters. It cannot do this d irectly. Instead, it propagates through e-mail a ttachments, peer-to-peer file transfer networks, social networks, and websites that ask the visitor to do\,•nload a special progran1 to experience their contents. They a lso propagate through USB RAM sticks. In Afghan istan, the Ta liban left infected USB RAM sticks in pub lic places. When U.S. forces found these drives and inserted them into their USB ports, they spread the infection throughout their networks.
Worm s Worms are s in1ilar to viruses. However, instead of attaching them- selves to o ther progran1s, worms are full progran1s. Norn1ally, they propagate between computers with the same n1echanisms that viruses use.
However, son1e worms are able to jump directly beh-veen con1pu ters without human intervention. Th is means tha t no social engineering is necessary. However, d irectly propagating worms have a n1ajor limitation. They must be written to exp loit a particu lar vulnerability on the receiving host, and that host must have the vulner- ability. Humans are often gullible, but propaga tion through social engineering takes time. Worms tha t propagate directly can do so in n1illiseconds, and each \'\'Orm that succeeds will launch itself against n1any n1ore victims. In 2003, the Slan1mer worn1 infected 90% of all vulnerable con1puters attached to the Internet \,•ithin 10 minu tes.
116 Chapter 4 • Networ kSecurity
Viruses
Small pieces of code that must attach themselves to legitimate programs
This makes them difficult to detect
When the program executes, the virus infects other programs on the computer
Viruses also self-propagate to other computers by attaching themselves to e-mail messages, software downloaded from websites, peer-to-peer file transfer networks, social networks, RAM sticks, and so forth
Worms
Stand-alone malware programs that do not have to attach themselves to legitimate programs
Usually propagate like viruses
In some cases, a vulnerability will allow worms to jump directly to another computer with no human interaction
Viruses cannot do that
This can spread an infestation very quickly across many hosts
Trojan Horses
Replace an existing file, taking its name
Consequently, it appears to be "legitimate"
This makes it hard to detect
Cannot propagate by itself
Must be delivered to the comouter bv a hacker or other malware
FIGURE 4 -3 Comm on Types o f Malware
Troj an Horses In The llind, the Trojan horse \Vas sup posed to be a gift offering. It was really a trap . The Greeks left it a t the ga te a nd let the Troja ns bring it insid e. In n1alware, a T rojan horse is similar.
• First, it disgttises itself as a legitimate fi le. This makes it d iffic ult to detect.
• Second, in contrast to vi ruses, \,•orms, and n1obile code, a Troja n ho rse cannot propagate to another computer on its own initiative. It m ust be placed there by anothe r piece o f ma lware, by a h um a n hacker, or by a user d ownload ing the program voluntari ly.
A Trojan horse cann ot spr ead from one computer t o another by itself.
Test Your Understand ing
7. a) How do viruses a nd \'l'Orms d iffer? b) How d o viruses and worms p ropa- gate us ing social engineering? c) Do all wom1s s pread by direct propagation? d) W h y is d irect propagation especially dangerous? e) Wha t are Trojan horses? f) Ho w do Trojan horses propaga te to computers?
Chapter 4 • Network Secur ity 117
Payloads
In war, when a bo m ber aircraft reaches its target, it releases its payload o f bo n1bs. Sin1ilarly, after they s p read, viruses, worms, and othe r typ es of n1a lware m ay exe- cute p ieces o f code called payloads. Mal icious payloads can do extensive d an1age. Fig u re 4-4 gives son1e examp le o f this.
Erasing or E.nc.rypting Your Hard Drive Most people do not back up th eir files regularly or effectively. Some mah,•are m alicious ly e rases a hard d rive, creating a devastating loss of critical d ata . More recently, ransonn,•are has encryp ted every- th ing on a hard d r ive and has then told the user to pay a ransom to get the data unencryp ted. This ransom ty pically must be paid in Bitcoins to a particular server. Typically, the thieves do provide the decryption key, b ut th is is not a lways the case. In the massive WanaCry ransomwa re attack that took p lace in May 2017, th e thieves had a p oor paym ent system and generally d id not decryp t thei r victims' files. This \,•as ex tremely damaging because this m assive attack encr yp ted the data o n abou t 300,000 con1puters a ro und th e world.24 Ironically, it is th ought that the thieves reaped less than $100,000 in ransom d uring the attack. Most ransom attacks a re smaller but bring in n1ore n1o ney.
Turn Your Computer into a Spam or Pornography Server Nobody likes getting s pa m , wh ich is unsolicited com n1ercial e-m ail, o ften o f a fraudu len t natu re. Wh ere d oes it com e from ? Actua lly, it m ay be com ing fron1 your O\Vn con1puter.
After Propagation, Malware May Execute Payloads
Code that does damage
Malicious Payloads Intend to Do Damage
Can erase your hard drive
Ransomware encrypts your files, forcing you to pay ransom to be able to read them
Can make your comput er into a spam source or pornography distribution site
Spyware can st eal information from your computer and send it to attackers
Keystroke loggers capture what you type
Data miners search your storage for Social Security numbers, bank account numbers, etc.
Credit card number theft
Steal credit card numbers, make unauthorized purchases
Credit card companies will reimburse, but the process can be painful
Identity theft
Steal enough information to impersonate the victim in large financial transactions
No reimbursement for stolen funds
Reoairina credit can be difficult
FIGURE 4-4 Payloads
24 Dustin Volz, "Cybcr Attack Eas es, Hacking Group Threatens to Sell Code," R,111,rs, May 17, 2017. http:// www.rcutcrs.com/ artide/ uscyberattackidUSKCNJ8B0AC.
118 Chapter 4 • Network Security
Spammers often install spam-generating software on compromised computers. (Why pay for their O\vn computers to send spam?) More seriously, some attackers \Vill turn a compromised computer in to a pornography server, even a child pornog- raphy server. This will, of course, litter the computer \vith pornography.
Spyware One concern on the list is spyware, which can steal information from your computer and send it to attackers. Keystroke logger spyware captures what you type and analyzes it for login credentials and other things you type. It then sends these key- strokes back to the spymaster. At a more sophisticated level, data miners actively search your storage for Social Security numbers, bank account numbers, and other sensitive infor- mation. Data miners can extract a great deal of sensitive data in a very short period of time.
Credit Card Number Theft Two other payloads are very common. One is mal- \vare to do credit card number theft. The thief can use this information to make unau- thorized purchases. Credit card firms will refund money spent on purchases by the thief, but getting this refund can be a painful process.
Identity Theft In some cases, thieves collect enough data about a victim (name, addn.,ss, Social Security number, driver's license number, date of birth, etc.) to imper- sonate the victim in complex financial transactions. This impersonation is called iden- tity theft. Thieves commit identity theft in order to purchase expensive goods, take out major loans using the victim's assets as collateral, obtain prescription drugs, get a job, enter the country illegally, and do many other things. Identity theft is more damaging than credit card theft because it can involve large monetary losses that are not reim- bursed by anyone. In addition, correcting the victim's credit rating can take months. Some victims have even been arrested for crimes committed by the identity thief.
Test Your Understanding
8. a) What are payloads? b) What is ransomware? c) What is spyware? d) What is the difference between the two types of spyware mentioned in the text? e) Dis- tinguish between credit card number theft and identity theft. g) Which is more harmful to the victim? Why?
Human Break-Ins (Hacking)
A virus or worm typically has a single attack method. If that method fails, the attack fails. However, human adversaries can attack a company with a variety of different approaches until one succeeds. This flexibility makes human break-ins much more likely to succeed than mahvare break-ins.
What Is Hacking'? Breaking into a computer is called hacking. Legally, hacking is defined as intentionally using a computer resource without authorization or in excess of authorization. The key issue is authorization. 25 If you see a password written on a note
25 Note that the unauthorized access must be intentional. Proving intentionality is almost always necessary in criminal prosecution, and hacking is no exception. However., damage does not have to be intentional for a break-in to be hacking.
Chapter 4 • Network Secur ity 119
Humans Can Use Many Attack Methods
This makes them more dangerous than malware, which usually has only one or two attack methods
Hacking Intentionally using a computer resource
without authorization or
in excess of authorization
If an Action Fits the Definition, It Is Hacking
For example, if you find username and password on a piece of paper negligently left around, you are still not authorized to use the account, so to use it would be hacking
Irrelevant Considerations
Not well-protected: does not excuse hacking
Just testing the resource's security. does not excuse hacking
Penalties Depend on the Amount of Damage Done
Easy to do damage accidentally
FIGURE 4 -5 Human Br eak-Ins (Hacking) (Study Figure)
attach ed to a computer screen, this d oes not mean tha t you have a utho rization to use it. Also, note that it is hacking even if a person has legitimate access to an account but uses the account for 11nn11//10rized purposes.
Hacking is intention ally using a computer resource without authorization or in excess of authorization.
All hacking is illegal. Penalties d iffer by the type of asset tha t is hacked and by the amount of d am age done, but it is very easy to do enough harm accid entally to n1erit a ja il term, and "intentionally" only a pplies to intending to use the asset, not intend ing to do dan1age.
Test Your Understanding
9. a) What is the definition of hacking? b) If you see a usernam e and password on a s ticky note on a m onitor, is it hacking if you use this infom1ation to log in? Explain in terms of the d efinition. (Answer : No, you d id no t receive a utho riza- tio n to use it.) c) You d iscover that you can get into other e-mail accounts after you have logged in under your account. You spend just a fe\,• minutes looking a t ano the r user 's mail. Is that hacking? Exp lain in terms of the definition. d ) If you click on a link expecting to go to a legitima te website but are d irected to a \,•ebsite tha t con tains information you are not a utho rized to see, is that hacking? Explain in tem1s of the d efinition.
120 Chapter 4 • Network Security
4 Malware Software Update
FIGURE 4-6 Distr ibuted Denial of Service (DDoS) Attack Using Bots
Denial-of-Service (DoS) Attacks
The goal of denial-of-service (DoS) attacks is to make a computer or an entire neh,vork unavailable to its legitima te users. We sa\,v the massive DDoS attack against KrebsOn- Security.com in Chap ter 1. Let's look at these attacks in a bit more detail. As Figure 4-6 shows, most DOS attacks involve flooding the victim con1puter \,•ith attack packets. The victin1 computer becomes so busy processing this flood of attack packets that it cannot process legitimate packets. The overloaded host n1ay even fail. Or transmission lines may be so clogged \,•ith distributed denia l-of-service (DDoS) traffic that the host n1ay remain active but be unreamable.
The goal of denial-of-service (DoS) attacks is to make a computer or an entire network unavailable to its legitimate users.
The attacker begins by comprom ising computers and install ing ma lware pro- gran1s called bots on hundreds or thousands of PCs or servers. This collection of compromised computers is called a botnet, and the a ttacker is called the botmaster. When the user sends these bots an a ttack command, they all begin to flood the victin1 with packets.
Typically, the adversary does not con1municate w ith bots directly. Rather, he or she sends orders to a command and control server, \Vhich then sends attack con1- n1ands to the bots. In effect, the attacker is h'l'o levels removed fron1 the attack, making the botrnaster d ifficul t to identify.
In n1any cases, the bot malware will not function properly when it is first fielded. With bots, however, the botn1aster can send updates, as F igure 4-6 illustra tes. Thus fixed, the bots can be effective in subsequent attacks.
More rad ically, the bo t malware can be changed from one type to another. Many botnets are created initially to generate span1. As these attacks become less effective, the botn1aster can turn the botnet into a DDoS n1achine and later some- thing else.
Chapter 4 • Network Secur ity 121
Test Your Understanding
10. a) What is the purpose of a d enial-of-service a ttack? b) Which progran1s directly attack the victim in a d istributed denial-of-service a ttack? c) What is a collection of compron1ised computers ca lled? d) What is the person who con trols them called ? e) To what computer does tile attacker send messages d irectly? f) What are tile implica tions of the fac t tlla t bo ts can be upda ted ?
Advanced Persistent Threats {APTs)
In tile past, crin1inal attacks were brief and limited-the electronic equ ivalent of smash- and-grab thefts in jewelry stores. Increasingly, ho\,•ever, \,•e are experiencing advanced persistent tllreats (Al'Ts) in whlch tile adversaries have n1ultiple objectives that they continue to p ursue for d ays, weeks, montlls, or even years. These are true nigh tma res fo r corporations.
Th e adversary m ust fi rst break into the firm. In a large n1ajority of cases, he o r she does this through an extremely \,•ell-crafted spear phlshing attack tha t gives the attacker access to critical autllen tication creden tia ls. (Thls was probably tile case in the Target breach case at tile beginning of thls chap ter.) "The adversary uses tile initia l foot- hold to explore and break into o tller parts of tile firn1's IT infrastructure. The attacker n1ay also install Trojan ho rses a nd o ther exp loitation programs. In each o f these steps, tile attacker uses advanced pen etra tio n and explo ita tion n1e thods. This is tile origin of "advanced" in the name.
APTs are exp ensive to m ount. Conseq uently, they were o nly done by na tional govern m en ts in tile past. Ho\,vever, if there are good prospects for a large tlleft, crimina l groups now n1ay launch tllen1. This \,•as tile case with the Ta rget attack.
Test Your Understanding 11. a) Explain "ad vanced " in the tern, advanced persistent threat. b) Exp lain "persis -
te n t" in the context of APTs. c) How do adversaries often en ter tile syste m a nd the n exp a nd to other parts of it? d) Who m ounts APTs today?
Prolonged Attack
Days, weeks, months, sometimes years
Initial foothold, then move to other systems
Plenty of time to learn systems and do damage
Advanced
Uses attack techniques well beyond typical hacks
Although often begins with a relatively simple spear phishing attack
Difficult and Expensive
Only worth it for major objectives
Once done only by nation-states, now done by criminal hackers (e.g., Target)
FIGURE 4-7 Advanced Persist e nt Threat s (Study Figure)
122 Chapter 4 • Network Security
TYPES OF ATTACKERS
The threat en vironment consists of types of attacks and types of attackers. As Figure 4-8 sho\,•s, there are several different types of attackers facing o rganizations today.
Cybe rcriminals When most people think of a ttackers, they norn1ally have two p ictures in their n1ind. The first is the o ld-school hacker driven by c uriosity, the thrill of the break-in, and the desire to increase one's reputation among other o ld-school hackers. They \Vere seen as annoying but not too damaging.
This view is completely out of date. Hackers today are overwheln1ingly cyber- criminals \,•ho attack to n1ake n1oney. This has been true since the beginning of this centu ry. Cybercrim inals often work in loosely s tructured ga ngs. Funded by their
Cybercriminals
Most attackers today are motivated by money
Often attack as sophisticated gangs with ranges of skills
Can buy crimeware to help in attacks
Black markets for stolen credit cards and other valuable information
Employees, Ex-Employees, and Other Insiders
Current employees: Revenge or theft
Dangerous
Already have access
Know the systems
Know how to avoid detection
Are trusted
IT employees and security employees are the most dangerous
Ex-employees are dangerous, so all access must be terminated before their leaving
Contractors with access permissions are also "insiders"
Nonmalicious insiders: unaware or aware but consider their violations minor
Business Competit ors
Espionage to steal trade secrets
Denial-of-service attacks
On the Horizon
Cyberwar by nations: espionage and damage
Cyberterror by terrorists
Hacktivists attack for political motives
Dangerous because tend to be sophisticated
Danaerous because want to do widesoread damaae
FIGURE 4-8 Types of Attackers
Chapter 4 • Network Security 123
crimes, m any crin1inals can afford to hire the best hackers and to enhance their O\Vn skills. Consequently, criminal a ttacks are not just growing in nun,be rs; they a lso a re gro\ving very rapidly in technical sophistication.
Today, most hackers ar e cybercriminals.
Crimina l attackers have access to a vast online cybercrime comnn mity tha t gives them access to crimeware p rograms \,•ith slick user interfaces and p repaid annua l u pdates. There are e-comn, erce black m arkets for them to bu y and sell credit card n um- bers and iden tity information. Many elements of this black n,arket are in countries w here la\,, enforcement is n1inimal a t best.
Test Your Understanding
12. a) What typ e of adversar y are most hackers today? b) Why is this type o f attacke r extremely dangerous? c) Wh a t resources can they p urch ase and sell over the Internet?
Employees, Ex-Employees, and Other Insiders
A large nun, ber of attacks are undertaken not by outsiders but by em ployees. O ften, they are d isgruntled employees who a ttack for revenge. However, they also may be employees w ho sim ply \,•ant to stea l. Employees are especially d angerous for four reasons:
• They a re kno\,•ledgeable about corporate systen,s,
• They typically have access to key systen, s,
• They have knowledge about how to avoid detection, and
• They tend to be trusted.
The most d angerous en1ployees are IT staff men,bers and especially IT security staff men,bers. An ancient Rom an question, "Quis custodiet ipsos custod es?" m eans "Who guards the guardians?" It is a serious question in security.
For ex-employees, revenge is a con,mo n n1o tive. Another is stealing trade secrets that the employee \,•orked on and believes are "his" or "hers." It is important to tem,i- nate all ex-employees' access to internal resources after they leave. In fac t, even before em ployees leave, it is im portant to m onitor their access for signs that they are infiltra ting con1pan y intellectual property.
Often, contractors and service providers are given access credentials. This m akes them i nsiders, a nd th ey m ust be cons idered da ngerous as a consequence. When Edward Snowden sto le files fron, the National Security Agency in early 2013, he ½' as an employee of contractor Booz Allen Han,ilton in Hawaii. In the Target breach, the account that thieves used to break into Target's computers was that of an air conditioning service con1pany performing services for Target.
Malicious insiders have garnered the most attention in the past. Ho\,•ever, compa- nies also need to be concerned \,<ith nonmalicious insiders who commit security violations through ignorance o r because they consider that the violation will do little or no damage. The Target breach and n, any o ther breaches begin with unsafe acts by nonrnalicious insiders.
124 Chapter 4 • Network Security
Test Your Understanding
13. a) Why m ay employees attack? b) For what four reasons are employees espe· d ally dangerous? c) Who are the most dangerous employees? d) Why m ay ex-employees attack? e) What should be done before an employee leaves the firm? f) Why are contractor firms more dangero us than o ther o utside firms?
Business Competitors Your business competitors m ay also attack you. All businesses have trade secrets such as customer lists, production schedules, p roduct formulations, lists of p rojects, and lists of employees. Especially in some in d ustries, it is common for business competi- tors to attempt to find these trade secrets. Th is m ay range from legal activities such as looking at your public website to hacking attacks to find \veil-p rotected information . In some cases, competitors will actually attack you using d enial-of-service attacks and other disruptive assaults. They also may attack your firm's rep utation via social m edia.
Test Your Understanding
14. What three types of attacks m ay come from your firm 's business competitors?
Cyberterrorists and National Governments On the horizon is the danger of far more massive cyberterror attacks by terrorists and even \VOrse cyberwar attacks by national governments. These could p rod uce unp rec· eden ted dam ages in the hundreds of billions of dollars.
The United States has acknowled ged th at it has long had cyberwar capabilities, and it established a con solidated Cyberwar Command in 2009. It is clear th at sev- eral other countries h ave these capabilities as \Veil (especially China). Countries could use IT to do esp ion age to gather intelligence, conduct attacks on op ponents' financial and power infrastruct ures, or d estroy enemy command and con trol facilities d uring physical at tacks.26
Russia is especially focused on disrupting political processes in other countries. Russia's hacking and selective release of information d uring the United States p resi- dential elect ion in 2016 has received the m ost at tention, but they have been active d uring the elections of several other countries as well.
Cyberterror attacks by terrorists are also likely. During physical attacks, terror- ists migh t disable communication systems to th\vart first responders and to spread confusion and terror among the pop ulation. Cyberterrorists could also cond uct purely
26 A 2009 a rticle in the New York Times reported that before the 2003 invasion of Iraq, the United States considered an attack that would shut down Iraq's entire financial infrastructure Oohn Markoff and Thom Shanker, "'03 Plan Displays Cyberwar Risk," New York Times, August l , 2009. www.msnbc.msn.com/ id/3032619 /%2328368424). This attack was no t approved, but not because it was infeasible. It was held back because its impact might have spread beyond Iraq and might even have damaged the U.S. financial system. More recently, attacks by the United States and Israel used the Stuxnet worm to damage a specific group of nuclear centrifuges in a specific factory in Iran. 'I1:'te researchers who discovered Stuxnet were amazed by its complexity and by the scope of the operation that produced and tested it. It even involved forged digital certificates for important firms.
Chapter 4 • Network Security 125
IT-based attacks. Nation-states are concerned about the side effects of cyberwar attacks, but terrorists have no such qualms.
Cyberwar and cyberterror are particularly dangerous for three reasons. First, funding allov,s them to be extremely sophisticated . Second, they focus on doing dam- age instead of committing thefts. Third, they are dangerous because they are likely to be din.>cted against many targets simultaneously for massive damage.
Espionage has more limited objectives than destructive attacks. In spying, the goal is to learn an enemy's secrets. Several countries are doing this on a massive scale. In many cases, they also are targeting commercial enterprises to steal trade secrets use- able by firms in their countries. The Chinese have been very effective in penetrating classified U.S. defense n.,sources in recent years.
Hacktivists attack for political motives. They do so to embarrass corporations or governments. Edv,ard Snowden's publication of secret programs in the U .S. National Security Agency (NSA) was an example of hacktivism. Although hacktivists are often viewed favorably, their release of information can cause considerable damage. Wikileaks has been the most active hacktivist group. Its website, ,vikileaks.org, has a long list of files that still can be do,vnloaded.
Test Your Understanding
15. a) What are cyberterror and cyberwar attacks? b) Why are cyberwar attacks especially dangerous?
PROTECTING DIALOGUES CRYPTOGRAPHICALLY
Having looked at the threat environment, ,ve no,v begin to look at the tools that com- panies use to at tempt to th,vart attackers. One of these is cryptography. Formally, cryptography is the use of mathematics to protect information.
Cryptography is the use of mathematics to protect information.
Cryptography is important in and of itself. We begin w ith "crypto," however, because it is part of many other security protections. A knowledge of cryptography is necessary to understand how they work.
Encryption for Confidentiality Encryption for Confidentiality When most people think of cryptography,
they think of encryption for confidentiality, which Figure 4-9 illustrates. Confidential- ity means that even if an eavesdropper intercepts a m~>SSage, he or she will not be able to read it. The sender us~,;; an encryption method, called a cipher, to create a message that an eavesdropper cannot read. Ho,vever, the receiver can decrypt the message in order to read it.
Confidentiality means that even if an eavesdropper intercepts a message, he or she will not be able to read it.
126 Chapter 4 • Network Security
Message "Hello"
5J Party A
Key ( 'i::i iiwi>
Cip her & I Encrypted Message Key
Network
Eavesdropper
[ Encrypted Message
FIGURE 4-9 Encryption for Confidential ity
~ ;; Same "1JF?"' Key
Cip her & Key
Party B
Message "Hello"
Keys It is impossible to keep ciphers secret. Ho\vever, the message is encrypted with both the cipher and a key. Different keys produce different encrypted messages for the same cipher. Consequently, these keys must be kept secret. There is nothing mysterious about keys. They are simply strings of bits of a certain length. They should be selected randomly.
Key Length Cryptanalysts study encrypted messages in order to learn encryp· tion keys. The normal \Vay to do this is to try all possible keys to see which one produces an intelligible message. The \Vay to defeat exhaustive key s earches is to use long keys. Every bit that is added to the key doubles the number of keys that must be tried by cryptanalysts. For most encryption ciphers, key lengths must be 128 bits or greater to be considered strong. For some, however, strong keys must be 2,000 b its or longer.
Keys are Jong strings of bits.
Test Your Understanding 16. a) What protection does confidentiality provide? b) What is a cipher? c) In encryp-
tion for confidentiality, what must be kept secret? d) What is the minimum size for encryption keys to be considen.>d strong in most encryption ciphers?
Electronic Signatures: Message Authentication and Integrity Confidentiality is not the only goal of cryptology. In addition to encrypting each packet for confidentiality, cryptographic systems normally add electronic signatures to each packet. This is illustrated in Figure 4-10. Electronic signatun.>S are small bit strings that provide message-by-message authentication, which ensures that the person or pro- gram you are communicating w ith is not an impostor. An electronic s ignature allows the receiver to detect a message added to the dialogue by an impostor.
Authentication ensures that the person or program you are communicating with is not an impostor.
Chapter 4 • Network Security 127
1 Encryption for Confidentiality Electronic
Signature gives Authenticallon and ES Message
.A Message Integrity ~ ~ -----~
2 After an ES is added, the message plus the ES are Encrypted for Confidentiality
FIGURE 4-10 Electronic Signature for Authentication (and Message Integrity)
Electronic signatures also provide a second cryptographic benefit, message integ- rity. Message integrity means that the receiver \,•ill be able to detect whether the packet is altered by an attacker while the packet is in transit. If the n1essage integrity test fails, the receiver discards the message.
Overall, cryptographjc systems provide three protections to every packet. Encryp- tion for confidentiality provides message-by-message confidentiality, while electronic signatures provide n1essage-by-n1essage authentication and message integrity.27
Overall, cryptographic systems provide three protections to every packet. Encryption for confidentiality provides message-by-message confidentiality, while electronic signatures provide message-by-message authentication and message integrity.
Test Your Understanding
17. a) What two protections do electronic signatures provide? b) What three protec- tions are typically g iven to each packet?
Host -to-Host Virtual Privat e Networks (VPNs)
Sometimes, transmission through untrusted networks is necessary. One of these untrusted networks is the Internet, which has no built-in security and is full of attackers. Other untrusted networks are \,•ireless networks; in these networks, any- one can intercept your transmissions. The \,•ay to address a lack of security is to cre- ate a host-to-host virtual private network (VPN). F igure 4-11 illustrates this concept. Of course, transmissions actually pass through a rea l neh,•ork. In tern1s of security, however, the hosts are effectively comnu,nicating via a priva te neh,•ork tha t con- nected just then1. A VPN n1akes it appear that the two hosts are communicating via a priva te secure neh,•ork.
A VPN makes it appear that the two hosts are communicating via a private secure network.
27 Another common protection is anti-replay. In some cases, an attacker may be able to do damage by captur• ing an encrypted message. Although the attacker cannot read the encrypted message, he or she may be able to accomplish objccHves by simply retransmitting the message later. Anti-replay protections prevent this.
128 Chapter 4 • Network Security
Browser
-Client
Untrusted Network: The Internet, wireless network, etc.
Host
SSL./TLS Virtual Private Network (VPN) Cryptographically protected transmission path
like having your own private network to connect to the webserver
FIGURE 4-11 SSL/TLS Host-to-Host Virtual Pr ivate Networ k (VPN)
Webserver
A comn1on cryptographic system for VPNs is SSL/TLS. SSL/TLS \,•as created as Secure Sockets Layer (SSL) by Netscape. The In ternet Engineering Task Force then took over the standard, renaming it Transport Layer Security (TLS). It is called by both names today, so we call it SS LffLS.28
SSL/TLS is an attractive cryptographic system for \,•ebservice because SSL/ TLS is built into every webserver and browser today, so the cost of add ing SSL/TLS p rotectio n is negligible. Given security threats o n the Interne t, SSL/TLS shou ld be used w henever possible.
Test Your Und erstanding 18 . a) Distinguish beh-veen priva te neh,•orks and virtua l private neh'l'orks. b) Why
is SSL/ TLS attractive for VPNs to connect browsers to \,•ebservers?
AUTHENTICATION
Electronic signa tures provid e message-by-message au thentication. Ho\,•ever, there are many types of au thentication in use today, each w ith strengths and \'l'eaknesses. Authentication is crucial to controlling access to resou rces so that ad versaries can be prevented from reaching them.
Authentication Terminology and Concepts
Figure 4-12 illustrates the n1ain terminology an d concepts in authentication. The user trying to prove his or her iden tity is the supplicant. The party requiring the supplicant to prove his or her identity is the verifier. The supplicant claims to be a particular user,
28 Vl'hcn you use SSL/ TLS, the URL begins with https:/ / . Although you will not notice it, the port number in TCP changes from 80 to 443, which indicates HTTP over SSL/ TLS.
©r,u~y _._ or Impostor? ..
Acceptance or Rejection 0 (Sometimes Authorizations) 4
AGURE 4--12 General Authentication Concepts
Chapter 4 • Network Security 129
True Party or Impostor?
the true party. The supplicant tries to prove that he or she is the true party by providing credentials (proofs of identity) to the verifier.
The specific question that all authentication methods ask is whether the supplicant's credentials prove that he or she is the true party.
The type of authentication tool that is used \,• ith each resource must be appropri- ate for the risks to that partic11/nr resource. Sensitive information should be protected by very strong authentication methods. Ho\,•ever, s trong au thentication is expensive and often inconvenient. For relatively nonsensitive data, \,•eaker but less expensive au then ti cation methods n1ay be sufficient.
The type of authentication tool that is used with each resource must be appropriate for the risks to that particular resource.
Test Your Understanding
19. a) What is authentication? b) Distinguish between the supplicant and the veri- fier. c) What are credentials? d) Who is the true party? e) What is the specific goal of authentication? f) Is the supplicant the true party or is the supplicant an impostor? g) Why n1ust authentication be appropriate for risks to an asset?
Reusable Passwords
The n1ost common authentication credential is the reusable password, which is a string of characters that a user types to gain access to the resources associated with a certain usemame (account) on a compu ter. These are called reusab le pass\,•ords because the user types the same pass\,•ord each tin1e he or she needs access to the resource. Unfortu- nately, the reusable password is the weakest form of authentication, and it is appropriate only for the least sensitive assets.
The reusable password is the weakest form of authentication, and it is appropriate only for the least sensitive assets.
130 Chapter 4 • Network Security
Reusable Passwords
Passwords are strings of keyboard characters
They are typed to authenticate the use of a username (account) on a computer
They are used repeatedly and so are called reusable passwords
Benefits
Ease of use for users (familiar)
Inexpensive because they are built into operating systems
Often Weak (Easy to Crack)
Common words and simple variations
Traditional Advice for Password Security
Passwords should be long and complex
Should be at least 8 to 12 characters long
Should mix case, digits, and other keyboard characters (S, #, etc.)
Such passwords are very strong but difficult to remember
Such passwords are often wrilten down or stored online or worked around
In the end, long and complex passwords do not live up to their promise
2017 National Institute of Standards and Technology Guidance
Use long phrases that are not easy to guess
Using all lower case is fine if the phrase is long
Still use a different password for each site, and not a simple variation of the phrase
This approach is both more secure and easier on employees than traditional approaches to strong passwords
Perspective
Even with improvements, reusable passwords are only strong enough for very unimportant assets
The goal of new types of authentication is to allow firms to get rid of reusable passwords entirely
FIGURE 4 · 13 Reusable Passwo rd Authentication (Stu dy Fig u re)
Ease of Use and Low Cost The po p ularity of password a uthen tica tion is hard ly surprising. For users, password s are familiar a n d rela tively easy to use. For corpo rate IT departmen ts, password s add no cost because opera ting systems a n d man y a pplica tions have b uilt-in password au thentica tion.
Picking Poor Passwords Unfortuna te ly, users te n d to p ick very poo r pass- words. The n1ost commo n password is 123456, and n1a n y others are easily g uessable. These weak passwords a re con1mon words, n a m es of s p o rts tean1s, a nd common variations (suc h as re p lacin g a n "s" b y a d o lla r s ign a n d the le tter " l" b y a 1). If a n y sizeable fra ction o f a company's e mployees uses weak passwords, the compa n y
Chapter 4 • Network Security 131
w ill be a t consid erable risk, because a n attacker can often jump easily fron1 a n employee compu ter (or mob ile p hone) to a more sen si tive device such as a server in accounti ng.
Traditional Advice on Reusable Passwords Traditional adv ice has been to force en1ployees to p ick s trong passwords by insisting that their pass\,•ords be long, have at least a single change of case (not in the first character), a digit, an d a non- letter, non-nun1ber character such as a space or@ s ign .
This enforces strong passwords, but people have a hard time remen1bering them. They \,•rite them down, s tore them in a file on the con1puter, or keep th en1 in son1e oth er poorly protected form. They use the san1e pass\vord for many differen t hosts. Th ey forget their pass\,•ords and get a pass\,•ord reset that usually invo lves them answering challenge questions that are easily guessed or a llows an a ttacker taking over their e-n1ail account to do the pass\,•ord resets.
National Institute of Standards and Technology In the United States, the National Institu te of Standards an d Technology creates recon1mended security practices for the U.S. government. These recon1mended practices are imp lemented by n1a ny commercial and nonprofit firn1s as well because of the Institu te's repu - ta tion for secur ity excellence. In 2017, the Institute release a revolutionary set of recommenda tions for reusable passwords. They said that traditiona l approaches to enforcing strong passwords had backfired and led to bad security practices.
In its new recomn1endation, the Institute recommended a radical change. For- get case changes, d igits, and oth er keys. Just create long phrases tha t ca nnot be easily guessed. This will give the san1e or better con1puta tional strength a nd yet \,•ill be easy to ren1ember. O ne should still use differen t pass\vords a t oth er sites, bu t the new National Institute of Stan dards and Technologies new recon1mendation for long but memorable passphrases should go a long \,•ay to change the way corporations use reusa hie pass\,•ords.
Ever-Smaller Scope of Usefulness Even w ith the new password gu idelines fron1 the Na tio nal Institu te of Standards and Technology, password \,•ill remain a very \,•eak forn1 of authentication su itable only for the least risky assets. Other forms of authentica tion are being created specifically to allo\,, firn1s to comp letely eliminate reusable passwords.
Passwords are only useful f or nonsen sitive assets.
Test Your Unders tanding
20. a) What was the traditional recommendation for passv,ords? b) What is the U.S. National Institute of Standards and Technology's new reconm1endation? c) What two benefits should this nev, reconm1endation bring? d) Is it still in1portant not to use the san1e password at multiple sites? e) Why is it undesirable to use reusable passwords for anything but the least sensitive assets? f) Why are other forn15 of authentication being created?
132 Chapter 4 • Networ k Security
other Forms of Authentication
Companies are beginning to look fo r stronger types of au then tication for n1ost of their resources. This \,•ill allow them to replace n1ost or all of their reusable pass\,•ord access sys- tems. We have space to mention o nly the few types of authentication sho\,'11 in Figure 4-14.
Access Cards To get into your hotel room, you may have to swipe an access card through a card reader. Many bus systems let r iders purchase access cards to pay for their travel. Man y compan ies use access card s fo r door access control. In addi tion, simple access card readers can be p lugged into USB ports o n comp uters for computer access. Of cou rse, the loss of access card s is a fundam ental p roblen1.
Perspective
Goal is to replace reusable passwords
Access Cards
Permit door access
Need to control distribution and disable lost or stolen access cards
Biometrics
The use of biological measurements to authenticate you
Vary in cost, precision, and susceptibility to deception
Angerprint scanning
Inexpensive but poor precision, deceivable
Sufficient for low-risk uses
For a notebook, may be better than requiring a reusable password
Iris scanning
Based on patterns in the colored part of your eye
Expensive but precise and difficult to deceive
Facial scanning
Based on facial features
Increasingl y used in computers and cellular phones
Controversial because can be done surreptitiously-without the supplicant's knowledge
Varies widely in strength
Digital Certificate Authentication
Extremely strong
See Figure 4-15
Two-Factor Authentication
Supplicant needs two forms of credentials
Example: debit card and pin
Strengthens authentication
FIGURE 4 -14 Ot her Forms of Authentication
Chapter 4 • Network Secur ity 133
Losses m ust be rep orted in1med iately, a nd the card m ust be disabled remotely a nd for all access doors.
Biometri cs In biometric a u then tica tion, access con trol is gra nted based on som e thing you ah,•ays have with you-your body. Biometrics is the use o f bodily measuren1en ts to authenticate you. There a re severa l types of bion1etrics. They d iffer in cost, p recision, and susceptibility to deception by someone wishing to impersona te a legi timate user.
Biom etrics is the use of body measurements to authenticate you.
• At the lo\,, end on price, precision, and the ability to reject deceptio n is fingerprint recognition, which looks at the loops, w ho rls, and ridges in a finger. Although not a strong fo m1 of a u thentication, its price n1akes it acceptable for low-risk resources such as most tablets, and sn1artphones. For such devices, fingerprint recognition may b e p referable g iven the tendency of peop le to p ick poor passwords a nd to fo rget them.
• A t the high end of the scale o n p rice, p recision, and the ability to reject decep - tio n is iris recognition,29 w hich looks a t th e pa ttern in the colored part of you r eye. Iris scanne rs are normally used fo r access to sensitive rooms.
• A con troversia l form of b iom e trics is facial recognition, in w hich an individua l is iden tified by his or her facial features. Facial recognitio n can be d o ne sur- reptitiously-without the kn owledge of the person being scanned . This raises p rivacy issues. O n the positive side, we a re beginning to see fac ial recognition scanning on compu ters and sn1ar tp hones.
Digital Certificate Authentication The s tro ngest form of authentica tion is d ig ital certifi cate authentication.3° F igure 4-15 illustrates this form of a u thentication.
• In this fo rm of authentica tion, each party has a secre t private key that only he or she knows.
• Each party also has a public key, which anyone can kno\,•. It is not kept secret.
• The p ublic key of a person is available from a certificate authority in a document called a d igital certifi cate.31 A digital certificate is cryp tographically protected for message integrity, so that it cannot be changed \Vithout this change being obvious in a way that causes the verifi er to reject it.
29 Jn sdcncc fiction movies, eye scanners arc depicted as shining light into the supplicant's eye. This docs not happen. lris scarmcrs merely require the suppUcant to look into a camera. [n addition, science ficHon movies use the term retinal scanning. The retina is the back part of the eye; it has distinctive vein patterns. Retinal scanning is not used frequentl y because the suppUcant must press his or her face against the scanner. 30 It also good for authenticating software processes, which have no heads or fingers and have a difficult Hme swiping access cards. 31 The true party creates a public key/private key pair on his or her own computer. The TP then sends the public key to the certificate authority. The CA creates the digital certificate and sends it to anyone who wishes it. The true party never transmits his or her private key to anyone.
134 Chapter 4 • Networ k Security
1
Supplicant: Claims to be someone (True Party).
2
4
Certificate Authority provides True Party's Digital Certificate
o-i Verifier Sends Supplicant's Private Key 3
Sends back Response Message encrypted w ith the
supplicant's private key
Challenge Message
~ /=icat: contains: f'fl public key of true party,
~ ~,-~ ;_,,, which is public information
~ 6
Verifier decrypts wtth public key of true party contained in true party's digital certificate. (Never wtth the supplicant's public key.)
If this produces the challenge message, the Supplicant knows the True Party's private key. Only the True Party should know it. Accept the Supplicant as the True Party.
FIGURE 4-15 Digit al Certificate Aut hent ication
The supplicant claims to b e someone, the true party. To test this claim, the verifier sends the subject a challenge message. This is just a randon1 stream of bits. It is not even encrypted for confid entiality.
To prove its dain1 to being the true party, the supplicant encrypts the challenge n1essage with /,is or her private key and sends this response message to the verifier. Again, there is no encryption for confidentiality.
Th e ver if ier gets the true party's digi tal certificate, w hich contains the true party's public key. The verifier tests the response m essage by decrypting it \,•ith the public key of tl,e true party, \,•hjch is contained in the d igital certificate. If the decryp- tion produces the origina l challenge m essage, then the supplicant has proven that he or she knows the private key of the true party. Only the true party should know th is key. Therefore, it is reasonable to authenticate the supp lica n t as the true party. If the decrypted respo nse message is no t a m atch for the origina l c ha llenge message, the su pplican t is treated as an impostor.
Note that the verifi er uses the public key of the true pnrty-not the s11pplicnnt's public key. If the verifier used the supp lica nt's public key, the test \,•ould always suc- ceed. The supplicant's public key wou ld d ecrypt the message correctly. In1pos tors wou ld always b e authenticated.
No te that the verifier uses the public key of the true party-not the supplicant's public key.
There are three parties involved-the supp licant, the veri fi er, a nd the true party. Each has a public key and a private key. Therefore, you should never say the private key or the public key. Ah,vays say the supp licant's p ublic or p rivate key, the verifier's public or pr iva te key, or the true party's p ublic or private key.
Chapter 4 • Network Secur ity 135
Th er e are three parties involved-the supplicant, t he verifier, and the tru e party. Each has a pub lic k ey and a p rivate key. Th eref or e, you sho uld n ever say "the privat e key• or "the p ublic key. • Always say the supplican t 's public or p rivate key, the verif ier's p ub lic or priva t e key, or the true party's p ub lic or private key.
Two-Factor Authen t ication Debit cards are potentially dangerous because if son1eone finds a lost debit card, the finder n1ig ht be able to use it to make p urch ases. Conseq uently, possess ion of the debit card is not enough to use it. To use a debit card , the user m ust type a personal identifi cation number (PIN), which usually is four or six digits lo ng . Requiri ng two credentials for authentication is called two- factor authentication. Two-factor au thentica tio n is n1ore difficu lt to defea t because the attacker must obtain both sets of credentia ls .32
Two -fa ct or authentica tion r equires two form s of authentica tion .
Test Your Understanding
21. a) How do you authenticate yoursell with an access card? b) What is bion1et- rics? c) Why may fingerp rint recognition be accep table for user authentication to a laptop? d ) Wh y is iris recognition desirable? e) Wh y is face recognition controversial?
22. a) In d ig ita l certifica te au thentica tion, what d oes the supp lican t d o? b) What does the verifier do? c) Does the verifier decrypt with th e true party's p ublic key or the supplicant's public key? Why is this in1portant? d) How does the verifier get the true party's public key?
23. a) Wha t characteristic of the true party is used in access card a u thentica tio n, iris a u then tica tion, and digital certificate au thentication? b) Which form of a u then tica tion tha t we looked at depe nds on the su pplica n t provi ng tha t it knows some thing th at only the true party shou ld kno\,•? c) Wha t if this inform ation is learned by a n attacker? d) Why is two-factor a u then tica tion desirable?
FIREWALLS AND INTRUSION DETECTION SYSTEMS
In hosti le mil itary environments, travelers mus t pass th roug h ch eckpoints. At each checkpoint, guards \,•ill exan1ine their cred entials. If the guards find the creden tials insufficient, the guard w ill stop the traveler fron1 proceeding and note the violation in a checkpoint log.
32 However, if a user's computer is compromised, the attacker typically controls both credentials, so two- factor authe ntica tio n g ives no security. Two-factor a u thenticatio n also may fail if an eavesdropper can inter• ccpt au the ntication communication be tween the supplicant a nd the verifie r. Two-factor a uthen tication is desirable, but factors tha t lim it its use must be understood.
136 Chapter 4 • Network Security
Dropping and Logging Provable Attack Packets Figure 4-16 shows tha t firewalls operate the san1e way. When a packet arrives, the firewall exam ines it. If the fire\,•all identifies a packet as a provab le attack packet, the firewall d iscards it. (Synonyms for provable are definite, certain, etc.) On the other hand, if the packet is not a provable attack packet, the firewall allows it to pass.
If a firewall identifies a packet as a provable attack packet, the firewall discards it.
If a packet is not a provable attack packet, the firewall passes it.
The firewa ll copies information about each discarded packet into a fire,vall Jog fi le. Firewall managers shou ld read their firewall log files every day to understand the types of attacks coming against the resources that the firewall is protecting. This alerts the security staff to the kinds of attacks it is under a t the tin1e.
Note that fire\,•alls pass nil packets that are not provable (certain) attack packets, even if they are suspicious. By analogy, police cannot arrest someone unless they have probable cause, \,•hich is a reasonably high standard of proof. They cannot arrest someone for being suspicious.
Note that firewalls pass all packets that are not provable (certain) attack packets, even if they are suspicious. By analogy, police cannot arrest someone unless they have probable cause, which is a reasonably high standard of proof. They cannot arrest someone for acting suspiciously.
Consequently, firewalls never stop all attack packets. It is importan t to harden all interna l hosts against attacks by adding firewalls, adding antivirus pro- gran1s, installing all patches promptly, and taking other precautions. This chapter
Not a Provable Attack Packet:
~---:;::=-rP'.'.:a':'.:sse7d Hardened • L _ _J....__....__....___J Server
Hardened Client PC
Provable Attack Packet:
Denied and Logged
§ FIGURE 4-16 General Firewall Operation
Internal Corporate NetwO<k
Provable Attack Packet
Attacker
Nata.__~~ Provable Attack Packet
Leg~imate Host?
Chapter 4 • Network Security 137
focuses on network security, rather than hos t security, so we \Vil! not consider host hardening.
Because firewalls do not stop packets that are not provable attack packets, they never stop all attack packets.
Test Your Understanding
24. a) What does a firewall do when an arriving packet is definitely an attack packet? b) Does a firewall drop a packet if it probably is an a ttack packet? c) Why is it important to read fire\,•all logs daily?
Stateful Packet Inspection (SPI} Firewalls
How do firewalls exan,ine packets to see if they are attack packets? Actually, there are several firewall fi ltering mechanisms. We only look a t two-sta teful packet inspection (SPI) and next-generation fire½•alls.
Figu re 4-17 shows that stateful packet inspection (SPI) firewalls recognize that there are two states (stages) in a dialogue between two parties. The first is the initia l handshaking state, which is the initial interaction that takes place to authenticate the o ther party and o ther activities. This is crucial to security, so SPI fire\,•alls spend a grea t deal of time on this and requ ire high-quali ty authentication. If a connection between the two sides is not authentica ted a t this stage, the connection-opening attempt is termina ted.
After this intense but brief handshaking s tate, everything else is ongoing con1- n1unica tion. If a packet arrives tha t is part of an approved connection, it is given only cursory examination because authentication had been proven initially. It is passed through with li ttle or no additional inspection. It is like an employee with an ID badge.
1
2 Ongoing Communication State After a connection is approved,
light authentication and other security protections are neede<I and provide<! for packets
that are part of an approved connection. y ln~ial Handshaking State
Strong authentication (and other security)
is needed and provided. Approves a connection.
3 Heavy protection for the inrtial state,
which needs it. After the connection is approve<!, light attention per packet.
Good protection at a reasonable p rice
AGURE 4 -1 7 Stateful Packet Inspection (SPI) Firewall
138 Chapter 4 • Network Security
To give an an alogy, think of a telephone conversation. When someone calls you, you \,•ant to ensure that you know \,•ho you are ta lking to. O nce you establish that, you ignore authentication for the remainder of the call. Trus is \,•ha t SPI fire\,•alls do with network connections.
If a packet a ttempts to open a connection, the SPI firewall compares it to the rules in its access control list (ACL). ACL rules specify w ha t to do ½•ith arriving packets. Figure 4-18 shows a sin1ple SPI firewall ACL for connection-opening attempts.
An access control list (ACL) is a set of rules for determining what to do with arriving packets.
There are six columns. The fourth brings up something you saw in Chapter 2. This is the server port nun1ber. For ½•ebservers, the well-known port number is 80. For mail servers, it is 25. In this figure, the company that uses this ACL respects \,•ell-kno\,'11 port numbering.
Server port numbers usually specify the application involved in the connection.
• The first rule allows any device to open a connection to a particular webserver (IP address 60.44.2.17, server port nun1ber 80). This might be the con1pany's public webserver.
• The second rule allows an y device to open a connection to any \,vebserver. This is a lazy rule that some firewall administrators use when they do not know what webservers they have but realize that blocking access to a legitima te \,•ebserver will cause problen1s.
Source IP Destination IP Server Port Action on Rule Address Add ress Nu mber Con nection Remark
1 Any 60.3.47.138 80 A llow Open access to this webseNer.
2 Any ANY 80 Allow Open access to any webseNer.
3 Any Internal 60.1.232.89 80 Authenti- Open access for internal cate, then hosts to this webseNer, allow following aut hentication.
4 Finance Finance Any Authenti - Any connection between cate, then Finance hosts with allow authentication.
s Any Internal 60.44.2.17. 25 Allow Open access for internal hosts to this mail seNer.
6 Any A ny Any Deny Deny any connection not permitted by a previous rule.
FIGURE 4 - 18 Access Control List (ACL) for a Stateful Inspection Firewall to Apply to Packets Attempting to Create a Connection
Chapter 4 • Network Secur ity 139
• The third ru le allo\,•s an y internal host to connect to a par ticular \,•ebserver. This migh t be a \,•ebserver for h um an resou rces information that all in ternal employ- ees shou ld be a ble to reach. To ad d a level of protection, the sup plicant m ust authen ticate itself before the connection.
• The fou rth rule permits connections be h,•een all finance d epartment hosts. Again, authentication is reqttired in this high-security environment.
• The fifth rule pern1its connections beh,•een any internal host and n1a il server 60.44.2.17 (server port nun1ber 25).
• The fi nal rule ca tegorically d en ies connections that have not been previously allowed by earlier rules. This is the "d eny all" rule that typically ends this type of firewall. It enforces the policies that went into creating the ACL by d isapproving any connection not envisioned by tha t policy. For exan1ple, if a cl ien t in marketing \,•ishes to connect to a fina nce d epartment server, this will be prohibited beca use it is not specifically approved.
Statefu l packet inspection firewalls provide a good bala nce of security and economy. For the n1ost sensitive par t of a connection, SPI fire\,•alls provide s trong secur ity. For ongoing comm unication, \,•hen less intense security is needed , SPI fi re- walls only d o enough security for the s ituation. The latter saves m oney. Thanks to this ba lance of s trong security \,•hen it is n1ost needed and economical operation n1ost o f the tim e, most m ain border fi rewalls today a re sta tefu l packet inspection fi re\,•alls.
Tes t Your Understanding
25. a) Why are stateful packet inspection (SPD fire\,valls attractive? b) What are the h,•o states in connections for SPI fire\,•alls? c) Which state needs the m ost secu- rity p rotection? Why? d ) Why are SPI firewalls econon1ica l? e) What type of firewall do m ost corporations use for their main bord er firewalls?
26. a) In Fig ure4-18, explain why Ru le 1 brings more security than Rule 2. b) Explain \,vhy the last rule in a n ACL should deny anything not previously approved by earlier rules. c) Why do you think authen tication is sometimes reqttired before accepting a connection? d) When a packet add ressed to 60.1.232 .89 arrives, \,•hat rule \'l'ill the SPI firewall look a t first? e) Why m ust Ru le 2 come after Rule 1? f) Add a rule to permit access by hosts in accounting to server 60.3.4.67. Reqttire a uthentication. Wha t rule nun1ber would you give it?
Next-Generation (Application Aware) Firewalls (NGFWs)
The newest type of firewall is the next-generation fi rewall (NG FW). The most impor- tant capability of NGFWs is tha t they are application a,vare. This means that, unlike statefu l packet inspection firewalls, NGFWs can d etern1ine the s pecific applica tion that is sending and receiving n1essages over a connection.
Stateful packet inspection fire\,•a lls might seem to be a p p lica tion aware, but they really are o nly aware of port numbers. This is problematic because an attacker can run an attack program over Port 80. Rule 2 in Figure 4-18 would enable all connections to this n1ah,•are. This is called port spoofing. It is d ifficul t to th\,•art w ith SPI fi re\,•alls.
140 Chapter 4 • Networ k Security
Application-aware NGFWs preven t port spoofing by identifying any app lica tion that does not behave like a webserver. Fur ther, NGFWs can usually identify the specific p ro- gram (like Shazam does fo r n1usic).
Identifying applications, while valuable, is expensive.
• First, the a p plication-aware firewall m ust collect all traffic in a connection.
• If TCP is being used by the a pplication, all of the packets d e livering an app lica- tion n1essage must be brought togeth er, their TCP segments extracted, a nd th e applica tion message reconstructed.
• This must be done for multiple application messages, sometimes m any.
• Finally, the pattern across man y application n1essages must be examined and com- pared to the fingerprints of various known a pplications. This may cause the NGFW to tem 1inate the connection and report its findings to a security adn,inistrator.33
Applica tion awareness allo\'l'S firewa ll administrators to create rules for individ- ual applica tions. Going back to F igure 4-18, an NGFW firewa ll \,•o uld add a colum n for Application. For example, companies m ay not permit You Tube traffic or may lim it it to avoid overloading th e neh,•ork. And, of course, if a m alware program is iden tified, its traffic can be stopped automa tically. By providing visibility into a pplication tra ffic patterns, NGFWs also provide infom1ation fo r be tter neh'l'ork n1anagem ent.
Test Yo u r Und erstand ing
27. a) Why a re SPI firewalls lin1ited in their ability to detect a ttack packets? b) How d o NGFWs ad d ress this proble m? c) Think of a t least h'l'o specific examples of how a pplication information can be used to increase security. d ) Wh y a re NGFWs more expensive than SPI fi rewa lls? (The answer is not in the text.)
Next-Generation Rrewalls Are Application-Aware
Can base decisions on the actual application that is creating traffic
Advantages of Being Application Aware
Detects port spoofing (running a different application on a well-known port number).
Create accept/reject rules based on specific applications.
Recognize specific malware applications, providing laser-focused firewall decisions.
For network and security management, can see which applications are using which percentages of network traffic
Tradeoffs
Processing requirements make NGFWs more expensive than SPI firewalls per packet
Richer information requires greater management effort to create and implement policies and rules
FIGURE 4- 19 Ne xt-Generatio n (App licat ion Awa re) Firewa lls (Study Figure)
33 This complex process used to require a prohibiti ve amount of processing power. However, application· specific in tegrated circuits (AS[Cs) can now be built to handle application identification. ASlCs put many calculations normally done in software into hardware instead. This is far foster than software processing, g iving AS!Cs the power to handle their loads.
Chapter 4 • Network Security 14 1
Intrusion Dete ction Syst e m s {IDSs)
It \,•ould be nruve to expect firewalls to stop all attack packets. Most obviously, they do not drop suspicious packets-only d efinite attack packets. Intrusion detection systems (IDSs) \,•ere created to supplement firewalls by foc using specifically o n identifying suspicious transmissions. When they find suspicious packet streams that may create a problem, they log them for security adnunistrators to exanune. If a threat appears to be very serious, the IDS will send an alarm to security administrators. Next-generation firewall processing grew out of IDS processing methods, b ut NGFWs are still limited to stopping definite attacks. NGFWs are like locks, whereas IDSs are like burglar alarms.
Intrusion detection systems (IDSs) were created to supplement firewalls by focusing specifically on identifying suspicious transmissions.
Fal se Positives (False Alarms) Have you ever had a neighbor \,vith a twitchy car alam1 that \,•en t off \,vhenever a ca t \,•alked near the car? Unfortunately, intrusion detec- tion systems also genera te many false alarms, which are called false positives. An IDS sends the average b usiness about 10,000 security a lerts per day, only a handful of which are real threats. Finding these real attacks is literally like finding a needle in a haystack.34
Con1panies n1ust invest sufficient human resources into handling alarms and reading log files. Even then, finding the one or two true attacks in a long strean1 of false alarms leads to frustration and flagging vigilance.
No Alternatives Although IDSs create many problems, firms today realize that it is in1possible to prevent breaches auton1atically and tha t they mus t be able to iden tify and s top attacks if they succeed initially. learning to look for meaningful patterns in IDS a lerts and log files is enormously difficult, but there is no alternative.
Test Your Understanding
28. a) Do IDSs stop packets? b) Wh y are they painful to use? c) How do they offer a broader picture of the threat en vironn1e nt than NGFWs?
The Need for Intrusion Detection
Firewalls only stop provable attack packets
Some way is needed to identify suspicious transmissions
Intrusion Detection System (IDS) Characteristics
Like car alarms for security
If detect suspicious activity, send a warning or shut down the threat
Problem of many false alarms (false positives)
FIGURE 4 ·20 Intrusion Detection Systems (IDSs) (Study Figure)
34 John E. Dunn, "Average US Business Fields 10,000 Security Alerts per Day, Damballa Analy• s is Finds," Tcrchworld.com, May 13, 20 14. http://ncws.techworld.com/sccurity/35 16426/ avcragc,.us--busincss•fi e:lds--1()()()().security-aJerts-per--day-damballa·anaJysis-finds/.
142 C hapter 4 • Network Security
IN MORE DEPTH
Antivirus Protection
Both firewalls and antivirus programs attempt to stop attacks. However, they work at different levels. Firewalls examine packets and groups of packets. Antivirus (AV) programs, in contrast, examine entire files. When an e-mail message arrives at a mail server, the server may pass any attachment to an AV program for vetting .
Firewalls examine packets and groups of packets, Antivirus (AV) programs, in contrast examine entire files.
Antivirus programs do not simply check for viruses. They also examine the attached file for worms, Trojan horses, and other forms of malware. These programs were named antivirus pro- grams when "malware" was roughly synonymous w it h "virus." A lt hough the scope of detection has broadened, the name antivirus has stuck.
Traditionally, AV programs only looked for malware signatures, which are snippets of code that let the ant ivirus program identify particular malware programs. Signature detection is still w idely used, but it is no longer sufficient. First, the number of malware programs is now so large that the processing power to detect all known malware via signature detection would drive any computer to its knees. More fundamentally, many malware programs now mutate constantly, rewriting t heir code in a way that maintains functionality while making the matching of strings of characters useless.
Today, AV programs also look for behavioral patterns-things the file is attempting to do. To give an extreme example, if the file is a program t hat w ill try to reformat a computer's hard drive, that is an undeniable indicat ion that the program is malware. Some AV programs even run the suspect program in a sandbox (environment it cannot escape from) to watch it operate.
Test Your Und erstand ing
29. a) Distinguish between w hat firewalls look at and what antivirus programs look at. b) Are AV programs used to detect more t han viruses? Explain. c) Distinguish between signature detection and behavioral pattern detection. d) Why is signature detection not enough?
Arewalls versus Antlvlrus Programs
Firewalls analyze packets and streams of packets
Antivlrus programs analyze files
Search for All Malware, Not Only Viruses
Signatures versus Behavior
Tradltlonally looked for signatures (characteristic bit patterns) for specific malware
Malware writers now create code that mutates slightly each time it runs
Defeats most signature detection
Now, also look at behavioral patterns: What programs do
FIGURE 4-21 An tivirus Protection (Study Figure)
END-OF-CHAPTER QUESTIONS
Thought Questions
4-1. What are your choices if you are hit by ransom- ware? Which would you recommend?
4-2. a) What form of authentication would you rec- ommend for relatively unimportant resources? Justify your answer. b) What form of authen- tication would you recommend for your most sensitive resources?
4-3. What is the promise of newer authentication systems?
4-4. Is the supplicant the true party or an impostor? 4-5. In digital certificate authentication, the suppli-
cant could impersonate the true party by doing the calculation with the true party's private key. What prevents impostors from doing this?
Chapter 4 • Network Security 143
4-6. What are the implications for digital certificate authentication if the true party's private key is stolen?
4-7. a) If someone in your firm gives you his or her password and you log into that person's account, is this hacking? Justify your answer in terms of the definition of hacking. b) If you think someone in your office is sending slanderous e-mail about you, is it hacking if you break into that person's e-mail account to see if this is true? Justify using the defini- tion. c) If you Jog into a server at your bank to test their security, is this hacking? Justify using the definition.
Harder Thought Questions (You May Not Get These, but Try)
4-8. When a sales clerk accepts a credit card pay- ment, he or she should type the last four digits of the credit card into the terminal in order for the terminal to verify that the last four digits on the card are the same as on the magnetic stripe. Why should the sales clerk not ask the customer what the last four digits are?
Perspective Questions
4-10. What was the most surprising thing you learned in this chapter?
4-9. Keys and passwords must be Jong. Yet most personal identification numbers (PINs) that you type when you use a debit card are only four or six characters Jong. Yet this is safe. Why?
4-11. What was the most difficult part of this chapter for you?
This page intentionally left blank
Chapter 5
Ethernet (802.3) Switched LANs
LEARNING OBJECTIVES
By the end of this chapter, you should be able to: • Explain basic Ethernet terminology and hov,r Ethernet is standardized.
• Describe basic physical propagation concepts: digital and binary signaling and why they reduce transmission errors; full-duplex transmission, and parallel transmission.
• Explain the technologies of 4-pair UTP and optical fiber; compare their relative strengths and weaknesses, including cost and transmission distances.
• Design a physical network based on knowledge of transmission requirements and Ethernet physical link standards, including link aggregation.
• Describe the Ethernet II Frame. Explain basic Ethernet data link layer switch operation.
• Describe security threats to Ethernet and ways to deal ,vith them.
ETHERNET BEGINS
Bob Metcalfe, a PhD student at Harvard University, ,vrote his dissertation on the new ARPANET (,vhich ,vould later morph into the Internet). His committee rejected it as insufficiently theoretical. Metcalfe ,vas d evastated. He had been offered a position at the Xerox Palo Alto Research Center, ,vhich ,vas doing cutting-edge computer and n etwork research. In particular, PARC had just built the Alto, ,vhich looked like a PC but ,vas far more po,verful. It had a full-page display and a graphical user inter- face using the mouse, which PARC adopted from Doug Engelbart's Augmentation Research Center at Stanford Research Institute. Apple later popularized this input device with the Macintosh.
145
146 Chapter 5 • Ethernet (802.3) Switched LANs
When Metcalfe told Xerox that he wou ld not be graduating, PARC told him to con1e an y\,•ay and finish his d isserta tion \,vhile he \Vorked there. Metca lfe asked for a brief delay so he could first visi t the University of Ha\,vai' i's ALOHANET project. PARC accepted the delay. ALOHANET did packet transmission using radio. If two sta- tions transnutted at the san1e time, their colliding packets would be garbled and would not be retransn1itted. During his visit, Metcalfe analyzed the ALOHANET protocol and found \,•ays to reduce collisions. He added the ana lysis to his dissertation. This time, his conm1ittee accepted it.
At Xerox, his job \,vas to network the Altos. Metcalfe realized that his improve- n1ents to the ALOHANET protocol \,•ou ld permit him to run a similar network over physical transn1ission media. There \,•ere several physical med ia that he could use. To keep his op tions open, he referred to physical media generically as the ether, after a d iscredited nineteenth-century theory about how light propagated. He wrote sofrn•are and hand-soldered printed circuit boards to n1ake his vision real. When his Eth ernet network becan1e operationa l, it ran at 2 .94 Mbps, which was enorn1ous speed for that time.
When Xerox decided not to comn1ercialize Ethernet, Metca lfe started his own company. In those days, there \,•ere several wired loca l area network standards. Ho\,•ever, the brilliant simp licity of Metca lfe's protocol meant that Ethernet prod- ucts \,•ere subs tantially cheaper and quicker to develop than products following competing protocols. Ethernet quickly blew the con1petition ou t of the ½•ater. Since then, Ethernet has continued its dominance in wired loca l area networks and has gro\,•n remarkab ly in speed. In this chap ter, you \,•ill see many examples of ho\,, Ethernet continues to be a rela tively inexpensive technology tha t still provides the speed and other affordances tha t con1panies need.
Ethernet is inexpensive but does what corporations need. This is its formula for dominance in wired local area networks.
INTRODUCTION
Local Area Networks
Local a rea netwo rks (LAN s) are networks that operate on the customer premises,1
which is the property o\,•ned by the organization tha t uses the network. This m ight be a home, an entire building, a university campus, or an industrial park. On its own pren1ises, the con1pany can use whatever technology standards it wishes.
Local area networks (LANs) are networks that operate on a customer premises-the property owned by the organization that uses the network.
1 "Custome r premises" is always spe lled as plurat althoug h it is used as if it is sing uJar. [t's a legal jargon thin g.
Chapter 5 • Ethernet (802.3) Switched LANs 147
Operate on a customer premises
The property owned by the person or organization that uses the network
Companies can use whatever technology standards they wish
FIGURE 5 -1 Local Area Networks (LANs) (Study Figure)
Test Your Understanding
1. What is a local area network (LAN)?
Perspective: Layer 1 and Layer 2 Standards
Let's begin wi tha brief recap of somedistinctions mad e in the first two chapters. Figure 5-2 sho\,•s a s½•itch ed Ethernet ne h,•ork. Etherne t is a single-network s tandard, so it is governed by physical and data link layer standard s. The messages that travel from the source host to the destina tion host are frnmes, forwa rd ing devices are s,vilches, and Ethernet uses EUI-48 d ata link layer addresses instead of IP addresses. The path that a frame travels through an Ethernet network is a datn link. The transn1ission links that connect pa irs of d evices are physical links. Ethernet signaling standards govern physica l layer transmission.
Today, LAN standards com e from the IEEE Standards Associa tion, through its 802 LAN/MAN Standards Committee. Ethernet standards specifically come fron1 the Com n1ittee's 802.3 Wor king G roup (Figure 5-3). F igure 5-4 notes tha t aln1ost all p h ysica l and d a ta li n k layer standards are o pe n system in terconnectio n (OSI) standards. It also no tes tha t E thernet standard s are submitted to the Internationa l Organiza tio n for Standard s (ISO) by the IEEE for accep tance as an official OSI s tan- dard. However, ISO always accep ts these submissions. In fact, as soon as the 802.3 Working Gro up fin ishes a s ta ndard (and son1e times even before), vendors begi n developin g products.
Physical Link : Path Between
Adjacent Devices
--i:::.----' .... , Ethernet Switch B
Ethernet Swttch D
Server X EUl-48 Address
F2-44 -ED-1 E-F5-3F
Data Link: Path o f Frame
Through a ,.... Single Network ... -..: --..:: ... ::.--.
Ethernet Switc h C
Ethernet Switch E
Client PC 1 56-BB-4C-E7-FF-4A
Ethernet Switch F
ServerY F9-4 7-12-AE-C4-7B
FIGURE 5- 2 Swit ched Ethernet Network: Physical and Dat a Lin ks
148 Chapter 5 • Ethernet (802.3) Switched LANs
Requires standards at Layers 1 (wires and signals) and 2 (frames and switches)
OSI standards dominate at these layers
Ethernet standards are created by the IEEE 802.3 Working Group of the IEEE Standards Association's 802 LAN/MAN standards committee
Called 802.3 standards
Other Working Groups exist (e.g., the 802.11 WG creates Wi-Fi standards)
Submitted to ISO, which ratifies them as OSI standards
FIGURE 5.3 Ethernet Origins
Test Your Understanding
2. a) A t \,•hat layers a re Ethernet standards defined ? b) Are Ethernet m essages packets or fra mes? c) Are Etherne t forwarding devices switches or rou ters? d ) Is the pa th an Ethernet n1essage takes fron1 the source host to the d estination host a physica l link, a data link, or a route? e) Does Ethernet use EUI-48 addresses or IP addresses? f) Why are Ethernet stand ards form ally called 802.3 standards?
Basic Physica l Layer Terminology
Workgroup Switch es and Core Sw itches Figure 5-5 sho\VS that Ethernet net- works have two types of switches.
• Workgroup switches connect individual hosts to the network.
• In turn, core sw itches connect s\,•itches to other switches. An Ethernet network's collection of core switches is called the network's core.
Workgroup switches conn ect individual hosts to the network.
Core switches connect switches to o ther switches.
Ethernet Dominant Standards Layer (802.3 Standards) Architecture
Application None
Transport Internet (IETF)
Internet
Data link Yes OSI (ISO and ITU-n
Physical Yes
FIGURE 5-4 Ethernet Standards a nd OSI Standards
Comments
Ethernet standards created by the 802.3 Working Group, submitted to ISO for f inal acceptance as st andards.
Chapter 5 • Ethernet (802.3) Switched LANs 149
Trunk Links (Mostly Optical Fiber)
Core Ethernet Swttch B
Core Ethernet Switch A
Core Ethernet Switch C
Core
Workgroup Work group Work group Ethernet Swrtch D Ethernet Switch E Access Links Ethernet Switch F - -(Mostly UTP) V
Client PC 1 Server X Server Y
FIG URE 5-5 Types of Ethernet Switches and Transmission Li nks
Figure 5-6 sho\,•s a typical \,•orkgroup switch. It is 48 cm (19 inches) w ide to fit into a standard equipment rack. It is 9 cm (3.5 inches) tall. Core s\,•itches are the san1e width and depth, but their heights typically range fron1 abou t 18 cm (7 inches) to a n1eter (39.37 inches) tall.
Access Links a nd Trunk Links Just as there are two types of Ethernet switches, there are two types of physica l links.
• Access links connect individual hosts to their workgroup switches.
• Trunk links connect switches to other switches.
FIGURE S-6 Ethernet Workgroup Switch with 48 Ports
150 Chapter S • Ethernet (802.3) Switch ed LANs
Test Your Understanding
3 . a) ___ switches connect users to the network. b) ___ s,vitches connect switches to other s\\•i tches. c) __ links connect users to workgroup S\\•i tches. d) _ links connect s\\,j tches to o ther s,vi tches.
ETHERNET PHYSICAL LAYER STANDARDS
Physical layer standa rds govern physica l links between devices. This includes con- nectors, plugs, transmission media, a nd s igna ling. We look a t sign al ing fi rst because it in trod uces concepts \Ve ",jll need ,vhe n "'e look a t transmission n1edia.
Test Your Unde rs tanding
4. \Nhat four things do physical layer standards govern?
Signaling Bits an d Signal s A frame is a long series o f bi ts (ls and Os). To transn1it the
fran,e over a physical link, the sender converts these ls and Os into physical signals. These signals propagate (travel) down the transn1ission link to the device a t the other end. That device converts the s ignal back into the ls and Os of the frame.
Binary Signa ling Figure 5-7 illustrates the two n1ain types o f sign aling, binary a nd digi tal signaling. Binary signa ling has two s tates (conditions), which n,ay be h,•o voltage levels or ligh t be ing turned on or off. O ne state represents a 0. The other state represents a 1. In the figure, a 1 is represented as a high vol tage, a nd a O is represented as a O voltage. In optical s igna ling, a light being turned o n typically represen ts a 1, and light be ing turned off typically rep resents a 0.
Binary Transmission
1 -
0 -
Clock Cycle
In binary transmission. there are two states. One bit is sent in each clock cycle.
Time
FIG URE 5 -7 Bina ry a nd Dig ital Signaling
11 -
10-
01-
00 -
Oigrtal Transmission
Clock Cycle Time
In digital transmission, there are a few states (2, 4. 8 , 16, .... ) More than one bit is sent in each clock cycle.
Chapter 5 • Ethernet (802.3) Switched LANs 151
Digital Signaling The figure a lso sho\VS digital signaling, in \,•hich there are a fe,v alternative states (2, 4, 8, etc.).2 How ma n y is "a few?" In some systems, there can be 64 or even 256 states, but the number of states is usually m uch lower. The number of alternative s tates is a lways a po\,•er of two-h,•o, four, eight, sixteen, and so forth.
In binary signaling, there are two possible states.
In digital signaling, there are a few possible alternative states (2, 4, 8, etc.).
Adding states increases the complexity and cost of signaling. Ho\,•ever, Figure 5-7 sho\,'S that if you have n1ultiple s ta tes, you ca n send multiple bits in a sing le clock cycle. Wi th two s tates, you can on ly represent a s in gle 1 or a 0. With four s tates, however, the lowest sta te might represen t 00, the next lo\vest state m ight represent 01, th e next 10, and the highest 11. Wi th four s tates, then, you can send two bi ts at a tin1e.
In Chapter 2, \,•e sa\,, tha t the number of alternative states is hvo to th e po\,•er of the number of bits. In symbo ls, this is a = zb. In digital signaling, a is the number of pos- sible altern ative states, and bis the number of bits transn1itted in each clock cycle. For exan1ple, if you transmit o ne bit per clock cycle, then b is one, and a is 2. This is binary signaling. The h,•o alternatives are 1 and 0. If you wish to transm it three bits per clock cycle, you need 23 (8) a lternative states.
Equation 1: a = zb
Binary Is a Special Case of Digital We have talked about binary and digital transmission systen1s as if they are different. Actually, binary transmission is a special case of d igital transmission. In binary transn1ission, few means "h,•o." All transmission is digital.
Binary transmission is a special case of d igital signaling. Not all signa ling is binary, but all signaling is digital.
Clock Cycles Note the term clock cycle in the figure. When the sender transnuts, it holds the transmission state constant for a brief period. This period is the clock cycle. The receiver can read the signal at any tin1e w ithin the clock cycle. As clock cycles get shorter, m ore state signals can be transn1itted per second, but it becomes more difficult to read then1 at the receiving end. To get a feeling for this, note that if the transnussion s peed is one gigabit per second (1 Gbps) and binary transmission is used , each clock cycle is only one billionth of a second !
2 lf '1>i'-' means two, w here does "'digital" come from? [t comes from the fact tha t we call our JO fingers digits. In fact, some early computer systems operated on Base 10 arithmcHc, the same arithmetic that we 10-fingcred people use. Very quickly, however, the advantages of building computers and transmission S)'Stcms that used two or a multiple o f two states brought about binary and digital computation and also binary and d igita l signaling.
152 Chapter 5 • Ethemet (802.3) Switched LANs
Test Your Understanding
5. a) Distinguish between binary and digital signaling. b) if you w ish to transmit three bits per clock cycle, how many s tates must the system have? (Answer: 8) c) If you want to transmit five bits per clock cycle, how many states must the system have? d) If you know that a system has 16 states, hov,r many bits can it send per clock cycle? (Answer: 4) e) The 802.llac Wi-Fi standard uS<.>S 256 states. How many bits can it send per clock cycle? f) Every time you double the number of states, how many more bits can you transmit? (The answer is not in the text.) g) Why is the signal held oonstant over each clock cycle? h) How long is the clock cycle if I transmit at 100 Mbps per seoond using signaling with four states?
4-Pair Unshielded Twisted Pair (UTP) Physical Links
Physical links connect adjacent devices a long the data link in a single network. Physical layer standards specifically govern transmission med ia, connectors, and plugs. Ethernet uses two types of cabling today. These are 4-pair UTP and optical fiber.
4-Pair Unshielded Twisted Pair (un>) cables Ethernet oopper \vire is called 4-pair unshielded3 twisted pair (UTP) cabling because the cord contains eight \vireS arranged in four pairs. Figure 5-8 shows that two wires of each pair are l\visted around ~,ach other several
8-Pin RJ-45 Connector UTPCord
Jacket
Industry Standard Pen
UTP Cord
Jacket
FIGURE 5-8 4-Pair Unshielded Twisted Pai r (UTPJ Ethernet Cable
3 Ethcmet cable is unshielded, To operate in harsh electromagnetic environments, cords may be protected by surrounding the entire cord and perhaps even individual pairs with metal /oil shielding. Although plac- ing tinfoil on your head will not protect you from the government eavesdropping on your thoughts, metal foil prevents the electromagnetic background energy from interfering with the transmitted signal. Today~ shielded cabling is rare.
Chapter 5 • Ethernet (802.3) Switched LANs 153
RJ-45 Jack
~ • --:;:,:~
RJ-45 Connector RJ-45 Connector
.)
FIGURE 5-9 Ethernet (RJ-4 5) Connector and Jack
times per inch.4 F;gure 5-9 sho\,•s the RJ-45 connectors and RJ-45 jacks that 4-pair UTP uses. These cords are popularly called Ethernet cords because Ethernet is their n1ain use today, and their connectors and jacks are popularly called Ethernet connectors and Ethernet jacks.
Parallel Transmission Signals are sent b y changing voltage or o ther characteristics of an electrical s ignal. Ethernet transmits on all four pairs in each direction sinlultaneously. This is parallel transmission. As Figure 5-10 shows, Ethernet transmits four times as fast as it could if it only had a single pair.5 The benefit of parallel transmission is rugher speed.
Th e benefit of parallel transmission is higher transmission speed.
Serial Transm ission (N bits per clock cycle)
Parallel Transmission (4 ·N bits per clock cycle)
1 Clock Cycle ,( ),
""'Ii N bits
1 Clock Cycle - .. N bits
N bits
N bits
Nbits
FIGURE 5-1 0 Parallel Transmission in Ethernet
1 UTP Pair
4 UTP Pairs
4 The two wires of each pair are twisted around each other because it limits the e ffects o f nearby electromag- netic intcrforcncc from lights, electrical motors, and other wire pairs, even in the same 4-pair cable. In the nineteenth century, Alexander Craham Bell realized tha t if you twist the two wires in a pair, intcrforcnce adds to the signal on half o f the twist and subtracts from the s ignal on the other half. The two will cancel out. Docs it work t"his perfectly? No, but it works quite well. 5 Ethernet is not the only transmission technology to use parallel transmission. [n the past, many printer interfaces used eight or more transmission lines in each direction. Most computers, in turn, cormcct their components with a transmission bus that has 100 or more w ires in parallel.
154 Chapter S • Ethernet (802.3) Switched LANs
Rad,a bon
Each pair radiates radio signals, dissipating the signal. This causes attenuation, which increases with propagation distance.
FIGURE 5 -11 Radiat ive Attenuation in 4-Pair UTP
Radiat ive Attenuation Ethernet cable consists of lo ng co pper ,v ires. Th is n,a kes it an excellent antenna. As the s ign a l travels down the cable, so me of the sig- nal rad iates away, d issipating the signal's energy. Dissipation grows w ith distance (Figure 5-11). Beyond son,e d ista nce, the signal becon,es unreadable.
Test Your Understanding
6. a) Ho,v many wires are there in Ethernet cable? b) How is each pair organized? c) What are the t"'O nan,es for connectors and jacks? d) How does Ethernet use parallel trans1nission? e) What is the benefit of parallel transmission? f) Wha t propagation problem limits tra nsmission d is tance in 4-pair UTP?
Maximum Cord Distance Ho,v far can a UTP cord carry a signal? Figure 5-12 s hows that maximun, trans1n ission distance depe nds on two things. One is the qua lity o f the UTP cable. In increasing order of quali ty, there a re Category Se, Category 6, and Category 6A .6 These are norn,ally called Cat Se, Cat 6, a nd Cat 6A.7 Today, nearly all
Ethernet Signaling Standard
lOOBASE-TX
lOOOBASE-T
2.SGBASE-1'
SGBASE-1'
lOGBASE-T
lOGBASE-T
Transmission Speed
100 Mbps
1 Gbps
2.5 Gbps
5 Gbps
10 Gbps
10 Gbps
Cable Quality Category
Cat Se. 6, 6A
Cat Se, 6,6A
Cat Se, 6, 6A
Cat Se, 6,6A
Cat 6, Cat 6A
Cat 6A
e.New standards desig ned in response to faster Wt- Fi Access Points.
Maximum Cord Length
100 meters
100 meters
100 meters
100 meters
55 meters
100 meters
FIGURE 5- 12 Ethernet Signal ing Standards, Transmission Speed, UTP Cable Quality, and Maximum Cord Length for 4-Pair UTP
6ThC' 802.3 \.Vorking Croup docs ,,ot create wiring qualil)' standards. 11,csc standards come from the lillcrna• tional Organization for Sta 1,dardization and the fo tcrnational Electrotcchnical Commissio1, {1S0/fEC). Th~ 802.3 Vl'orking Group adds signaling standards. 7 Category Sc is Category 5 enha1,ccd. Category 6A is Cat~gory 6 Augmented. Why not make both enhanced or Auginc1'1ed? 1'nc a1,swcr is that the standards we.re created at diffc.rent times by d iffere nt standards agc1\ci~s.
Chapter 5 • Ethemet (802.3) Switched LANs 155
installed Ethernet cable is Cat Se and Cat 6. As the figure shO\VS, both can carry Ethernet signals 100 meters at 1 Gbps.
The 10 Gbps Problem For 10 Gbps (l OGBASE-1), h owever, Cat 5e cannot be used at all, and Cat 6 qu ality cable can only span 55 meters. This is too short for many situations. Cat 6A will carry l OGBASE-T u p to 100 meters, but not much Cat 6A is installed.
2.5 Gbps and 5 Gbps for Wi-Fi Access Points There w as n ot much demand fo r speeds beyond 1 Gbps until recen tly. Ho\vever, wireless access points have been growing in sp eed. In Chap ter 6, \Ve \Vil! see that the ne\vest Wi-Fi s tandard can exceed sp eeds of 6 Gbps. Companies n eed to connect these n ew access points via 4-pair UTP to an Eth ernet switch. In resp onse, the 802.3 Workin g Group is developing two n ew standards. They are designed to car ry signals a t 2.5 Gbp s and 5 Gbps. More impor- tantly, they can use existing installed Cat Se and Cat 6 cabling. These two s tandards a re 2.5GBASE-T and SGBASE-T.8
Test Your Understanding
7. a) If you need to transmit 600 million b its per second 90 meters, w hat signa ling standard and UTP quality stan dard would you use? b ) If you n eed to transmit 7 Gb ps 40 meters, w hat signaling standard and UTP qua lity s tandards could you use? c) Which wou ld you p robably use if you w anted to sen d th e signal over installed cabling? d) If you need to transmit 7 Gb ps over 120 meters, w hat signaling s tandard and UTP q uality standard would you use?
8. For w hat s p ecific p urpose were th e 2.5GBASE-T and SGBASE-T standards d evelop ed ?
Optical Fiber (Fiber)
In optical fib e r, ligh t signals travel through g lass. Typ ically, light is turned on in a d ock cycle to represen t 1 and off to re p resen t 0. Figure 5-13 s h o\VS tha t a fib er cord con sists o f two fiber s trands- on e fo r propagation in e ach d irection . Two strands per- mit simultaneous two-way tra nsmission, \Vh ich is called full-d u plex trans mission.
Optical Fiber Cord w ith Two Strands for Full Duplex Communication
FIGURE 5-13 Optical Fiber (Fi ber) Cable
8 USB provides both data transmission a nd a little electrical power. Power over Ethernet (POE) optionally provides limited power to Ethernet devices, saving the cost of running power to them separately. POE gave enough wattage for early access points, but some new access point can be powered by Ethernet.
156 Chapter 5 • Ethernet (802.3) Switched LANs
Wavelength (peak to peak)
~--------------~ Amplitude t Amplijude
(Power) { (Power) -----'-,1--- ~--,-t ~ - -----'I-- --.,-- ~--------------~ ~--------------~
Wavelength Wavelength (trough to trough) (start to s tart)
light travels in waves. A wave's amplrtude is its power.
Optical fiber transmission is described in terms of wavelength. Wavelength is the physical d istance between comparable points on adjacent cycles.
Wavelengths for optical fiber are measured in nanometers (nm). LAN fiber uses 850 nm almost exclusively because it is cheap and usually sufficient.
Wide area networks use 1,310 and 1,550 nm light to support longer distances.
FIGURE 5- 14 Lig ht Transmission Metr ics
There is o n ly a s ingle UTP connector s tandard, but there are n1any types o f op tical fiber connectors. 9
Figure 5-14 s ho\,•s that lig ht \,•aves are measured in terms of , vavelength. This is the physical distance between comparable parts of two consecutive waves. This might be the beginning o f one cycle to the beginning of the next, h,•o consecutive peaks, two consecu- tive troughs, an d so forth. The amplitude of the wave, in tum, is its power (brightness).
Wavelengths are n1easured in nanometers (nm). In optical fiber, there are three wavelength "windows" in w hich light travels especially well. These are centered o n 850 nm, 1,310 nm, and 1,550 nn1. Each wind ow is about 50 nm wide.
Test Your Understanding
9. a) Ho\'I' does fiber usually transmit a 1? b) How do fib er cords typ ically p rovide full-dup lex transmission? c) In what units are light wavelengths measured? d ) What are the three wavelength \'l'indows used in fiber transn1ission? e) What is amplitude?
Multimode Fiber Propagation Limitations We saw in Figure 5-11 tha t propagation d istance is limited by rad ia tive a ttenuation. Figure 5-15 s hows tha t th is is not true in op tical fi ber. Signals travel through an inner g lass core covered by an outer glass clad d ing. There is total internal refl ection ½•hen a ligh t ray hits the core/ clad d ing boundary. There is no sign a l loss.
However, there is an other propagation problem in the mu ltimod e fiber used in LANs. For technical reasons, light rays can only en ter the core a t a few angles. These
9Surprisingly, media standards do not specify connectors and plugs. However, Figure 5-13 shows that fiber can use different connectors at each end. Fiber can work with whatever type of fiber port a switch or router uses.
Chapter 5 • Ethernet (802.3) Switched LANs 157
M ultimode Optical Fiber
G) Perfect Internal Reflection; No Radiative Attenuation
/ /
Light ,-.,
i Source Direct Mode ' 850 nm - Reflected Mode - 1 I "\.
0 Light can only enter the core at certain angles called modes. This creates arrival time delays called modal dispersion. At some distance, successive signals overlap, become unreadable.
FIGURE 5- 15 Modal Dispersion in Multimode Fiber
Cladding
Core of 50 Microns
Arrival Time Delay
light rays are called modes. LAN fiber cores are 50 microns in diameter-abou t the dian1eter of a human hair. Cores of this diameter can admit several modes, giving r ise to the nan1e multimode fiber.
In F igure 5-15, two n1odes are shown. One travels straight down the m iddle of the core. The other reflects a t a core/ cladding boundary. The reflected n1ode trav- els a longer distance and so takes slightly longer to reach the end. This time gap is called modal dispersion. If n1odal dispersion becon1es too large, the modes of successive light pulses w ill overlap too much for the receiver to understand the s ig- nal. (The Box "Fiber Modes and F iber Wavelengths" shov.•s that fiber \,v ith a much sn1aller dian1eter only allows the direct mode. This elim ina tes moda l d ispersion, allo\,•ing signa ls to travel greater distances \,•ithout becon1ing unreadable. How- ever, th is single-n1ode fiber is expensive. Multimode fiber distances are generally fine in LANs.)
Test Your Understanding
10. a) What is a n1ode? b) What is n1ultimode fiber? c) What lin1its transn1ission distance in n1ultimode fiber?
Maximum Optical Fiber Transmission Distances Earlier, we saw tha t lin1- its on propagation distance for 4-pair UTP depend on E thernet s igna ling standard, speed, and UTP cord quality. F igure 5-16 does the same for n1ultin1ode optical fiber. For mu ltimode fiber, the quality standards are optical multimode (OM) designa tions. OM3 and OM4 fiber are sold today. Figure 5-16 shov.•s that a t speeds up to 10 Gbps, both quality levels of n1ultin1ode fiber easily span the 200 to 300 meters commonly needed in LANs. For very high speeds, however, maximun1 transn1ission distances become uncomfortably short.
In multimode fiber, quality standards are optical multimode (OM) standards. OM3 and OM4 multimode fiber are sold today.
158 Chapter 5 • Ethernet (802.3) Switched LANs
Multimode Fiber Quality Standard
OM3
OM4
Ethernet Signaling Standard
1 OOOBASE-SX
l OGBASE-SR
40GBASE-SR4
l OOGBASE-SRlO
1 OOGBASE-SR4
1 OOOBASE-SX
lOGBASE-SR
40GBASE-SR4
1OOGBASE-SR10
1 OOGBASE-SR4
light Wavelength
850nm
850nm
850nm
850nm
850nm
850nm
850nm
850nm
850nm
850nm
Transmission Speed
1 Gbps
10 Gbps
40 Gbps
100 Gbps
100 Gbps
1 Gbps
10 Gbps
40 Gbps
100 Gbps
100 Gbps
Maximum Transmission Distance
550 meters
300 meters
100 meters
100 meters
70 meters
1,000 meters
440 meters
125 meters
1 SO meters
100 meters
FIGURE 5- 16 Ethernet Multimode Fiber Signaling Speed, Optical Fiber Qua lity Sta ndards, and Maximum Transm ission D istance IO
To see ho\,, to use the figure, suppose you need to provide 10 Gbps signaling over 250 n1e ters.
• O n OM3 cabli ng, 10GBASE-SR has a maxin1um tra nsn1ission distance of 300 meters, and OM4 fi ber raises this to 440 meters. Both \,•ould work, but OM3 fiber is less expensive and so wou ld be the preferred choice.
• In tum, if the required distance is 330 n1eters, only more expensive OM4 fib er would \,•ork beca use the maximun1 propagation distance for OM3 at 10 Gbps is only 300 n1e ters.
• No\,, suppose tha t th e maximun1 transmission distance is 85 meters, w hich is close to the length of a footba ll fi eld. OM3 and OM4 fiber wou ld both \,•ork. Ho\,•ever, fron1 F igure 5-12, so would Cat 6A UTP. UTP is less expens ive than fiber, so when UTP can do the job, it is the correct choice.
In Figure 5-16, all choices use mu ltimode fiber and 850 nm light. At 100 Gbps, n1aximun1 cord d istances fa ll below the traditional minin1ums for LAN physica l links. Companies may now have to use n1ore expensive 1,310 nm and 1,550 nm ligh t sources that carry signals farther in some of their links. They n1ay even begin to implement son1e links using single-n1ode fiber, \,•hich is described in the Box, "Fiber Modes and light Wavelengths."
10 Earlier, we looked a t parallel transmission in the case of 4-pair UTP. The40CBASE-SR4 and JOOGBASE-SRIO and JOOBASE-SR4 optical fiber standards also use parallel transmission. The 40CBASE.SR4 standard uses four fiber strands in each d irection, each operating at 10 Gbps; this gives a total of 40 Gbps. The IOOC:BASE.SRJO s tandard uses ten strands in each direction, also transmitting at JO Gbps per strand. The JOOGBASE-SR4 standard uses four strands operating at 25 Gbps. SR. by the way, means Short Range, indicating that it is designed for LANs.
Chapter 5 • Ethernet (802.3) Switched LANs 159
The Coming Explosion in Multimode Fiber Speed Standards In its first 27 years, the 802.3 Working Group only produced s ix speed standards. We are in the middle of a very brief period in which Ethernet will get an exp losion in new standard speeds. Earlier, we saw 2.5GBASE-SX and 5BASE-SX, w hich \Vere created for th e new fa ster Wi-Fi access p oints. New higher-speed fiber standards, in tum, are needed for hypersca le (very large) server farms. The 40GBASE-SX and lOOGBASE-SX s tandards are already in p lace, but companies want even fas ter standa rds as well as n1ore stan- dards between the highest a nd the lo\,•est. The ne\,v standards w ill probab ly focus o n 25 Gbps, 200 Gbps, and 400 Gbps. Fortuna tely, fe"' corpora tions have hyperscale da ta centers, so the relevance of these ne\,v extremely high-speed standards shou ld be limited .
Test Your Un derstanding
11. a) If I wish to run Ethernet over fiber using 1000BASE-SX signaling over 500 meters, \'\'hat are my options? (Ans\-ver: Both OM3 or OM4 cabling will be sufficient.) b) Which should I choose? Justify your answer. c) If I wish to run Eth- ernet over fib er using lOOGBASE-SR signaling over 100 meters, \,•hat op tions do I have? d) Which should I ch oose? Justify you r answer. e) If I w ish to run Eth- ernet over fiber using 100GBASE-SR10 signaling over 70 meters, \,•ha t o ptions do I have? f) What is the farthest I can transn1it a signal \,•ith lOOGBASE-SR signaling? g) What is the quality designa tor for n1ultimode optical fiber?
Link Aggregation (Bonding) Ethernet speeds have traditionally increased by factors of 10 (10 Mbps, 100 Mbps, 1 Gbps, 10 Gbps). What should you do if you only need slightly n1ore speed than a certain stan- dard specifies? For example, what if you have a pair of lOOOBASE-SX switches that you need to connect at 1.8 Gbps? You could replace the switches with lOGBASE-SR s\,•itches. (In son1e cases, you can replace ports or groups of ports o n a s\,•itch.) However, upgrading by a factor of 10 can be expensive.
Figure 5-17 illustrates tha t a con1pany can also in.stall two or more UTP or fiber trunk links to connect a pair of 1000BASE-SX switches. The IEEE calls this link aggregation.
Optical Fiber Cord Optical
Fi ber Cord
1000BASE-SX Swi tch
Two links provide 2 Gbps of tr unk capacity between the switches.
1000BASE-SX Switch
FIGURE 5- 17 Link Aggregation (Bond ing)
160 Chapter S • Ethernet (802.3) Switched LANs
Using two cords to increase distance.
This is NOT link aggregation.
FIGURE 5· 18 Link Aggregation Increases Spe ed, not Distance
Networking professionals also call it bonding. Ethernet supports link aggregation for both UTP and fib er ports. If you need 1.8 Gbps of capacity to connect two switches, you can use two bonded fiber cords and lOOOBASE-SX signaling.
A corrunon mistake in understanding link aggregation is to confuse increasing speed-\vhich link aggregation is designed to do-and increasing d is tance, wh ic h it d istinctly does 11ot do. Figure 5-18 sho\\'S this mistaken understanding.
Link aggregation uses existing ports, so it usually costs much less tha n purchas- ing new faste r switches. You do have to add anothe r physical li nk o r t\\'O, but cords are cheap compared to switch u pgrades. Still, a fter two or three aggregated links, the co,npany should cmnpare the cost of fur ther link aggregation wi th the cost o f a bigger increase in capacity by n1oving up to the next Etherne t speed. A 10-fold increase is likely to be a solution tha t lasts a long time.
Test Your Understanding
12. a) If I wish to connect two switches wi th fiber a t a s peed o f 30 Gbps, w ha t o ptions do I have? b) Which would you choose? Justify your ans,ver.
Persp ective on Purchasing Physical Links in Ethernet
Network budgets are gro\ving slowly if a t all. A t the same time, de,nand for service is gro\\•ing rap idly. Compan ies must spend their money very careh1lly beca use over- spending o n some physica l links "~II deny fun ds for others. The key general principle of net\\•ork design is, "Choose the least expensive option that "'ill achieve the required speed." If 4-pa ir UTP can do it, don't use fiber. If OM3 fiber can do it, don't buy OM4. If multimode fib e r can do it, don't use single-mode fiber. If link aggregation is cheaper than going up to the next speed s tand ard, use it. Of course, require,nents should reflect not o nly today's traffic but also the likely increase in demand over a reasonable future time frame. There ,nay be additional considerations in son,e cases. For example, a finn n1ay have a policy of only using OM4 fiber for h1ture li nks. Ho,vever, learn the key genera l principle.
Th e key general principle of network design is, "Choose the least expensive option that will achieve the required speed."
Chapter 5 • Ethernet (802.3) Switched LANs 161
Test Your Understanding
13. Explain the key general principle o f neh-vork design and why you should fo llo,-v it.
Single-Mode and Multimode Fibe r Optical fiber offers single-mode and multimode fiber technology. Figure 5-19 shows that the main difference is core diameter. M ultimode fiber has a " thick" core diameter of SO microns (millions of a meter). This is roughly the thickness of human hair. Single-mode fiber has a core diameter of only 8.3 microns.
As we saw earlier in the chapter, the "thick" SO-micron core diameter of mult imode fiber permits multiple modes to enter the fiber. This leads to modal dispersion, which limits distance. As core diameter decreases, fewer angle modes can enter the core. A t 8.3 microns, only a single mode can enter the core. Consequently, fiber w ith a diameter of 8.3 microns is called single- mode fiber. In single-mode fiber, there is no modal dispersion, so signals travel much farther than they do in multimode fiber. The only remaining limitation is absorption of the light by the core's glass. This glass is very pure, so this absorptive attenuation is small. Single-mode fiber can often span many kilometers.
On the downside, single-mode fiber is more expensive than multi mode fiber to buy and install. In addition, single-mode fiber transmission normally eschews inexpensive 850 nm light sources in favor of more expensive 1,3 10 nm and 1,550 nm light sources, which can send the signal farther. Until now, mult imode fiber using 850 nm light sources has been fine for LANs. In hyperscale server farms, however, we can expect more single-mode fiber operating w ith greater light wavelengths.
Test Your Understanding
14. a) Compare relative cost and maximum propagation distance for multimode and single-mode fiber. b) Why does multimode fiber dominate LAN installations? c) For LAN fiber, what is the dominant signal wavelength? d) Why does this wave- length dominate?
Light Source 850 nm,
1,310 nm, or 1,550 nm
,-----------------:=1-- Cladding
There is no modal d ispersion
Thin f Core f 8.3
Microns
There is only the absorptive attenuation of the glass core Th,s ,s very small, so distance hmrts are very large
FIGURE S-19 Si ngle-Mode Fiber
162 Chapter 5 • Ethernet (802.3) Switched LANs
THE ETHERNET DATA LINK LAYER SWITCHING AND FRAME SYNTAX STANDARD
Sin g le switch ed neh,•orks, li ke all s ingle n e h, •orks, requ ire s tandards a t th e physical and d ata link layers. We have jus t seen tha t E thernet h as many physical layer stan- dards. However, Figure 5-20 shows tha t Ethern e t only has a single n1ajor data link layer standard. This is the 802.3 MAC Layer Standard.
Physical Link and Data Link Length Restrictions
In the previous section, \,•e focused on distance limitations for pl1ysicnl links in Ethernet. Fortunately, neh,vork design focuses on dntn links beh'l'een h'l'o hosts or a host and a router. For data links, there is no distance lin1itation.
Figure 5-21 s h ows ho\'I' mu ltiple physical links a re organized into a data link.
• Th e sou rce sends a s igna l that is "Hig h-Low." It transm its usin g lOOOBASE-T sign a ling over the Cat Se UTP link to the first s\,•itch. The s ignal gets d is torted, but it is still readable as a 1 or O u p to 100 meters.
• Th e first s\,•itch does n o t merely amp lify the d istorted signa l. It completely regenerates th e signal. It sends a brand-new High-low signal. The link beh'l'een the fi rst and second S\'l'itches uses OM4 fib er. With lOOOBASE-SX, the signal can travel up to 1,000 meters.
• The second switch, like the firs t, regenerates the a rriving signal so that it can travel up to 100 meters to the destination host using lOOOBASE-T signaling over Cat 6 UTP
In the fi gure, the maximun1 length of the data link beh,•een the source and des tina tion hos t is 1,200 meters. Th is can easily be lengthened b y adding more switch es a nd p hysical links. The n1aximum d istances we saw earlier in the chap- ter were on ly for physical links. There is n o maximun1 dis ta nce for data links in switched neh,•orks, so there is no lim it to the s ize of switc hed neh'l'orks.
Th e maximum distances we saw earlier in the chapter were only for physical links. Th ere is no maximum distance for data links in switched networks, so there is no limit to the size of swi tched networks.
Switches ve rs us Transmission Lines Suppose you must connect h,•o end points, given a speed and d is tance req u irement. Suppose th a t you can use a s ingle run of expensive o p tical fiber. Suppose that you can use h, •o runs of less exp ensive 4-pair
l OOOBASE-T l OOOBASE-SX l OGBASE-SR 100GBASE-SR4
FIGURE 5-20 Ethernet Standards for Signaling and Fra me Forward ing
Original Signal
Received Signal
Cat Se UTP Physical link
100BASE-TX (100 m maximum)
Regenerated Signal
Received Signal
OM4 Multimode Fiber
Physical link
1000BASE-SX (1,000 m maximum)
Data link (1,200 m maximum)
Chapter 5 • Ethernet (802.3) Switched LANs 163
Regenerated Signal
Received Sig nal
Cat 6 UTP Physical link
100BASE-TX (100 m maximum)
FIGURE 5-21 Dist ances f or Physical Links versus Data Links
UTP plus an intermediate swi tch. Figure 5-22 illustra tes this situation. Whic h should you select? The answer is that if a s ingle physical link \,•ill do, add ing an intern1ed ia te switch almost never m a kes sense economically. S\vitches are m uch n1ore expensive than physical links.
Test Your Understanding
15. a) Are the maximun1 d istances for UTP and optical fi ber transmission sho\,vn in Figure 5-12 and Figure 5-16 distance limits for physical links or data links? b) In Figure 5-21, \'l'ha t would the m aximun1 da ta le ngth be if the ph ysica l link on the left \'l'as OM4 fiber? c) If you need to span 600 n1eters at 1 Gb ps, \'l'ha t options do you have? (Include the possibility of using a n intermediate S\'l'itch.) d) How \,•ou ld you d ecide w hic h option to choose? e) If a d istance can be s pa nned by UTP or o ptica l fiber, \,vh y \'l'ould you a lmost never ad d a n interm edia te S\'l'itch?
Option 1: Use a more expensive physical link to achieve a required distance.
~ ------M- u- lt-im_ od_e- Fi_b_e_r ------<~
Physical link
Option 2: Use a an intermediate switch and cheaper media to achieve a required distance.
Cat Se UTP Physical link
Cat 6 UTP Physical link
Choose Option 1. Media are Cheap, Switches are Expensive
FIGURE 5-22 The Undesirability of Attaining t he Req ui red Distance w i t h an Intermed iate Swit ch
164 Chapter 5 • Ethernet (802.3) Switched LANs
Ethernet Data Link Layer Switch Operation
In this section, we discuss the basic da ta link layer operation of Ethernet switches. This is also governed by the 802.3 MAC Layer Standard. In the section after this one, \,•e discuss other aspects of E thernet switching that a firm n1ay or may not use.
Fram e Forwarding F igure 5-23 sho\VS an Ethernet LAN \Vith three switches. Larger E thernet LANs have hundreds of s\,•itches, but the operation of individual S\'V itches is the san1e no matter how many s½•itches there are. Each ind ividua l switch n1akes a switching decision about which port to use to send the frame back out to the next switch or to the destination host.
In the figure, Host Al (we abbreviate the address) w ishes to send a fran1e to Host ES. This frame must go to S\,•itch 1, then Switch 2, and then Switch 3. Switch 3 w ill send the fran1e to Host ES.
Switching Table Switch 2 Port Station 3 A 1-44-05-1 F-AA-4C 3 B2-C0-13-5B-E4-65 7 04-47-55-C4-B6-9F 7 ES-BB-47-21-00-56
----.-{ Port 5 on Switch 1 Switch
I Frame to ES ...
Frame .
' to Port 3 on Switch 2 2
Switch 1
Frame
Frame to ES ...
Frame to ES ...
A 1-44-05-1 F-AA-4C Switch 1, Port 2
B2-C0-13-5B-E4-65 Switch 1 , Port 7
Switching Table Switch 1 Port Station 2 A1-44-0 5 -1F-AA-4C 7 B2-C0-13-5B-E4-65 5 04-47-55-C4-B6-9F
1 s ES-BB-47-21-03-ss 1
FIGURE 5-23 Multi-Switch Ethernet Operation
Port 7 on Switch 2 to Port 4 on Switch 3
~ \ • Frame to ES ...
04-47-55-C4-B6-9F Switch 3, Port 2
Switch Frame 3
ES-BB-47-21-00-56 Switch 3, Port 6
Switching Table Switch 3 Port Station 4 A1-44-05-1F-AA-4C 4 B2-C0-13-5B-E4-65 2 04-47-55-C4-B6-9F 6 ES-BB-47-21-00-56
Chapter 5 • Ethernet (802.3) Switched LANs 165
To begin this process, Host Al puts E5-BB-47-21-D3-56 in the Destination Address Field of the frame. It sends the frame to S\,vitch 1, into Port 2.
• Switch 1 looks up the address E5-BB-47-21-D3-56 in its switching table. It sees that E5 is associated with Port 5, so it sends the frame out Port 5. This is a very simple process, using little processing power. Ethernet s\,•itches are inexpensive for the volume of traffic they carry.
• Port 5 on Switch 1 connects to Port 3 on Switch 2. Switch 1 sends the fran1e out Port 5 to Switch 2. Switch 2 now looks up the address E5-BB-47-21-D3-56 in its S\Vitching table. This address is associated with Port 7, so Switch 2 sends the fran1e out Port 7.
• The frame arrives at S\,•itch 3 through Port 4. Switch 3 no\,, looks up the address E5-BB-47-21-D3-56 in its own switching table. This time, the address is associa ted \,•ith Port 6. Switch 3 sends the fran1e out Port 6. This takes it to the destination Host E5-BB-47-21-D3-56.
Note that each switch only knows the inforn1ation in its switchi ng table.11
More specifically, it only knows \,•hat port to use to send the frame back out. S\,• itches do not kno\,v the entire data link between the source host and the destina- tion host.
Test Your Understanding
16. a) Do s\,vitches know the en tire data link between the sou rce and destination host? b) What does a switch kno\,v?
Hie rarchica l Swi tch Organization Note that the switches in F igure 5-24 form a hierarchy, in \,•hich each s\,•itch has only one parent s\,•itch above it. In fact,
Server X
Client A
Client B
FIGURE 5 -24 Hie rarchica l Ethernet Topology
Server y
Server z
11 How docs an Ethernet switch build its switching table? [t notes the source address in every frame that arrives. lf the source port address is not in its tablci the s witch adds it to the table.
166 Chapter 5 • Ethemet (802.3) Switched LANs
the Ethernet standard requires a strict hierarchical topology (topology is the physical organization of S\vitches and transmission links). Otherwise, loops would exist, and a single loop \Viii cause the nehvork to shut do\vn. Figure 5-2 earlier sho\ved a larger switched Ethernet LAN organized in a hierarchy.
Ethernet requires a hierarchical switch topology.
In a hierarchy, there is only a single possible path between any two hosts. To see this, look at the data link behveen Client Host A and Server X. The frame must pass through Switch 6, Switch 4, Switch 3, Switch 2, and S\vitch 1.
In a hierarchy, there is only a single possible path between any two hosts.
If there is only a single possible path behveen any hvo hosts, then there is only one possible port to send an arriving frame back out. Thanks to this simple rule, an Ether- net switch only needs a little computation pO\ver per frame handled- a simple table lookup. This makes Ethernet switches inexpensive per frame handled. During the 1970s and 1980s, there were competitors in the LAN S\vitching market, but Ethernet's lo\v cost, combined w ith adequate performance, made it dominant in the market.
Test Your Understanding 17. a) How are switches in an Ethernet LAN organized? b) Because of this organi-
zation, how many possible paths can there be between any two hosts? c) In Figure 5-2, what is the single possible path between Client PC 1 and Server X? Just give the letters of the switches. d) Behveen Client PC 1 and Server Y? Just give the letters of the switches. e) In Figure 5-24, list the S\vitches on the path of frames from Client B to Server Z. f) Repeat for Client A to Client B. (Yes, clients do talk to one another.) g) From Server X to Ser ver Z. (Yes, servers do talk to one another.)
18. a) What is the benefit of having a single possible path through an Ethernet network? b) Why has Ethernet become the dominant LAN technology?
Core Fields in the Ethernet Frame In Chapter 2, we saw the most important fields in the Ethernet II frame. The box, "Sec- ondary Fields in the Ethernet II Frame," discuss~,s the remaining fields. We will add one piece of information to the discussion of the core fields here. We look at how to represent EUI-48 addresses in hexadecimal notation, which is hO\V they are usually depicted.
Recall that Ethernet addresses are EUI-48 addresses (formerly MAC addresses). Although computers \VOrk \Vith this raw 48-bit form, humans normally expr~,ss these addresses in Base 16 hexadecimal (hex) notation. Figure 5-25 shows ho\v to convert a 48-bit Ethernet address to hex notation. In the figure, the address begins w ith 10100011.
• First, divide the 48 bits into hvelve 4-bit units, which computer scientists call nibbles. The first nibble is 1010. The second is 0011.
Chap ter 5 • Ethemet (802.3) Sw itched LAN s 167
' Dedmal Hexadecimal Dedmal Hexadedmal
4 Bits (Base 10) (Base 16) 4 Bi1s (Base 1 O) (Base 16)
0000 0 0 hex 1000 8
000 1 1 1 hex 1001 9
0010 2 2 hex 1010 10
0011 3 3 hex 101 1 11
0 100 4 4 hex 1100 12
0 10 1 5 5 hex 1101 13
0 110 6 6 hex 1110 14
0 111 7 7 hex 111 1 15
Divide a 48-bit Ethernet address into 12 four-bit "nibbles." (1010, 000 1, etc.) Convert each group o f 4 bits into a Hex symbol. (A, 1, etc.) Combine two hex symbols into pairs and place a dash between pairs (A 1-etc.)
8 hex
9 hex
A hex
B hex
C hex
D hex
E hex
F hex
For example, 1010000 1 becomes 1010 000 1, which b ecomes A 1, w hich becomes A 1 (followed by a dash)
The finished hex exoression miaht be: A1-36-CD-7B-DF-01 hex
FIGURE 5-25 Hexadecimal Notat ion
• Second, convert each nibb le into a hexadecimal symbol, using Figure 5-25. For example, 1010 is a A. The next nibble is 0001, which is 1.
• Third, write the hex symbols as six pairs of symbols separated by dashes. In th is case, the first pair is Al. The entire add ress in "hex" migh t be A l -CC-66-0D-SE-BA.
To conver t a hex address back to b inary, change each symbol pair back to its 8-bit pattern. For example, if a hex pair is 2E, 2 is 0010, and Eis 1110, so 2E is eq uivalent to the octet 00101110. Note th at you must keep the hvo leading Os in 0010 because the two symbols represent eight bits.12
Test Your Understanding 19. a) Are Ethernet EUI-48 addresses expn.,ssed in hex for humans, devices, or both?
b) Which letters may appear in a hex EUI-48 address? c) What is 5 hex in binary? (Answer: 0101) d) What is 9 hex in binary? e) What is F hex in binary? (Answer: 1111) f) What is A hex in binary? g) What is binary 0011 in hex? (Ans\ver : 3) h) What is binary 0000 in hex? i) What is binary 1111 in hex? j) What is A6 in binary? (Answer: 01101101) k) What is 6D hex in binary? 1) Convert Al -B2-C3-44-5D-3C to binary. Leave a space between each octet. As a check, there must be 48 bits.
12 Excel offers the bin2hex and hex2bin functions. Many advanced calculators can also do the calculation,
168 Chapter 5 • Ethernet (802.3) Switched LANs
IN MORE DEPTH
Secondary Fields in The Ethernet Frame
Figure 5-26 lists three secondary fields in an Ethernet II frame.
Tag Field s (O ption a l) In Chapt er 4, we saw that companies m ay g ive f rames prio rity levels so t hat high-priori ty frames for latency-intolerant appl icat ions can go first. This was not in t he orig inal 802 .3 standard. If a company w ishes t o use priority, it must configure its equipment to recognize two opt ional tag f ields. These f ields, when used, are inserted just before t he length f ield. The first t ag field, t he Tag Protocol ID Field, merely indicates that the frame is tagged. The second gives the tagged i nformat ion . Note again that these tag fields are optional. If priority and t he other m atters they handle are not used, t here are no tag fields in t he frame.
Three bits in t he Tag Control Information Field are for priority level. W it h 3 bits, there can be eight priority levels. Another 12 bits are used for Ethernet VLAN numbers, w hich we w ill see in the Security section.
PAD Field In early versions of Ethernet, if the t otal length t he Ethernet Data Field w as less t han 46 octets, it could cause problems for network operat ions. Consequent ly, if the Data Field is less t han 46 octets long, a PAD Field is added t o make t he Data Field plus the PA D 46 octets long. For example, if the Data Field w ithout a PAD is 40 octets long, a six-octet PA D Field is added . However, if the Data Field is 100 octets long, no PAD is added . The PAD Field, if needed, is placed before the Frame Check Sequence Field.
Test You r Understanding
20. a) What inform ation do the two t ag fields give? b) W hen is the PAD Field added?
I Reld s in Order of t rri val 1 Destination EUl-48 Address (48 bits)
Source EUl-48 Address (48 b its)
1 Tag Protocol ID (OptionaQ (2 octets)
Tag Control Inform ation (Optio nal) (2 oc tets)
Eth er Type (2 octets)
IP Packet (variable length)
- ~ PAD
Frame Check Sequence (4 octets)
FIGURE 5- 26 Seco ndary Fields i n an Ethernet II Fram e
Tag Fields are
I used to add pr io rity (3 b its) andVLANs (12 bits)
- Added if frame is too short
Chapter 5 • Ethernet (802.3) Switched LANs 169
MANAGEMENT
SNMP
In Chapter 3, we discussed the Simple Net\vork Manageme nt Protocol (SNwlP) for man- aging remote devices. SNMP was d eveloped expressly fo r Ethernet and TCP /IP devices. As noted in Chapter 3, companies use net\vork visualiza tion programs to analyze d ata fro m the SNMP management informa tion base a nd to send comma nds to devices to change how they opera te. To be visible to the SNMP manager, an Ethernet switch must be a manageable s witch, n1eaning that it ,n ust have an SNMP agent. It also needs the electronics to gather the data the SNMP manager asks fo r in Get comn1ands and to make changes indicated in Set comn1ands. Manageable switches a re much more expensive than ordinary nonmanageable swi tches like the o ne you may have a t home.
Test Your Understanding 21. a) Wh at p rotocol do compan ies use to manage their Ethernet neh,,orks?
b) \"/hat a re n1anageable S\Vitches? c) Are all Ethernet switches ,nanageable?
Reliability We have seen that Ethernet switches ,nust be a rranged in a hierarchy. In a hiera rchy, there ca n on ly be one possible d a ta link behveen t\vo hosts. We sa"' that th is makes Ethernet switches inexpensive. Ho"'ever, if there is a break in a transm ission link o r switch, there is no ivay a ro und it. In Figu re 5-27, what if the lin k fails be t\veen Sw itch 1 and S",jtch 2? v\Then Host A transmits a frame, it will s to p at S,vi tch 2 beca use it cannot travel on. (For the ,n oment, ignore the backup link.) This d oes not mean that the entire net\,,ork goes do"'n. Host C can s till reach Host B beca use the data li nk be t\veen them does not pass through the faile d link.
Now look at the backup link that can connect Swi tch 2 and S",jtch 5. What if this backup link is plugged into the hvo sivitches? In that case, the entire net\,,ork "'ill be un able to "'ork. Ethernet technology is very serious abou t strict hiera rchies. (The firs t
Host B
FIGURE 5- 27 Failures a nd Backup Li n ks
Host C
The Rapid S panni ng Tree Protocol
Disables loops
170 Chapter 5 • Ethernet (802.3) Switched LANs
au thor sometimes d oes this as a class demonstration w ith cheap 4-port Ethernet s\,•itches to sho\'I' \,•hat happens ½•hen a loop is introduced into a functioning neh,•ork.)
However, if the switches a re con,mercial grad e, the p roblem o nly lasts a m om ent. The s\,•itches quickly realize that son,ething is \,•rong. They begin sen ding supervisory frames to o ne another using the Ra p id Spanning T ree Protocol (RSTP). The switches then break the loop by closing the MO ports of one of the physical links creating the loop. The neh,vork is hierarchical again. Transmission restarts.
NeMork engineers quickly saw that they cou ld also use RSTP for an unintended purpose, to crea te backup links like the one shown in Figure 5-27. They could set it u p so the backup link \'l'ould be auton,atically d isabled by RSTP but left in p lace. Then, if the link ben,•een S\,vi tch 1 and Switch 2 failed, the s\,•itches would engage in RSTP exchanges. They \,•ou ld open the MO ports connecting the backup link. The nehvork would be whole aga in, a nd all comnn mication would continue. This seems simple. It is not. Creating backup links in a way th a t the neMork \,•ill reconfigure itself as th e hierarchy the neMork m anager \,•ants turns ou t to be con1plicated. Beyond a handfu l o f backup links, the effort begins to be prohibitive.
Tes t Your Und ers tanding
22. a) What reliability p roblem d oes Ethernet have? b) How can some redundant backup links be installed \'l'ithou t creating loops? c) Is this easy to do?
ETHERNET SECURITY
Ethernet Security in Perspective
Ethernet was designed to be simple, low in equipment price, and extremely lo½• in m an- agement labor. This required the extensive use of trust. Devices can add then15elves to basic Ethernet neMorks \,•ithou t proving their righ ts to join them. Corporations have tended to downplay Ethernet security because you have to get inside the corpora te walls to exploit these \,•eaknesses by plugging in physically to the LAN. However, if a computer within the neMork is con1prontlsed, the attacker is effectively inside the walls and can a ttack freely. These a ttacks on lANs are no t \Videspread, but they are po tentially danger- ous. We look a t four security threats and countermeasures the companies should assess.
Virtual LANs (VLANs) for Network Segregation
Even within a corporate si te, a company does not wan t to give every em ployee access to every resource. Ethernet can enforce this segregation of neMork resources. It does this through virtual LANs (VLANs), which are clusters o f servers and hosts that are allo\,•ed to con,municate with o ne another.13
13 Although YLANs arc now thought of as security tools, they were originally created to reduce broadcasting. In some s ituations, hosts or switches will broadcast frames to all other hosts on the LAN. To g ive an example, if the destination address in an arriving packet is not in a switch's switching table, the switch does not know what port to send it out. The switch broadcasts it out all ports. ln s malJ Ethernet LANs, this docs not create problems. In very large Ethernet LANs, broadcasting is more frequent and can be a serious capacity hog.
Host A1 ... VLAN3
Host B2 ... VLAN3
Host C3 ... VLAN 47
FIG URE 5-28 Virtual LANs (VLANs)
Host 04 ... VLAN 47
Chapter 5 • Ethernet (802.3) Switched LANs 171
Host A 1 ... on VLAN 3 can only communicate with Hosts B2 ... and ES ... , which
eon the same VLAN.
Host ES ... VLAN3
Host F6 ... VLAN 47
Figure 5-28 illustrates VLANs in Ethern et. In the figure, th ere are four switches and six hos ts (h,•o clients and four servers). These hosts a re assigned to one o f h,•o virtual LANs: VLAN 3 or VLAN 47.
Host Al is on VLAN 3. If it sends frames to Host B2 or Host ES, the switches will permit the transmission beca use Hosts Al, B2, a nd ES are on the san1e VLAN. Ho\,•ever, if Host Al tries to send a fran1e to Host D4, the S\'l'itches will not del iver the fran1e because Host D4 is o n a d ifferen t vir tual LAN, VLAN 47.
If the user of Host A 1 is in the m arketing departmen t, VLAN 3 might consist of the clients and servers in n1a rke ting. VLAN 47, in turn, m ig ht be the VLAN for the accounting d epartment. P utting these d epartn1ents o n d ifferen t VLANs ensures that people in the m arketing d epartn1en t have no access to the accounting servers, w hich n1ay hold sensitive information .
Test Your Understanding
23. a) What is the security benefit of Ethernet VLANs? b) In Figure 5-28, to \,•hich hosts can Host D4 send fra mes?
Initial User Authentication Through 802.1X
One way to reduce risks is to authenticate a user before he or she is authorized to use a switch port. In 802.lX Port-Based Network Access Control, the s\,•itch initially permits frames to be exchanged o nly beh'l'een the supplicant host and a central authentica tion server (see Figure 5-29). The authentication server asks the supplicant for specific cre- den tials. The supplican t responds. If the server accepts the credentials and authenti- cates the host, it authorizes the switch to authorize access to the port. Otherwise, the port ren1ains unauthorized and the supplicant is locked ou t of the neh,•ork.
Test Your Understanding
24. a) What secu rity threat is 802.lX designed to protect against? b) When 802.lX is being used, what happens if an a ttacker plugs his or her host into a s\,•itch?
172 Chapter 5 • Ethernet (802.3) Switched LANs
Adversary Impersonates a Switch, Sends the
Target Switch a MaUcious Command
Authentication Server
FIGURE 5 -29 Initial User Authentication with 802.1X and Switch-to-Switch Security w ith 802.1AE
802.1AE Switch-to-Switch Protection
Of course, an authenticated host may still be a malicious user or an a ttacker who has taken over the host. As noted earlier, the host can inutate a switch and send management frames to real switches. It can tell them to shut down, d irect all traffic through them so that they can read everythmg going through the neh,•ork, and do many other thmgs.
Attacks on switches are serious because they affect the overall operation of the Eth- ernet network. Normally, a switch will accept any management frame sent by another switch (or a host pretending to be a switch). The way to reduce trust is to require s\,•itches to authenticate then-iselves before another s\,•itch will listen to then1. The 802.lAE standard sho\,'11 in Figure 5-29 \,•as created to do this. It also encrypts traffic between switches.
Test Your Understanding
25. What type of attack does 802.lAE protect against?
ARP Cache Poisoning
Another possibility is a man-in-the-middle a ttack14 using ARP cache poisoning. Every host has an ARP cache that associates known IP d estination addresses \,•ith their kno\,'11 EUI-48 address. It is easy for an a ttacker's host to send an ARP update message to other hosts it can reach via Ethernet. It tells them tha t the EUI-48 address of the router to wruch outgoing packets will be sent is actually the attacker's EUI-48 address. If hosts allow these unsolicited updates, as they often do, then every tin1e they send packe ts believing tha t they are sending them to the router, they are actually sending the m to the attacker's host. The attacker can read them and pass them on.
14 This is the only common case in networking toda y in which gcndcr•neutraJ terminology is not used.
Chapter 5 • Ethernet (802.3) Switched LANs 173
A~a9k, the victim will send frames des • ~ th router to the attacker instead
1 Router 1.2.3.4
A1-CE-...
... . .;71 ..
Before versus after the attad<
Victim's ARP Cache:
3 1.2.3.4:A1 GE .. . 1.2.3 .4:B2-58-.. .
M ITM Attacker 5.6.7.8
82-58-...
FIGURE 5-30 A RP Cache Poisoning (Study Figure)
Test Your Understanding 26. a) Before the attack, \,vhere does the ARP cache tell the v ictim to send a fran1e
carrying a packet to the router? b) Where does it tell the victim to send s uch frames after the attack? c) What harm can the attacker do?
END-OF-CHAPTER QUESTIONS
Thought Questions
5-1. a) If both UTP and optical fi ber can be used for a particula r physica l link, which should I choose? Why? b) If both OM3 fiber and OM4 fiber can be used for a particular physical link, which should I choose? Why? c) Some compa- nies are now installing OM4 even when OM3 can do the job. Why do you think they do that?
5-2. What Work Group of the 802 LAN/ MAN Standards Committee developed the 802.IX and 802.IAE s tandards? This wor king group, by the way, creates security and management standards for use in all other Working Groups.
Design Questions
5-5. Design an Ethernet nehvork to connect a single client PC to a single server. Both the client and the sen•er w ill connect to their workgroup switches ,•ia UTP. The two de,•ices are 900 meters apart. They
5-3. In ARP cache poisoni ng, the attacker poisons the victim's ARP cache. This a llows the attacker to read frames that the victim sends to the router. How can it read the frames that the victim receives from the router?
5-4. Can you thi nk of a way to allow a cli- ent on one virtual LAN to communi- cate w ith a server on another VLAN? Hint: Switches typica lly ha,•e no way of doing it. Hint 2: It in,•olves an access control list or som e other type of device. The ACL permits specific client- server host pairs to communicate.
need to communica te a t 800 Mbps. Your design will specify the locations of any switches and the transmission link between the switches.
174 Chapter 5 • Ethernet (802.3) Switched LANs
5-6. Add to you r design i n the previo u s questi on. Add another client next to the first client. Both connect to the same sw itch. This second client wi ll a lso communicate w ith the server and w ill
Troubleshooting Question
5-7. You connect t wo switches in a la rge Ethernet switch with 113 switches. You are us ing 4-pair UTP. Immediately after
Perspective Questions
5-8. What was the mos t s urpr isi ng t hi ng you learned in this chapter?
a lso need 800 Mb ps in t ransmission speed. Again, your design will speci fy the locations of switches and the t rans- mission link be hveen the switches.
you make the connection, the nehvork s tops transmit ting traffic. v\7hat do you think might have happened?
5-9. v\7hat was the most difficult part of this chapter for you?
Chapter Sa
Hands-On: Cutting and Connectorizing UTP1
LEARNING OBJECT IVES
By the end of this chapter, you should be able to:
• Cut, connectorize, and test 4-pair UTP cabling.
• Exp lain the difference between solid w ire and stranded-\v ire UTP.
• Know \,•hen to use patch cables.
INTRODUCTION
Chapter 5 d iscussed UTP \,•irin g in gen era l. This chapter discusses h o\,, to cu t and connectorjze (ad d connectors to) sol id UTP wiring.
SOLID AND STRANDED WIRING
Solid-Wire UTP ve rsus Stra nded-Wire UTP
The TIA/EIA-568 s tandard requires that long runs to \,•all jacks use solid-wire UT P, in which each of the e ight wfres really is a single solid \,vfre.
Ho\,•ever, patch cords running from the wall outlet to a NIC usually are stranded- ,vire UT P, in w hich each of the eight "wfres" really is a bundle of thinner wire s trands. So strand ed-wire UTP has eig h t b undles of wfres, each b undle in its own insula tio n and acting like a single wire.
1This material is based on the author's Jab proj«ts and on the Jab proj«t of Professor Harry Reif of James Madison Ur\lversity.
175
176 Chapter Sa • Hands-On: Cutting and Connectorizing UTP
Solid-Wire llTP
Each of the eight wires is a solid wire
Low attenuation over long distances
Easy to connectorize
Inflexible and stiff-flot good for runs to the desktop
Stranded-Wire UTP
Each of the eight " wires" is itself several thin strands of wire within an insulation tube
Flexible and durable-good for runs to the desktop
Impossible to connect orize in the field (bought as patch cords)
Higher attenuation than solid-wire llTP-Used only in short runs
From wall jack to desktop
Within a telecommunications closet (see Chapter 3)
FIGURE Sa- 1 Solid-Wire and Stranded-Wire UTP (Study Figure)
Relative Advantages
Solid wire is needed in long cords because it has lo\,•e r a ttenuation than stranded w ire. In contrast, stranded-wire UTP cords are n1ore fl exible than solid -wire cords, n1aking them ideal for patch cords-especially the one running to the desktop- because they can be bent n1ore and still function. They are more d urable than solid-wire UTP cords.
Adding Connectors
It is rela tively easy to add RJ-45 connectors to solid-\,•ire UTP cords. However, it is very d ifficult to add RJ-45 connectors to s tranded-wire cords. Stranded-wire pa tch cords should be purchased from the factory precut to desired lengths and preconnectorized.
In add ition, \,•hen p urchasing equ ipn1ent to connectorize solid-wire UTP, it is important to purchase crin1pers designed for solid \,•ire.
CUTTING THE CORD
Solid-wire UTP normally con1es in a box o r s pool containing 50 meters or n1ore of wire. The first step is to cut a length of UTP cord tha t matches your need. It is good to be a little generous \,•ith the length. This way, bad connectorization can be fixed by cutting off the connector and adding a new connector to the shortened cord . Also, UTP cords should never be su bjected to pulls (strain), and adding a little extra length creates some slack.
STRIPPING THE CORD
Now the cord must be s tripped a t each end using a stripping tool such as the one sho½•n in Figu re Sa-2. The installer rota tes the s tripper once around the cord, scoring (cutting into) the cord jacket (but not cutting through it). The installer then pulls off the scored end of the cord, exposing abou t 5 cn1 (about 2 inches) of the w ire pairs.
Chapter Sa • Han d s -On: Cutting and Connect orizing UTP 177
·~ --. --- - FIG URE 5a-2 Stripping Too l
It is critica l not to score the cord too deep ly, o r the insulation a round the indi- vidual \,•ires may be cut. This creates short circu its. A really deep cut a lso \,•ill ruck the wire, perha ps causing it to sna p in,med iately or la ter.
WORKING WITH THE EXPOSED PAIRS
Pair Colors
The four pa irs each have a colo r: orange, green, blue, o r bro\'l'n. One \Vire of the pair usu ally is a com pletely solid co lor. The other usua lly is w hite with s tripes o f the pa ir's color. For instance, the orange pair has an orange \,•ire and a white wi re \,•ith ora nge s tr ipes.
Untwisting the Pairs
The wires of each pair are h,•isted around each o the r several times per inch . These n1ust be unh,•isted a fte r the end of the cord is stripped.
Ordering the Pairs
The wires no\,• must be p laced in their correct order, left to right. Figure Sa-3 shows the location of Pin 1 o n the RJ-45 connector a nd on a \'l'all jack or NIC.
Wh ich color wire goes in to w hich connector slo t? The h,•o standa rdized pat- terns a re shown in Figu re Sa-4. Th e T568B pattern is m uch m ore comm o n in the United States.
178 Chapter Sa • Hands-On: Cutting and Connectorizing UTP
0 Pin 1 _ ____ -k...._
Q RJ-45 Connector
(spring clip on bottom)
RJ-45 Port
0
FIGURE Sa-3 Location of Pin 1 on an RJ-45 Connector and Wall Jack or NIC
The connectors at bo th ends of the cord use the same pattern. If the white-orange wire goes into Pin 1 of the connector on one end of the cord , it a lso goes into Pin 1 of the connecto r at the other end.
Cutting the Wires
The length of the exposed w ires n1ust be lin1ited to 1.25 cn1 (0.5 inch) or sligh tly less. After the wires have been arranged in the correct o rde r, a c utter should cut across the wires to make them this length. The cut should be made straig ht across so that all \,•ires are of equal length. O therwise, they w ill not all reach the end of the connector \,•hen they are inserted into it. Wires that do not reach the end w ill not m ake electrica l contact.
ADDING THE CONNECTOR
Holding the Connector
The next step is to place the \,•ires in the RJ-45 connecto r. In one hand, hold the connector, clip side do\vn, \,•ith the opening in the back of the connector facing you.
Pin* T568A T568B
1 W hite-Green W hite-Orange
2 Green Orange
3 W hite-Orange White-Green
4 Blue Blue
5 White-Blue White-Blue
6 Orange Green
7 White-Brown White-Brown
8 Brown Brown
'Do not confuse T568A and TS68B pin colors w ith the TIA/ EIA-568 Standard.
FIGURE Sa-4 T568A and T568B Pin Colors
Chapter Sa • Hands-On: Cutting and Connectorizing UTP 179
Sliding in the Wires Now, slid e the wires into the connector, making sure that they are in the correct order (\,•hite-orange o n your left). There are grooves in the connector that will help. Be sure to push the wires all the way to the end or proper electrica l contact will not be n,ade with the pins at the end.
Before you crimp the connector, look down at the top of the connector, holding the tip away from you. The first \,•ire on your left should be mostly white. So should every second \'Vire. If they are not, you have inserted your w ires incorrectly.2
Some Jacket Inside the Connector
If you have shortened you r wires properly, there w ill be a little bit of jacket inside the RJ-45 connector.
CRIMPING
Pressing Down
Get a really good crimping tool (see Figure Sa-5). Place the connector with the \'Vires in it into the crimp and push down firmly. Good crimping tools have ratchets to reduce the chance of your pushing down too tightly.
Making Electrical Contact The fro nt of the connector has eight pins running from the top almost to the botton, (spring clip s ide). When you crimp the connector, you force these eight pins throug h the insulation around each \,•ire and into the \,•ire itself. This seems like a crude electri- cal connection, and it is. However, it normally works very \,veil. Your \,•ires are now
FIGURE Sa-5 Crimp ing Tool
2 Thanks to Jason Okumura, who suggested this way of checking the wires.
180 Chapter Sa • Hands-On: Cutting and Connectorizing UTP
connected to the connector's pins. By the way, this is called an insulation displacement connection (JDC) because it cuts through the insulation.
Strain Relief
When you crimp, the crin1per also forces a ridge in the back of the RJ-45 connector into the jacket of the cord. This provides strain relief, meaning that if someone pulls o n the cord (a bad idea), they \,•ill be pulling o nly to the point where the jacket has the ridge forced into it. There will be no strain where the w ires connect to the p ins.
TESTING
Purchasing the best UTP cabling n1eans nothing unless you install it properly. Wiring errors are common in the fi eld, so you need to test every cord after you install it. Testing is inexpensive con1pared to trou bleshooting subtle \,•iring p roblems later.
Testing with Continuity Testers The s implest testers are continuity testers, which merely test whether the \Vires are arranged in correct order \,•ithin the two RJ-45 connectors and are m aking good electrical contac t w ith the connector. They cost only about $100.
Testing for Signal Quality Better testers cost $500-$2,000 but are \Vorth the extra money. In addition to testing for continuity problen1s, they send test signals through the cord to determ ine \,•hether the cord n1eets TIA/ EIA-568 signal-quality requiren1ents. Many include time domain reflectometry (TOR), w hich sends a signal and listens for echoes in order to measure the length of the UTP cord or to find if and where breaks exis t in th e cord.
Test Your Unders tanding
1. a) Explain the technica l difference beh,•een solid-\,•ire UTP and stranded-\,vire UTP. b) In w hat way is solid-wire UTP be tter? c) In what \,vay is stranded-\,vire UTP better? d) Where would you use each? e) Which should only be connec- torized at the factory?
2. If you have a wire run of 50 meters, should you c ut the cord to 50 n1eters? Explain. 3. Why do you score the jacket of the cord with the stripping tool instead o f c utting
all the \,vay tluoug h the jacket? 4. a) What are the colors of the four pairs? b) If you are follo\,ving T568B, \,•hich wire
goes into Pin 3? c) At the other end of the cord, would the same wire go into Pin 3? 5. After you arrange the w ires in their correct order a nd cut them across, how
n1uch of the \'Vires should be exposed from the jacket? 6. a) Describe RJ-4S's insula tion d isplacement approach. b) Describe its s train
relief a pproach . 7. a) Should you test every cord in the field after installation? b) For w ha t d o
inexpensive testers test? c) For \,vhat do expensive testers test?
Chapter 6
Wireless LANs I
LEARNING OBJECT IVES
By the end of this chapter, you should be able to:
• Exp lain basic Wi-Fi 802.11 terminology and the role of access points.
• Exp lain basic radio signal propagation concepts, including frequencies, antennas, and \,•ireless propagation problen1S. These are physical layer concepts.
• Explain the freq uency spectrum, service bands, ch annels, bandwidth, licensed versus unlicensed service bands, and the type of spread spectrun1 transmission used in 802.11 Wi-Fi LANs. These are also physica l layer concepts.
• Describe 802.11 Wi-Fi WLAN opera tion \,•ith access points and a switched Ethernet distribution systen1 to link the access points. D istinguish between BSSs, ESSs, and SSIDs. D iscuss comn1unication beh,•een access points. These are data link layer concepts.
• If you read the box, "Media Access Con trol (MAC)," con1pare CSMA /CA+ACK and RTS/CTS for med ia access con trol. These are data link layer concepts.
• Compare and contrast the 802.ll n a nd 802.llac transm issio n s tandards. D;scuss emerging trends in 802.11 operation, including channels \,•Hh mum \,,;der band\,,jdth, MIMO, beamforn1ing, and mul tiuser MIMO. Th ese are physica l layer concepts.
• If you read the box, "802.11 /Wi-Fi Notes," Be able to kno\,, w ha t happens \,vhen devices follow different Wi-Fi standards, explain how devices that follow new Wi-Fi sta ndards get released in profile \,•aves, and describe en1ergjng 802.11 standards and w ha t they will brmg.
181
182 Chapter 6 • Wireless LANs I
INTRODUCTION
OSI Standards In Chap ter 5, \,•e looked at wired Ethernet networks. Technologies for net\vorks require both physical and data link layer s tandards. Consequently, they use OSI stan- dards. In this chap ter and in Chap ter 7, we look at w ireless LANs. Like wired LANs, wireless LANs are s ingle networks, which require physical and DLL standards. So they too use OSI standards.
Wireless LANs are governed by standards at the physical and data link layers. OSI domi- nates at this layer. This tells you that wireless LAN standards are OSI standards rather than IETF standards.
Test Your Understanding
1. a) A t \,vhat layers do w ireless LANs operate? b) Do wireless LAN s tandards governed by OSI or TCP /IP stand ards? Justify your answer.
802.11 = Wi-Fi 802.11 Wireless LANs (WLANs) use radio for physical layer transmission on
the customer premises. In the last chapter, we sa\,, that the 802.3 Working Group of the IEEE's 802 LAN/MAN Standards Con1mittee creates Ethernet standards. Other working groups create other standards. The dominant WLAN standards today are the 802.11 standards, which are created by the IEEE 802.11 Working Group.
Wireless LANs (WLANs) use radio for physical layer transmission on the customer premises.
Wi-Fi It is common to call the 802.11 standards "Wi-Fi" standards. In fact, the terms have become almos t interchangeable, and we use them that way too. However, as an IT professional, you should understand the technical difference
Wireless LANs
Require standards at the physical and data link layer
So OSI standards
Standards created by the IEEE 802.11 Working Group
Wi-Fi
Certification system managed by the Wi-Fi Alliance
Wi-Fi now synonymous for 802.11
FIGURE 6- 1 802.11 / Wi-Fi Wireless LAN (WLAN) Technology (Study Figure)
Chapter 6 • Wireless LANs I 183
between 802 .11 and Wi-Fi. The term Wi-Fi sten1s fron1 the Wi-Fi Alliance, wh ich is a n industry consortium of 802.11 produc t vendors. Whe n the 802.11 Working Group creates standard s, it o ften creates n1a n y op tions. The Wi-Fi Alliance crea tes subsets of 802.11 standards wi th selected o p tions. The a llia nce cond ucts interop er- abil ity tests an1ong p rodu cts that claim to m eet these "profi les." On ly p roducts that pass interoperability tests n1ay display the Wi-Fi logo on the ir p roducts. Products t hat do not pass are rarely sold, so when son1eone p icks up a box con taining an 802.11 product, they a ln1ost ahvays see the Wi-Fi logo. This is why Wi-Fi has come to be more \Videly known than 802.11.
It is com mon to call the 802.1 1 standards "Wi-Fi" standards. In fact, t he terms have become almost interchangeable, and w e use them that way too.
Test Your Understanding
2. a) Distinguish between 802.3 standards and 802 .11 s tandards. b) What is the actual d ifference be h,veen 802.11 and Wi-Fi? c) Do we use the two terms inter- changeably?
Basic Access Point Operation
Figure 6-2 shows access point o peration. First, it shows \,•hat happens \,•hen a wireless host sends a frame to another w ireless host using th e san1e access point (1 and 2). The source host transmits the frame to the access point. The access po int then retransmits the frame to the destina tion host. We show th is interaction as a pair of poin t-to-point transn1issions.1
Ethernet Work group
Switch
Server Needed by Client
4
'··, ..
" 4 • • -
Internet Access Router
Corporate Ethernet LAN
UTP
. . ··,
FIGURE 6 -2 Access Point Operation
W1-fi Access Point
Sending Wireless Client
1 ~
Access Point connects hosts d irectly and connects wireless clients to servers and Internet access routers on the Ethernet network.
1 Actually, each device broadcasts its signal, so the signal spreads in aU directions from the transmitter. The arrows indicate that only the receiver., to which the frame is addressed, pays attcnHon to the frame (or at least should).
184 Chapter 6 • Wireless LANs I
In n1ost si tuations, hov.•ever, the cl ient needs to connect to a server that is else- where, on the corporate Ethernet LAN or o utside the orgaruzation o n the Internet. As Figure 6-2 shows, to reach corporate servers and to reach the site's Internet access router, the client needs to con1m unicate over the corporate Ethernet LAN (3). Consequently, the access point connects via UTP to an Ethernet workgroup S\'l'itrn, which connects the wireless client to the rest of the site network.
Test Your Understanding
3. a) In a Wi-Fi LAN, d o two w ireless hosts usually send fra m es directly to o ne another? Exp lain. b) Why d oes the access point connect to the corporate Ether- net LAN?
RADIO SIGNAL PROPAGATION
Perfidious Radio Chapter 5 discussed propagation effects in v.•ired transmission med ia (UTP and optical fiber). Propagation effects in wired transmission can be well controlled by respecting cord distance limits and taking other installation precautions. This is possible because wired propagation is predictable. If you input a s igna l, you can estin1ate precisely what it will be at the other end of a cord. A v.•ired network is like a fa ithful, obedient dog.
Propagation effects in wired transmission can be well controlled by respecting cord distance limits and taking other installation precautions.
In contrast, radio propagation is very unreliable. Radio s igna ls bounce off obsta- cles, fa il to pass through v.•alls and filing cabinets, and have other problems v.•e look at in th is section. Consequently, Wi-Fi net\,•orks, v.•hich use radio to deliver signa ls, are n1ore con1p lex to implement than wired networks. They do not have a few simple installation guidelines tha t can reduce propagation effects to nonissues. Therefore, we will spend more time on wireless propagation effects than we d id on v.•ired propaga tion effects. We are dealing with cats.
Propagation effects in wireless networks are complex and difficult to solve.
Test Yo u r Understanding
4. a) In 802.3 Ethernet net\,•orks, can sin1ple installation rules usually reduce propagation effects to nonissues? b) In 802.11 Wi-Fi networks, can simp le installation rules usually reduce propagation effects to no nissues?
Frequencies Radios for data transm ission are called transceivers because they both transn1it and receive. When transceivers send, their v.•ireless signa ls propagate as waves, as we saw in Chapter 5. F igure 6-3 again notes tha t v.•aves have amplitude and wavelength.
Chapter 6 • Wireless LANs I 185
Wavelength
Amplitude t - - -1------\-- --r-- -,f----- ...... r-----,.--
Amplttude Wavelength .. 1 Second, 2 Cycles
Wavelength is the physical distance between comparable points on adjacent cycles. Optical fiber transmission is described in terms of wavelength.
Frequency is the number of cycles per second . In this case, there are two cycles in 1 second , so the frequenc y is two hertz (2 Hz).
Radio transmission is measured in terms of frequency.
Amplttude is the power of the wave.
AGURE 6-3 Electromagnetic Wave
Optica l fiber waves are d escribed in terms of w a velength, but radio waves are described in tern,s of another wave cha racteristic, frequency.
Frequency is used to describe the radio waves used in WLANs.
In waves, frequency is the number of con1ple te cycles per second. One cycle per second is one hertz (H z). Metric d esigna tions are used to describe frequencies. In the m etric system, frequencies increase by a factor of 1,000 rather tha n 1,024. Th e n1ost con,mo n radio frequencies for \,•ireless transceivers range between abou t 500 m egahe rtz (MHz) a nd 10 gigahertz (GHz).
Test Your Understanding
5. a) What is a transceiver? b) Is w ireless radio trans n1ission usually d escribed in terms of wa veleng th or frequency? c) What is a hertz? d ) At \,•ha t range o f fre- quencies d o m ost wireless systems operate?
Antennas
A transceiver uses an antenna to transn1it its signal. Figure 6-4 sho\,vs th at there are two types of radio antennas: omnid irectional antennas and d ish antennas.
• Omnidirectional antennas transmit signals equally strongly in all d irections and receive incoming signals equally well fron, all d irections. Consequently, fue an tenna does not need to point in the d irection of the receiver. Ho\,•ever, because the signa l spreads in all th ree d imensio ns, only a small fraction of the energy transmitted by an omnidirectiona l antenna reaches the receiver. Omnidirectional
186 Chapter 6 • Wireless LANs I
- Omnidirectional Antenna
Signal spreads in all directions Rapid signal attenuation
No need to point at receiver
Dish Antenna
Focuses signals in a narrow range Signals can be sent over longer distances
Must point at receiver
FIGU RE 6 -4 Omnidire ctiona l a nd Dish Antennas
a ntennas are used for short distances, such as those fo und in a wireless LAN or a cellular telephone ne h,•ork.
• Dish an tennas, in contrast, concentrate signals in a particular direction, wruch allows signals to travel farther for the same transmission power. (A d ish antenna is like the reflector in a flashlig ht.) It also allows then1 to receive weaker incoming signals from that d irection. Dish antennas are used for longer d istances because of their focusing ability, although users need to know the d irection of the other radio. In addition, d ish antennas are b ulky. {In)agine if you had to carry a d ish \,•ith you whenever you car- ried your cellular phone. You \vould not even kno\,• \,vhere to point the dish!)
Test Your Understanding
6. a) D istinguish beh'l'een onmidirectional and dish antennas in terms o f o pera- tion. b) Under \,•hat circun1stances would you use an omnidirectiona l an tenna? c) Under w hat circun1stances would you use a dish an tenna? d) What type o f a ntenna normally is used in WLANs? Why?
Wireless Propagation Problems
We have alread y no ted that, alth o ugh \'l' ireless comn1unica tion gives m obil ity, it is not very p red ictable, a nd there o ften a re serious propagation problen1s. Figu re 6-5 illustrates fi ve com n1on wireless propagation p roblems.
Inverse Sq uare La w A ttenuation Compared to signa ls sen t th rough w ires and optical fib er, radio signa ls attenuate very rapidly. When a signa l spreads out from any kind of an tenna, its strength is spread over the area of a sphere. (In omnidirectiona l antennas, power is spread equally over the sphere, \,•hereas in d ish antennas, power is concentrated primarily in one d irection on the sphere.)
The a rea of a sphere is p roportional to the square of its rad ius, so signal strength in any d irection weakens by an inverse square law rule. If d istance is d oubled, signal strength fa lls to a q uarter of its o riginal value (1 / 2 squared). For examp le, if a signal is 100 \,•a tts at 10 meters, it w ill only be 25 Wat 20 n1eters. If the distance is increased 10-fold, then signal strength will be only 1/ 100 its original value (1 / 10 squared), 1 watt.
1
Electromagnetic Interference
(EMI)
Direct Signal
Reflected S.gnal
5 Multipath
Interference
2 Inverse Square Law
Attenuation P2 =P,t(r/r,)'
There are two forms of attenuatio . Two effects get worse w ith frequ c .
FIGURE 6-5 Wireless Pro pagat ion Pro blems
Chapter 6 • Wireless LANs I 187
3 Absorptive Attenuation
(Increases with Frequency)
4
Dead Zone (Shadow Zone) Qncreases w~h
Frequency)
Inverse square la\,, attenuation is very rapid attenuation-far more rapid than a ttenua- tion in 4-Pa ir UTP a nd op tical fib er.
Absorptive Attenuation As a radio sign al travels, it is partially absorbed by the a ir n1o lecules, plants, a nd o ther things it passes through. This absorptive attenu- ation is especially bad because \-Valer is an especially good absorber of radio signals. Rain a nd n1oisture in plants can reduce power substantially.
Absorptive a ttenua tion can be confus ing because we have already seen inverse square la\,, attenuation. Yes, \Vireless propagation suffers from two forms of attenuation.
Distance Ratio
1
2
3
4
5
6
7
8
9
10
Distance Ratio Squared
1
4
9
16
25
36
49
64
81
100
Signal Strength
Compared to Original
100.0°;.
25.0%
11. 1%
6.3%
4.0%
2.8%
2.0%
1.6%
1.2%
1.0%
Init ial Pow er (P2) (watts)
100
100
100
100
100
100
100
100
100
100
final Power (P2) (watts)
100
25
11 .1
6.3
4.0
2.8
2.0
1.6
1.2
1.0
Note: if the original distance is 10 meters and the final distance is 30 meters, the distance ra tio will be 3. The signal strength ratio will be 11 .15%. If the o riginal power at 10 meters is 100 watts, the signal at 30 meters will be 11 .1% of 100 Wor 11.1 W.
FIG URE 6-6 Inverse Sq uare Law Attenuat ion (St udy Figure)
188 Chapter 6 • Wireless LANs I
Inverse square la\,, attenuation is due to the signal spreading out as a sphere and so becoming weaker a t each point on the sphere as the sphere expands. Absorptive attenu- a tion is signal loss through energy absorption.
Wireless transmission suffers from two forms of attenuation-inverse square law attenuation and absorptive attenuation.
D ead Zones To some extent, radio signals can go through and bend around objects. However, if there is a dense object (e.g., a thick wall) blocking the direct path beh,•een the sender and the receiver, the receiver may be in a dead zone, also called a shadow zone. In these zones, the receiver cannot get the signal. If you have a n1obile phone and often try to use it inside buildings, you may be familiar \,•ith this problen1.
Multipath Interfere nce In addition, rad io \,•aves tend to bounce off \,•alls, floors, ceilings, and other objects. As Figure 6-7 shows, this may mean that a receiver will receive h,•o or more signals-a direct signa l and one or more reflected signals. The d irect and reflected signals \,•ill travel different distances and so n1ay be out of phase when they reach the receiver. For example, one may be at its highest an1plitude and the o ther a t its lowest, giving an average of zero. If their amplitudes are the same, they w ill con1pletely cancel out. In a real situa tion, n1ultiple signals traveling d ifferent paths w ill interfere, so \,•e call this type of interference mu ltipath in terference.
Multipath interference n1ay cause the signal to range from strong to nonexistent within a few centimeters. If the difference in time behveen the direct and reflected signal is large, some reflected signals may even interfere \,vith the next d irect signal. We will see later that this is controlled by spread spectrum transnussion, \vhich spreads the signal over a wide range of frequencies so that multipath interference effects average out to zero. Multipath interference is the most serious propagation problem a t WLAN frequencies.
Multipath interference is the most serious propagation problem at WLAN frequencies.
Direct and reflected signals combine. At some frequencies, cancel each other. At some frequencies, double the intensity. Averaged over a spread spectrum signal, there is no problem.
FIGURE 6•7 M ult ipath Interfer ence
Direct Wave
Reflected Wave
Low Amplitude
Total = 0
High Amplitude
Chapter 6 • Wireless LANs I 189
Electrom agnetic Interference (EMI) A fin al common p ropagation p roblem in wireless con1munication is electromagnetic interference (EMI). Many devices produce e lectrom agnetic radiation at frequencies used in w ireless data conm1unications. An1ong these d evices are cordless telephones, n1icro\,•aves, and nearby access points. We will see later in this chapter that p lacing access points so that they give good coverage with- out creating excessive mutual interference is an in1portant but diffic u lt task in WLAN n1anagen1ent.
Frequency-Dependen t Propag ation Problems To con1plicate matters, two wireless propagation p roblems intensify as frequency increases.
• First, higher-freq uency \'l'aves suffer more rapidly fron1 absorptive a ttenuation than lower-freque ncy waves because they are absorbed more rapidly b y n1ois- ture in the air. Consequen tly, as we \,•ill see in this chapter, WLAN signals around 5 GHz a ttenuate more rap idly than signals around 2.4 GHz.
• Second, dead zones becom e worse w ith increasin g fre q uen cy. Rad io \,•aves become less able to bend a round objects in their paths.
Test Your Understanding
7. a) If you qua druple propagation d istan ce, how n1uch will signal intensity change at the receiver? (Ans\,ver: 1/16) b) If you increase p ropagation distance b y a fac- tor of 100, how much will signal intensity ch ange at the receiver? c) If the signa l strength fron1 a n o mnidirectional radio source is 8 n1 Wat 30 n1e ters, how stron g \'l'ill it be at 150 n1eters, ignoring absorp tive attenuation? Show your work. (Ans\,•er : 0.32 mW) d) What w ill it be at 200 meters? e) If the signal s trengtll fron1 an o nmidirection al radio source is 20 n1W at 10 meters, how strong w ill it be at 70 n1e ters, ignoring absorptive attenuation? Show your \'l'ork.
8. a) Contrast in verse square law attenuation and absorptive attenuation. b) What causes dead zones? c) What is the m ost serious p ropagation p roblem in WLANs? d ) Ho\,v is it controlled? e) What t\,vo propagation problems becon1e \,•orse as frequen cy increases?
SERVICE BANDS AND BANDWIDTH
Service Band s
The Freq uency Spectrum The frequency spectrum is the range of all possible frequen cies fron1 zero hertz to infinity, as Fig ure 6-8 sho\'l'S.
Service Ba nds Regu la to rs divide the freq ue n cy spectru m in to con tigu - ous spectrun1 ran ges ca lled service bands, ½•hich are d edicated to s pecific services. For instance, in the U nited States, the AM radio service ban d lies between 535 kHz and 1,705 kHz. The FM radio service band, in turn, lies bet\,•een 87.5 MHz a nd 108.0 MHz. Wi-Fi uses the 2.4 GHz service band tllat \,•e will see later in trus chapter; this ban d extends fron1 2.4 GHz to 2.4835 GHz. Wi-Fi also uses tile 5 GHz service band, w hich ran ges from 5.25 GHz to 5.725 GHz (with som e gaps in between tllat are used
190 Chapter 6 • l\1ireless LANs l
Frequency The frequency spectrum is the Spectrum range of all possible frequencies
(0 Hz to Infinity) from O Hz to mfinity.
I Channel 5 A service band is a (usually) contiguous range o f the ~ Channel 4
frequency spectrum dedicated to a specific purpose, such as FM
Service [ radio, emergency response, GPS,
Band Channel 3 etc.
I Channel 2 Service bands are divided furth er into channels. Signals sent in I Channel 1 different channels do not interfere wi th one another.
OHz
FIGURE 6-8 The Frequency Spectrum, Service Bands, and Channels
for other services). There are hundreds of other service ba nds for po lice and fire depart- n,ents, amateur radio operators, communication sa tell ites, and n,any other purposes.
Channe ls Service bands are subd ivided fu rther into s maller frequency ranges called channels. A different s ignal can be sent in each channel because signa ls in d if- ferent channels do not interfere 1,vith one another. This is "'hy you can receive different television channels successfully. In FM radio, channels a re 200 kHz "'ide. So the first channel extends fro1n 87.5 MHz to 88.5 MHz.
Test Your Understanding
9. a) Distinguish among the frequency spectrum, service bands, and channels. b) In rad io, how can you send n, ultiple signals without the signals interfering ,vith o ne another? c) How 1nany channels are there in the FM band? (You can co,npute th is from information in the text.) d) Are the set of frequencies used for police com1nun ication in a city channels or a service band? Explain. e) An FM radio station is called Moldy Oldies 101.1. Is this a channel or a service band? f) Wi-Fi o perates in the 2.4 GHz __ and the 5 GHz __ .
Sign al and Channe l Bandwidth Figu re 6-3 s ho,ved a wave opera ting at a si ngle fre que ncy. In reality, Figure 6-9 sho\\'S that real s ignals do not travel a t a single freq ue ncy. Ra ther, real signa ls s pread over a range o f frequencies. This range is called the signal's ba nd,vidth. Signal bandwidth is n,easured by s ubtracting the lo\\'est freq ue ncy from the highest freq uency.
A channel also has a band,vidth. For ins tance, if the lowest freq uency o f an FM channe l is 89.0 MHz a nd the h ighest fre quency is 89.2 MHz, then the channel band- width is 0.2 MHz (200 kHz). AM radio channels are 10 kHz ,vide, FM channels are 200 kHz "' ide, and telev is ion channels are 6 MHz w ide.
Signal Power
t lowest
Frequency
Signal
BandWidth
Highest Frequency
Signals spread over a range of frequencies.
Chapter 6 • Wireless LANs I 191
Frequency is measured in hertz (Hz)
Frequency
Faster signals spread over a wider range of frequencies. This rang e of frequencies is called the signal's bandwidth. Channel bandw idth m ust be wide enough for the signal's bandwidth.
FIGURE 6-9 Signa l Bandwidt h
How \,•ide n1us t the c ha nnel ba nd\,•idth be? The c hannel ba nd\,•idth n1us t be wide enoug h for a s ignal 's bandwidth. Clau de Sha nno n d iscovered a rem arkable t hing about s igna l tra nsn1ission. A sig na l carrying X bits per second onl y needs ha lf the bandwidth of a signa l carrying 2X bits per second .2 Looked a t the o ther way, if you wa n t to tra nsmit !\,•ice as many b its per second, you need to dou ble your bandwidth. More gen erally, if you \,•an t to be a ble to transn1it N times as fas t, you need N times as mu ch cha nne l bandwidth. High bandwidth brin gs hig h radio tra nsm ission speed .
To transmit N t imes as fast, you n eed N times as much channel ban dwidth.
Radio channels with large band\,•idths are called broadband channels . They can carry d ata very quickly. Althoug h the tem1 broadband technically refers o nly to the w idth of a channel in radio, broadband has con1e to mea n "fast," whether or not rad io is used .
Tran smission systems that are very f ast are usually called br oadband systems even when they do n ot use r adio channels.
Test Your Understanding
10. a) Does a signal travel at a single frequency, or does it spread over a range o f frequencies? b) If the lowest frequency in a channel is 1.22 MHz and the highest frequency is 1.25 MHz, what is the channel band wid th? c) If you want to trans- mit seven times as fast, how m uch wider must the cha nnel be? d) Why is la rge channel bandwid th d esirable? e) What do \'l'e call a system w hose channels are \,•ide? f) Wha t other types of systen1 do we call broadband?
2 Speaking more precisely, Shannon also found that the s ignal-to-noise ratio (the ratio of s ignal power to noise power) also affects propagation speed. However, eng ineers find it fa r easier to increase speed by increasing bandwidth than by increasing the signal-to-noise ratio. Increasing signal power is usually limited by regula• tionsi and reducing noise power is technically very difficult.
192 Chapter 6 • Wireless LANs I
Signal Bandwidth
Figure 6-3 shows a wave operating at a single frequency.
However, most signals are spread over a range of frequencies (see Figure 6-9).
The range between the highest and lowest frequencies is the signal's bandwidth.
As transmission speed increases, the signal bandwidth increases.
Channel Bandwidth
Channel bandwidth is the highest frequency in a channel minus the lowest frequency.
An 87.5 MHz to 88.1 MHz channel has a bandwid1h of 0.2 MHz (200 kHz).
Channel Bandwidth and Propagation Speeds
The maximum possible transmission speed increases with bandwidth.
Doubling the bandwidth doubles the maximum possible transmission speed.
Multiplying the bandwidth by X multiplies the maximum possible speed by X.
Higher-speed signals need wider channel bandwidths.
Channel bandwidth must be sufficient for the signal's bandwid1h.
Broadband Channels
Broadband means wide channel bandwidth and therefore high speed.
Today, "broadband" has come to mean "fasL" whether or not radio transmission in channels is used.
FIG URE 6 -10 Cha nn e l Bandwidt h a nd Transmission Speed (Study Figure)
Licensed and Unlicensed Service Bands
If t"•o nea rby transceivers send a t the sam e frequency, their signals w ill inte rfere with each oth er. To prevent chaos, governmen ts regu la te rad io transmission . The Interna- tional Telecon,munica tions Union, w hich is a branch of the Uni ted Nations, crea tes world wide rules that define service bands a nd s pecify ho\,v individual rad io service bands a re to be used . Individual countries enfo rce these rules but are given discre tion over how to implement con trols.
Licensed Service Bands In licensed service bands, transceivers mus t have a government license to opera te. They also need a license change if they move. Comn,er- cial television bands a re licensed ban ds, as are AM and FM rad io bands. Governn,en t agencies con trol \Vho n,ay have licenses in these bands. By doing so, the governn,en t limi ts interference to an accep table level. In some licensed service bands, the ru les allow mobile hosts to move abou t but cen tra l transceivers a re regula ted. This is the case fo r m obile telepho nes.
Unlicensed Service Bands Ho\vever, for companies that have w ireless access points and n1obile con1puters, even the requiren, en t to license central antennas (in this sit- uation, access points) is an impossible burd en . Consequently, the Inte rnational Telecom- n,unications Union crea ted a fe\,• unlicensed service bands. In these bands, a con1pany can add or drop access points any tin1e it chooses. It can also have as n,an y wireless hosts as it \Vishes. All 802 .11 Wi-Fi ne two rks operate in these unlicensed rad io bands.
Chapter 6 • Wireless LANs I 193
Licensed Service Bands
If two nearby radio hosts transmit in the same channel, their signals will interfere.
Most service bands are licensed bands, in which hosts need a license to transmit
The government limits licenses to reduce interference.
Television bands, AM service bands, etc. are licensed.
In cellular telephone bands, which are licensed, only the central antennas are licensed, not the mobile phones.
Unlicensed Service Bands
Some bands are set aside as unlicensed bands.
Hosts do not need to be licensed to be turned on or moved.
802.11 Wi-Fi operates in unlicensed service bands.
This allows access points and hosts to be moved freely.
However, there is no legal recourse against interference from other nearby users.
Your only recourse is to negotiate.
At the same time, you may not cause unreasonable interference by transmitting at illegally high power.
FIGURE 6 -11 Licensed and Unlice nsed Ra dio Service Bands (Study Figure)
Th e downside of unlicensed service bands is that companies n1ust to lerate inter- ference from o thers. If your neighbor sets up a wireless LAN next door to yours, you have no recourse but to negotia te with h im o r her over such matters as \Vhich channels each of you will use. A t the same time, the la\,v prohibits unreasonable interference by using illegally high transmission po\,•e r.
Test Your Understanding
11. a) Do WLANs tod ay use licensed o r unlicensed service bands? b) Wha t is the advantage of us ing unlicensed service bands? c) Wha t is the downsid e?
Channel Use and Co-Channel Interference
Figure 6-12 illustrates two importa nt po ints about ho\,• Wi-Fi uses its channels. The first is that an access point norn1ally uses a single channel (although some can operate on more than o ne). Access Point A is transn1itting on "Channel l ," and so is adjacent Access Point B. They will in terfere. This is called co-channel interfe rence because they are using the same ch annel.
What about Access Point A and Access Point D? They a re adjacent, bu t they are operating o n d iffe rent channels (1 and 6). Therefore, they will no t interfere w ith o ne an other.
When co-channel interference occu rs, it d oes not stop transmissio ns, but it does slo\,• them do\,•n . One hotel decided to be "consistent" and put all access points on the san1e channel. Service was terrible.
To reduce co-channel in te rference, network administrators try to set adjacen t access points on d ifferent channels. Ho\,•ever, there a re a limited n umbe r of channels
194 Chapter 6 • l\ 1ireless LANs l
Interferenc e ??? .. .. ~-----------:.- Acc ess Point A
Channel 1 Access Point 8
In the 2.5 G Hz band, nonoverlapping 20 MHz channels are 1. 6 & 11.
???
Channel 1
! ' I??? ' . . . ' T
???
Acc ess Point C Channel 6
! ' : ??? ' T
~------------~ 0 ~---- --- --- - ~ Acc ess Point D
Channel 6 Acc ess Point E
Channel 6
FIGURE 6-12 Channels an d Co-Ch an nel Interference in W i-fi
Access Point F Channel 11
in the service ba nd s tha t Wi-Fi uses, so if there a re n,any nearby access po ints, some of then, will inev itably s u ffe r co-ch a nnel interference. Red ucing co-channel interfe rence is an important goal in design .
Test Your Understanding
12. In Figu re 6-12, there are question n,arks between severa l pai rs o f routers. For each o f these pairs, list their channels o f o pera tion and whether they ,vill interfere.
The 2.4 GHz and 5 GHz Unlicensed Service Bands
802.11 W i-Fi WLANs today use two u n licensed service ba nds. One is the 2.4 GHz un licensed ba nd. The other is the 5 GHz unlicensed band .
The 2.4 GHz Unl icensed Service Band The 2.4 G Hz unlicensed service band is the san,e in ,n o s t co untries in the world . Un fortuna tely, it on ly has 83.5 M Hz of
The 2.4 GHz Unlicensed Service Band
2.400 GHz to 2.835 GHz for the entire unlicensed service band.
This is small total bandwidth (435 MHz).
There can only be three nonoverlapping 20 MHz channels.
Difficult to put nearby access points on different channels.
If not, there will be co-channel int erference.
The 5 GHz Unlicensed Service Band
Slightly shorter propagation distance because of higher absorption at higher frequenci es.
Deader dead zones because of higher frequencies.
More bandwidth than the 2.4 GHz band.
Usually allows nearby access points to operate on nonoverlapping channels.
With increasingly wider channels, the ease of channel selecti on is declining.
FIGURE 6-13 The 2.4 GHz and 5 GHz Un licensed Service Bands (St udy Figure)
Chapter 6 • Wireless LANs I 195
tota l service band band\vid th. Traditionally, each 802.11 channel was 20 MHz wide, although 40 MHz bandwidth cha nnels were introd uced in 802.ll n. D ue to the \,•ay channels are allocated, there are only three possible nonoverla p ping 20 MHz 802.11 channels. These are centered at Channels 1, 6, and 11.3 In addition, there can o nly be a single 40 MHz channel, and if an 802.lln sta tion fin ds itself in a cro\,•ded area, it w ill drop back from 40 MHz to 20 MHz to reduce interference. Th is wi ll, of course, cu t transn1issio n speed in ha lf.
The 5 GHz Service Band W i-Fi also opera tes in the 5 GHz unlicensed service band . The big advan tage of the 5 GHz band is th a t it is far wider than the 2.4 GHz band. In con trast to the 2.4 GHz band's mere th ree 20 MHz channels, the 5 GHz band provid es between 11 and 24 nonoverlapp ing 20 MHz channels today, depending on the country. This n un,ber of c hannels in th e 5 GHz band is going d o\,•n as channels becon,e \,•ider to provide higher s peed per channel. The 5 GHz unlicensed band w ill soon be as cro\,•ded as the 2.4 GHz unlicensed radio band.
Add ing to the a ttractiveness o f the 5 GHz unlicensed band, regulators in severa l countries have been expand ing it to add n1ore total band\,•id th and th erefore more channels. Th e United Sta tes added n1ore bandwidth in 2003. In 2013, the Fed eral Conununica tio ns Commission announced th a t it wou ld add a fu rther 35%. In con- trast, th e 2.4 GHz band has no expansion potential because it is bordered by services that cannot be m oved.
Test Your Understanding
13. a) In v,hat h,•o service bands does 802.11 operate? b) How n, a ny 20 MHz non- overlapping channels d oes the 2.4 GHz band support? c) Why is this a pro blem? d) Why are con1panies n1oving rapidly into the 5 GHz band? e) If you triple channel bandwidth, wha t happens to the nun,ber of channels in a service band? (The answer is not d irectly in the text.)
SPREAD SPECTRUM TRANSMISSION
At th e freq uencies used by WLANs, there are n u merous propaga tion problems. To address the \,•orst of these prob lems, mu ltipath in terference, regu lators n,andate the use of a form o f transmission called spread spectrum tra nsm ission (Figu re 6-14). Spread spectrum transmission uses far \,•ider c ha nnel bandwidth tha n the tra ns- n, ission speed requ ires. Ho\,•ever, there is no increase in total energy. Th e signal is simp ly s p read ou t. Conseq uently, there is no increase in speed when these wid er channe ls a re used.
3 Channel numbers were defined for the 2.4 CHz band when channels were much narrower. A 20 MHz 802.11 channel overlaps several initially defined channels. Channels 1, 6, and 11 operate in the 2.402 GHz to 2.422 G Hz, 2.427 GHz to 2. 447 GHz, and 2.452 GHz to 2.472 GHz frequency ranges, respectively.
196 C hapter 6 • Wireless LANs I
Normal Transmission
A Spread Spectrum Transmission Bandwidth Bandwidth
In normal transmission, channel bandwidth is selected to meet the speed requirements o f the signal. In spread spectrum transmission, the signal is spread over a much wider bandwidth. In spread spectrum transmission, there is no more energy; it is merely spread out. So there is no increase in transmission speed with spread spectrum transmission. Goal: Reduce propagation effects at specific frequencies, mainly multipath interference. Done to improve transmission reliability, not to increase speed. Not done for security as in milrtary spread spectrum transmission.
FIGURE 6- 14 Spread Spectrum Transmission
Spread spectrum transmission uses far wider channel bandwidth than the transmission speed requires.
It is required by regulators to reduce multipath interference problems at Wi-Fi frequencies.
Spread spectrum channels are much wider than normal channels, but they do not transmit signals faster.
Normal versus Spread Spectrum Transmission
Spread spectrum transmission transnuts signals redundantly across its broad channel bandwidth, so that if there are transnussion problems at some frequencies, the signal will still get through.4
In wireless LANs, spread spectrum transmission is used to reduce propagation problems, not to provide security or higher transmission speed.
In commercial spread spectrun1 transn1ission, security is not a benefit. The military uses s pread s pectrum transn1ission for security, but it does so by keeping certain param- eters of its spread s pectrum transn1ission secret. Commercial s pread spectrum transnussion n1ust n1ake these paran1eters publicly known to allo\,, parties to conmnmicate easily.
Test Your Understanding
14. a) In the 2.4 GHz and 5 GHz service bands, what type of transmission method is required by regulators? b) What is the benefit of spread spectrum transnus- sion for business communication? c) Is spread spectrun1 transnussion done for security reasons in con1mercial WLANs? d) Does spread spectrun1 transn1ission increase transnussion speed thanks to its \,vider channels?
4 Spread spectrum transmission was invented by Holl ywood Actress Hedy Lamar a nd com poser George Anthe:il during \+Vorld \+Var ll. Thcfr idea w as to transmit RADAR over a very w ide range of frequencies so that German intcrforencc, which was limited to narrow frequency ranges, would not prevent most o f the s ig nal from getting through. Their inventio n was overlooked a t the tim e.
Bandwidth of Spread Spectrum Channel
Chapter 6 • Wireless LANs I 197
Subcarrier 1 (part of fram e)
Subcarrier 2 (another part of frame)
Subcarrier 3 (yet another part of frame)
More Subcarriers
Subcarriers are subchannels
FIGURE 6-15 Orthogonal Frequency Division M ultiplexi ng (OFOM)
Orthogonal Frequency Division Multiplexing {OFDM) Spread Spectrum Transmission
There are severa l spread spectr u n1 transmiss ion n1ethods. T h e 802.11 Working Group's curren t standards a ln1ost exclus ively use o rthog onal freq uency d ivision multiplexi ng (OFDM), \,•hich F igure 6-15 illustra tes.
In OFDM, each broadband channel is divided in to many smaller subchannels called subcar riers. OFDM tra nsn1its part of a frame in each subcar rier. OFDM sen ds da ta redundantly across t11e subcarriers, so if there is impairn1ent in one or even a few s ubcarriers, all of th e frame \'l'ill usually s till get th rough.
Wh y use subcarrie rs instead of simp ly spreading th e signal over th e en tire cha n - nel? The problem is t11at sending d ata over a very wide c h annel reliably is technically difficult. It is much easier to send ma n y slow s ignals in n1any small subcarriers.
Test Your Understanding
15. a) Wha t sp read sp ectrum transn1ission method dominates today? b) Why d oes it divide tl1e ch annel into subcarriers?
802.11 WLAN OPERATION
From 802.11 to 802.3
As Figure 6-16 shows, when a \,•ireless host wishes to sen d a frame to a server, it transn1its t11e frame to a wireless access point.
• When the \,•ireless host transmits, it p uts tl1e packet into an 802.11 frame. 5
• The fran1e arrives at the access point. Of course, an 802.11 frame cannot travel over the 802.3 LAN. Wt-Fi has an entirely d ifferent frame organization, and Eth ern et switch es have no idea ho\,v to handle 802.11 fran1es. The access point cannot sin1ply pass the frame o n.
• To address this problem, the access point ren1oves tl1e packet fron1 tl1e 802.11 frame a nd p laces the packet in an 802.3 Ethernet frame.
5 802. 11 frames arc much more complex than 802.3 Ethernet frames. Much of this complexity is needed to counter wireless propagation problems.
198 C hapter 6 • Wireless LANs I
2 _ __ ~
3 _____ ~ 802 .1 1 Frame
I Pac ket 5 ------,
802.3 Frame Containing Packet
Packet
802.3 Frame Containing Packet
6 ___ ~ I Packet
Seiver Needed by Client
4 Access Point
Removes packet from incoming frame,
places ,t in ongoing frame
Distrib ution System (Wired Ethernet LAN)
FIGURE 6 ·16 Packet and Frame Transmission
Radio Transmission
1
Notebook Client
Notebook client sends a packet to the server
on the distribution system (w ired LAN)
• The access point then send s th is 802.3 fra m e to the Ethernet network, w hich delivers th e 802.3 frame to the server.
• Later, w hen the server replies, the wireless access point receives the 802.3 fram e, removes the packet from the Ethernet fran1e, and forwards the packet to the wireless host in a Wi-Fi frame. 6
Th e pack et goes all the way from t h e wire less h ost t o a server. Th e 802.11 fram e t ravels only between the wireless h ost and the wireless access point. Th e 802.3 fram e t ravels only between the wireless access point an d the server.
Tes t Your Unders tanding
16. a) Why must an access point remove an arriving packet fron1 the frame and p lace the packet in a d iffe re n t fran1e \,vhen it sends the packe t back ou t? b ) Describes the s te ps tha t occur when the server transmits a packet back to the wireless clien t.
Wireless Networks with Multiple Access Points
Access points have limited signal range. To serve a large b uilding or other p hysical areas, a company n1ust install many access points. The user connects to the nearest access point. To do this, the user m us t kno\,, its service set ID (SSID), which is its nam e.7 Th.is is not a
6 This sounds Hkc w hat a router does. However, a route r can connect any two s ingle networks. Access points are limited to connecting 802.3 and 802.11 networks. 7 Thc fi rst author o nce gave his access point the SSID EviJHackcr. He changed it when his neighbors expressed nervousness about seeing it on thefr list or available access points. On the positive s ide, there were no attempts by outside hosts to cormcct to his access point.
Extended Service Set (ESS)
Large Wired LAN Distribution System (OS)
;,,....----+-+- ~ A basic service set (BSS) an Access access point and its wirel ss hosts. Point A
Service set 10 (SSID) id en ifies an access point.
Extended service set (ES is a group of BSSs with the s e SSIO that connect via a distrib ion
(SSIOzabc)
I I system. (In this case, SSI =abc.),- - ---,>-<--
Traveling hosts can be handed off (roam) to a different BSS in the same ESS.
Access Point B
(SSID=abc)
FIGURE 6- 1 7 W i-Fi W ir eless LAN with Mult iple Access Points
Chapter 6 • Wireless LANs I 199
Basic Service
Set
~BSS)
Roam ing/ Basic Hand o ff Service
Set
~ (B SS)
problem, because all Wi-Fi devices show you the available SSIDs of nea rby access points. You just pick the one you want to connect to.
Companjes \'l' ith mu ltiple access points \Vould like their access points to work together. For example, if you connect to th e access point in a classroom a nd th en go to the cafeteria after class, you \,•ould like to keep your connection \,•ithout having to con- nect again in the cafeteria. This is called roaming, and it is part of the 802 .11 standard . As you pass through several access points on the \,•ay to the cafeteria, the one you are leaving and the one you are entering can a utomatically pass you from the forn1er to the la tter.
How do access poin ts kno\,v that they are o n the same network? The simple a nswer is tha t they all have the same SSID. In Fig u re 6-17, the two access points sho\,'11 have the urumaginative SSID abc. The access point in a single network also needs to transmit messages back and forth to d o roaming and other things. They normally do thls through the con1pany's S\vitcl1ed Ethernet neh,•ork. In 802.11 jargon, trus is called the d istribution system .
Tes t Your Understanding
17, a) What is a roan1ing in 802.11? b) What characteristics do all access points in a corporate neh,vork share? c) Over what transmission system d o access points commuruca te w ith each other to accomplish roantlng? c) Distinguish between a BSS, and ESS, and an SSID.
Media Access Control
The access point and all o f the wireless hos ts it serves transmit a nd receive in a sin gle c hannel. F igure 6-18 shows that if two devices tra nsmit in the same ma n- nel a t the same time, their s igna ls ½•ill in terfere \,•ith each o ther. This is called a
200 Chapter 6 • Wireless LANs I
... '- ~,-,: . / Access '- . ...,.i:...;,
, Point ~ Transmits Channel 1
Channel Sharing
--' ~/-- /
laptop , . Transmits 1', Channel 1
The access point and all the hosts it serves transmit in a single channel. tf two devices transmit at the same time, their signals will collide, becoming unreadable.
Media Access Control (MAC) MAC methods govern when devices may transmit so that only one device transmits at a time.
FIGURE 6-18 Hosts and Access Points Transmit on a Sing le Channel
collisi on . It makes b o th s ig nals u n readable. When a \,• ireless hos t o r the access point t ra nsn1its, a ll other devices mu st wa it. As t he number of hosts served by an access p oin t increases, ind ivid ua l throug hpu t fa lls because of this \,•ailing. The box " Media Access Con trol (MAC)" d iscusses ho\,v medi a access control (MAC) n1e thods govern w he n hosts and access poin ts n1a y tran sm it so that collisions a re avoided.8
Media access control (MAC) m ethods govern whe n h osts and access points may transmit so that collisions can be avo ided.
The access point and a ll of th e wireless h ost s it serves t ransmit and receive in a single ch anne l. Wh en a wireless h ost or the access point tran smits, all other de vices must wait.
Test Your Understanding
18. All \,•ireless hosts and the access point that serves them transm it on the same channel. a) What problem does this cause? b) Ho\,v does n1ed ia access control (MAC) ad d ress this problen1? c) Does m edia access contro l a pply to w ireless hosts, access p oin ts, or both? d ) Can a wireless access point and one of the wireless clien ts in its BSS transmit sim ultaneously?
8 Yes, this is where the term MAC address comes from. Conceptuall y, Media Access Control is a s ublayer of the data lillk layer. It applies to Ethernet, Wi-Fi, and other 802.11 standards. Add resses are defi ned at this layer so tha t all 802.11 s tandards use EUJ-48 add resses.
Chapter 6 • Wireless LANs I 201
IN MOR E DEPTH M ed ia Access Control ( M AC)
The 802.11 standard has two mechanisms for media access control. The first, CSMA/CA+ACK, is mandatory. Access points and wireless hosts must support it. The second, RTS/CTS, is optional.9
CSMAICA+ACK Media Access Control
The mandatory method is Carrier Sense Multiple Access with Collision Avoidance and Acknowl- edgment, which is mercifully shortened to CSMA/CA+ACK.
Carrier sense (CS) means to listen to (sense) traffic (the carrier, in radio parlance). Multiple access (MA) means that this method uses listening to control how multiple hosts can access the network to transmit. Quite simply, if another device is transmitting, the wireless host or access point does not transmit.
Collision avoidance (CA) means that the method attempts to avoid two devices transmit - ting at the same time. One issues that if one device has been sending for some time, two or more others may be waiting to send. If they both send as soon as the current sender stops, they will both t ransmit at the same time. (YVe have all been in conversations like this.) This will cause a colli- sion. Collision avoidance adds a random delay time to decide which device may transmit first. This works, but it is inefficient because it adds dead time when no one is transmitting . If nobody has been transmitting for a long time, this random delay step is skipped because the likelihood of a collision is small.
CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance)
Sender listens for traffic
Carrier is the signal; sensing is listening
1. If there is traffic, waits
2. If there is no traffic:
2a. If there has been no traffic for less than the critical time value, waits a random amount of time, then returns to Step 1.
2b. If there has been no traffic for more than the critical value for time, sends without waiting.
These steps avoid the collision that would result if hosts could transmit as soon as one host finishes transmitting.
ACK (Acknowledgment)
Receiver immediately sends back an acknowledgment
If sender does not receive the acknowledgment, retransmits using CSMA
CSMA/CA plus ACK is a reliable protocol
FIGURE 6- 19 CSMA/CA+ACK M edia Access Control (Study Figure)
9 Actually, if you have even a s ingle host with oldcr802.1 lb equipment connected to an access point, RTS/ CTS becomes mandatory. However, 802. 1 lb wi reless hosts are almost never encountered anymore.
(continued)
202 Chapter 6 • Wireless LANs I
ACK means that if the receiver receives a message correctly, it i mmediately sends an acknowledgment to the sender, not waiting at al l. This is another reason to require stations to delay before sending when a sender stops transmitting.
If the sender does not receive an ACK, it retransmits the frame. Sending acknowledgments and doing retransmissions makes 802 . 11 Wi-Fi transmission reliable because it provides both error detection and error correction. CSMA/CA+ACK is the only reliable transmission method we will see in this book other than TCP. Most early wired DLL protocols were reliable because transmis- sion then was unreliable, even in w ired networks. Under these circumstances, error correction at the data link layer made sense. This is no longer true today generally. Today, w ired transmission protocols such as Ethernet are unreliable. Doing error correction is simply not worth the effort at each hop between switches when transmission errors are rare. We have seen that w ireless trans- mission, however, is encumbered with propagation problems, and lost or damaged frames are far too common. It makes sense under these conditions to make 802.1 1 (and many other w ireless protocols) reliable.
Thanks to CSMAICA+ACK, 802.11 is a r eliable protocol.
CSMA/CA+ACK works well, but it is inefficient. Waiting before transmission wastes valuable time. Sending AC Ks and doing retransmissions also is time consumi ng. Overall, an 802.11 LAN has throughput substantially lower than rated speeds.
Test Your Understanding
19. a) What does CS mean? (Do not just spell out the abbreviation.) b) How is carrier sensing used in multip le access? c) Why is CA desirable? d) Does a frame's receiver transmit an ACK immediately or after a random delay? e) Is CSM A/CA+ACK reliable or unreliable? f) Why w as 802.11 made reliable? g) ls CSMA/CA+ACK efficient?
Request to Send/Clear to Send (RTS/CTS)
Although CSMA/CA+ACK is mandatory, there is another control mechanism called request to send/clear to send (RTS/ CTS). Figure 6-20 illustrates RTS/CTS. As noted earlier, the RTS/CTS pro- tocol is usually optional. Avoiding RTS/CTS whenever possible is w ise because RTS/CTS is much less efficient, and therefore slower, than CSMA/CA+ACK.
2. Access Point broadcasts a
Clear-to-Send (CTS) message
3.
1 . Host that wishes to transmit may send a
Request-to-Send (RTS) message
Host A
Host A may transmit freely
4 . Other hosts must wait while Host A transm~s
FIGURE 6 -20 Request to Send/Cl ear to Send Media Access Cont rol
Chapter 6 • Wireless LANs I 203
• When a host wishes to send, the host may send a request-to-send (RTS) message to the wireless access point. This message asks the access point for permission to send messages for a short period of time on an exclusive basis. It is like someone asking for recognition by a human meeting director so that they may take the floor.
• If the access point responds by broadcasting a clear-to-send (CTS) message, then other hosts must wait. The host sending the RTS may then transmit, ignoring CSMA/CA.
RTS/CTS makes sense primarily when two wireless clients can both hear the access point but cannot hear each other. With CSMA/CA+ACK, the two stations may transmit at the same time. RTS/CTS eliminates this.
Test Your Understanding
20. a) Describe RTS/CTS. b) Is CSMA/CA+ACK required or optional? c) Is RTS/CTS required or optional? d) Which is more efficient, RTS/CTS or CSMA/CA+ACK? e) When does it make sense to use RTS/CTS?
802.11 TRANSMISSION STANDARDS
The 802.11 Working Group has crea ted several WLAN transn1ission s tandards s ince 1997. We will look a t the two importa nt standards today, 802.lln and 802.llac.10
Channel Bandwidth and Service Band Bandwidth One major difference between 802. l l n and 802.llac is c ha nnel bandwid th. Recall tha t v.• ider channel ban dv.• id th mea ns faster speed. As F igure 6-21 shov.•s, the tota l ba nd\,•id th in the 5 GHz service band is about 665 MHz in the U nited Sta tes. The norn1a l bandwidth of 802.lln is 40 MHz. Therefore, there can be abou t ten 40 MHz 802.ll n channels in the 5 GHz unlicensed service ba nd. That is a good n un1ber of channels, bu t s peed is lin1i ted.
802.1 1n 802.11ac 802. 11ac 40 Hz Channels 80 M Hz Channels 160 Hz Ch annel s
Total Service Band Bandwidth 665 MHz 665 MHz 665 MHz
Channel Bandwidth 40 MHz 80MHz 160 MHz
Total Service Band 16.6 8.3 4.2 Bandwidth Divided by Channel Bandwidth
Actual Number of Channels 12 6 2
FIGURE 6-21 Num ber of Cha nnels in the 5 GHz Unlicensed Radio Band
10 Somcttmcs access points also have to deal with staHonscommunicating with the older 802.11g standard in thc2.4 G Hz band and the even older 802.lla standard in thc5 GHz band.
204 Chapter 6 • Wireless LANs I
Th e 802.llac standard, in con trast, has e ither 80 MHz or 160 MHz channe ls. That means m ore speed-twice or fou r tin1es the speed of 802.lln's 40 MHz channels. (Other things make 802.ll ac transmission even faster.) Ho\vever, with a tota l band- wid th of about 665 MHz, there can only be six 80 MHz ch annels and only two 160 GHz ch annels, due to the \,•ay tha t channels are allocated.
As channel bandwidth incr eases, the number of channels in a service band decreases prop ortionately.
Test Your Understanding
21. If you triple ch annel b a ndwid th in a service band, \,•hat ha p pens to the number of ch annels in a service b a nd?
Speed and M arket Status
Figure 6-22 compares the 8 02.lln an d 802.lla c s tandards. 802.lln produ cts deliver sp eeds of 100 to 600 Mbps. The newer 802.ll ac standard delivers far higher rated speeds of 433 Mbps to 6.9 Gbps. 802.ll n still d on1inates the installed b ase today, b ut 802.llac dom ina tes sales and will soon supplant 802.lln as the dominant Wi-Fi technology.
Test Your Understanding
22. a) Compa re the rated speed s o f 802.lln and 802.llac. b) Compare the n1arket s tatus o f 802.lln and 802 .llac. c) If you need an access point providing 3 Gb ps service, \,•hat choice d o you have?
Characteristic 802. 11n Dual Band 802. 11ac
Rated Speed 100 Mbps to 600 Mbps. 433 Mbps to 6. 9 Gbps.
Status Widely used Widely used and dominates sales
Unlicensed Band(s) 2.4 GHz and S GHz 5GHz
Channel bandwidth 40 MHz, but will drop back 80 MHz or 160 MHz to 20 MHz if there is interference with older 20 MHz standards
Number of Non-Overlapping 3 in 2.4 GHz band; 12 in the 6 at 80 MHz channel Channels (varies by country) United States in S GHz band bandwidth and 2 at
160 MHz channel bandwidth in the United States in the S GHz band
Maximum MIMO spatial streams 4 8 Multi-User MIMO / Beamforming? No Yes
FIGURE 6-22 Ch a racteristics of Major 802.11 Wi-Fi Sta ndards
Chapter 6 • Wireless LANs I 205
The rated speed of the access point
The actual throughput (aggregate) of the access poinL which is lower
The number of users transmitting simultaneously determines individual throughput
Your distance from the access point will also affect how fast the access point transmits to you
As you travel away, the access point will transmit more slowly to be more easily understood
FIGURE 6 -23 Yo ur Individual Throughput Will Vary. A Lot. (Study Figure)
Your Service Speed Will Vary. A Lot.
The rnted speed of a network is the speed tha t it called for in the s tandard. This is the speed tha t is advertised on the box. In reality, throughput-the speed your network actually provides-is always lower, often substantially lower. Let's say that the rated speed of your access point is 600 Mbps. The throughput n1ight be 500 Mbps-or a lot lo\,•er.
In add ition, the access point and the \Vireless clients all transmit in a single chan- nel. As we sa\v earlier, \,•hen the access point or a w ireless host is transmi tting, the others must \,•ait. The 500 Mbps for an access point, then, is aggrega te throughput. Suppose that an access point serves 50 devices. At a particular mon1ent in time, 5 of them wish to transmit. These 5 wou ld share the aggregate throughput. On average, each wou ld get 100 Mbps of individunl throughput. If 20 \,•ished to transmit, each would receive only 25 Mbps.
Things get worse for an individual \,•ireless host as it gets far ther from the access point. The signal degrades \,•ith d istance, creating more transmission errors. Standards con1pensa te for this by transmitting more slowly to a host if errors become substantial. This reduces errors, but it also reduces individual throughput.
In genera l, given the uncertainties involved in ra ted speed versus throughput, individual throughput changing as the nun1ber of stations needing to transn1it changes, and individual throughput changing as a function of distance, it is in1possible to know ho\,• n1uch transmission speed you \Viii get as a w ireless client. It is a lways good to install a program that measures your actual upload and download speed when you are being served by an access point.
Test Your Understanding
23. a) You are using a n access point with a rated speed of 4 Gbps. Why will you experience much less speed? b) What \,•ill happen to your speed as you move away fron1 the access point?
Multiple Input/Multiple Output (MIMO)
Increasing band\,•idth is the easiest \,•ay to boost transmission speed, but there is a more elegant \,•ay to increase speed without increasing bandwidth. Figure 6-24 notes that stan- dards beyond 802.l lg use a technique called multiple input/multiple output (MlMO) to double, triple, or quadruple transmission speed (or even increase it more) \,•ithout increasing charmel bandwidth.
206 Chapter 6 • Wireless LANs I
Antenna A
Antenna 1
Access Point
Spatial Stream ~ lll,.
--- -===::::::::::=-~-="""'.~?~ .,__ ---- Antenna
B
- - --,~ Spatial Stream 2 in same channel
-Antenna 2
Wireless Host
Two spatial streams are sent in the same channel, but from different sending antennas. The two signals arrive at slightly different times at the two receiving antennas.
This allows the receiver to distinguish between the two signals.
FIGURE 6- 24 Multiple Input/Multiple Output (MIMO) Operation
The key to higher throughput in MIMO is that the host or access point sends two or more spatia l streams (radio signals) in the same channel between two or more d ifferent antennas on access points and w ireless hosts. Earl ier, we said that that was impossible. Actually, it used to be in1possible, b u t newer technology has n1ade this possible.
In the figure, there are h,vo spatial strean1s. Each carries different information. As we saw earlier in this chap ter, tv.•o signals in the same channel should interfere \,•ith each other. However, the two spatial strean1s sent by d ifferent antennas will arrive at the h,vo receiving antennas with slightly d ifferen t time lags. Using detection and separation methods based on differences in arrival times for the two spatia l streams, the receiver can separate the h,•o spatial strean1s in the san1e channel and so can read them ind ividually.
Even w ith only two spatia l streams using h,•o antennas each on the sender and receiver, MIMO can roughly double throughput. Using more antennas and therefore n1ore spa tial streams can increase throughput even more. MIMO is not limited to two spa tial streams.
The 802.lln standard introduced MIMO to Wi-Fi. With two spatial strean1s, the rated speed in 802.lln with 40 MHz channels is 300 Mbps. Three spatial streams raise the rated speed to 450 Mbps, and four raise it to 600 Mbps. The 802.lln standard requires access points to support four spatial strean1S, although \,•ireless hosts are only required to support two spatial strean1s. Typ ical speeds in 802.lln products today have rated speeds of about 300 Mbps.
The 802.llac standard, in addition to doubling or quadrupling channel band- width compared to 802.lln, doubles the number of possible spatial streams to eight. The standard offers 16 possib le con1b inations of bandwidth (80 MHz or 160 MHz) and number of spa tial strean1s (1 to 8). This crea tes a large number of possible rated speeds: 433 Mbps to 6.9 Mbps. Products today typically provide rated speeds of about 1.5 Gbps, but speed is increasing rapidly.
Another benefi t of MIMO, beyond greater transmission speed, is greater trans- n1ission range. Greater propagation d istances may pern1it fe\ver access points to be installed, and this will lo\,ver equipment and installa tion cost.
Chapter 6 • Wireless LANs I 207
Test Your Understanding
24. a) How does MIMO use s patial streams to increase transn1ission s peed? b) What is the main benefit of MIMO? c) What is its other benefit?
Beamforming and Multiuser MIMO Today, jet figh ters u se phased array radar systems tha t are flat dishes \,•ith many tiny antennas spread over the su rface. Controlling the relative phases of the s ign als from these antennas can focus the radar bean, in a particular direction very rap- id ly. The antennas on advanced MIMO systen1s can do the same, focusing the radio power instead of broadcasting it isotropically (in all directions equally). Figu re 6-25 illus trates this focusing, which is called bearnforming .
Obvious ly, beamforn1ing means that when the access poin t tra nsm its to (or receives fron1) a \,•ireless device the signal w ill be stronger. The radio can either operate at lower power or send the signal far ther.
Bean1forn1ing a lso allows multiuser MIMO (MU-MIMO), in whic h th e access point focuses o n two \,•ireless devices at the same time. With focused transmissions, it can commurucate with two or more devices sin1ultaneously. This eliminates the time a device may have to \,•ait before transm itting in order to avoid collisions.
Test Your Understanding
25. a) What is beamforn1ing? b) What benefits can it bring? c) Distinguish between MIMO and n1ultiuser MIMO (MU-MIMO).
Beamforming
Mulbuser MIMO (MU-MIMO)
Beam 1 Beam2
Laptop 2
Beamformmg
Beamforming can direct signal energy toward individual devices. This sends stronger signals, bringing longer range. It can also allow an access point to communicate with multiple devices in a sing le channel through multiuser MIMO (MU-MIMO).
FIGURE 6-25 Beamf orming and Mult iuser M IM O
208 Chapter 6 • Wireless L ANs I
Backward Compatibility
IN MORE DEPTH
802.11 / W l-FI NOT ES
You have several 802 .11 n devices in your home-two notebooks, two laptop computers, a voice-activat ed home controller, and an access point. You are thinking of upgrading your access point to 802 .11 ac. Wi ll your devices work with the new access point? They w ill. W i-Fi devices have backward compatibility. This means that new devices will always work w ith existing devices (although perhaps not with truly ancient devices). This is good, because otherwise you would have to throw out all your 802.11 n devices, or at least add an external USB device to implement 802. 11 ac (see Figure 6-26).
This does not mean that your devices will magically operate at 802.1 lac speeds. Thei r radios can only give 802. 11 n speeds. This is where backward compatibi lity comes i n. The new 802. 11 ac access point retai ns the abili ty to transmit 802 .11 n signals, i ncluding those in the 2.4 GHz channel. A ll t he devices, t hen, w i ll t ra nsmit using 802. 11 n. If you w ant 802. 11ac speeds, you w i ll have to buy new client devices or buy an external 802. 11 ac device. The good news is that you are free to upgrade them individually o r not at all, w ai ting until you buy new 802. 11 ac-compati ble devices.
Test Your Understanding
26. a) You are consideri ng a laptop computer that uses 802.1 1 ay. (802.1 lay is d iscussed in t he next subsection.) W ill your existing 802. 11 ac access point be able to communicate with t he new device? b) What standard w i ll they use in t he communication if commu- nication is possible? c) What principle does this communication exemplify?
Profile Waves for Wi-Fi Devices
As noted earlier, the W i-Fi Alliance tests for int eroperability between 802.1 1 devices. Until an 802.11 device pass certification, it cannot display the Wi-Fi logo on its box.
However, 802.1 1 standards have many options, some of which would be impossible or at least very expensive to implement when a standard is f irst released. The W i-Fi A lliance addresses this challenge by releasing a series of profi le waves over time, each specifying certain things that must be included .
The Wave 1 profile for a new standard always gives a good increase in performance com- pared t o the previous standard. The Wave 2 profile gives still better performance by implementing more advanced options. Waves may continue beyond Wave 2, although by the time there is a need for a third w ave, a better standard is often available. It is not unusual for profile waves to stop below the theoretical best speeds of the standard.
Old
Wireless Client
802.11n only
Communication Us,ng 802.11 n
Backwards compatibility requires new
devices to continue to support previous technology.
FIGURE 6-26 Backward Compatibility
New Access Point
802.11ac 802.11n
Chapter 6 • Wireless LANs I 209
Standards Have Many Options
Some may be impossible or too expensive to implement initially
The Wi-Fi Alliance defines profile waves by doing compatibility testing
Devices must be tested for compatibility with a particular profile wave
Only then are they certified as Wi-Fi compliant
Wave Profile Progression
Wave 1 profiles are usually good improvements over past standards
Wave 2 profiles provide more speed and other features
Confusingly, wave profiles themselves have options
This gives sometimes unwelcome variability for performance between device pairs
802.1 1ac
Wave 1 profile gives a data stream of up to 1.3 Gbps
Wave 2 profile gives a data stream of 2.5 Gbps, plus MU-MIMO
FIGURE 6- 27 Profile Wa ves for Wi-fi Devices (Study Figure)
To give an example, 802.1 lac Wave 1 products were limited to 80 MHz channels and up to three M IMO spatial streams. At the high end, this gives a data rate of 1.3 Gbps. A cellular tele- phone with only a single antenna w ill probably receive a throughput around 250 Mbps. A wireless computer with three antennas w ill probably see about 750 Mbps.
The Wave 2 802.11 ac profile brings 160 MHz channels (if there is room for them) and a fourth antenna to give four M IMO spatial streams. This and other improvements w ill bump the data stream to about 2.5 Gbps.
This is roughly a doubling in potential speed, but newer waves also introduce features beyond speed. For example, Wave 2 adds MU-MIMO capability, allowing separate beamformed transmission w ith more than one device simultaneously.
Test Your Understanding
27. a) Why does t he Wi-Fi Alliance release compat ibility testing profiles in waves instead of com bin ing t he entire st andard's features initially? b) W hen someone says th at an access point is a W ave 1 802. 11 ac device, what improvements do you expect to receive w it h a Wave 2 802. l lacdevice?
Coming Attractions
The 802.1 1 Working Group produces new standards constantly. Many are minor standards or are important management standards t hat you w ill learn if you go into networking as a career. How- ever, three standards under development are worth knowing about broadly because they have t he potential to make 802 .11ac a quaint memory.
802.11ax The 802.11ax standard now under development could be thought of as a supercharged 802. 1 lac. It uses the same 5 GHz unlicensed band. 11 seems like a minor upgrade; it will only raise the maximum speed from 7 Gbps to 10 Gbps.
However, 802. 1 lax addresses a problem t hat is becomi ng more important than speed- i ncreasing density (the number of hosts per access point). The 802.1 ax standard p romises to seive four times as many hosts per access point as 802. l ac. 11 w ill do so by being more spectrum
(cout;uued)
210 Chap ter 6 • Wireless LANs I
802.11ax
In the unlicensed 5 GHz Band
A little faster than 802.11ac
But can serve many more stations per access point
High-density operation is becomi ng important as the number of devices in an area grows
The 60 GHz Unlicensed Band
Very high attenuation so short range, strong dead zones, and difficulty penetrati ng walls
14 gigahertz of total bandwidth
802.11ad in the 60 GHz Band
Up to 7 GHz of rated speeds
Today's products offer only about half that
802.11 ay in the 60 GHz Band
More sophisticated version of 802.11 ad
Should bump basic speed to 20 to 30 Gbps over longer distances than 802.11ad
May be able to penetrate walls
FIGURE 6 -28 Coming Attractions (St udy Figure)
efficient, sending more bits per hertz of bandwidth. For example, it w ill transmit w ith 1,048 states per clock cycle, and it will int roduce a much more efficient media access control mechanism to control when hosts transmit.
The 60 GHz Unlicensed Band: 802.11ad and 802.11ay In corporations, the 5 GHz band is close to being as saturated like the 2 .4 GHz b and in corporations. The enormous 160 MHz channels of 802.1 l ac at its most aggressive chew up massive amount of the 5 GHz band. 11
802.11ad in the 60 GHz Band A new higher-frequency 60 GHz unlicensed band has been approved, and products have begun appearing t o exploit it in wireless LANs. The act ual range of frequencies varies in different parts of t he world, but it is usually very w ide. In t he United States, the Federal Communication Commission has allocat ed t he frequencies between 57 GHz and 71 GHz. This is 14 GHz in total. The base channel b andwidth is 2.1 6 GHz, which is wider than the entire 5 GHz band.
The first 802 . 11 standard for 60 GHz, 802.11 ad, can provide 7 Gbps of speed. The 802. 11 ac standard's maximum rate is this fast, but 802.1 lac products do not reach it. Today, Wave 2 802. 11 ac speeds are only 3.2 Gbps. The 802.1 l ad standard is attractive for high-end residential use. It can support w ireless communication between a laptop and a television for streaming 4K video. It also can make w ireless connections t o replace USB cords and do so at ultrahigh speeds. In residences, it is a high-speed cable replacement technology.
High Absorptive Attenuation A lt hough the 60 GHz band h as a great deal of cap ac- ity, it also has serious propagation problems. In Figure 6-5, we saw that absorptive attenuation
11 The 5 GHz band does not extend to 6 G Hz, a nd it has sections within its ran ge that have not been approved fo r unlicensed use.
Chapter 6 • Wireless LANs I 21 1
i ncreases as frequency increases. Consequently, the 60 GHz band has much higher attenuation
than the 5 GHz band. 12 Its maximum propagation distance is very short.
Shadow Zones and Clear Lines of Sight Recall the other problem with increasing fre- quencies: objects block waves far more as frequency increases. Tests have shown that 802. 1 lad signals cannot go through building walls. In fact, wooden doors stop them almost completely. The 802.1 1 ad standard requires a clear line of sight with no obstacles between the access point and a host. In office areas, this is difficult. Together, high absorptive attenuation and strong shadow
zones limit 802. 1 lad to a single room, and not a room with significant obstacles.
802.11ay The existing 802.1 lad standard is not very sophisticated. It does not offer M IMO or other advances that 802. 1 lac has offered for some time. A next-generation 60 GHz standard promises to add M IMO and much more. This 802.1 1ay standard is still under development, but it should bump basic speed to 20 to 30 Gbps over substantially longer distances than 802. 11 ad, and by bonding several channels together, it will be able to provide much higher speeds. Using MU-M IMO, it also can direct energy with beamforming to give much better range. This and other improvements should even allow it to penetrate walls and other obstacles, at least to some extent. Of course, we will have to wait and see.
Test Your U nderstanding
28 . a) What is the main promise of 802.1 l ax over 802.1 1 ac? b) Why is the 60 GHz unl icensed band attractive? c) What p roblems does it pose for W i-Fi ? d) How is 802 .11 ay l ikely to
be better than 802. 1 lad?
END-OF-CHAPTER QUESTIONS
Thought Questions
6-1. Why might a company decided to use 80 MHz channels in 802.llac instead of 160 MHz channels?
6-2. a) Wha t do physical layer s tandards govern? b) What do data link layer s tandards govern? For the following lettered question par ts, say whether the concept is a Layer 1 concer n or a Layer 2 concern. Explai n your
reasoni ng. c) Multipath i nte rference. d) Media Access Control. e) MfMO. f) Converting between 802.11 frames and 802.3 fra mes. g) Wireless propagation problems. h) Roaming. i) 802.llac.
6-3. You can transmit 1.54 Gbps in a channel you use frequen tly. You want to transmit at 4.32 Gbps. How much wider must your channel be than its current bandwidth?
12 Right around 60 GHz, there is an even more severe absorption problem. Radio waves at that frequency cause oxygen atoms in the air to vibrate, leaching energy from the signal. Around 60 C Hz, attenuation can be up to 100 times higher than it is at neighboring frequencies. The FCC originally allocate the range from 57 CHz to 64 C Hz, much of which is heavily affected by oxygen absorption attenuation. In 2016, it added the range from 64 C Hz to 71 CHz, which is well pas t the oxygen absorption peak.
212 Chapter 6 • Wireless LANs I
Troubleshooting Question
6-4. You have been using you r phone and you r school's Wi-Fi networ k to access hosts on the Internet. Suddenly, you cannot reach Internet hosts. Cre- a te a hvo-column table. a) In the first
Hands On
Chapter 6a has a set of hands-on exer- cises tha t w ill help you make the things
Perspective Questions
6-5. What was the most surpr ising thi ng you learned in this chapter ?
column, create a list of PoSSible causes. b) In the second column, describe how you would test each one. (You may not be able to test them all.)
you have learned t n this chapter more concrete .
6-6. What was the most difficul t part of this chapte r for you?
Chapter 6a
Hands-On: Using Xirrus Wi-Fi Inspector
LEARN ING OBJECT IVES
by the end of this chapter, you should be able to:
• Use Xirrus Wi-Fi Inspector with son1e facility.
• Interpret output from Wi-Fi Inspector in specific situations.
• Do a site survey.
INTRODUCTION
Wi-Fi analysis programs listen to nearby access points (and son1etimes w ireless hosts) to d etern1ine such things as how strong their s ignals are, \,•hat types of security they use, w hat their SSIDs an d BSSIDs are, and sometimes the d irections of the ind ividua l access points.
There are n1a ny Wi-Fi a na lysis programs for n1obile devices. Many have "stun1- b ler" in t heir names in homage to one o f the firs t exan1ples, NetS tumbler. This chapter looks at Wi-Fi Inspector from Xirrus, \,•hich runs o n Microsoft Windo\,•s and is available as a free d own load fron1 Xirrus . A con1parable Windo\,•s Widget that a lways remains on the desktop is also ava ilab le from Xirrus.
THE FOUR WINDOWS
F igure 6a-1 shows the ribbon menu and fou r tiled windo\,•s tha t appear w hen you bring u p Wi-Fi Inspector. This view shows all information in a s ingle \Vindow. Th is is the defau lt. It is a lso what you see if you click o n Sho\,• A ll in the Layou t ribbon.
213
214 Chapter 6a • Hands-On: Using Xirrus Wi-Fi Inspector
--· SSIO
......... SSIO: .....,. - 0Jco~1);ll:S1 ""- . - ~·-- 802.11,,
~ Adlpflel"~. tr,~GenO'tlo(P-1 Wfdt111+1 1030
...... = HAC 8Ct77:37!3]:59T~
"' l92.168.1,10l """ M.2S.221. SS <..t~Y. ltl, 168, I, 1
bt~~1": 61-~183, 13
8SS1D
~ /IIAll• 45 _ ~ " 1'CS<CM' ~ ~ ;~nS,90,tZH e , ... ,..., I'""' <:< -~:
XIRRUS Wi-Fi Inspector
[-·l ~-- l
,.,, t,J ~·--~~----··------- -------·-----------~-----~---
.,. ·• - ... 1· , ...
·- - - - - . -- . • - ... .......... .. "' '1l.bll,,l\.-4$ 0896 )1:28:0(:4' 1 "
.,, - - .. ~ . "' .............. .."!'!I' - - . ill ... > ' , '\.. ~24 OJ: 25 :!IC:?l:ll:51 ... ,. I
.,. .,. ... ,,. JOO ,,. "" ,,. ... ,. 0 ' ,-, g.A,Ocl I At<k.t lO lii:,oro
FIGURE 6a.-.1 Four Windows in Wi-Fi Inspector
The Radar Window (Read the Fine Print)
The n1ost obvious windo\,, is the radar \,•indow, \,vhich shows all access points in the vicinity. The access points are spread out across the two-din1ensional picture.
Relative Direction (M ean ingless) It appears that the radar window shows the relative directions of the access points, much as an a ir traffic radar display sho\,'S the directions of nearby aircraft. Actually, it does not. The access points are n1erely spread out for readability. Direction is meaningless. In this sense, the radar window is n1is leading. Ho\,vever, it looks cool.
D istan ce From t h e Cen ter {Signa l Stren gth) What does d is tance from the center n1ean? It looks like it means physical d is tance, as it would on a physical radar screen. Rather, it n1eans signal strength. Access points tha t are sho\,•n closes t to the center are the strongest, and access points that are the far thest from the center are the weakest.
M easuri ng Sign al Strength Signal strength g ives the RSSI (relative signal strength indicator) for the access point. Smaller negative nun1bers are better. For exan1ple, -60 dBm is a very strong signal, \,•hile -87 dBm is a very \,•eak signal. In
Chapter 6a • Hands-On: Using Xirn,s Wi-Fi Inspector 215
Figure 6a-1, Na lu24 has a s igna l strength of --65, which is quite good. Belkin has a signal strength of-89, which is terrible.
For signal strength, smaller negative numbers are better. (It's a double negative.)
Expanding t he Rad ar W indo w The radar \,•indow in its nom1al sn1all form can only display four access points. Under the Layout section of the menu, selecting Radar in the Layout Group w ill n1axim ize the radar w indow. This allows up to ten access point names to be seen. By the way, "network" and "SSID" are synonyn1s.
Figure 6a-2 sho\,'S the expanded radar windo\,•. There are on ly two nearby access points, so there is no need for a large radar \,•indow. However, it certainly is easier to read the relative indicated signa l strength.
Connection Window
The connection windo\,v (in the upper right in Figure 6a-1) shows information about the access point to which the con1puter running Wt-Fi Inspector is currently connected (Na lu24). It sho\,'S the SSID (the network name, in this case, Nalu24), the BSSID (the
- Nctarr,o,t,;, Sp.-cdTcst ~N:)11 St"tln,;is
Nri.orb Q.ill't-,TCS1 ...... Sho-M ~Teat Slop rests ~
FIGURE 6a-2 Expanded Radar Window
....,,...., ''"""
Nah . .i ~4
•
XIRRUS Wi-Fi Inspector
216 Chapter 6a • Hands-On: Using Xirrus Wi-Fi Inspector
access point's MAC address, in this case, Cisco-Linksys:73:22:511), the channel (6), the signal strength (--65 dBn1), and the network mode (802.l l n).
In the midd le is information about the user's PC. It shows the user's MAC address and configuration informa tion, including the user's IP address, the IP address of the destination server, the IP address of the default gate\,•ay (router), and the neh,•ork's external IP address given to it by the ISP. (This is a home network.) This informa tion does not tell the user about nearby access points, but it can be very useful in assessing connection problems.
On the right is a Connect/Disconnect button . Clicking this button shows a list of potential networks and allows the user's computer to disconnect from the current access point and pick another to connect to. The user can also turn off the computer's wireless adapter.
The Networks Window
The neh-vorks window shows detailed information about each of the nearby access points. This is what the user goes to \,•hen he or she wants detailed information. The row for the access point to whim the user is currently connected is sho\,•n in orange highlighted. Wi-Fi Inspector updates the inforn1ation in the neh,•orks window fre- quently. As Figure 6a-3 shows, the informa tion in this \,vindow is detailed.
• SSTD. The network name.
• Signal level in either dBm or percentage. Remen1ber that sn1aller negative dBn1 nun1bers indicate higher streng th. Next to the number is a colored bar.
• Green is for s igna ls of-70 dBm and above (--60 dBm, etc.). • Yellow is for signa ls beh,•een -71 dBm and -80 dBm. • Orange is for signals between -81 dBn1 and -90 dBn1. • Red is for -91 dBm and belo\,•.
- 0 X
- XIRRUS Wi-Fi Inspector
--· SSIO
--" It fl rfffri MER WA, ....... , & i&&fi&tttM , FIGURE 6 a- 3 Networks Window
1 The fi rst two octets in a MAC address identify the company making the network adapter in the access point. Wi-Fi inspector converts this information into a humanly readable name.
Chapter 6a • Hands-On: Using Xirn,s Wi-Fi Inspector 217
- ' '
Rio ht dick on SSIO name to locate Adaprer Name •
Def .. , Vendor BSSID Cha .• , Freq .. , Net... G-aph
2437 Access
FIGURE 6a--4 Locating an Access Point
• Network Mode. 802.llg, 802.lln, e tc.
• Default Encryption. None, WEP, TKIP (in WPA), or AES (802.lli).
• Default Authentication. Open (none), WPA/PSK, WPA2/ PSK, WPA/802.lX, or WPA2 /802.1X.
• Vendor. The nan1e of the device n1anufacturer.
• BSSID. The access point's MAC address. • Channel. The channel number.
• Frequency. The center frequency of the channel.
• Network Type. Access point or ad hoc (no access point).
• Graph. Trus is a c heckbox that tells Wi-Fi Inspector to graph the signal level over time (checked) or not to do so (unchecked ). In the figure, both are checked, so both \,•ill be graphed.
In the fi gure, the access po ints are lis ted in terms of d eclining signal strength. However, the neh,•orks table can be sorted by any column heading. The user n1erely clicks on the column heading.
Figure 6a-4 zooms in on the ne tworks \,v indo\,•. In the upper r ight, there are ins tructions to "Right cl ick on SSID nan1e to Locate." In th e section on the radar win- dow, we sa\,, that the w indow does not give the physical locations of access points. Th e Loca te function under ne tworks addresses th is lack of physical location in a limited bu t interesting \,•ay. If you right click o n an SSID name suc h as Nalu24, you r compu ter begins beeping. If you are far away, it will beep slowly. As you approach it, the beeping speed ½•ill be increased. Essentially, you are using the neh'l'ork analysis version of a Geiger counter.
Signal History In th e neh'l'orks \,•indo½', we sa\,v that the user can check or uncheck \,vhether graph- ing should be d one. The Signal History window shows these graphs. The graphs in Figure 6a-5 show th a t the signal streng th for Nalu24 is uniforn1ly excellent and that the signal strength for Belkin in is uniformly poor. Major fluctua tions wou ld indica te serious problems.
218 Chapter 6a • Hands-On: Using Xirrus Wi-Fi Inspector
- a.ei:w ~ ~lest ltt~C\F!how ScttnDs 14storyin:1Net:wo.'b Quali!yTest
~,. Gomt<'bOl'I T_. SICIO
"' ... ... ,so "' ,so
FIGURE 6a- 5 Signal History
other Groups on the Ribbon
no 100 ,.
•
XIRRUS Wi-Fi Inspector
'-bdlon.e-18 Ol•l6·Jl:21!'.0l•• "'-Na!u24 00'.2Sc9C:1l:2?:51
0
Th e Layou t group on t he rjbbon is the most-used fea ture of the Xirrus Wi-Fi Inspector.
Help Group The Help group provides a user's gmde to expla in th e program's detailed func tionality. There is also a helpful glossary of tern,s.
Settings Group Th e Settings group allows the user to adjust m any settings, for examp le, exp ressing RSSI in percentage terms instead of in terms of dBn, .
Tests Gr oup The w indows in Wi-Fi Inspector provide information v isually. The Tests group allo\,•s the user to conduct m ore detailed tests. These tests are good for troubleshooting.
TESTS
As just no ted, the Tests group actively tests the quality of your service. The Tests group performs three impo rtant tests.
Conn ection Test
The connection test sho\,•s how \,•ell you are connected to the outside world and to critical interna l devices. Figure 6a-6 shows the resul ts of a connectio n test. It sho\'l'S that Wi-Fi Inspector uses ping to test latency to you r DNS server, defau lt gate\vay (router), and a host on the Internet (In ternet Reachab le). It also does a DNS lookup, in this case fo r \'' \'l'w.google.con,.
The test shows that the user has low latency for the default rou ter and an Internet host. It a lso shows that th e DNS lookup was successfu l. In color, these are shown in green, \,•Hh the word Pass. However, there is relatively high latency to the user's DNS server (152 ms). This is ind icated by a yellow bar \'l'Hh the text Wnrning: 1,igh latency. However, the latency is not very high. This connection looks good.
Chapter 6a • Hands-On: Using Xirn,s Wi-Fi Inspector 219
.. CoMe«ion Test Results
Connection Test Results
Tc:~t Addrcn Summary Rei.ult ONS Reachable 24.2S.227.55 P11lg'. S of 5, 152 m~ latency Wa rning: high latency Gateway Reachable 192.168,1. 1 Ping; S of 5, 96 ms,e,c latency Pass
ONSLookup www ggle corn IP addren: 74.12S.224.209
Internet Reachable 74.12S.214.209 Ping: S of 5, 109 msec latency Pass
FIGURE 6a-6 Connection Test
Speed Test The speed test takes the user to speediest.net. Figure 6a-7 shows a test in w hich there was a do\,•nload speed of 14 Mbps and an upload speed of just under 1 Mbps. These are reasonable nun1bers.
FIGURE 6a•7 Speed Test i n W i-fi Inspector
220 Chapter 6a • Hands -On: Using Xirrus Wi-Fi Inspector
Quality Test
Figure 6a-8 sho\,'S resu lts from the quality test, \,•hich takes you to pingtest.net. The results give the user's quality level a B. However, the box on the left notes th a t th e connection should be fine for anything but gan1ing.
• The ping (latency) averaged 84 ms, w hich is a little high for games. The server is less than 50 miles a\,•ay. Connecting to a more d is tant server would increase latency.
• Jitter, \,•hich is variation in latency fron1 packet to packet is 24 ms. This can affect voice and video, for w hich jitter can resu lt in jittery voice or video. Again, the nun1ber is fairly good.
• There was zero packet loss. The connection appears to be reliable.
• The re is a MOS score of 4.33. This is a traditional su bjective indica to r o f voice call quality. A MOS score of 5 indicates toll-call quality on the telephone systen1. A MOS of 4.33 is quite good.
One caveat is that pingtest.net is a bit "grabby." It tries to sell you its tools and is slightly aggressive. In addition, the site uses Java, \,•hich you n1ay have to d ownload. You may a lso have to give a firewall exception to this Java program.
Pi i ?.49.183,1 3
\ ·----
Before you begin the test: Maximize your PC performance with TuneUp
"""" Honolulu , HI OISTNG, < SO mi
FORUM U~K
"'
'" Road Runner ••• 31/5
DIRECT LINK
FIGURE 6a-8 Quality Test
,. Test A91ln
M Ct E
, Too I (),m
SIM! ..... 1 ,.,d
v .... Best
""" """1 ·~ "·" Us~ lnteri A•p< ....,
-- -· '
Chapter 6a • Hands-On: Using Xirn,s Wi-Fi Inspector 221
HANDS-ON EXERCISES
Questions
1. Why is the radar \,•indow's in1age of a radar scope misleading? 2 Ho\,• would you locate an access point despite the limitations of the radar window?
This will take one to four paragraphs. 3. There is a value of -44 dBm for signal strength. Ho\,• good is this? 4. How can you sort the nern•orks w indow? 5. What information does the Connection Test give you? 6. What information does the Speed Test give you? 7. What information does the Quality Test give you?
Activity
Select a bui lding. Go to at least ten locations. At each location, record the informa tion in the networks \,vindo\,•. A lso, do a connection and speed test. Write a brief report describing what you learned about Wi-Fi service in the building, referring to the data you collected.
Th is page intentionally left blank
Chapter 7
Wireless LANs II
LEARN IN G OBJECT IVES
By the end of this chapter, you should be able to:
• Exp lain 802.lli Wi-Fi security.
• Exp lain w hy 802.lli security is not enough for WlANs.
• Discuss 802.11 WLAN managemen t.
• Work with d ecibel representations of power ratios (if you read the box o n decibels).
• Con1pare peer-to-peer local wireless technologies that \,•ill be important for the Internet of Things, including Bluetooth.
CHILD' S PLAY1
A you ng g irl sat at a con1puter a nd connected to the local Wi-Fi net½•ork. L ike n1a n y public wireless net\,vorks, th is one was "open," meaning that it o ffe red no secu r ity. A lthough a regu lar con1puter user, Betsy Dav ies \,•as o nly seven years old and no t a com p uter genius. She did not even know how to do w hat s he in tended
1 Nicola, "Hidcmy ass! Experiment: 7-Ycar-Old Cirl Hacks Public Wi-Fi Nchvork in Less Than 11 Minutes/' HidcMyAss.com, January 22, 2015, http: //b log.hidcmyass.com/ 2015/ 01 / 22/ hidcmyass·cxpcrimcnt- 7-ycar-old -g irl-hacks· public-wi•fi •in ·lcss,,than· ll· minutcs/; Ben Rossi, "How a 7-Ycar-Old Girl Hacked a Public Wi-Fi Network in 10 Minutes,'-' www.lnformationagc.com, January2 1, 2015, http:/ / www.information• age.com / how-7-ycar--old-girl-hackcd- public-wi•fl •nctwork-1 O· m inutcs- 123458891 / ; Victoria \+Voollas ton, "Hacking Wi-Fi ls Child's Play! 7-Ycar-Old Shows How Eas y It ls to Break Into a Public Network in Loss Than 11 MINUTES," DailyMail.com, http:/ / www.dailymail.eo.uk/ scicncctcch/ .
223
224 Chapter 7 • Wireless LANs 11
to do tha t day-hack the connection of a nearby computer. Th is \,vou ld a llow her to eavesdrop on all the traffic sen t between the victim and the access point. To learn ho\,,, she read a brief tutorjal. She the n q uickly hacked her target connection. It took her 10 min u tes a nd 54 seconds, includ ing read ing the tu todal. It had literally been child's play.
This incident did not take place in a coffee shop or other pub lic hot spot. It was an experimen t, d o ne w ith the pern1ission of her parents. However, there was noth- ing ren1arkable about the experimental si tuation. Ms. Bailey den1onstrated ho\,, easy it is to hack a connection in the many public neh-vorks tha t m any people frequently use. La ter in this ch apter, we \,•ill see the type of attack she used. It was a m an-in-the middle a ttack using a n evil twin access point. The experjm ent was conduc ted by a ven- dor that offered a vfrtua l priva te neh,•ork (VPN) service, HideMyAss.com . We will see la ter in this chapter how this would have prevented the hack.
In one su rvey, 59% of people in Brjta in used unsecure Wi-Fi hotspots in 2015. One in fi ve did so weekly. Among unsecure hot spot users, 19% did online bank.ing, and 31% sent e-mails and d ocuments. In the United States, 87% of people s u rveyed had used a p u blic hot spot.2 More than 60% believed that th ey were protected w hile using a public access point.3 Seventeen percent bel ieved that the Wi-Fi supp lier pro- tected then,; the san1e percent believed the \,•ebsite d id. The s imple real ity is that your signa l spreads o ut like a sphere \,•hen you transmit, reaching everyone nearby. With- out encryp tion and other protections, everything you send is electro nically vjsib le to everyone nearby.
You do not have to be in a n unsecure Wi-Fi hot spot to have your connection to the Internet hacked. You can be sitting in your office a t work. Figure 7-1 illustrates a typical organizational site. It has a border firewall tha t scrutinizes traffic going into
Customer Premises
Border firewall blocks Internet attack
a\ ,~\e«:' (/1- ~e\"'
Unsecure Access Point
Wireless Traffic bypasses border
firewall, not stopped 21~
FIGURE 7- 1 Dri ve-By Hacki ng
Internet Hacker
Drive-By Hacker
2 Michael Covington, #Free V\li -Fi and the Dangers of Mobile Man-in -the-Middle Attacks," betancws.com. 2015, https:/ / bctancws.com/2016/10/08/ froo-wi-li-mobilc-man-in -thc-middlc-attacks/. 3 Jbid.
Chapter 7 • Wireless LANs JI 225
and ou t of the si te. Within the s ite, clients connect to the interna l nehvork through Wi-Fi access poin ts. Their con,munication is not fil tered by the border firewall because they are treated as being inside its protection.
The fig u re a lso s ho\,vs a driv e-b y h a cker loca ted outside the corpo- rate prem ises. He o r s he con nec ts to an u nsecure access point wi th in the site.4 If the a tten1pt is successful, then the a ttacker ca n comn,unicate \,•ith any hosts within the site-\,• ithou t going through th e border fi rewa ll. The a ttacker can send attack packets to an y host and will be able to intercep t at least son, e conversations within the customer pren,ises.
Con1panies may mistakenly believe that son,eone outside their walls \,•ill be too far away to comn1unicate with internal access points. However, drive-by hackers use highly d irectional antennas that allow them to send very strong signals and to receive signals that \,vould be too weak to hear with normal Wi-Fi equipn1ent. Many use Pring les cans.
Tes t Your Understanding
1. a) Do p u blic hot s po ts protect your transmissions? b) What type o f attack did Ms. Davies use? c) How long d id it take her to hack the connection, includ - ing reading the tutorial? d ) How can a drive-by hacker defeat a site's bord er fi rewall?
802.11 i WLAN SECURITY
802.11i Rea liz ing the danger o f drive-by hackers, the 802.11 Working Grou p created the 802.lli standard. F igure 7-2 sho\VS that 802.lli provides cryptographic protection
ffU 2 No end-to-end cryptographic protection I ..
fl}-----~ ~---- Netwo~ l---,~ Wireless Eavesdropper Access~ Server
Client (Drive-by hacker) Point ~ (P}. 3 Configure with 802.11 i (WPA2)
,. • ,. I _ __..,~ security, not WPA or WEP security 1 802 .11 i link security '-
between wireless client and the access point
FIGURE 7 -2 Scope of 802.11 i Security Proteclion
4 Merely collecting wireless transmissions to determine such things as SSID, signal strength, and channel is not illegal. This practice, although called war driving. is built into every W'i·Fi program. lt cannot be illegal because you need this infom,ation to connect to an access point. Of course, a subsequent attempt to connect to an access point without authorization is iJJcgaJ.
226 Chapter 7 • Wireless LANs 11
between the wireless access poi n t and the wi reless host. This p rotection includes in itia l au thentica tion plus n1essage-by-message confid entiality, integri ty, and authen tication (CIA). A drive-by hacker canno t read traffic (confi d e ntiality), n1odi~ traffic (in tegrity), or connect to the access poin t to send traffi c (au thentica- tion). Hot spot access poin ts shou ld also secure local comm u nica tion with 802.lli secu rity. Unfortu nately, this security is not n, a nda tory. In fac t, because it involves au thentica tion, many ho t spot owners avoid it because this n,akes the access poi n t harder to use.
Note in the figure th at 802.ll i pro tection on ly provid es link security on the link between the wireless client and the wireless access poin t. It does no t provide end-to-end s ecurity all th e \Vay between the \,• ireless client and the server on the wired LAN (or a server on the Internet). The 802.lli s ta ndard has a very limited objective-to protect \,• ireless transn1ission bet\,•een the access poin t and the \,• ire- less client host.
Th e protection pro vided by 802. 11 i only ext ends between the wireless access point and th e wireless client host.
Although its physical scope is limited, 802.lli protects tra nsmissio ns within its scope very wel l. For example, the standard uses the Advanced Encryption Sta n- dard (AES) for confidential ity. It also uses s trong s tandards for all other aspects of cryptology.
Historically, the 802.ll i standard was the third standard created to protect com- nn mication between \vireless clients and access points in 802.11 WlANs. The origina l standard was w i red eq uivalent privacy (WEP) . The 802.11 Working Group created WEP as part of the origina l 802.11 standard in 1997. WEP was deeply f!a\,•ed. As a stop- gap measu re, the Wi-Fi Alliance crea ted an interim security standard based on an early draft of 802.lli b u t using much weaker s tandards for cryptographic p rotections. The Wi-Fi Alliance called their interim standard Wireless Protected Access (WPA).
Today, there is no reason to use WPA because 802.lli is superior, and using WEP is malpractice at best. However, many w ireless access points and wireless routers con- tin ue to offer WEP and WPA. To add to the confusion, the Wi-Fi Alliance calls the 802.lli standard WPA2, and m any w ireless access points and \,•ireless rou ters still use this terminology. All access points and \,•ireless clients today sup port WPA2 at no extra cost. The o nly choice today should be to use 802.11i/WPA2.
Th e choice today sho uld be to use 802. 11 i/WPA2 .
5 Some people recommend further security protcc-tions, such as turning off the periodic broadcasting of the access point's SS10. Users need to know this SS10 to use an access point. l-Jowcvcr, the SSID is transmitted in the dear (without encryption) in every frame header. Hacker software reads it effortlessly. Another common recommendation is to accept only computers whose wireless network interface cards have prcapprovcd EUI-48 addresses. Again, however, the EUJ .. 48 address is also transmitted in the clear in every packet, and attackers can easily read and spoof one of these addresses. Overall, these measures take a great deal of work, and they are easily pushed aside by readily available hacking software. They might make sense if you are only concerned about a home network and unsophisticated but nosy neigh• bors, but turning on 802.11 i protection is easier, and it provides security automatically without additional rabbit's-foot gambits.
Chapter 7 • Wireless LANs JI 227
Test Your Understanding
2. a) What cryptographic protections does 802.lli provide? b) Ho\,, is this protec- tion limited? c) Distinguish between link security and end-to-end security. d) What does the Wi-Fi Alliance call 802.lli? e) When offered the choice w hen you are configuring a wireless access point, \,vhich WLAN security standard should you choose?
802.11 i Sta g es The 802.ll i s tandard provides a broad s p ectrum of secur ity protec tions. At the beginni ng of a session between a client a nd an access p o int, th e two parties excha nge information. This norn1ally includes initial authentication, w hich is distinct fron1 o ngoing n1essage-by-m essage a u then tica tion that takes p lace after the initial hand- shaking stage. In initia l a u then tica tion, the \,•ireless clien t is the su pp lica n t. It m ust prove its iden tity to the access poin t before th e access poin t w ill allow the cl ient to connect.
Wh en the 802. 11 Working Group created the 802.lli stan dard, it realized that different initia l a u thentication m e thods \vou ld be needed in hon1es and large enter- prises. These two initia l authen tication n1ethods are sho\,•n in Figu re 7-3. Note that whatever initial a uthentication mode is used, o ngoing communica tion has the san1e very strong pro tections, \'l'i th message-by-n1essage confid en tia lity, in tegrity, a nd au then tica tion. These o ngoing protections are extren1ely strong.
Figu re 7-4 shows that these t\,•o initial a u then tication modes are designed for very differen t environ n1ents. 802.l X i n itial a uth enti cation mod e was created for corporations with many access poin ts. It is ex tremely strong b ut con1plex to in1ple- n1en t. Usi ng 802.lX for initial authen tica tion wou ld be overkill in res idences. To use it, you would have to have a separate a u then tication server in addition to the other devices in your home! The Wi-Fi A llia nce has righ tly dubbed this enterprise mod e .
1. Initial Authentication Phase
Pre-Shared Key Initial Authentication Mode
(Personal Mode)
OR
802.1X Initial Authentication Mode
(Enterp rise Mode)
Time
2. Ongoing Protection Phase
Same Ongoing Protection with Message·by- Message Confidentiality, Integrity, Authentication (Regardless of how 1mtial authentication ,s done)
FIGURE 7-3 Phases in 802.11 i Cryptograph ic Security Between the Wireless Client and t he Access Point
228 Chapter 7 • Wireless LANs 11
Mode of 802.1 1 i Init ial Authentication Pre-Shared Key Mode 802. 1X Mode
Environment Home, business w ith single Companies with multiple access point access points
Uses a central 802. lX No Yes authentication server
Authentication Basis Knowledge of pre-shared key Creden tials on the 802. l X authentication server
Technical Security Technologically strong, but Technically extremely strong weak human security can but can be defeated by compromise the technological rogue access points and evil
security twin attacks
Operational Threats Mismanaging the pre-shared Rogue access points, evil key twin attacks
FIGURE 7-4 802.11 i Modes of Initial Auth e nt icat ion
The 802.11 Working Group created th e simpler Pre-Shared Key (PSK) i nitial authentication mod e for hom es with a single access router. PSK n1od e is also attractive for sma ll businesses \,•ith a single access point. PSK initial a uthentication mode is a bit \Veaker than 802.lX initia l authentica tion m ode, but it is still strong if in1plemented proper! y. The Wi-Fi Alliance calls this personal mode.
Test Your Understanding
3. a) For wha t use scenario was 802.l li PSK n1ode created? b) For wha t use scenario was 802.lli's 802.l X n1ode crea ted? c) Does the choice of initial authentication n1ode change how other phases of 802.l l i work?
Pre-Shared Ke y (PSK) Initial Authentication Mode in 802.11i
Pre- Shared Session Keys Figure 7-5 shows that the access poin ts and wireless hosts need to kno½• the same pre-shared key (PS K) for initial authentication.6 Den1- onstrating to the access point that the client knows the PSK a uthenticates the client to the access point. As "p re-shared" suggests, all hosts o n the single access point have the same pre-shared key to a u thenticate then1selves. In fact, anyone w ho kno½•s the PSK can a uthenticate himself or herself to the access point.
Unshared Pairwise Session Keys After au thentication using the pre-shared key, the wireless access point gives each authenticated d evice a new unshared painvise session
6 Thc figure shows the PSK being sent by Host X to the wireless access router/access point. In fact, when a host tries to connect to the access point, the access point sends a challenge mcss.1gc, which the host encrypts with the PSK II the encrypted challenge message can be decrypted back to the challenge message via the PSK, the access point knows that the host knows the PSK and should be accepted.
Pre-shared Session Key (PSK) For Initial Authentication
~ Host X
~ - a 1
Pre-Shared Key
Access Point A Supports 802.11 i PSK
Initial Authentication Mode
Chapter 7 • W irel ess LANs JI 229
All hosts use the same Pre-shared Key for initial authentication
fjiJ) Host Y ~-. 1
Same Pre-S hared Key
Host Z
1 Same Pre-Shared Key
FIGURE 7-5 802.11 i Pr e-Shared Key (PSK) Init ial Authentication M o de
key to use \,•hile communicating with the access point subsequen tly. Figure 7-6 shows this second key. It is a session key because it \,•ill o nly be used for a single conm1unication ses- sion. The next time a client au thenticates itself, it will receive a differen t session key. It is a pairwise key in the sense fuat each client \,•ill have a d ifferent session key to use with the access point. Each clien t will use its own pairwise session key to encrypt frames sen t to the access point. Other clients, not kno\-ving the unshared pairwise session keys of others, will not be able to read these fran1es.
Secu r ity Threat s in 802.11i PSK M ode Althoug h 802.lli PSK mode is tech- nically strong, it faces some threats involving how the PSK is managed. Operational (hun1an) secu rity must be equa l to the teclmical security if a residence or small business is to be safe.
One operational security threat is fuat someone w ho is not authorized to use the neh,•ork w ill learn the pre-shared key. In a home or very small business, there is the danger tha t someone, ra tionalizing that "everyone kno\,vs" th e pre-sha red key, \,•ill
Access Point A.
- Unshared Pairw,se 1
Session Key AA
HostX
Pre-S hared Key
After Host X authenticates itself to the access point (A), the access point gives the PC an unshared Pairwise Session Key (AX)
that only the access point and Host X will know. They will use this key to communicate afterward.
Other hosts will receive d rfferent unshared Pairwise Session Keys so that they cannot read the frames of others.
Host Y Different 2 ~ Un5!1a':'d
Ii\-.~ ~ Pairwise ~ Session Key
Pre-Shared Key AY
FIGURE 7-6 Unshared Pairwise Session Key after Init ial Authentication
230 Chapter 7 • Wireless LANs 11
give it to an unauthorized person. Some PSK n1ode access points at least have a guest account to provide temporary access to outsiders as app ropriate.
If a person leaves a con1pany that uses 802.lli PSK mod e, it is important to change the pre-shared key. There is no a utoma ted way to do this. It must be changed on every device tha t will use the access point. Given the fac t tha t work is involved, it is all too easy to delay this.
An other d anger is that the household or sm all business w ill select a weak pass- phrase. To create the pre-shared key, the household or company creates a long pass- phrase, w hich is n1uch longer than a pass"•ord. The client or access point enters this passphrase; the system then autom a tica lly generates the 64-bi t PSK. The passphrase n1ust be at least 20 characters long to generate a strong pre-shared key. If short pass- phrases are used, 802.lli in PSK n1ode can be cracked in seconds.
In 802.11 i pre-shar ed k ey mode, the passp h rase must be at least 20 characters Jong to gener ate a st rong p re-shared k ey.
Test Your Understanding
4. a) For w ha t use scenario was 802.lli PSK mode crea ted ? b) Wh a t m ust a user kn ow to authentica te his or her d evice to the access point? c) In \,vhat ways is the pairwise session key the user receives after au the n tication d iffere n t fron1 the PSK? d) Wh at three opera tional secu r ity threa ts must PSK users consid er? e) Wh y is this risk probab ly acceptab le for the PSK use scenario? (The answer is not in the text.) f) How long must passphrases be to generate strong pre-shared keys?
Not seeing the Pre-Shared Key as "secret• because "Everybody knows it," someone
may give rt to an unauthorized person.
If someone leaves the company, the PSK may not be changed because there is no automated way to do this on
the access point and every device.
PSKs are generated from passphrases, which are only secure jf they are long. A
passphrase must have at least 20 c haracters.
FIGURE 7-7 Operational Secur ity Threats in Pre-Shared Key Mode (Study Figure)
802.l X Authentication
Server
Chapter 7 • W irel ess LANs JI 23 1
1 Specification o f Required Credentials
2 Credentials (Password, Biometrics, etc.)
~-------1{wrred Netw.=3)1--------<t!i•------.,--f" 802 .1 X Authenticator Supplicant
Credentials Database Lookup
and Decision
4 Authorization 5 Authorization
0 Any Traffic, Protected ~--------------------------------------------->-
FIGURE 7-8 802.lX Init ial Authenticat ion Mode
802.1X Initial Authentication Mode Operation
Again, 802.ll i w ith PSK mode for initial au thorization is for homes and for small businesses with a single access point. Large firms \,•ith many access points must use a different 802.lli initial au thentication n1ode, 802.l X mode. (The Wi-Fi Allia nce app ro- priately calls th.is n1ode enterprise mode.)
The Elements of 802.1X Initi al Authentication M od e Figure 7-8 shows that there are three devices involved in 802.l X initial authentication in 802.lli. The \,•ireless clien t is called the supp licant, of course. However, there is no single verifier. Instead, the verification functio n is d istributed over two devices. The fi rst is the access point, \,•h.ich is the 802.lX authenticator. The second is a central 802.lX auth entication serve r. The access point/ authenticator is mostly a pass-through device d uring initial au thentica- tion. The real work of authentica tio n is done by the 802.lX authe ntication server. It has the database on credentials, and its job is to do the heavy work of checking supplicant authentication cred entials.
The 802 .1X Aut h entication Process F igure 7-8 also shows th e four steps in the 802.lX initial authentication process in 802.li.7
• R eq11ire111ents for Credentials. When the supp licant firs t contacts the access point, the access point authentica tor notifies the 802.lX cen tral authentica tion server. The server sends requirements for credentials to the su p p licant. The access point authenticator passes it on to the su p plicant.
• Provide Creden tials. The su pplicant sends the required cred entials to the access point, \,•hich passes it on to the authen tication server.
7 In many apartment buildings, a person reaching the front door must buzz your apartment and ask you to open the building's outer door. The buzzer is the authenticator. It buzzes your apartment. You arc then the authentication server. You ta lk to the person and decide whether to let the person in. ff you decide to Jct the person in, you send a signal, and the door opens for the visitor.
232 Chapter 7 • Wireless LANs 11
• Crede11tials Clteck. Th e 802.lX a u thentication server receives the credentia ls and checks then1 aga inst its auth entica tion database. For examp le, if the cre- dentials are a usernan1e a nd pass\,•ord, the cen tral au the ntication c hecks to see if the pass\,vord matches the password in the credentials database for the usernan1e.
• A11tltorizatio11 Message to tlte A11tlte11ticator. If the authentication succeeds, the 802.lX authentication server sends back an authorization message. This message is not sent to the supplicant like the earlier messages. Instead, it is sent to the access point/ 802.lX authenticator itself. It tells the access point to accept a connection from the authenticated user.
• A11tltorizatio11 Message to the C/ie11t. When it receives the authorization message, the access point a uthenticator authorizes the connection to the client supplicant a nd sends a n authorization n1essage to the client.
• The clien t may no\,, send packets to any host on the network.
Test Your Understanding
5. a) Con tras t t he use scenar ios for initia l au the n tication in PSK mode a nd 802.lX m ode. b) Wh ich initia l a u the n tication n1ode or modes of 802.lli authentication use(s) a cen tral au thentica tio n server? c) What does the Wi-Fi A lliance ca ll this 802.lli initial authe ntication mode? d ) In 802.lX oper ation, what device acts as the authenticator in Wi-Fi? e) In 802. lX, which is the verifier?
6. a) Wh at initial a u thentication mod e does 802.lli use? (This is a tr ick q ues tion.) b) Which ini tial a u the n tication mode is used for message-by- n1essage encryption, authentica tion, and n1essage in tegrity? (Another trick q uestion!)
BEYOND 802.111 SECURITY
Again, the 802.lli standard protects comnn.uucation between the \,•ireless access point and wireless clients. This grea tly reduces risks. Ho\,•ever, two types of attack can suc- ceed even if a con1pany implements 802.lli security well. These are attacks on rogue access points a nd evil twin attacks.
Rogue Access Points
The first threat that can defeat 802.lli security is the crea tion of rogue access points. A rogue access point is an unau thorized access point set up within a firn1 by a n employee or departmen t. Rogue access points are dangerous because they are typ i- cally configured with no security or poor security. Figure 7-9 shows tha t even if a fim1 carefully applies 802.lli to every one of its au thorized access points, the presence of a single unsecure rogue access point w ill give a drive-by hacker access to the fim1's
Target Host
FIGURE 7-9 Rogue Access Poi nt
Employee wrth Uncertain Motives
Unsecure Rogue ~ cessPo,nt
I
I
Chapte r 7 • Wireless LANs JI 233
Dnve-By Hacker
Secure Corporate Access Point
internal network. In o ther \,•ords, a single rogue access point d estroys the security that the firm has so laboriously crea ted w ith 802.ll i. In the terminology o f the Appendix, this is a \,•eakest link problem. The least secure access point detern1ines the strength of the entire network.
A rogue access point is an unauthorized access point set up within a firm by an employee or department.
The en1ployees \,•ho set up rogue access points may not have malicious intent. In n1any cases, they set up their own access points because they are getting poor Wi-Fi service. However, even nonn1a licious emp loyees w ho set up unauthor ized access points can ruin \,•ireless security.
Test Your Unders tanding
7. a) Who creates a rogue access point? b) Why can they defeat 802.lli security? c) Do employees who set u p rogue access points have ma licious motives?
Evil Twin Access Points and Virtual Private Networks (VPNs)
The second type of a ttack that 802.lli \,•ill not stop is the on1inous-sounding evil twin access point attack. An evil hvin attack is a man-in-the-middle attack in w hich the evil twin intercepts traffic passing between a wireless host and a legitimate access po int.
An evil twin attack is a man-in-the-middle attack in which the evil twin intercepts traffic passing between a wireless host and a legitimate access point
Evil Twin A ccess Points Figure 7-10 illustrates an evil twin access point a ttack. Norn1ally, the \,•ireless client shown in the figure \,•ill associate with its legitim a te access point. The two will establish an 802.lli connection between then1, comn1unicating via a con1m on encryption key.
234 Chapter 7 • Wireless LANs 11
Evil Twin "Access Poont"
802.11i Connection 1: KeyVC- ET
1 Desired
2 Instead, ET establishes connections
with the victim client and the access point. Different key for each connection.
802.11i Connection 2: Key ET-AP
!Ffii! ....,_ __ Desired Connection --),,- ~ -- Network \
Server (legitimate) Victim Client Access Point
(Leg~imate)
Client would encrypt frame with Key VC-AP. Wireless transmission would be secure.
Access Point would decrypt with Key VC-AP,
send on the original frame.
FIGURE 7·10 Desired Operation and Evil Twin Connection
An evil twi n access poi n t (u sually a notebook computer) has sofl\,•are to impersonate a real access poin t. The ev il !\,• in operates at very high power. If the wireless host is configured to choose th e highest-po\,•er access point it ca n reach, it will associate \Vi th the evil t\vin access point instead of w ith the legitimate access point. The evil !\,•in \,•ill es tablish a secu re 802.ll i con nec tion with the \-V ire less victim clien t. Th is is Security Connection 1. It will use Key Client-ET (VC-ET) for e ncryp tion.
An evil twin a ccess point is a notebook computer configured to act like a r eal access point.
Next, the evil twin associates with the legitimate access point using 802.lli, creating Security Connection 2. This connection will use Key ET-AP for encryptio n. The evil twin now has rn•o syn,metric session keys-one that it shares with the victim client and o ne that it shares \,•ith the legitimate access point.
Normal Operation Figure 7-11 shows \,•hat ha ppens when an evil l\'\'in operates normally.
• When the host transn1its a frame, the host fi rst encrypts it with key Client-ET. It then transn1its the encrypted fran, e to the evil h,•in.
• The evil h,•in decrypts the received frame \,•ith key C lient-ET. It then reads the n1essage in the clear. Its eavesdropping task is done.
• To continue the deception, the evil l\'\'in reencrypts the frame, this time with Key ET-AP. Then it sen ds the encrypted frame to the legitima te access point, w hich decrypts it and passes it on.
A man-in-the-middle a ttack is difficult to detect because it is transparent to both the wireless clien t and the access point. Both operate as usual. Neither can tell that it is dealing with an impostor.
Chapter 7 • Wireless LANs JI 235
2
Evil Twin ET decrypts with Key VC- ET, Read s the frame, Reencrypts wtth Key ET-AP, sends on to AP.
3 Frame encrypted w~
KeyVC-ET Frame encrypted with
Key ET-AP Access Point decrypts
_/ with Key ET-AP, / sends to server
1
tt,;i/ -o(-----------------~ ,J~ Network ~ ~ DeSJred Connection Server
Victim Client Acee~~ Point (legitimate) Encrypts with (Leg1t1mate)
KeyVC-ET
FIGURE 7- 11 Operati on w ith Evil Twin Connections
A man- in-th e-middle attack is difficult to detect because it is transparent to both the wireless client and the access point. Both operate as usual. Neither can tell that it is dea ling with an impostor.
Using a VPN to Defeat Evil Twins If a clien t cannot detect th a t it is being deceived by an evil twin access point attack, ho\,• can it protect itself? The answer is that it can take a sin1ple precau tion. As Figure 7-12 shows, a client can implement a virtua l priva te nehvork (VPN) between itself and the server it \,•ishes to con1municate with . We sa\,v VPNs in Ch a p ter 4. A VPN is simply an encrypted path through an untrusted network. Because the transmission is encrypted, others cannot read it. It is as if the transn1ission \,•as traveling over its own private network.
Client encrypts with Key Client-Server, then Key VC- ET. Sends the doubly-encrypted frame to the Evil Twin. Evil Twin decrypts wtth Key VC-ET. The frame is s till encrypted wtth Key Client-Server. The Evil Twin cannot read it. Confid entialrty is maintained.
End-to-End Virtual Private Network (VPN) Key Client-Server
802.11i Connection w tth Evil Twin Key VC-ET
FIGURE 7- 12 Defeating an Evil Twin Attack by Usi ng a Virtual Private Network (VPN)
236 Chapter 7 • Wireless LANs 11
The evil h,•in still intercepts traffic. No\v, however, intercep ting the traffic d oes it no good . Consider what happens w hen the clien t transmits a fran1e.
• The client first encrypts a fran1e it with the VPN key, Key Client-Server, which it shares w ith the server. It then encrypts the fra me again, this tin1e with the key it shares \,•ith the evil h,•in (Victim Client-ED. Now it sends the doubly encrypted fra me to the evil twin.
• The evil h,•in decrypts the fran1e with the Victim Client-ET key. However, the frame is still encrypted w ith the VPN key. The ET cannot read the n1essage.
Test Yo u r Understanding
8. a) What kind of ph ysical device is an evil twin access point? b) What does the evil twin d o after initial association \,•hen the victin1 client transn1its? c) D is- tinguish between evil twin access points and rogue access points. (The answer is not explicitly in the text.) d) How are VPNs a ble to defeat evil twin a ttacks? Explain in detail. e) Ho\'I' can you tell if your client con1pu ter has succun1bed to an evil twin attack? f) Why is this in1portant?
802.11 WI-Fl WIRELESS LAN MANAGEMENT
Un til recen tly, the term WLAN m anagen1en t was alm ost a n oxymoron. Large WLANs were like airports without control towers. Companies knew that they needed tools to cen tralize WLAN managemen t. Vendors began to provid e these tools.
Access Point Placement
The first m anagement issue is \,•here to p lace access points throughou t a b uilding or site. If access poin ts are p laced poorly, th ere \,•ill be overloaded access p oin ts, dead spots, and crip pling interference between access points.
Initial Planning The first step in placing access points is to detern1ine how far signals should travel. This deternunes the rad ius of service around each access point.
• If the radius is too grea t, man y hosts will be fa r fron1 their access points. Hosts far from the access point n1ust d rop d o\,•n to lower transm ission s peeds, a nd their fran1es will take longer to send a nd receive. This \,•ill reduce the access point's effective capacity. Also, a large circle may con tain too man y users to handle.
• If the radius is too sn1all, however, the firm will need man y more access points to cover the area to be served. Having access points too close together will also increase co-channel interference if it is present.
Once an a ppropriate rad ius is selected (say, 10 meters), the compan y gets o ut its architecture d ra\,•ings a nd begins to lay out lO-n1eter circles that cover all points in the building, as sho\,•n in Figure 7-13. Where there are thick wa lls, filing cabinets, o r other obstructions, shorter propagation d istances must be used. When this is done, it will be clear that access points often cannot be placed precisely in the middle of the circle, so other adjustments must be made.
Chapter 7 • Wireless LANs JI 237
•
0 Circles are 10 m in diameter --- ••
-1 •. 0 ccess points are put into pl;;,., provision~a~y=.= =~~~- I
A site survey is done and-adjustments are made.
~
FIGURE 7- 13 Access Point Placement in a Building
Of course, in a multistory bu ilding, planning must be done in three dimen- sions. The "circles" are now bubbles with radiuses of 10 meters. Again, the goal is to provide coverage to all poin ts w ithin the building w hile reducing overlap as much as possib le.
Finally, planners ass ign c hannels to access point positions. Th ey attemp t to n1inin1ize co-ch a nnel interference \-Vhile doing so.
In sta llation and Initial Site Surveys Next, the access points are installed pro- visionally in the planned locations. Ho\,•ever, the implementation work has just begun. When each access point is installed, a n initial site survey must be done of the area to d iscover any dead spots or o ther problems. This requires signal analysis software, w hich can run o n a notebook computer or even a smartpho ne.
When areas with poor signal strength are found, surrounding access points n1ust be n1oved appropria tely, or their signal strengths must be adjusted until all areas have good signal strength. Users should now have good service.
Ongoing Site Surveys Although the initial site survey should result in good service, conditions \,•ill change w ith time. More people n1ay be given desks in an access point's service areas, signal obstructions may be put up for business purposes, and
238 Chapter 7 • Wireless LANs 11
other changes n1ay occur. Site surveys must be done frequently and routinely; they also n1ay be done in response to specific reports of problems.
Tes t Your Und ers tanding
9. a) Describe the process by which access point locations are determined. b) When n1ust firms do site surveys to give users good service?
Centralized Management
Large organizations have hundreds or thousands of access poin ts. Traveling to each one for manua l configura tion and troub leshooting \,•ou ld be ex tren1ely expen- sive. To keep management labor costs under control, organizations must be able to n1anage access poin ts remote ly. The Sin1p le Neh,•ork Management Protocol, which we saw in Chapter 3, n1akes this possible. Figure 7-14 shows that the manage- n1ent console constantly requests data from the individual access points. This data includes signa l strengths, indications of interference, error rates, configuration set- tings, power levels, channels, securjty settings of nearby access points, and other diagnostic inforn1ation.
If fue admin;strator detects a problem in the network when reading the data, he or she can send SNMP Set con1mands to access points to increase power, decrease power, s\,•Hch channels, or make other changes.
The figure a lso shows a wireless access point initiating an SNMP trap comn1and. A trap might indicate an abnom1al error rate, fue detection of a rogue access point, or disassociate messages t11at break connections. The last category, disassociate messages, n1ay ind icate that an attacker is committing a denial-of-service attack by sending disas- sociate n1essages to w ireless clients, telling tl1en1 to s top using the access point. This knocks fuem off t11e nel\vork.
Query for errors of various types, power levels, power
of nearby access points, etc.
SNMP Manager
SNMP Get Command & Response
SNMPTrap
~ ~ ~
SNMPSet Command&
Response
Change power, channel, etc.
Rogue access point detection, failed authentication, dissasociate commands
FIGURE 7- 14 Remote Access Point Management
Chapter 7 • Wireless LANs JI 239
Cen tralized network n1anagem ent sofh,•a re and h a rdwa re o n th e n1anagem ent console an d S\\•itch es or access p o ints is expensive. H owever, it greatly red uces m anage- n1ent labor, so there s hou ld b e con sid erable net savings fro m its u se.
In a d d ition, cen tralized WLAN m anagem ent's wireless in trusion detection func- tion ality is the only rea l way to m anage WLAN security. Man u a l d etection of th rea ts would be fa r too slow an d req uire p rohibitive a m ounts o f lab o r.
Tes t Your U nderstanding
10. a ) H ow n1ig ht a security a d n1inistrator u se SN MP Get con1mands to access p oints? b) How does centralized manag en1ent provide for the d etection of rogue access p o ints? c) Con1ment on the cost o f central a ccess point managen1ent.
IN MORE DEPTH Expressing Power Ratios in Decibels
Signal power is usually measured in milliwatts (mW). Networking professionals often compare two signal strengths. For instance, if signal power is 20 mW at 10 meters and 2 mW at 20 meters, the ratio of the second power to the fi rst is 0.1 . To give another example, if a larger antenna doubles a transceiver's transmission power, then the ratio of the fi nal power to the initial power is 2:1. Power ratios are expressed in several ways-as decimal numbers, percentages, or ratios (such as 2:1).
Calculating Decibel Values for Power Ratios
Networking professionals typically express the ratio of two powers in decibels (dB), using Equation 7-1. Lds is the decibel relative value of two power levels, P1 and P2. P1 is the initial power level. P2 is the final power level. The equation shows that the decibel expressions use a logarithmic scale .
Lds = 10 *Log10 (;~) (Equation 7-1)
This looks complicated, but it really is not. Figure 7-15 shows how to do decibel calculations in Excel or some other spreadsheet program. In the first example, the initial power is 40 mW and the fina l power is 10 mW. This gives a power ratio of 0.2 5. Excel has a LOG 1 0 function, and this is
Data or Formula Example 1: Attenuation Example 2: Amplification
Initial Power: P, (mW) 40 10
Final Power: P 2
(mW) 10 30
P/ P, 0.25 3
LOG 10(P,JP,) -0.602059991 0.477121255
L..,: 10*LOG10(P/P,) -6 020599913 (Negative) 4.771212547 (Positive)
FIGURE 7- 15 Decibel Calcu lat ion for Pow er Levels (cout;,wed)
240 Chapter 7 • Wireless LANs 11
applied to the power rat io. The result is -0.602. This logarithm is multiplied by a factor of 10. This gives a value of -6.02 decibels. Whenever t he second value is smaller than the init ial value, t he decibel value is negative.
Whenever the second value is smaller than the initial value, the decibel value is negative.
In t he second example, t he final power is larger t han the ini ti al power. For example, the signal may be increased by a larger ant enna. The i nit ial power is 10 mW, and the f i nal signal power is 30 mW. This gives a power rat io of 3:1. This time, t he deci bel val ue is 4 .77 dB, a positive val ue. Whenever the second val ue is larger t han the i nit ial val ue, the decibel value is posit ive.
Whenever the second value is larger than the init ial value, the decibel value is positive.
Test Your Understanding
11 . a) The power level at 10 meters is 100 mW. At 20 meters, it is 5 mW. How many decibels has it lost? b) Compared to an omnidirectional antenna, a dish antenna quadruples radi- ated power. How much is this change in decibels? c) Compute the decibel value for a power ratio of 17:1. d) Of 1:33.
Approximating Decibel Values
You do not always have a spreadsheet program with you. Nobody can calculate logarithms in his or her head. However, you can use two approximations to roughly est imate decibel values if you know t he power ratio.
First, Figure 7-1 6 shows that if you double the signal power, this is a gain of approximately 3 dB. If you quadruple the signal power, this is a gain of approximately 6 dB. For each addit ional doubling, the gain is another approximately 3 dB. This calculation is approximate, but it is close. (The exact value is 3.0 103.)
Powers of 2 Powers of 10
Power Ratio Approximate dB Power Ratio Exact dB
2 3 dB 10 10 dB
4 6 dB 100 20 dB
8 9 dB 1,000
16 10,000
32 100,000
1/2 -3 dB 1/ 10 -10 dB
1/4 1/100
1/8 1/1,000
FIGURE 7- 16 Decibel Approximat ions
Chapter 7 • Wireless LANs JI 24 1
Each doubling of power gives a gain of approximately 3 dB.
Each multiplying by 10 in power gives a gain of approximately 10 dB.
What if the power ratio is less than 1? If it is 0.5, then the deci bel value is approximately -3 dB. Cutting t his power in half gives-6 dB. Every addit ional h alving is another -3 dB. Agai n, if the power ratio is greater than 1, t he decibel val ue w i ll be positive, and if t he power ratio is less than 1, the decibel val ue w ill be negative.
If the power ratio is greater than 1, the decibel value will be positive, and if the power ratio is less than 1, the decibel value will be negative.
For posi tive or negative powers of 10, the situation is si mi lar. A power ratio of 10: 1 is exactly 10 dB. (There is no approximation.) A power ratio of 100 is 20 dB. Each further increase by a factor of 10 is another 10 dB. Likewise, a power ratio of 0. 1 is -10 dB, and a power ratio of 0.0 1 is -20 dB.
What if a ratio is not a multiple of 2 or 10? What if it is, for example, 3:1? Well, 2:1 is 3 dB; and 4: 1 is 6 dB. So the answer is somewhere between 3 dB and 6 dB. That is not very precise, but it can be useful in practical situations. The 2:1 and 10:1 approximation will not always be useful, but they are good tools for networking professionals to have.
Test Your Understanding
12. a) Fill in the missing values in Figure 7-16. Approximate, without using Excel, the decibels for a ratio for b) 8 :1 . c) 9: 1. d) 110:1 . e) 1 :7. f) 1 :90. Use terms like "a little higher t han " or " a little lower than. ··
PEER-TO-PEER PROTOCOLS FOR THE INTERNET OF THINGS {loT)
In Chapter 1, you learned tha t the Internet of Things involves hosts talking to o ther hosts without hun1an involven1ent. IoT machines simply communicate directly \,• ith o ne another to coordinate their work. Much of their communication \,•ill be peer-to- peer, that is beh,•een the two d evices with no server involved. Normally, more dis - tance and s peed are desirable. But "fast and far" is a lso a recipe for draining batteries rap id ly. If comn1unication takes p lace over short d istances and at slower speeds, this "slow and close" comn1unica tion extends battery life. As we wi ll see la ter, RFID tags can trans mit wi thout have any internal power.
" Slow and close • communication extends battery life.
Ba ttery drain is especially in1portan t for IoT devices too sn1all to plug into a \,•all or to use a trad itional rechargeable battery. Many use sn1all coin batteries like the o ne in Figure 7-17. These ba tteries \,•ill need to last months or even years in n1os t devices. This is possible o nly if en ergy demands are kept very lo\v. Energy res trictions for IoT transmissions tha t use coin batteries requ ire ne\,• standards.
242 Chapter 7 • Wireless LANs 11
FIGURE 7- 17 Coin Battery
Energy Restrictions for loT Devices that use Coin Batteries Require New Standards Figure 7-18 shows several con1munication peer-to-peer pro- tocols that pron1ise to be a ttractive for IoT con1mu n ication in genera l. They vary wid ely in the possib le distance between the l\,vo d evices and in tran smission speed. Th ose at the lo\,vest level use the least e nergy and are su itable for IoT dev ices with coin ba tteries
Test Your Understanding
13. a) Why is low speed and short d istance good in the Internet of Things? b) Is there a sing le dominant IoT con1munica tion standard?
250 Mbps .
24 Mbps
3 Mbps
<500 kbps
NFCIRFIO
A Few Cenlimelers
Wi-Fi Direct
Classic Bluetooth 3 .0 HS
Class,c Bluetooth 2.0 HOR
Bluetooth Low Energy
Zogbee Z-Wave
Tens of Meters
FIGURE 7- 18 Peer-to-Peer Communicat ion Prot ocols f or the Internet of Things (loT)
Chapter 7 • Wireless LANs JI 243
BLUETOOTH
If you have a wireless headset for your n1obile phone or pocket n1usic player, or if you have a hands-free cellular systen1 in your car, you are already using Bluetooth. These are precisely the kinds of short-range moderate-speed applications that Bluetooth was created to handle. Bluetooth is a short-range radio technology designed for personal area nehvorks (PANs)-small groups of devices in a communication bubble around a person's body or a single desk (Figure 7-19). Bluetooth is essentially a cable replacement technology. In contrast to 802.11, Bluetooth is not standardized by the IEEE. Rather, it is standardized by the Bluetooth Special Interest Group (SIG), \,,hich is an industry trade association.
8/uetooth is a short-range radio technology designed for personal area networks (PANs)-sma/1 groups of devices around a person's body or a single desk.
Bluetooth is essentially a cable replacement technology.
Classic Bluetooth and Bluetooth Low Energy (LE)
There are two forms of Bluetooth, Classic Bluetooth and Bluetooth Low Energy. Per- haps surprisingly, they are deeply incon1patible. Both can use the 2.4 GHz unlicensed radio band, and both use the same radio and antennas, so they do not need entirely separate technology. Ho\,,ever, they work very differently. Bluetooth lo\,v Energy is not a n1ere extension of C lassic Bluetoo th. F igure 7-20 con1pares C lassic Bluetooth with Bluetooth LE.
Classic Bluetooth and Bluetooth Low Energy are incompatible.
Classic Bluetooth The original version of Bluetooth, Classic Bl uetooth, has t\,,o data rates: an Ex tended Data Ra te speed of 3 Mbps and a High Speed rate of 24 Mbps. The two form a single service \'l'ith modestly fast normal operation and high burst-speeds operation for occasional file transfers and o ther actions. Until recently, these were the only types of Bluetooth.
Personal Area Network
A PAN is a small group of devices around a person's body or a desk.
It replaces cable with radio waves.
FIGURE 7- 19 Bluetooth Personal Area Networks (PANs)
244 Chapter 7 • Wireless LANs 11
Use Case Headsets, speakers, keyboards, etc. High duty cycle (percentage of time in use)
Principal Benefit Good performance at modest power
Speed Up to 3 Mbps
Brief high-speed transfers at modest power
Up to 24 Mbps
Power Required Low (Rechargeable mobile phone battery)
FIGURE 7-20 Bluetoot h Mod es o f Operation
Fitness trackers Low duty cycle Low cost for very brief, low-speed, and infre- quent communication
Up to 2 Mbps but usually 125 kbps or 500 kbps.
Very Low (coin battery)
Bluetooth Low Ene rgy More recen tly, the Bluetooth Allian ce introduced Blue- tooth Lo,v Energy (Bluetooth LE). Compared to Classis Bluetooth, Blu e tooth Low Energy has s im ilar range bu t greatly reduced power consun1ption. Classic Bluetooth req uires wall po\,•er or a rechargeable battery. Bluetooth Lo\,• Energy \,•as created to work for a ne\,• class of small devices, su m as light s\,•itrnes, that use a small coin b at- tery that is expected to last for a long time, even years. This req u ires extremely lo\,• energy output.
8/uetooth Low Ener gy (LE) is for d evices with coin batteries.
D ual-Mo de an d Sin gle-M o de Device Devices wi th rechargeable ba tteries, s uch as m obile phones, usua lly offer b o th Classic Bluetooth and Bluetooth LE. They have a rechargeable b attery, so they can easily implement both modes. In contrast, small IoT d evices typ ically o nly have a coin battery. They u sually o nly sup port Bluetooth LE because even a brief use of traditional Bluetooth would s lash battery life.
Test Your Understanding
14, a) Wha t is a PAN? (Do not just s p ell ou t the a bbreviation .) b) Com pare the rela tive be n e fi ts of the h,•o types of Classic Bluetooth. c) Why would you not \'Van t to use high -speed Bluetooth all the tin1e? d ) What is the benefit o f Bluetooth Low En ergy? e) What type o f b attery do very sn1all Blu etooth LE devices req uire, and \,•hy is th is important? f) Wh y do s ma ll IoT d evices o nly im p lement Blu e tooth LE?
One-to-One, Mast er- Slave Operation
Figure 7-21 sho\,•s several d evices con1municating w ith Bluetooth . The device in th e top center is a n1obile phone. To its left is a printe r. Th e n1ob ile phone user w ishes to print a webpage on the printer. The u ser selects print, rnooses the target printer, an d
Basic Printing Profile
SYNCH Profile
Chapte r 7 • Wireless LANs JI 24 5
Slave Master J Master Slave One-to-one connections. Master-slave operation. A master may have up to seven slaves. A slave may have up to seven masters. A master and rts slaves form a p iconet. Profiles provide application-level functionality. This includes printing, synchronization, etc.
FIGURE 7- 21 Blue toot h Operation
Mas/ier Human
Slave Interface ~ Device ~ Profile
prints. The mobile is simultaneously synching files beh,•een itself and the con1pu ter on the right. At the same tim e, the con1puter is con1municating \,•ith its Bluetooth \,•ireless keyboard.
One-to-One Connections Note that Bluetooth uses one-to-one connections between pairs of devices. In the fi gure, Bluetooth in1plen1ents a one-to-one connection between the mobile phone and the printer. It also in1plen1ents one-to-one connections between the mobi le phone and th e desktop computer and beh,veen the desktop and the keyboard. Although the mobile phone connects to h,vo devices, these are separate Bluetooth connections.
8/uetooth always uses point-to-point communication between a pair of devices.
Master- Slave Control In addition, Bluetooth always uses master-slave control. One d evice is the n1aster, the o ther the slave. In the p rin ting scenario, the n1obile dev ice is the n1aster a nd the printer is the slave. The n1obile p hone con trols the printing process.
In Bluetooth, one device is the master and the other device is the slave. Th e master controls the slave.
Multiple Slaves and Masters Although communication is ah,•ays one-to-one, a master may have up to seven slaves simultaneously. A master and its slaves comprise a piconet. In C lassic Bluetooth, a slave m ay a lso have up to seven n1asters. This means that a slave n1ay be part of multiple piconets.
It is possible for a Bluetooth device to be a master a nd a s lave simulta ne- ously. Consider the relationship between the m obile phone and the desktop con1- puter. Th e two are synchronizing informatio n. The n1obile phone is the n1aster, and the d esktop is the s lave. Ho\vever, the desktop is sin1ultaneously a n1aster to the keyboard.
246 Chapter 7 • Wireless LANs 11
A Bluetooth device may be a master of one device and a slave to another device simultaneously.
Test Your Understanding
15. a) What does it mean that Bluetooth uses one-to-one operation? b) Is this still true if a n1aster communicates with four slaves simultaneously? c) Can a Bluetooth n1aster have multiple slaves? d ) Can a Bluetooth slave have two n1asters? e) Can a Bluetooth device be both a master and a slave simultaneously?
Bluetooth Profiles
For Wi-Fi, th e 802.11 Working Group d id not have to worry about applica tions. Desk- tops and laptop PCs o n 802.11 WLANs already had man y applications. For example, word processing programs knew how to work with printers in general, a lthough working with a ne\,, printer usually required the con1puter to add the printer to its configuration and install device drivers.
However, there were no app lication protocols in existence for PAN app lications such as wirelessly controlling keyboards, telephone headsets, printers, a nd other devices. Consequently, in addition to defining physical and data link layer transmis- sion standards, the Bluetooth SIG also defined applica tion profiles, \,•hich are ca lled Bluetooth profiles. Profiles govern how devices share informa tion and specify control n1essages for various uses. Figure 7-21 shows th ree Bluetooth profiles.
• For printing, the mobi le phone uses the bnsic printing profile (BPP) . A Bluetooth device can print to an y BPP con1pliant printer \,•ithout having to install a printer driver on the Bluetooth device.
• For synchronizing information with the desktop computer, the mobile phone uses the synchronization profile (SYNCH) . It simply selects the compu ter and begins the synchroniza tion.
• Desktop con1puters, in turn, use the h11mnn inter/nee device (HTD) profile for mice, keyboards, and other input devices. Again, there is no prior setup beyond selecting the device.
Test Your Understanding
16. a) Why \'l'ould it be nice if Wi-Fi offered a basic printing profi le? b) What Bluetooth p rofi le \'l'ould you use for a game joystick, based on information in the text?
Bluetooth Low Energy
In general, Bluetooth LE and Classic Bluetooth are ou twardly sin1ilar. Both use one- to-one connections and master-slave control. In both, a master may also have up to seven s laves in its piconet. (The ability of a slave to serve multiple n1asters is still under development in Bluetooth LE.)
Similarities between the Modes
One-to-one connections, master-slave operation
Master may have seven slaves
Power-Efficient Design in Bluetooth Low Energy
Chapte r 7 • Wireless LANs JI 24 7
Usually 0.01 W to 0.5 W, compared to Classic Bluetooth's nominal 1 W (and usually toward the lower end)
Transmits slowly over short distances
Infrequent transmissions with deep sleep between
Terse connection openings (100 ms for Classic Bluetooth, 3 ms for Bluetooth LE)
Energy conservation pervades design (energy-saving spread spectrum method)
Advertising and Connections
Small loT devices periodically transmit advertising messages
Announce their existence and purpose
To connect, the master scans, initiates an opening
Beacons are advertising messages that include useful information
At airports, announcements of delays
Profiles
In stores, a coupon as a shopper nears a department
Navigation directions within a building
Specific to small loT devices
Fitness trackers
Glucose meter reading
FIGURE 7-22 Bluetooth Low Energy (Study Figure)
Advertisements and Connections There is one thing that Bluetooth LE slaves n1ust do frequently. They must wake up and transmit a brief advertisement message to announce their existence and say w hat they can d o. When the n1aster needs a connection, it scans for such advertisemen ts. The master then initiates a connection. The two parties then switch to n1aster-slave comn1t1rucation. Fortuna tely, ad vertisemen t messages are brief, and there is signilicant time beh,•een then1. This limits the power d ra in they create.
Beacons Bluetooth LE extends the advertisen1ent message by adding the concept of beacons. These are advertising messages that include potentially useful information. Beacons can offer you a coupon when you step into a store, give your n1obile phone d irec- tions for navigating through a hospital, tell you ho\,• n1any tickets are available for a movie near you, or inform you of flight delays in an airport. Masters can read this information from beacons without even making a connection.
Profiles Like Classic Bluetooth, Blue tooth LE has profiles. Of course, Bluetooth LE profiles refl ect their use cases. In medicine, there are profiles for reading g lucose n1eters, and there are profiles for heart ra te n1onitors. In sports, there is a fitness tracker profile and a loca tion and navigation profile.
248 Chapter 7 • Wireless LANs 11
Test Your Understanding
17. a) Wha t is a typica l speed, d istance, and po\,•er consumption for Bluetooth LE slaves? b) Wha t a re Bluetooth LE advertising n1essages? c) How do Bluetooth LE beacons d iffer from basic advertisen1e nt m essages? d) In general, how do Bluetooth LE profiles differ from Classic Bluetooth profiles? (You will have to think abou t this one a li ttle.)
OTHER PROMISING loT TRANSMISSION STANDARDS
Near Fie ld Communication (NFC)
We have seen tha t \,•hen radios transn1it, they produce e lectromagn e tic waves th at propaga te away, taking energy with th en1. Very close to an antenna, there is another phenomenon, a " near fi eld," w hich p u lses o u l\vard a short d ista nce, then is reab- sorbed into the a n tenna. This near field does not p ropagate a\,•ay fron1 the an tenna. As Figure 7-23 shows, the near field only extends a fe½• inches from a phone with a near fi eld communication (NFC) chip. Ho\,•ever, th e near field can be used for comn1u - nication. One device (in the fi gure a n1obile p ho ne) n1od u lates the near field to send inforn1ation. The o ther device (in this case a point-of-sa le tern1ina l), reads manges in the phone's near field . The POS d evice can also manip ulate the near field in a way that allo\,•s it to send information to the phone. This manipula tio n takes very little energy. In the most extreme case, passive radio frequ e ncy ID (RFID) circuits have no power at all (Figure 7-24). They use the power of the near field itself to n1odulate the near field to send informa tion.
Because NFC transn1ission takes place a t such extremely lo\,• speeds as 434 kbps, it cannot transfer very much inform ation. Also, near fie ld trans n1ission d istances only extend a fe\,• inches. Ho\,•ever, this is fine for n1an y purposes.
FIGURE 7-23 Near-fie ld Communication (NFC)
Chapter 7 • Wireless LANs JI 24 9
FIGURE 7- 24 Passive Radio Frequency ID (RFID) Circuits for Near Field Communication
NFC standards are still in flux. A ll NFC protocols use transmission in the 13.56 MHz unlicensed service band created for this purpose. Its technica l standards are also largely set. However, for applica tions such as point-of-sale payn1ents, there are competing applica tion standards as phone vendors and others push for domi- nance in a rapidly changing market.
Test Your Understanding 18. a) When h,•o devices comm unicate using NFC, ho\,, close must they be?
b) Ho\,v d oes near fie ld communication d iffer from norma l radio communica- tion? c) Passive RFID chips have no batteries. How can they transmit when queried? d) What is the sta te of NFC standards?
Wi-Fi Direct
In Figure 7-25, Wi-Fi Direct is the poster child for fast-and-far peer-to-peer commu- nication. When you have used 802.11, it has involved an access point. However, the 802.11 standard has always included an ad hoc mode, in which h'l'o w ireless Wi-Fi hosts con1municate d irectly. This provides medium-speed conununication over typical Wi-Fi d istances. It has no problem connecting devices tha t are a t different ends of a house. The Wi-Fi Alliance calls this Wi-Fi Direct. (Sometimes, people shorten this to Wi-Di.) Confusingly, con1panies that implement it on their phones, tablets, and other devices crea te their own name for it. This has plagued Wi-Fi D irect w ith marketplace confusion, and technical interoperability across vendors has been uneven.
Test Your Understanding
19. How is the access point used in Wi-Fi Direct?
250 Chapter 7 • Wireless LANs 11
Wi-Fi Direct (Wi-Di)
FIGURE 7- 25 Wi-Fi Direct
Zigbee a nd Z-Wave
Wi-Fi Direct is an 802.11 standard that allows device- to-device comm unication without the use of an access point.
No access point is involved
Near-field con1munica tion and Wi-Fi direct are designed for comn1unication between pairs of devices. Beyond that, two standards have been created to network IoT devices in a n1esh. One of these is Zigbee (named after the dance tha t bees do to communicate directions to fl owers \,•ith nectar). Figure 7-26 shows a Zigbee ad-hoc wireless nehvork. Ad hoc n1eans that the neh,•ork is self-organizing. There is no need to create a complete design in the beginning, and the neh,vork adapts a utoma tically to changes.
Zigbee Controller (and Often Gatew ay) The heart o f the network is the Zigbee controller. Th e contro ller coordina tes the nehvork, so every Zigbee neh,vork n1ust have one. Larger Z igbee neh,•orks may have several. In home a nd sn1a ll busi- ness networks, the con troller n1ay also be a ga te\,•ay to the In ternet. ("Ga te\,•ay" was an early name for " rou ter.") In fac t, the controller/ga teway may actua lly be an Internet access router with buil t-in Zigbee con troller func tional ity.
Zigbee End D evices Zigbee end devices are IoT devices such as light switches, lig ht b u lbs, thermosta ts, air conditioners, door locks, and televisions. These devices n1ust be able to comn1unicate via the Zigbee protocol.
Zigbee Rou ters End devices may connect to a controller, but they may also con- nect to Zigbee routers. Routers permit Zigbee neh,•orks to span larger d is tances than a single controller. For example, in Figure 7-26, S\,•itch 1 and the l ight Bulb may be too far apart to con1municate directly. Ho½•ever, ½•hen S\,•itch 1 transmits, its fran1e goes to the controller/gateway (\,•hich again may be a residential access router) to Router Rl, which forwards it to the Light Bu lb.8
8 A number or companjes now put Zigbcc functionality in their access routers. ln fact, some arc beginning to create meshes of access routers tha t use Zigbce to communicate. (Others are beginning to create meshes of access routers using different protocols as well.) In the past, there have been range extenders that you could put into a distant room to extend your basic home access router's range. Mesh access rou ters give full access muter functionality on each device in the mesh. They also arc self-organizing, making them easy to install.
C/ G: Controller & Gateway
End Device 1: Swttch 1
I ~ FIGURE 7-26 Zigbee Ad-Hoc Wireless Network
R: Router
End Device 3: Swttch 2
I !
Chapter 7 • Wireless LANs JI 251
End Device 2 : light
C -<--- 1 .,
R: Router
Du a l-Ban d Use in Zigbee Zigbee opera tes in h,•o unlicensed ba nds. One is the familiar 2.4 GHz unlicensed band. Another is the 800/900 MHz u nlicen sed band. It gets this sp lit des ignation because the ba nd is in the 800 MHz ra nge in Europe but in the 900 MHz range in North America. The lower ba nd can carry sig- nals sl ig htly far ther, bu t th e higher band can transm it s ignals slightly fas ter, albeit at the cost of sligh tly greater energy u se.9
Z-Wave Z-Wave is a sin1ilar ad hoc w ireless neh,•orking protocol. Z-Wave and Zigbee are the n1ost popu lar s tandard s for ad hoc \,•ireless networking, but o thers are beginning to appear. Z-Wave is similar in speed and range to Zigbee for small- to-mid-size networks, and both have 128-bit AES encryption and o ther good security protections. In corporations, size limitations and other factors do become in1portan t in large ad hoc w ireless networks that span large building. For examp le, Z-Wave o nly operates in the 800/900 MHz ISM bands.
Test Your Unders tanding
20. a) What kind of neh-vork is Zigbee used for? b) Compare the roles of Zigbee controllers, Zigbee end devices, and Zigbee routers. In what radio bands does Zigbee operate? c) What other ad hoc networking protocol is widely used? d) In \'l'ha t radio band or bands does it opera te?
SECURITY IN THE INTERNET OF THINGS
Security is a complex situation for emerging loca l w ireless transmission technologies. Like all wireless technologies, they are vulnerable to eavesdropping, data n1odification, and impersona tion.
9 An intriguing recent development has been the creation of Green Power devices in Zigbec. These arc devices that do not require a battery at all. For example, light switches are powered by the act or flipping the switch. The energy of this motion is captured and used to send out a s ignal.
252 Chapter 7 • Wireless LANs II
Threats Eavesdropping Data modification Impersonation
Cryptological Security
Some have no cryptological security Example: Near field communication for reading passive RFID tags They rely on short transmission distances to foll eavesdroppers However, directional antennas and amplifiers can read signals that are far longer than
distances in standards
Strength of Security
Some have reasonably good security Example: Bluetooth However, still not as strong as 802.111 security
Device Loss or Theft In this age of bring your own device (BYOD) to work, this Is a serious problem
Most devices are only protected by short PINs
Maturity
In general, new security technologies take some time to mature During this period, they often have vulnerabilities that must be fixed quickly User companies must master security for each new technology they use
FIGURE 7-27 Security in Emergi ng Local W ireless Technol ogies (Study Figure)
Some of these technologies have no cryptographic security at all. The classic example is using NFC to read passive RFID tags. These technologies assume that eavesdroppers cannot get close enough to read the information because maximum transmission distances are very small. However, distances in the standards are for normal devices. Eavesdroppers with h ighly directional antennas and amplifiers can intercept signals over much longer distances. Bluetooth probably has the best security among emerging wireless technologies, but its security is still weaker than 802.1 li 's security.
In today's \VOrid of bring your O\vn device (BYOD) to work, emerging local wire- less technologies make a worrisome corporate security situation even more problem- atic. For example, if devices such as mobile phones are lost or stolen, they are often protected only by brief PINs, if they are protected at all. Many of th~,se devices contain sensitive corporate information, and even if they do not, they may allow attackers to log into sensitive servers on the corporate nenvork.
As a rule, new security technologies tend to have vulnerabilities that take time to discover and protect against. One must hope that technology vendors will be quicker to act than attackers. In any case, companies need to fully understand security for each technology.
Chapter 7 • Wireless LANs II 253
Test Your Understanding
21. a) Why is a short transmission range not a protectio n against eavesdroppers? b) Describe the state of cryptographic security for new transmission standards. c) Why is device theft o r loss a serious r isk?
END-OF-CHAPTER QUESTIONS
Thought Questions
7-1. In the Ms. Betsy Davis case at the begin- ning of the chapter, the access point on the local network did not have secur ity. This makes a man-in-the-middle attack much easier. a) Given what you learned in this chapter, d escribe how it would be possible to use a man-in-the-middle attack if the legitimate access p oint does not implement 802.lli. b) How can you get the user to associa te w ith your evil twin access point? (The answer is not in the text.)
7-2. a) A s traight road w ith governm ent- provided Internet w ill receive 16 access p oints that a re 10 meters ap art. About how many access p oints w ou ld be needed if the city decided to increase the distance to 20 meters? Just give a rea- soned estimate. b) A single-story build- ing is 100 meters by 100 meters. If access p oints a re placed 10 meters apart on average, about how many access points
Perspective Quest ions
7-5. What was the most surpris ing thing you learned in this chapter?
will be needed? c) If the same building is also 100 meters tall, how many access points will be needed? d) Repeat Part b if the access points are 20 meters apart? Give a reasoned estimate.
7-3. (If y ou read t he b ox "Expr essing Power Ratios in Decibels") a) If you are told that a signal has attenuated by 20 d B, about how much has it attenu- a ted? b) What would you say abou t attenuation if you were told that a sig- nal has attenuated by 19 dB? You must approximate. c) What would you say about attenuation if you were told that a s ignal has attenuated by 7 dB?
7-4. Create a policy for 802.11 Wi-Fi security in a w ireless net wor k in a five-person company with one access point. This is not a tr ivial task. Do not jus t jot down a few notes. Make it a one-page document for people in your firm to read, not some- thingfor your teacher to read.
7-6. What was the most difficult part of this chapter for you?
This page intentionally left blank
Chapter 8
TCP / IP Internetworking I
LEARNING OBJECT IVES
By the end of this chapter, you should be able to:
• Define ruerarchical IPv4 addresses, networks and subnets, border and internal routers, and masks.
• Given an arriving packet's destination IPv4 address, explain what the router w ill do \,•ith the packet based o n its routing table.
• Exp lain the IPv4 packet header fields \,•e did not see in earlier chapters.
• Exp lain the IPv6 packet's main header fi elds and IPv6's use of extension headers.
• Con vert a 128-bit IPv6 address into canonica l text no tation cons istent \,•ith RFC 5952.
• Exp lain TCP segment fields, UDP d a tagram fie lds, and TCP session closings.
• Exp lain w hy application message fragmentation is not possible \,•ith UDP.
INTRODUCTION
Switched nel\,•orks and wireless nel\,•orks are governed by Layer 1 and Layer 2 s ta ndards. We looked at s ing le network standards in Chapters 5, 6, and 7. In this c hapter and the next, we look at in terne tworking, w hich is governed by Layer 3 and Layer 4 standards. Figure 8-1 illustrates this situa tion.
We only look at TCP / IP internetworking because TCP / IP don1inates the work of ne twork professionals at th e internet and transport layers. However, rea l-\,•orld routers cannot limit then1selves to TCP / IP intern el\,•o rking. Comn1ercial routers are multiprotocol routers, w him can route not only IP packets but also IPX packets, SNA
255
256 Chapter 8 • TCP / IP Intemehvor king I
layer Name
5 Application
4 Transport
3 Internet
2 Data Link
1 Physical
Ethernet LANs
802.3
802.3
FIGURE 8- 1 Sta ndards Layers Re ca p
Wireless LANs
802. 11
802. 11
The Internet Dominant Standards Agency(ies) / Architecture
None
TCP, UDP IETF / TCP/IP
IP IETF / TCP/IP
ISO and ITU-T / OSI
ISO and ITU-T / OSI
packets, AppleTa lk packets, a nd o ther minor types of packets that \,•e cannot cover in an introductory text book.
We examined the TCP / IP architecture in Chapter 2. We focused o n IP, TCP, and UDP, a lthough we looked at a few other TCP / IP standards. Figure 8-2 shows a fe\,, of the m any stan dards the Interne t Engineering Task Force (IETF) has crea ted ½•ithin the TCP / IP architecture. Some of the standards are shaded in this figure. We will look at them in this chapter and in Chap ter 9.
Ma n y of these are supervisory standard s tha t govern ho\,, rou ters a nd hosts on the Internet work beyond the d elivery of packe ts. As a \Vorld\,•id e network, the Internet needs ma n y n1ore supervisory protocols to govern it than do Ethernet and W i-Fi networks.
Test Your Understanding
1. a) Which two layers s tandardize Ethernet a nd Wi-Fi operation? b) Which t\,vo layers s tand ardize most of the In terne t's operation? c) What do IP, TCP, and UDP govern? d) Wha t d o TCP /IP supervisory protocols govern?
5 Application User Applications Supervisory Applications
HTTP SMTP Many DNS BGP Others
4 Transport TCP
3 Internet 1Pv4 and 1Pv6 ICMP OSPF
2 Data Link None: Use OSI Standards
1 Physical None: Use OSI Standards
Note: Shaded protocols are discussed in this chapter and in Chapter 9.
FIGURE 8- 2 Major TCP/IP Standa rd s
Many Others
UDP
EIGRP ARP
Router
Interlace
Router Connectors and Their Electronics are Calle<! Interfaces
An example of different terminology in
single-network and Internet standards
FIG URE 8-3 Router Interfaces and Switch Ports
IP ROUTING
Chapter 8 • TCP /IP Internetworking I 257
Port
Switch Connectors and Their Electronics are Called Ports
Routers make decisions about forwarding packets-which interface to send an arriving packet back out to get it closer to its destination. For routers, ports are called interfaces. This is another exan1ple of how terminology differs for single neh,•orks and the Internet. Single-network and Internet standards are governed by different organizations, and they use different temlinology (Figure 8-3).
Router ports are called interfaces.
In this chapter, \,•e will see that router fon,•arding is n1uch more complex than the Ethernet s\,•itching. H igher complexity requires routers to do more work per arriving packet than switches do per arriving frame. Consequently, routers are more expensive than switches for a given volun1e of traffic. A common network adage reflects this cost difference: "Switch where you can; route ½•here you n1ust."
When routers forward incoming packets closer to their destination hosts, this is routing.
Test Your Understanding 2. a) What are interfaces? b) Explain the neh-vork adage "S\,vitch \,•here you can;
route \,•here you n1ust."
Hierarchical 1Pv4 Address ing To understand the routing of 1Pv4 packets, it is necessary to understand 1Pv4 addresses. Chapter 1 showed that IP Version 4 (IPv4) addresses are 32 bits long. Ho\,•ever, 1Pv4 addresses are not s imple 32-bit strings. They have internal structure, and this internal structure is important in routing.
Sing le Net work s versus uN etworks" on the Inte rnet To understand IPv4 addressing, you need to understand what the term "nel\,•ork" n1eans on the Internet (Figure 8-4). It does not n1ean a single network, like an Ethernet network . Ra ther, a network on the Internet is a collection of routers and data links owned by a
258 Chapter 8 • TCP / IP Intemehvorking I
.... ... Network on the Internet ... . . -~------ ... .... - - - - """'. .--~ ·. • •
The Internet
On the Internet, "ne twork" does not mean a sing le network like Ethernet. Rather, "Network" is an organizational concept.
It means the routers and data links owned and managed by a recognized organization.
FIGURE 8-4 " Network" on t he Internet
recognized organization. You r hon1e net\,•ork is not a recognized net\,•ork. The U ni- versity of Hawai'i network is a recognized organization. So is An1azon.com. Both are end-u ser organ izations. Internet service prov iders (ISPs) are a lso recogn ized organiza tions. ISPs are not end-user organizations.
On the Internet, "network " does not mean a single network such as an Ethernet LAN. It is an organizational concept It means the routers and switches owned by a recognized organization, which is an end-user organization or an ISP.
Hi erarchical Addressing As Figure 8-5 shows, IPv4 add resses are hierarchical. They consist of three parts (groups of bits) that locate a host in progressively smaller
The Internet (All IP Addresses)
UH Network (128.171 .x.x)
Shidler Subnet (128.171.17.x)
~ 128.171.17.47
ISP Network (60.x.x.x)
Subnet 60.33.22.x
~ 60.33.22.5 f;iiil 128.171.17.13
"- XYZ Subnet (128.171.20.x)
10 128 171.20.47 1 Netwo, Part • 128. 171
Sul oet Part = 17 He st Part= 13
FIGURE 8-5 Hierarchical 1Pv4 Addresses
t Network Part = 60
Subnet Part= 33.22 Host Part =5
Chapter 8 • TCP /IP Internetworking I 259
parts of the Internet. These are the neh,•ork, subnet, and host parts. We \,•ill see later in this chapter how hierarchical IPv4 addressing simplifies routing tables. (Our exam- p les are IPv4 addresses, bu t IPv6 routing works the san1e way but with 128-bit IPv6 addresses and masks.)
In IPv4 addressing, a part is a group of bits within the IPv4 address.
Network Part First, every IPv4 address has a network part, wruch identifies the host's recognized neh,•ork on the Internet. In Figure 8-5, the neh,•ork part for the University of Hawai' i Network is 128.171. All host IPv4 addresses in the University of Ha\,•ai'i Network (UH Neh,•ork) begin with the network part 128.171. This is two IP 8-bit address segments. Therefore, UH Network's part is 16 bits long.
Do not get hung up on the neh-vork part being 16 bits. The UH Neh,•ork is only an example. Different organizations have different network parts that range fron1 8 to 24 bits in length. For example, Figure 8-3 sho\,'S an ISP network with the network part 60. This network part is 8 bits long, not 16 bits.
Do not get hung up on the network part being 16 bits. This is only an example. Different organizations have different network parts that range from 8 to 24 bits in length.
Subnet Part Most large organizations further d iv ide their networks into sn1aller units called subnets. After the network part in an IPv4 address con1e the bits of the subnet part. The subnet part bits specify a particular subnet \,•ithin the network.
For instance, Figure 8-5 sho\,'S that in the IPv4 address 128.171.17.13, the first 16 bits (128.171) correspond to the network part, and the next 8 bits (17) correspond to a subnet on this network. (Subnet 17 is the Shid ler College of Business subnet within the University of Hawai'i Network.) All host IPv4 addresses within this subnet begin with 128.171.17.
Again, do not get hung up on the subnet part being 8 bits long. In different orga- nizations, subnet lengths vary w idely. Keep clear in your head that the UH Network is only being used as an example. For the ISP shown in the figure, in fact, the subnet part is 16 bits long rather than 8 bits long.
Again, do not get hung up on the subnet part being 8 bits long. In different organiza- tions, subnet lengths vary widely. Keep clear in your head that the UH Network is only being used as an example.
Host Part The remaining bits in the 32-b it IPv4 address constitute the host part, which specifies a particular host in a subnet. In Figure 8-5, the host part of the UH Network host is 8 bits long \,vith a segment value of 13. This corresponds to a particular host, 128.171.17.13, on the Shidler College of Business subnet of the University of Hawai'i Network. Again, host parts in different organiza tions d iffer in length.
260 Chapter 8 • TCP / IP Intemehvorking I
Va riable Part Lengths Can you tell just by looking at an 1Pv4 address V>'hich bits correspond to the neh,vork, subnet, and host parts? The answer is no.
• For instance, if you see the 1Pv4 address 60.47.7.23, you may have an 8-bit neh,•ork part of 60, an 8-bit subnet part of 47, and a 16-bit host part of 7.23.
• Or, you may have a neh'l'ork part of 16 bits, a subnet part of 8 bits, and a host part of 8 bits.
• In fact, parts may not even break conveniently at 8-bit boundaries. You may have a neh,•ork part of 20 bits, a subnet part of 12 bits, and a host part of 12 bits.
• The only thing you can tell when looking at an 1Pv4 address is that it is 32 bits long.
Hi era rchical 1Pv6 Address IPv6 addresses are also hierarchica l and consist of three parts that are sin1ilar to those of IPv4 addresses. However, there are differences beh'l'een 1Pv4 parts and 1Pv6 parts, and to d iscuss these, we need a better understanding of 1Pv6. We \,viii look at hierarchical 1Pv6 addresses in the next chapter.
Test Your Und ers tanding
3. a) What a re the three parts of an 1Pv4 address? b) How long is each part? c) What is the total length of an 1Pv4 add ress? d) In the 1Pv4 add ress, 10.11.13.13, what is the neh'l'ork part? e) If you see an 1Pv4 address, what do you kno\'I' for certain?
Routers, Networks, and Subnets
Border Routers Connect D iffere nt Net w orks As Figure 8-6 illustrates, neh,•orks and subnets are very important in router opera tion. Here \,•e see a simple site internet. The figure sho\,'S that a border rou ter's main job is to connect different neh'l'orks. This border router connects the 192.168.x.x neh'l'ork within the firm to the 60.x.x.x neh'l'ork of the firm's Internet service provider. Here, the xs are the ren,aining bits of the 1Pv4 address, so 192.168 and 60 are the neh'l'ork parts of the h'l'o neh'l'orks.
A border router's main job is to connect different networks.
,---------------~ 1
Borde, routers connect
2
Subnet 192.168.2.x
Internal Router
Subnet 192.168.3.x
different networks (192.168.x.x & 60.x.x.x).
Subnet Subnet 192.168.1.x ,. ,. 60.33.4.x
- ',=-'aorc:1er Corporate Router Network
192.168.x.x
ISP Network 60.x.x.x
Internal routers connect different subnets within a network.
FIGURE 8-6 Border Routers, Networks, and Subnets
Chapter 8 • TCP /IP Internetworking I 261
Inte rna l Routers Connect Different Subnets The site network also has an internal ro uter. An internal router, F igure 8-6 dem onstra tes, o nly connects d ifferen t su bnets wi thin a neh,•ork-in this case, the 192.168.1.x, 192.168.2.x, a nd 192.168.3.x subne ts. Many sites have m ul tiple internal routers to link th e s ite's subnets.
A n internal router only connects different subn ets within a n etwork.
Test Your Understanding
4. a) Connecting d ifferen t networ ks is the main job of \,•hat type o f router? b) What type of router connects d ifferent su bne ts?
Network and Subnet Masks
We have seen that in the University of Ha\,•ai'i network, the first 16 bits in IPv4 add resses are the network pa rt, the next 8 are the subnet part, and the fina l 8 a re the host part. However, because the sizes of the network, subnet, and host parts d iffer, routers need a way to tell the sizes of key parts. The tools that allow then1 to do this are masks.
32-Bit Strings Figure 8-8 illustrates how m asks \,•ork. An 1Pv4 mask is a string of 32 bits, like an IPv4 address. However, a m ask a lways begins w ith a series of ls; this is always follo\,•ed by a series of Os. The tota l length of an IPv4 mask is ah,•ays 32 bits, so if a mask begins \,•ith twelve ls, it will end \,•ith twenty Os.
There are h,•o kinds of masks.
• In a neh,•ork m ask, the bits in the network part of the mask nre ls, and the ren1aining bits are Os.
• In a subnet mask, the bits of both the network and the subnet pnrts nre ls, and the rem aining bits are Os.1
We have seen that the University of Ha\,•ai'i neh,•ork part is 16 bits and the su bnet part is 8 bits.
• So the network mask will have sixteen l s followed by six teen Os.
• The subnet mask will have h-venty-fo u r ls follo\,•ed by eigh t Os.
An 1Pv4 mask is 32 bits long
It begins with a series of 1 s
The remaining bits are Os
Example (Broken into octets for readability): 1111 1111 11110000 00000000 00000000
Prefix notation (the number of leading 1 s) for this example: /12
FIGURE 8-7 1Pv4 Network Mask (St udy Figure)
1 To give an analog)~ to specify a state in the United States, you only need to give the name of the state. "Oklahoma" is sufficient to identify that state. For cities, you need to specify both a city and a state. Th.ere is a Portland in both Oregon and Maine, so you ne«I to say "Portland, Oregon" to specify that city. The network part bits correspond to the state, the subnet parts to a city, so a subnet mask needs ls in both the network and subnet parts.
262 Chapter 8 • TCP / IP Intemehvorking I
The Problem
There is no way t o tell by looking at an IP address what sizes the network, subnet, and host parts are-only that their total is 32 bits
The solution: masks
Note: Decimal segment O is eight Os and Decimal segment 255 is eight 1s
Where the mask has 1 s, the result of masking is the original bits of the IP address
Where the mask has Os, the result of masking is O
Mask Operation
Network Mask
Network Mask
Destination IP Address
Network Mask
Bits in network part, followed by Os
Subnet Mask
Subnet Mask
Destination IP Address
Subnet Mask
Bits in network part and subnet parts, followed by Os
FIGURE 8-8 IP Networks and Subnet Masks
Dotted Decimal Notation
128.1 71.17. 13
255.255. 0. 0
128.1 71. 0 .0
Dotted Decima l Notati on
128.1 71. 17.1 3
255.255.255. 0
128.1 71. 17. 0
For example, suppose tha t the mask is 255.255.0.0. This means tha t the four 8-bit segmen ts of the n1ask have the values 255, 255, 0, a nd 0. In dotted decimal notation eight ls is 255 and eight Os is 0. Therefore, the four segments have, in order, eight ls, eight ls, eight Os, and eight Os. Putting this together, the n1ask has sixteen ls follo\,•ed by sixteen Os.
Prefix Notation for Masks Writing 255.255.255.0 is not very difficult, but net- working professionals often use a shortcut called prefix notation. The mask 255.255.255.0 is twenty-four ls followed by eight Os. In prefix notation, this mask is represented as / 24. Do you see the pattern? In prefix notation, a mask is represented by a slash follo½•ed by the nun1ber of initial ls in the n1ask. What about 255.0.0.0? Yes, it is / 8. Prefix notation is simpler to write than dotted decimal notation. (By the \,vay, we call this prefix notation because it focuses o n the first part of the mask-the part that is all ls.)
In prefix notation, a mask is represented by a slash followed by the number of initial 1 s in the mask.
Another advan tage of prefix notation for a mask is tha t it is sin1ple even if the number of leading ls is not a multiple of eight. For example, suppose tha t the mask is eighteen ls followed by fourteen Os. The n1ask in prefix notation is obviously / 18. What if you saw this mask in dotted decimal notation: 255.255.48.0? The first two octets are
Chapter 8 • TCP /IP Internetworking I 263
obviously all ls. Ho\vever, you would need you r decin1al-to-binary calculator to figure out tha t 48 is 110000.
Masking 1Pv4 Addresses Figure 8-8 sho\,•s \,•hat happens \,•hen a m ask is a pplied to an IPv4 address, 128.171.17.13. The mask is 255.255.0.0. Where the mask has ls, the result is the origina l bits of the 1Pv4 ad d ress. There are six teen l s. This is two octets. So the firs t n,•o octets of the result \,•ould be 128.171. For the rem aining 16 bits, w hich are Os, the resul t of the masking is 0. So the masking result is 128.171.0.0.
Network M asks Network m asks, as noted earlier, have ls in the network part and Os fo r the remaining bits. If the neh,•ork n1ask is 255.255.0.0 and the 1Pv4 address is 128.171.17.13, then the result of m asking is 128.171.0.0. This tells us that 128.171 is the network part.
Subnet Masks For subnet n1asks, in turn, the initia l ls indicate the nun1ber of bits in bot/, the neh,•ork and subnet parts. The refore, if 128.171 is the network part and 17 is the subnet part, then the subnet n1ask \,• ill be 255.255.255.0 (/24). If you mask 128.171.17.13 \vith /24, you get 128.171.17.0.2
Test Your Understanding
5. a) How many bits are there in an IPv4 mask? b) What d o the ls in an IPv4 net- \'l'ork mask correspond to in IPv4 addresses? c) What do the ls in an IPv4 subnet mask correspo nd to in 1Pv4 ad d resses? Think carefully! d ) When a network mask is a p plied to any IPv4 add ress o n the neh,vork, w hat is the result?
6. a) A mask has eight l s, fo llo\,ved by Os. Express this n1ask in d otted decimal no ta- tio n. b) Exp ress this mask in prefix notation. c) In prefix no tation, a m ask is / 16. Express this mask in d otted d ecimal nota tio n. d) Exp ress the mask /18 in dotted decima l notatio n. (You will need a ca lcu lator for this.)
HOW ROUTERS PROCESS PACKETS
Switching v ersus Ro ut ing
In Chap ter 5, we saw that Ethernet switch ing is very sin1ple. Ethe rnet switches n1ust be o rganized in a hierarchy. Therefore, there is only a single possible path be n,•een any two hosts across the network. When a fran1e arrives, there is o nly o ne possible port to send the fra me back out. In an Ethernet switching table, each Ethernet address only appea rs in o ne ro\,•. This single row can be fo und quickly, so an Ethernet s\,•itch d oes little work per frame. This n1akes Ethernet switching fas t and inexpensive.
2 Why not make the nchvork part Os and the subnet part ls instead of making both ls?Think of a network as a state and a subnet as a city. In the United Statcsi there arc hvo major cities named Portland-one in Maine and the other in Oregon. You cannot just say "'Portland" to designate a city. You n,ust give both the state and city. Analogously, there may be many subnet parts with a value of 17, so you must give both the network and subnet parts to designate a specifi c subnet. Another way to look at it is that if you only had ls in the subnet part of a subnet mask, you would break the rule that masks must have a number of leading l s followed by a number of trailing Os. (This repeats information in the previous footnote.)
264 Chapter 8 • TCP / IP Intemehvor king I
Ethernet Switching
Port 5 on Switch 1 to Port 3 on Switc h 2
Frame to ES-BB-47-2 1-03-56
Switch 1
A 1-44-05-1 F-AA-4C Switc h 1, Port 2
Router A
I
B2-CD-13-5B-E4-65 Switch 1, Port 7
IP Routing
ES-B B-4 7-21-03-56 Switch 2, Port 47
Switc hing Table Switch 1
Port Station 2 A1 -44-05-1 F-AA-4C 7 B2-CD-13-5B-E4-65 5 C3-20-55-3B-A9-4F 5 04-4 7 -55-C4- 86-9F 5 ES-B 8-47-21 -03-56 I
Packet to 60.3.47.129 ,....._ ..... Interface 1 .. . . ..
·· ···
Route 1: BOE
(Not Selected) Router B .. ..: ------ Router D ...... Routing Table for Router A
Route 3 : IP Address Next-Hop CE
Route Range Interface Router (Selected)
I 1 60.x.x.x 1 B 2 128.171.x.x 1 B 3 60.3.x.x 2 C 4 10.5.3.x 4 Q 5 128.17 1. 17.x 3 Local 6 10.4.3.x 2 C
FIGURE 8-9 Ethernet Switching versus IP Ro ut ing
. .. . . ... . ·------- 7
'II' •
Network 60.x.x.x
Router C Router E' __ ,,.
Host 60.3.47.129
Subnet 60.3.x.x
In con trast, routers are organized in m eshes. This gives more reliability because it allo\,•s m any possible a lternative routes between endpoints. Ho\,•ever, in a mesh, there are n1ultiple \,•ays to send a packet back out to reach its d estina tio n. Figure 8-9 shows that in a routing table, several rows n1ay m a tch an IPv4 ad d ress. Ro\,• 1 calls for send ing the packet out Interface 1 to Next-Hop Router B. Row 3, in turn, calls for sending the packet out Interface 2 to Next-Hop Rou te r C.
Chapter 8 • TCP /IP Internetworking I 265
Routing
Processing an individual packet and passing it closer to its destination host is called routing
The Routing Table
Each router has a routing table that it uses to make routing decisions
Routing tabl es have rows
Each row represents a route for a range of IP addresses-often packets going to the same network or subnet
The Routing Decision
1. Find all row matches
2. Find the best-match row
3. Send the frame oui based on information in the row
FIGURE 8- 10 The Routing Process
The fact that a packet n1ay be m atched by multiple ro\VS requires a fairly con1p lex process to be performed on each packet. Figure 8-10 sun1marizes this process. To route a packet, a router n1ust first find all rows that a pply to an incon1ing packet. In fact, it w ill have to look at every row in the table to see if it is a n1atch to the packet's destina tion IPv4 add ress. It n1ust then pick the best alternative route fron1 this list of n1atches. All of this requires quite a bit of work per packet, making routing m uch n1ore expensive than switching per n1essage handled.
Test Your Understanding
7. Why are routing ta bles m ore complex than Ethernet switching tables? Give a detailed answer.
Routing Table
Figure 8-11 shows a routing ta ble. We will see how a router uses its rows and colunms to n1ake the routing decision-\,•ha t to do with an arriving packet.
Rows Are Routes for All 1Pv4 Addresses in a Range
In the routing table, each row represen ts a route for all IPv4 ad dresses within a range of IPv4 addresses-typically ad dresses \,•ithin a particular network o r subnet. It d oes not specify the fu ll rou te, however; it only s pecifies the next step in the route (either the next-hop router to handle the packet next or, o n the last router, the destina tion host).
In the routin g table, each row rep resents a route for aff I Pv4 addr esses within a r ange of /Pv4 addresses.
Th is is importan t because the rou ting table does not need a ro\,, fo r each IPv4 ad dress as an Ethernet switching table does for EUI-48 ad dresses. It o nly needs a row for each group of IPv4 addresses. This n1eans that a router needs m any fe\,•er rows than an Ethe rnet s\,•itch \,•ould need for the sam e number of ad dresses.
266 Chapter 8 • TCP / IP Intemehvor king I
Packet arrives with destination IP address 128.171 .17.13
2.
1. Select the best-matc h row
Find all row matches
Row Destination Mask VPrefix) Metric Network or (Cost) Subnet
1 128.171 .0.0 255.255.0.0 (/16) 47
2 172.30.33.0 255.255.255.o V24) 0
3 60.168.6.0 255.255.255.0 V24) 12
4 123.0.0.0 255.0.0.0 (/8) 33
5 172.29.8.0 255.255.255.0 V24) 34
6 172.40.6.0 255.255.255.0 V24) 47
7 128.171.17.0 255.255.255.o V24) 55
8 172.29.8.0 255.255.255.0 V24) 20
9 172.12.6.0 255.255.255.o V24) 23
10 172.30.12.0 255.255.255.0 V24) 9
11 172.30.12.0 255.255.255.0 V24) 3
12 60.168.0.0 255.255.0.0 v 16) 16
13 0.0.0.0 o.o.o.o VO) 5
FIGURE 8-1 1 Ro uting Table
3. Decide how to send the packet back out
Interlace Next- Hop Router
2 G
1 Local
2 G
2 G
1 F
3 H
3 H
3 H
1 F
2 G
3 H
2 G
3 H
However, there are many more IPv4 addresses o n the Internet than there are Eth- ernet addresses on an Ethernet network. Even w ith ro\,•s representing groups of IPv4 add resses, core routers in the Internet backbone still have severa l hund red thousand rows. This is importan t. We w ill see that routers need to do calculations for all rows.
Tes t Your Und ers tanding
8. a) In a routing table, wha t does a ro\'I' represent? b) Do Ethernet switches have a row for each individual Ethernet address? c) Do routers have a row for each individual IPv4 address? d) What is the advantage of the answer to the previous subparts of this question?
Step 1: Finding All Row Matches
We will no\,• see how the rou te r uses its routing tab le to make rou ting decisions. Figure 8-12 sho\,•s that there are three very differen t steps. These differences can lead to confusion, so you mus t s tudy this n1ateria l carefully. The first step is to find
Chapter 8 • TCP / IP Internetworking I 267
Step 1: Find All Row Matches The router looks at the destination IP address in an arriving packet
For each row:
Apply the row's mask to the destination IP address in the packet
Compare the result with the row's destination value
If the two match, the row is a match
The router must do this to All rows because there may be multiple matches
This step ends with a set of matching rows
Example 1: A Destination IP Address that IS in the Range
Destination IP Address of Arriving Packet 128.171 .17.13
Apply the (Network) Mask 255.255.0.0
Result of Masking
Destination Column Value
Does Destination Match the Masking Result?
Conclusion
128.171 .0.0
128.171 .0.0
Yes
Row is a match
Example 2: A Destination IP Address that is NOT in the Destination Range
Destination IP Address of Arriving Packet 60.43.7.8
Apply the (Network) Mask 255.255.0.0
Result of Masking 60.43.0.0
Destination Column Value
Does Destination Match the Masking Result?
Conclusion
Step 2: Find the Best-Match Row
128.171 .0.0
No
Not a match
The router examines the matching rows it found in Step 1 to find the best-match row
Basic rule (always used): It selects the row with the longest match (Initial 1s in the row mask) If it finds one, there is no need to go on to the tie-breaker rule
ne Breaker (only when needed): If there is a tie on longest match, select among the tie rows based on a metric
For cost metric, choose the row with the lowest metric value
For speed metric, choose the row with the highest metric value
The router now knows the best-match row
Step 3: Send the Packet Back Out Send the packet out the interface (router port) designated in the best-match row
If the address says Local, the destination host is on that interface
Sends the packet to the destination IP address in a frame
AGURE 8-12 Steps in a Routing Decision
w hich of the ro\,•s in t he routing tab le m atch the des tination IPv4 address in a n arr iving packet. Due to the existen ce of alternative routes in a rou ter n1esh, m ost packets will match more than one row.
268 Chapter 8 • TCP /IP Intem e hvorking I
Row Number Column The first colunm in F igure 8-11 contains route (row) numbers. Routing tables actually do not have this colunm. We include it to allow us to refer to specific rows in our discussion. Again, each ro\,, specifies a route to a destination.
Row Matches Ho\,, does the router know which 1Pv4 addresses match a row? The answer is that it uses the Destination Network or Subnet colunm and the Mnsk colunms.
Suppose tha t all 1Pv4 addresses in the University of Hawa i' i net\vork should n1atch a row. The mask \,vould be the network n1ask 255.255.0.0, because the UH Neh-vork has a 16-bi t nel\,•ork part. If this mask is applied to any UH address, the result \,•ill be 128.171.0.0. This is the value that will be in the destina tion column. In fact, this n1a tches Row 1 in F igure 8-11.
Let's see how routers use these 1\-vo columns in Figure 8-11. We will use 1\-vo examp les. This is the first:
• Suppose that a packet arrives w ith the 1Pv4 address 128.171.17.13. The router w ill look first at Row 1.
• In this row, the router applies the n1ask 255.255.0.0 to the arriving packet's desti- nation 1Pv4 address, 128.171.17.13. The resul t is 128.171.0.0.
• Next, the router con1pares the masking result, 128.171.0.0, to the destination value in the row, 128.171.0.0. The h,•o are the same, so the row is a match.
Here is the second example.
• This tin1e, the destination IPv4 address in the arriving packet is 60.43.6.8.
• Again, the router applies the mask 255.255.0.0 in Ro½' 1 to the destination IPv4 address, 60.43.6.8. The result is 60.43.0.0.
• Next, the router con1pares 60.43.0.0 to the destination va lue in the row, 128.171.0.0. The two are not equal. Therefore, the row is not a match.
Mask and Compare This n1ay seem like an odd \,•ay to see if a row ma tches the arriving 1Pv4 address. A human can simply look at 60.43.7.8 and see tha t it does not n1atch 128.171.0.0. However, routers do not possess human pattern-n1atching abilities.
On the other hand, routers (and all computers) have specialized circuitry for doing n1asking and comparing-the two operations that row matching requires. Thanks to this specialized circuitry, routers can blaze through hundreds of thousands of ro\,'S in a tiny fraction of a second.
In contrast, if a hun1an saw 300,000 rows, finding matches visually \,•ould take a long time. For finding matches, stupid but fast beats smart and slow.
The Default Row The last row in Figure 8-11 has the destination 0.0.0.0 and the n1ask 0.0.0.0. This row will n1atch every 1Pv4 address because masking any IPv4 address with 0.0.0.0 w ill give 0.0.0.0, \,•hich is the value in the Destination Field of Row 13. This row ensures that at least one row will n1atch the destination 1Pv4 address of every arriv- ing packet. It is called the default row. In general, a "default" is something you get if you do not have a more specific choice.
In general, a "default" is something you get if you do not have a more specific choice.
Chapter 8 • TCP /IP Internetworking I 269
The Need to Look at All Rows Thanks to their n1esh topology, intemets have n1any alterna tive routes. Consequently, a router cannot stop fue first tin1e it finds a row n1atch for each arriving packet because t11ere may be a better match furtl1er o n. A router n1ust look at each and every row in the routing table to see \Vhich rows n1atch. So far, we have seen what the router does in Row 1 of Figure 8-11. The router then goes o n to Row 2 to see if it is a match by masking and con1paring. After this, it goes on to Row 3, Row 4, Row 5, and so o n, all the way to tl1e fina l ro\,v (Row 13 in Figure 8-11).
Test Your Understanding 9. a) In Fig u re 8-11, ho\,v will a rou ter test \,vhether Ro\,, 3 matches the IPv4
address 60.168.6.7? Sho\,v t11e calculations in the format given in Figure 8-12. b) Is fue row a match? c) Why is the last row called the default row? d) Why n1ust a router look a t all ro\,vs in a routing table? e) Which rows in Figure 8-11 match 172.30.17.6? (Don't forge t the d efau lt row.) Show you r calculations for ro\,vs that match. f) Which rows n1atch 60.168.7.32? Show your calculations for rows that match. g) Which rows in Figure 8-11 match 128.171.17.13? (Show your calcula- tions for rows that match .)
Step 2: Selecting the Best-Match Row
L.ist of Matching Rows A t the end of Step 1, th e router has a list of match- ing ro\vs. For a packet with th e destination IPv4 address 128.171.17.13, three rows in Figure 8-11 m atch.
• The first is Ro\v 1, as we have already seen .
• The second is Row 7, \,•ith a destination of 128.171.17.0 and a mask o f 255.255.255.0.
• Finally, the default row (Row 13 in this figure) will always be a m atch .
From these, t11e router must select the best-ma tch ro\,,, t11e row that represen ts the best route for an IPv4 address.
Basic Rule (Always Used): Longest Match How does the rou ter decide w hether to follow Ro\,, 1, Row 7, or Row 13? The ans\,•er is that it follows the rule of selecting fue longes t match (the longest number of initial ls in t11e n1ask). Row 1 has a mask of 255.255.0.0, \,•hich m eans that it has a 16-bit n1atch. Ro\,v 7, in tum, has the prefix /24, n1eaning that it has a 24-bi t n1atch. Row 13 has a frefi x of 0/. Ro\,, 7 has the longest m atch, so the router selects Row 7 as the best match.
By t11e way, note th a t t11e default row ah,•ays has a prefix of 0/. This is the short- est possible length of n1atch. Consequently, if any o ther row n1a tc hes, its length of n1a tch will be longer, and the defau lt row w ill never be c hosen as the best-match row.
Tie-Breaker Rule (Only When Needed): Best Metric Value In t11e previous example, tl1ere was a \vinner for longest match. There \,•as no need to handle a tie. However,
3 \+Vhy the longest matd, rule? The answer is that the closer a route gets a packet to the destination lPv4 address, the better. Row I only gets the packet to the UH Network, 128.171.x.x, whereas Row 7 gets the packet all the way to the Shidler College of Business subnet of the University of Hawai'i, 128.171.17.x. This is the subnet that contains host 128.171.17.13.
270 Chapter 8 • TCP / IP Intem e hvorking I
what if there is a tie instead of a win? For instance, the d estination IPv4 address 172.29.8.112 n,atches both Ro\,v 5 and Ro\,, 8 in Figure 8-11. Both have a match length of 24 bits-a tie.
In case of a tie for longest match, the tie-breaker rule is to use the metric column, w hich describes the desirability of a route. For instance, in Figure 8-11, the metric is cost. Ro\,, 5 has a cost of 34, \,vhereas Ro\,, 8 has a cost of 20. Lower cost is better //,an higl,er cost, so the router selects Ro\,, 8.
In this case, the ro\,v with the lowest metric won. However, w hat would have hap- pened if the n, etric had been speed instead of cost? More speed is better, so the router would choose Row 5, with the higl,er speed (34).
Test Your Understanding
10. a) Distinguish between Step 1 and Step 2 in the routing process. b) If any row other than the d efault ro\,, matches an 1Pv4 address, why \,•ill the router never choose the default ro\,v? c) Which ro\,'S in Figure 8-11 match 128.171.17.13? (Don' t forget the default row.) Show your calculations for ro\,'S that n,atch. d) Which of these is the best-match ro\,•? Justify your ans\-ver. e) What ro\,vs match 172.40.17.6? Show your calculations for rows that n,atch. f) Which of these is the best-match row? Justify your answer. g) Which rows n,atch 172.30.12.47? Sho\,, your calculations for ro\, 'S that n,atch. h) Which of these is the best-match row? Justify your answer. i) How would your previous ans\-ver change if the metric had been reliability?
Ste p 3: Sending the Pa cket Back Out
In Step 1, the router found all ro\,'S that matched the destina tion IPv4 ad dress of the arriving packet. In Step 2, it found the best-ma tch ro½'. F inally, in Step 3, the router sends the packet back out.
Interface Recall that rou ter ports are called in terfaces. Th e fifth colun,n in Figure 8-11 is the interface n u mber. If a rou ter selects a row as th e best m atch, the rou ter sends the packet out the interface designated in th at row. If Row 1 is selected, the router wi ll send the packet ou t Interface 2.
N ext-Hop Ro u ter In a switch, a port connects directly to another switch or to a con, puter. Ho\,•ever, a router interface connects to an entire subnet or network. There- fore, it is not enough to select a n interface to send the packet out. It is also necessary to specify a particular device on the subnet.
In n,ost cases, the router will send the packet o n to another router, called the next- hop router. The next-hop router column specifi es the router tha t should receive th e packet. It will then be up to that next-hop router to decid e \,•hat to do next. In Figure 8-11, the next-hop router value in Row 1 is G.4 The d efault row's next-hop-router is H . This router is called the default router, and an y packet no t n, a tching a specific row other than the default row will be sent to Router H .
In som e cases, ho\,•ever, the destina tion host itself \,•ill be on th e subnet out a particular interface. In tha t case, there is no reason to send the packet on to a nother
4 In an actual route r, this column would have the JPv4 address of Router H, rather than its name. However, we include the Jetter designation rather than the 1Pv4 address for case of w,dcrstanding.
Chapter 8 • TCP /IP Internetworking I 271
router. Ins tead, the router will send the packet directly to the d estina tio n host. To indicate that the next d estination is the destina tion host, the Next-Hop Rou ter column will say local.
Test Your Understanding
11. a) D istinguish beh,veen Step 2 and Step 3 in routing. b) What are router ports called? c) If the router selects Row 13 as the best-match ro\,•, w hat interface w ill the router send the packet out? d ) To \,•hat device? e) Why is this router called the default router? (The a nswer is not in the text.) f) If the router selects Ro\,v 2 as the best-match ro\,, for packet 172.30.33.6, what interface will the router send the packet out? g) To w hat d evice? (Don' t say, "the loca l device.")
Cheating (Decision Caching)
We have discussed \,•hat happens \,•hen a packet arrives at a router. However, what w ill the router d o if the next packet has the san1e destination IPv4 address? The ans\,•er is that the router should go through the entire process again. Even if a thousand packets arrive tha t are going to the same destination IPv4 ad dress, the router should go th rough the entire th ree-step process for each of them.
As you might expect, a router might cheat or, as it is euphemistically nan1ed, cache (remen1ber) the decision it m ade for a destina tion IPv4 add ress. It will then use this decis ion for successive IPv4 packets going to the sam e destination. Using a decision cache greatly reduces the work tha t a router \,•ill do for each successive packet to the san1e destination add ress (Figure 8-13).
Decis ion caching is not in the Internet Protocol. This is because it is not entirely safe. The Internet c hanges constantly as rou ters come and go and as links between rou ters change. Conseq uently, a cached decis ion that is used for too long \,•ill resu lt in non-optimal rou ting or even rou tes that \,•ill not work an d tha t \,•ill effectively send packets into a b lack hole.
Test Your Understanding
U. a) What should a router do if it receives several packets going to the same d esti- nation IPv4 address? b) Ho\,, would decision caching speed the routing d ecision for packets after the first o ne? c) Why is decision caching dangerous?
Standard Routing Decision Caching
If another packet arrives w ith the same If another packet arrives with the same destination IP address, destination IP address,
Go through the entire process again. Do what was done the last time.
Go through every row looking for matches.
Find t he best match row.
Send the packet out the indicated interface.
FIGURE 8- 13 Standard Ro uting versus Decision Caching
272 Chapter 8 • TCP /IP Intemehvor king I
Ro ut ing Tables for 1Pv6 Addresses
Rou ting tables for IPv6 addresses have the san1e colunms tha t routing tables fo r IPv4 addresses have. However, the destination address in an arriving packet is a 128-bit IPv6 ad dress, th e n1ask is 128 bits long, and the destination network a nd subnet add ress value is 128 bits long. Ho\,•ever, we have not looked at part lengths in hierarch ical IPv6 addresses, so we cannot d iscuss rou ting tables for IPv6 ad dresses yet.
IN MORE DEPTH
Masking When Masks Do Not Break at 8-Bit Boundaries
All the masks we have seen up to this point have had their parts broken at 8-bit segment boundar- ies. For example, at the University of Hawai'i, the network part is 16 bits long, which corresponds to two segments (128.171), the subnet part is 8 bits long (17), and the host part is 8 bits long (13). All the masks in Figure 8 -1 1 also break at 8-bit segment boundaries.
Masks that break at 8-bit boundaries are easy for humans to read. In general, you can look at a mask in the table and decide if it matches a particular 1Pv4 address. For instance, if the mask is 255.255.0.0 (116), and if the destination column value is 128.171 .0.0, this definitely matches the 1Pv4 address 128.171.45.230.
However, masks do not always break at 8-bit boundaries. For example, suppose that a row in the routing table has the destination address 3.143.12.12 and the mask is 255.248.0.0. Will the 1Pv4 address 3.143.12.12 match this row? At first glance, this certainly does not seem to be a match. How- ever, it is. While it would be nice to always break 1Pv4 address parts into 8-bit boundaries, companies have no control over the size of their network parts, and these usually vary from 8 bits to 22 bits.
To see why the 1Pv4 address and dest ination match in this example, look at Figure 8-14. This figure shows the matching analysis when the binary representations are given for each segment. Follow the masking and you w ill see that the result is a match. When a mask does not break at an 8-bit boundary, you must go back to the raw 32-bit 1Pv4 address, mask, and destination.
Test Your Understanding
13. An arriving packet has the destination 1Pv4 address 128.171.1 80.1 3. Row 86 has t he destination value 128. 171.160.0 . The row's mask is 255.255 .224.0 . Does this row match the destination 1Pv4 address? Show your work. You can use the Windows Cal- culator if you have a W indows PC . In W indows Vista and earlier versions of W indows, choose scientific when you open the calculator. In the W i ndows 7 and W i ndows 10 calculator, choose programmer mode.
' Dotted Decimal Notati on Segment 1 Segment 2 Segm ent 3 Segment 4
1Pv4 address 3.1 43. 12. 12 000000 11 1000 1111 00001 100 0000 1100
Mask 255.248.0.0 1111111 1 1111 1000 00000000 00000000
Result 3.1 36.0.0 0000001 1 10001000 00000000 00000000
Destination 3.1 36.0.0 0000001 1 10001000 00000000 00000000
Result and Yes Yes Yes Yes Yes Destination Match?
FIGURE 8-14 Using a M ask Whose ls Do Not Break Dow n at an 8·8it Boundary
Chapter 8 • TCP /IP Internetworking I 273
THE INTERNET PROTOCOL VERSION 4 (1Pv4) FIELDS
We have focused on IP routing. However, the Internet Protocol has other properties that networking professiona ls need to understand.
As noted in Chapter 1, most traffic o n the Internet and priva te internets today is governed by the IP Version 4 s tandard. (There were no versions O through 3.) We looked at the header checksum, the sou rce IPv4 address, and the destination IPv4 address in the first two chapters. Now we \,•ill look at the other fie lds in the IPv4 header.
The First Row
Figure 8-15 shows the IPv4 packet. Its first four bits constitu te the Version Number Field. This fi eld has the value 0100 (binary for 4). This indicates th a t this is an IPv4 packet. The next fi eld gives the header length, and the last field o n the first ro\,• gives the total length of the packet.5
Between the header and total leng th fields, h,•o fi elds govern transmission quality. The Differentiated Services Control Point Field can be used for priority or o ther qual- ity of service purposes. The Explicit Congestion Notification (ECN) Field can be used to reduce the transmission frequency between a pair of hosts to cope with congestion in the transmission system between them.
Test Your Understanding
14. a) What is the n1ain version of the Internet P rotocol in use today? b) Which fi eld can be used to specify quality of service? c) How can the ECN Field be used?
0
Version (4 b its) 1010 (4)
Internet Header Length (4)
Differentiated Services Control ECN Point (6) (2)
Identification (16)
Total Length (16) Length in Octets
Flags Fragment Offset (13) (3)
Time to Live (8) Protocol (8) Contents of the Data Field
Header Checksum (16) If an error is found, receiver discards packet. If it is correct, no acknowledgment
is sent. 1 = ICM P. 6 = TCP 17 = UDP IP does error checking and discarding;
it is not reliable.
Source 1Pv4 Address (32)
Destination 1Pv4 Address (32)
Options if Any (Rare) (variable) Padding
Data Field (variable) TCP Se ment, UDP Data ram, ICMP su eiviso
Differentiated Services Control Point: To request special ~rvk.es. such as priority. ECN is Explicit Congestion Notification. To notify the re<.elver of congestion along the route.
FIGURE 8- 15 IP Version 4 (1Pv4) Packet Syntax
31
5 The header length field gives the length of the header in 32-bit units. The length fi eld gives the total length of the 1Pv4 packet in octets.
274 Chapter 8 • TCP / IP Intemehvorking I
The Second Row
TCP fragn1ents application messages and sends them in individual packets. This has benefits th a t \'l'e sa\,, in Chapters 1 and 2. When IPv4 was crea ted, it was decided to allow routers to further fragment packets. Although this seen1ed like a good idea at the time, it led to many problen1s. Today, operating systems by default tell routers not to fragmen t IPv4 packets. When IPv6 was developed, packet fragn1enta tion was not allo\,•ed at all. The second row has information that the destination host uses to reas- semble fragmented packets. Given the unimportance of IPv4 packet fragn1entation, we will ignore the fie lds in this row. It is about as useful as the hun1an appendix, often a burst appendix at that.
Test Your Understanding
15. a) Distinguish bet\,veen a p plica tion message fragmentatio n a nd packet frag- n1en ta tion. b) Under what circumstances would the iden tification, flags, and fragn1ent offset fie lds be used in IP? c) Why did we not study then1 in detail? d) Does IPv6 allow packet fragmenta tion?
The Third Row
IP Time to Li ve (TTL) Field In the early days of the ARPANET, ¼•hich was the precursor to the Internet, packets that were misaddressed would theoretically circulate endlessly among packet s\,•itches in search of their nonexisten t destinations. To prevent this, IP added an ominous-sounding T ime to Live (TTL) Field that is assigned a value by the sou rce host. Different operating systen1s have different TTL defaults. Most insert the TTL value 128. Each router along the way decren1ents (decreases) the TTL Field by 1 when a packet arrives before going through the routing process. A router decrementing the TTL to O w ill d iscard the packet.
IP Pr otocol Field The Protocol Field reveals the contents of the Data Field. TCP and UDP have protocol va lues 6 and 17, respectively.
If the Protoco l Field valu e is 1, the IPv4 packet carries an Internet Control Message Protocol (ICMP) n1essage in its Data Field. As we \Viii see la ter in the next chap ter, IP is a lean mea n routing n1achine with no tin1e for supervisory n1essages. ICMP is TCP / IP's tool for carrying internet layer superv isory messages. After decapsu lation, t he in terne t layer process must pass t he con te n ts of the packet's Data Field up to a nother process.
The Protocol Field va lue tells the receiver \,•hich process should receive these con- tents. If the Protocol Field's value is 1, then the internet process \,•ill pass the con tents of the Data Field to the ICMP process because these contents are an ICMP n1essage.
Tes t Your Und erstanding
16. a) What does a router do if it receives a packe t wi th a TTL value o f 2? b) Wh a t does the next rou ter d o? c) Wha t does the Protocol Field value tell the desti- nation host? d) Wha t \'l'ill the destina tion internet process do if it sees 17 in the Da ta Field?
Chapter 8 • TCP /IP Internetworking I 275
IP Options
The IPv4 header allows o ptions. There are several possible options, and they m ay con1e in any order. Som e are only read by the destination host. However, a lack of required order means that each router must look at every option to see if it applies. This is time consuming.
Test Your Understanding
17. What problem is caused by the way tha t IPv4 hand les options?
IP VERSION 6 (1Pv6)
Outgrowing 1Pv4
Althoug h IPv4 continues to d ominate the In ternet's traffic, the Internet Assigned Num- bers Authority (IANA) initially did a poor job dis tributing IPv4 addresses. Today, there are no m ore to distribute. Yet new devices like mobile phones are exp loding, and each needs its o\,•n IPv6 address. This is forcing more organizations to use IPv6 addresses. Today, all firrns n1ust support IPv6.
The m ost fundan1ental change in IPv6 is the n1ove from 32-bit ad dresses to 128-bit addresses. Th is does not p roduce n1erely fou r times as many addresses. Each additional bit doubles the nun1be r of ad dresses. So while there are just under 4.3 bi llion (4.3 x 109) IPv4 ad d resses, there are 3.4 x 1038 IPv6 addresses-34 undecillion. To pu t this in perspective, th ere are about seven b illion people in the world today. For each person, there are 5 x 1028 IPv6 add resses. Even \,•ith the Intern et of Things, IPv6 \,•ill "solve" the add ress availability p roblem fo r n1any years to com e.
Test Your Understanding
18. a) Wha t is the n1ain problem with IPv4 that IPv6 \,•as created to solve? b) How does IPv6 solve this problem?
1Pv6
In its 1994 meeting, the IETF d ecided to create a ne\,, versio n of the Internet Protocol. The IETF called this new versio n IP Version 6 (1Pv6).6 Over the next few years, the IPv6 standards fan1ily grew and matured . It \,•as soon ready to be used, and many net- working and computer vendors began to build IPv6 into their products.
Organizations soon foun d tha t using these new equipn1ent capabilities, ho\,•ever, was a great d eal n1ore \,•o rk than simply tu rning them o n. For many years, few organi- zations saw the need to n1ake the expensive upgrade to IPv6 because they had enoug h addresses. In add ition, we \,•ill see in Chap ter 9 ho\,, Network Address Translation (NAT) g reatly extended the use of existing IPv4 addresses in firn1s, a t the cost of son1e
6 The JETF did define an Internet Protocol Version 5, but it was never implemented.
276 Chapter 8 • TCP / IP Intem e hvor king I
30%
25%
20%
15%
10%
5%
1Pv6 Traffic as a Percentage of Total IP Traffic seen by Google
17.33%
O% L __ _Ja:::::::.._ _______________ ---t~ 2012 2015
FIGURE 8 -16 Exp losive Growth in 1Pv6 Traffic
Source: Google.com.
2017
con1p lexity but at the gain of son1e security. IPv6 \,•ould have the m andatory inclusion of IPsec security functiona lity, but IPsec was quickly n1odified to work w ith IPv4 as well. Seeing no hard business case for upg rading, few companies did .
Now that IPv4 addresses are no longer ava ilable, however, nearly all con1panies are rushing to IPv6, and n1ost have a lread y begun to do so. Figure 8-16 sho\,'S th at after years of hovering near zero penetration, IPv6 is growing exp losively. In 2017, IPv6 accounted fo r 17 percen t of all IP tra ffic received by Google. This is no longer a trend tha t can be avoided. However, companies have found that IPv6 imp len1en ta tion is a lo ng and con1plex process. They need employees w ho understand this new p rotocol and other "v6" protocols such as ICMPv6 and DHCPv6. In addition, the tools to n1an - age IPv6 a re still less robust than those used to manage IPv4.
Test Your Understanding
19. What has been holding back the adoption of IPv6?
Writing 1Pv6 Addresses in Canonical Text Notation (RFC 5952)
We \,•rite IPv4 addresses for human consumption in dotted decim al notation-four seg- n1ents of decin1al numbers bern•een O and 255. The segn1ents are separa ted by dots. This gives addresses like 128.171.17.13. Hu mans can ren1ember these addresses, and they are certa inly easier to read and write than thirty-two ls and Os.
For the 128-bit addresses of IPv6, we would also like simpler ways to write them, but anything we do \,•ill still overload hun1an m en1ory. Consequently, when we write IPv6 addresses fo r human consu mption, \,•e do so to make the reading and writing easier. We also want to make the simplified IPv6 address searchable in text docun1ents because they are often presented in such documents.
Chapter 8 • TCP /IP lntemetworking I 277
128-bi t 1Pv6 Address. Hard to write. 001000000000000 10000000000 100111 1111 11 1000 100 11 0000000000000000000000000 00000000000000000000000001 100110 1001 11 111100001111 1100 1000
1. Convert to hexadecimal notation; write QlUQ.00000000000 10000000000100111 1111 letters in lowercase, divide four-symbol 11 1000 100 11 0000000000000000000000000 f ields by colons. 00000000000000000000000001 1001101001
11 1111000011111100 1000 2001 :0027 :fe56:0000:0000:0000:cd3f :OfcO
2. Remove leading Os from each field. 2001 :0027:fe56:Q.ll.Q.O.:Q.ll.Q.O.:Q.ll.Q.O.:cd3f:QfcQ However, there m ust be at least a single 2001: 27:fe 56:0:0:0:cd3f :fcO value left, so change 0000 to 0 . Do not remove t rail ing zeroes (see last f ield in t he right column).
3. Shorten ONE group of m ore than two 200 1 :27:fe56;0·Q·O;cd3f:fca groups of single-zero fields to two colons. 2001 :27:fe56::cd3f:fca
If t here are mult iple groups of more 200 1 :O:O:fe56:0:0:0:cd3f t han two colons, shorten t he longest. 2001 :O:O:fe56::cd3f
If t here is a tie for longest, choose t he 200 1 :O:O:fe56:0:0:cd3f:fca first. 2001 ::fe56:0:0:cd 3f:fca
4. The final address in simplified 1Pv6 2001 :27:fe56::cd3f:fca notation. Shortened but not short.
FIGURE 8-17 Writ ing 1Pv6 Addresses in 1Pv6 Canonical Text Representat i on Followi ng RFC 5952
To write IPv6 addresses in the IPv6 Canonical Text Representation, ,ve must follow a precise set of rules laid out in RFC 5952. Figure 8-17 shows these rules.
A 128-bit IPv6 addn.,ss is sho,vn in the following example. This is obviously dif- ficult to write and to read.
0010000000000001000000000010011111111110010101100000000000000000000000000 0000000000000000000000000011001101001111110000111111000000
Step 1: Convert t o Hexadecimal Notation To simplify the IPv6 addn.,ss, do not use dotted decimal notation as IPv4 does. Rather, 1Pv6 uses hexadecimal notation, which we saw in Chapter 5, in the context of Ethernet EUI-48 addresses.
Each "nibble" of 4 bits is converted into a hex symbol from O through F. A 128-bit IPv6 address, then, would be translated into 32 hex symbols (128 divided by 4).
In another annoying inconsistency in terminology, g roups of IPv4 bits are col- lected into segnients in dotted decimal notation, but groups of bits in IPv6 are called fields. This is an unfortunate use of term inology, because fields within an 1Pv6 are different from fields in the IPv6 header in general.
In Ethernet, we write hex symbols in pairs, separating each pair with a dash. This gives addresses like Al-B2-C3-D4-E5-F6. In IPv6, in contrast, we group hex symbols in tetrad (group of four) fields. An example of a field is Je56.
278 Chapter 8 • TCP /IP lntemetworking I
Note that \Ve write the hex symbols in lowercase \vhen w riting hex symbols in IPv6 addresses. Each symbol is still 4 bits, so fe56 represents 16 bits. A full IPv6 addn.,ss will h ave eight of th~,se fields separated by colons (128 bits divided by 16). The follo\ving is an IPv6 address written in hexadecimal notation.
2001:0027:fe56:0000:0000:0000:cd3f:Ofc0
Step 2 : Remove Leading Zeroes from Segments Th is is still long. Fortu- nately, there are rules to h elp us shorten the \Vriting of IPv6 addresses a little. The first is that in each field any leading Os are dropped. This is easy to understand. If the reader se<.,s: 27:, this must be :0027:. Note that only leading Os are dropped. If trailing Os or Os any\vhere else were d ropped too, the reader could not kno\v if :27: was :0027:, :2700:, or 0270:. Dropping leading Os is also natural because we do that when \Vriting decimal numbers. Here is what the IPv6 add ress looks like after leading Os are d ropped. (Note that the last segment is fcO, not fc.) It is much shorter.
2001:27:fe56:0:0:0:cd3f:fc0
Note that there is an excep tion to the rule about d ropping leading zeroes. If a field consists of all zeroes (0000), shorten this to O instead of \Vriting nothing. There are three such fields in this address.
Step 3: Reducing Multiple Single-Zero Fields If th ere are hvo or more single-zero fields in sequence, such as :0:0:0: in this example, you shorten this to a single pair of colons(::). So if an IPv6 address has th e sequence :0000:0000:0000:, this can be replaced by :: . This further simplifies our IPv6 ad dress to the following:
2001:27:fe56::cd3f:fca
Note that a single field \vith all zeros is not a group of all-zero fi elds. So if you have 2000:0:fa, you d o not shorten this to 2000::fa.
If you have more than one group of single-zero fields, the follo\ving rules apply.
• First, if there is more than one group of single-zero fields, o nly one group of single-zero fields may be shortened to::.
• Second, if there are multiple sequences of all-zero fields, the longest group of all-zero fields should be shortened. This just makes sense. One migh t as well shorten things as much as possible.
• Th ird, if two groups of single-zero fi elds tie for the longest number of all-zero groups, the first of these groups must be shortened.
These rules seem a little daunting, but these rules mean that everyone writes shortened IPv6 addresses th e same \Vay. Again, this is critical so that programs can test \vhether two addn.,sses in \vritten documentation are the same by comparing the text strings that are the simplified IPv6 notation .
Chapter 8 • TCP /IP lntemetworking I 279
Test Your Understanding
20. a) Why are IPv6 addresses simplified? b) Why must simplification rules be followed precisely? c) Are simplified IPv6 addresses written in uppercase or lowercase letters? d) Are simplified IPv6 addresses written with decimal or hexadecimal symbols? e) Hov,. many symbols are there in a field? f) How many bits are there in a field? g) How are fields separated? h) How many fields are there in an IPv6 adcir<.,ss?
21. a) Write the following IPv6 addn.,ss in canonical form using RFC 5952: 2001 :Oed2:056b:00d3:000c:abcd:Obcd:Ofe0. b) Write the following IPv6 address in canonical form using RFC 5952: 2001:0002:0000:0000:0000:abcd:Obcd:OfeO. c) Simplify the following IPv6 address using RFC 5952: 2001:0000:0000:00fe: 0000:0000:0000:cdef. d) Simplify the following IPv6 address using RFC 5952: 2001 :0000:0000:00fe:OOOO:OOOO:ba5a:cdef. e) What is the advantage of simplify- ing IPv6 addresses according to strict ruk,s? f) Which RFC is used to write IPv6 addresses in canonical form?
The 1Pv6 Main Header Figure 8- 18 shows the IPv4 header. Actually, \Ve \Vill call this the 1Pv6 main header because, as we will see, an IPv6 packet can have multiple extension headers before the Data Field. The obvious difference behveen the 1Pv4 and IPv6 headers are that 1Pv4 addresses are 32 bits \vhile 1Pv6 adcir<.,sses are 128 bits.
The second difference is that the IPv6 main header, although longer, is simpler than the IPv4 header, with fewer fields for routers and hosts to consider. This relative simplicity means that routers process longer IPv6 headers faster than they process IPv4 headers. This makes them cheaper for the amount of traffic that they process.
Version (4) Traffic Class (8) Flow Cont rol (20) 0110 Diffserv (6) Marks a packet as part of a specific flow of packets (6 in Binary) Congestion Notification (2) to be handled in a specified way.
Payload (Data Field) Length (16) Next Header (8) Hop Limit (8) Name of next header
Source 1Pv6 Address (128) There can be 2128 possible 1Pv6 addresses.
Destination 1Pv6 Address (128)
Extension Headers (Optional. There may be several.)
Data Field {TCP segment. UDP datagram. etc.) The extension headers plus the data field form the payload !
Traffi< Class Field (8) has two parts: Oiffse,v and Congestion Notification
Oifferentiated Setvices (Oiffsetv) Field describes specific special (differen tiated) setvices requested, such as pri0<ity.
Coogestion Notification notifies the receiver that congestion has been experienced along the route.
FIGURE 8-18 IP Version 6 (1Pv6) Packet Syntax w it h Main Header. Data Field, and Possib ly Extension Headers (Next Headers)
280 Chapter 8 • TCP /IP Intemehvorking I
Version Number Field Both headers begin with a 4-bi t Version Number Field. For IPv4, the fie ld value is 0100 (four). For IPv6, it is 0110 (six).
Traffic Class and Flow Label Fields The firs t row of th e IPv6 header also conta ins an 8-b it Traffic Class fi eld and a 20-bit flo\'I' label fie ld.7 The two fi elds specify how routing \,viii be hand led in terms of priority and other q uality of service matters.
• The Traf fic Class Field has t\,•o subfi elds. The 6-b it D iffe rentiated S ervices (Diffserv) subfield specifies w he ther this pnrtic11/nr packet should be given rou - tine best-effort service, high-p riority low-latency serv ice, or son1e other type of service. The last 2 bits are for congestion notifica tio n.
• The Flo,v Label Field value indica tes that the packet is a men1ber of a partic ular flow. The router has rules that apply to every pncket in the flow.
Payload Length In IPv6, the Payload Le ngth Field g ives the le ng th of the packet payload , \,•hich is everything beyond the 40-octet m ain packet header. The Payload Length F ield is 16 bi ts long, so a payload ca n be u p to 65,536 (216) octets long.
Th e Payload Length Field gives t h e length of the packet payload, which is everything beyond the 40-oct et main packet h ead er. I t includes both extension h eaders an d t h e data field.
Hop Limit Field IPv6 has a H op Limit Field that is like the IPv4 tin1e to live field. Each router along the way decrements this field's va lue by one, a nd if a router decren1ents it to zero, the router discards the packet.8
No Checksum Field? IPv4 has a Header C hecksun1 Field to c heck for packet header errors. When IPv4 \,•as created, there was a concern that if packet headers con- tained errors, they could cause serious problen1s for the Internet. Experience proved this concern to be groundless, so IPv6 has no c hecksum field. Th e computations need ed to check for errors in IPv4 were taxing, even for a 20-octet header. Dropping the checksum field s lashes packet hand ling time on rou ters.
Test Your Understanding
22. a) How do the Version Number Fields in IPv4 and IPv6 differ? b) What is the general purpose of the D iffserv su bfield? c) O f the Flow Label Field? d) In IPv6, how can the receiver tell the length of packet? e) Does the Payload Length Field include the lengths of any exte nsion headers in the packet? f) How is the Hop Limit Field used? g) Does IPv6 have a header checksun1 fi eld? h) What is the consequence of this?
7 [n the original definition of JPv6, these fields were 4 bits and 24 bits, respectively. 8 Intcrnct old timers know that when 1Pv 4 was created, the time to live value was supposed to be meas ured in seconds . However, this proved to be unworkable. The value was then interpreted as the maximum number or hops pcnnittcd by the packet. The hop limit field name in fPv6 rccogni= this.
Chapter 8 • TCP /IP Internetworking I 281
Main Header Next Header Field
0 I - ~
Hop-by-Hop Options -- Next Head er Field Extens ion Header (0)
6 I ~
TCP Segment .-
No Next Header Field Data Field (6)
FIGURE 8- 19 Main Header and Extension Headers in 1Pv6
Extension Headers
The 1Pv4 packet has option fields that allow the sender to add options. Few 1Pv4 packets have options, b ut each route r must check each packet for options, and this can cost sig- nificant time, especially because n1any options are only relevant to the destination host.
Main Header and Extension Header 1Pv6 took a d ifferent approach to options. As Figure 8-19 shows, the main header can be follo\,•ed by multiple extension headers. Each extension header has a well-defined purpose, such as providing inforn1ation fo r secu- rity or mobile operation. Each extension header serves the role that an option does in 1Pv4.
Next Header Field The headers are daisy chained together based on the Next H eader Field. The main header's Next Header Field specifies the first extension header. In F igure 8-19, the value is 0, n1eaning tha t the firs t extension header has hop-by-hop options that every rou ter along the way must conte nd with . This is o ften the o nly exten- sion header that routers need to d eal \,•ith. That extensio n header's Next Header Field has the va lue 6, ind icating tha t this header is follo\ved by the TCP segn1ent.
It is easy to confuse the terms payload and data fi eld. The data field is the content n1essage being delivered. The payload is everything that follows the main header. So the payload consists of bo th extension head ers and the data fi eld.
Figure 8-20 shows a few of the extension headers that have been d efined for the Next Header Field, as well as their code values (in parentheses). The full list is much longer.
Next Header Code (Value)
Supervisory Header
Hop-by-Hop Options (0) Destination Options (60) Mobility Header (135) Encapsulating Security Payload Header (SO)
FIGURE 8-20 1Pv6 Next Header Values
Upper Layer Messages Header
TCP (6) UDP (17) ICM P (1) ICMPv6 (58)
282 Chapter 8 • TCP /IP Intem e hvor king I
Test Your Understanding 23. a) Why is handling options the \,•ay that IPv4 d oes undesirable? b) Why is the
approach of using op tional extension headers desirable? c) Wha t is often the only extension header tha t routers n1ust consider? d ) How d oes the last exten- sion header before a UDP da tagram indicate tha t the UDP da tagram comes next? e) If you see O in the Next Header Field of a header, what w ill follow this header? f) Why are the tem1s paylond and data field not synonymous?
TH E TRANSMISSION CONTROL PROTOCOL (TCP)
Fie lds in TCP/IP Segm ents
In Chapter 2, \Ve looked briefl y at the syntax of TCP segments. In this section, \,•e look at the syntax of TCP segments in more depth. When IP \Vas designed, it \-Vas m ade to be a very sin1ple "best effort" protocol (although its ro uting tables are complex). Th e IETF left more complex internetwork transmission control tasks to TCP. Consequently, network professionals need to understand TCP very \,•ell. Figure 8-21 shows the syntax of TCP segments.
Sequence Numbers TCP can handle application n1essages o f almost any length . In Chap ter 2, we saw that TCP does this by fragn1enting long n1essages into n1an y pieces and sending each segn1ent in its o\,'11 TCP segment. For the receiver to put the p ieces of the application n1essages back in order, each TCP segmen t has a S equence Number Field that gives its position in the stream of segn1ents. The receiving TCP p ro- cess puts the segments in order of increasing seq uence number and reassembles th e ap plication m essage. The TCP process then passes the application n1essage up to the correct application process indicated in the port number.9
Acknowledgment N umbers In Chapter 2, we saw tha t TCP uses ackno,vl- edg ments (AC Ks) to acrueve reliability. If a transport p rocess receives a TCP segmen t
0 31
Source Port Number ( 16) Destination Port Number (1 6)
Sequence Number (32)
Acknowledgment Number (32)
Hdr. Len . Reserved Flag Fields (9) Window Size (16) (4) (3)
TCP Checksum (16) Urgent Pointer (16)
Options (If Any) I Padding if Short Option Data Field
FIGURE 8-21 Fie lds in a TCP Seg m e nt
9 Online Module A has a detailed discussion of TCP sequence and acknowledgment numbers.
Chapter 8 • TCP /IP Internetworking I 283
correctly, it sends back a TCP segment acknowledging the reception. If the sending transport process does not receive an ackno\vledgment, it transn1its the TCP segment again.
The Ackno,vledgment N umb e r Fi eld indicates which segn1en t is bei ng acknowledged. One n1ight expect th at if a segn1ent has sequence nun1ber X, then the acknowledgn1en t number in the segment that acknowledges it wou ld a lso be X. O nline Module A shows that the situation is more complex, bu t the ackn owl- edgn1ent number is at leas t related to the sequence n u mber of th e segmen t being acknowledged.
Flag Fields As discussed in Chapter 2, TCP has nine single-bit fi elds. Single-bit fields are called fla g fields. If they have the value 1, they are said to be set. AO means that a fl ag fi eld is not set. We sa\,, several uses of these flag bits in Chapter 2.
• If the ACK bit is set, then the segment acknowledges another segn1ent. If the ACK bit is set, the acknowledgment field must be filled in to inrucate which message is being ackno\vledged.
• If the SYN (synchronization) bi t is set, then the segment requests a connection open mg.
• If the FIN (finish) b it is set, th e n the segn1ent requests a norn1a l connection closing.
Opt ion s Fi elds It is con1mon for TCP segments to have option fields. Unfortu- nately, this feature \,•as not well thought out in the orig inal design, so there is no s imple way to talk about TCP options.
Test Your Unders tanding
24. a) Ho\,v long are sequence and acknowledgment numbers? b) How many flag fi elds d o TCP head ers have? c) If the ACK bit is set, what other field n1ust have a value?
Openings and Abrupt TCP Closes
In Chapter 2, we saw tha t TCP is a connection-orien ted protocol. Connection-oriented protocols have formal openings and closings. Figure 8-22 recaps normal closes and introduces a second type of close, th e reset.
In Chapter 2, \'l'e looked at normal closings. Just as you do not simply hang up on a telep hone call when you ¼'ant to fin ish talking, if you are polite, a nor- n1al TCP close consis ts of two FIN segments, o ne in each direction, plus their ackn o\,•ledgmen ts.
However, F igure 8-22 shows that TCP also pem1i ts a nother type of close. This is an abrupt close. Whenever eith er s ide wishes to end a conversation, it can s imply send a T C P rese t seg ment. This is a segment \,•ith th e RST (reset) flag bit set. A reset n1ay occur if a problen1 is encountered during a connection, for securjty reasons, or for severa l o ther reasons.
284 Chapter 8 • TCP / IP Intemehvorking I
Normal Four-Step
Close
Abrupt Reset
AST
FIN
ACK
Data
ACK
FIN
ACK
Reset (AST) is an abrup t c lose. There is no acknowledgment because the RST's sender is no longer listening. Usually prompted by communication problems or security concerns.
FIGURE 8-22 TCP Session Openings and Closings
..
Note in Figure 8-22 that an RST segment is not acknowledged. The side that sent the RST segn1ent is not listening any longer, so acknov.• !edging a reset \,•ould be as point- less as saying goodbye after son1eone has hung up on you. The RST segn1ent is one of two segment types that are not acknowledged. As noted in Chapter 2, a segn1ent that is nothing more than an acknowledgment (a pure ackno\,•ledgment) is not ackno\,•ledged because doing so \'l'ould create an endless loop of ackno\,•ledgn1ents.
Test Your Und ers ta ndin g
25. a) What is a FIN segment? b) D istinguish between fou r-way closes and abrupt resets. c) Wh y is a reset segment not acknowledged? d) What o ther type of segment is not ackn owledged?
THE LIMITED MAXIMUM LENGTH OF USER DATAGRAM PROTOCOL (UDP) DATAGRAMS
We sa\,, UDP in Chapter 2. This is a very sin1ple protocol, so the discussion in that rnapter is sufficient except for one point. This is the fact that UDP, unlike TCP, cannot do segmen- tation. The entire application n1essage n1ust fit into a single UDP datagram. Figure 8--23 shows that the Length Field in the UDP header is 16 bits long, so the n1axin1um length of the UDP data field (and therefore the maxin1um length of an application n1essage) is 65,536 octets. On the plus side, there is no need for sequence numbers, opening, closings, acknowledgments, or other things that require a longer header.
UDP cannot do segmentation, so an application message must fit into a single UDP datagram.
Chapter 8 • TCP /IP Internetworking I 285
0 31
Source Port Number Field (16) Dest ination Port Number Field (16)
UDP Length (in Octets) (1 6) UDP Checksum (Error Discarding but No Correction) (16)
Data Field (Variable Length: 2 16 bits give a maximum of 65,536 Octets)
The UDP length ft.eld gives the numbEH of octets ln the data fteld.
UOP'S length field is 16 bits.
It can fe,pre~nt 21' possible values-65.S36.
So the maximum length of the data field rS 65,536 octets.
The(e are no sequence numbers, so looge, application message-s cannot be segmented and sent ove, ~ral UDP datagrams. So UDP cannot send application messages longer than 65,536 octets.
FIGURE 8-23 UDP Datagram Field s
Test Your Understanding
26. a) Why can TCP handle long application n1essages? b) Why can UDP not han- dle long application messages? c) What is the maximun1 application n1essage size when UDP is used a t the transport layer?
END-OF-CHAPTER QUESTIONS
Thought Questions
8-1. a) How d oes the p ostal sen •ice u se hierarchical sorting? b) How does this s implify delivery decisio ns?
8-2. Gi\•e a no n-nehvork examp le of hierar- chical addressing, and discuss how it reduces the amo unt of wor k needed in physical delivery. Do no t use the postal service, or the telephone network.
8-3. A clie nt PC has two simu ltaneou s connections to the sa me webserver application p rogram on a webserver. (Yes, this is possib le, and in fac t, it is ra ther commo n.) What will be d iffer- ent behveen the TCP segments that the
Perspective Questions
8-5. What was the most s urpr isi ng thing you lea med in this chapter?
clien t sends o n the t wo connections? (Hint: Consider a ll the fie lds in a TCP segm ent.)
8-4. A ro uter that has the ro uting table in Figure 8-11 receives an incoming TPv4 packet. The source TPv4 address in the arriving packet is 10.55.72.234. The des- tinati o n !Pv4 address is 10.4.6.7. The TTL value is 1. The P rotocol Field value is 6. v\7hat will the ro uter do with this packet? (Hint: Carefully consider a ll the fields in the JP and TCP headers. Think like a router.)
8-6. What was the most difficult material for you in this chapter?
Chapter Sa
Hands-On: Wireshark Packet Capture
LEARNING OBJECTIVES
By the end of this chapter, you should be able to:
• Use the Wireshark packet capture progran1 at a novice level.
• Capture packets in real time.
• Analyze the packets at a novice level.
INTRODUCTION
A good way to practice what you have learned in this chapter is to look at individua l packets. Packet capture programs record packets going into and out of your con1puter. If you capture a brief v.•ebserver interaction, you can look at header fields, TCP three- step connection starts, and other information. There are several good packet capture progran1s. We look at Wireshark, which is sin1ple to use, popular, and free to download. (At least at the tin1e of this \,•riting.)
GETTING WIRESHARK
To get Wireshark, go to wireshark.org. Do not go to \,•ireshark.con1. Follow the instructions and download the program on your computer.
USING WIRESHARK
Getting Started
After installation, open the Wireshark program. You w ill see the opening screen. It \,•ill look like the screen in Figure 8a-1. There \,•ill be controls at the top with a blank area belo\,• them. You w ill soon fill this area \,•ith your packet capture.
286
Chapter Sa • Hands-On: Wireshark Packet Capture 287
~ The Wireshark Network Anatyzer
file fdit ~ew .Go Capture Analyze Statis.tics Hetp
~ Iii fill QC ill ~ @ X 21 S. -, .;, • 4) ;J' ~ l~(GII ©. €l €1. ~ I li lYJ "' S.. Ill filter: • fxpressiorL ~!ear Apply
,_ ______________ ..., ao2.1 · Chanr'---- .. Channel otC · FCS Filter._ __ .,_ Decryption Mode: (No'n;:) •
.,... ...,,,..s,, .. ,__,........___,,;.--.,~r-·,-.. . .,JII tl*'~---~_,,,_,.. ,, #••• FIG URE Ba-1 Init ia l Wireshark Screen
Starting a Packet Capture
To start a packet capture, click on the Go menu iten1. Then, \,•hen the Wireshark: Capture Interfaces d ialog box appears, as Figure 8a-2 illustrates, select a network interface and click on Start.
Getting Data
Your browser should already be open. Switch to your browser and enter a URL. (In this examp le, the author \,•ent to Wik iped ia.org.) This creates a flurry of packets between
• ~pres.slon. .. Clear &,ply
802.11 Ctlan~ J,,,,,,,,=""""'-
I FCS fitter. 1 ~ • Oeayption Mode. None J,,,,,,,,=""- -'=="--=
II W/reshart: Capt1.11e lnterl&CtS Descriptioo
9 MS Tl#lnel Jntetf~e Driver
IP
"''·"""' • NVlOlA nlorce MCP Networkfng Adapte, Offvef 192.168.1.100
.l:lelp
l 1
iatety start a capture from this interf
Oevke: \Oevice\NPF,. (428844E4-S8n-489F..S98F-109f-0291398E) Description: NVIDIA nforce MCP Networla ....... ·~ .• -·I .• -~· -.... ,,-.~.......r----41--IP~··-r-
FIGURE Ba- 2 Starting a Packet Capture in Wires ha rk
288 Chapter 8a • Hands -On: Wireshark Packet Capture
(IJI (Vnll'ded) • Wiresh1ut fite f dlt ~ ew S,io ppture &,r\atyie Statistics ljelp
filter: fxpressiOI\._ Clear &:,ply
801.11 ("h~nr • cn,mnd onO . FCS filter: Decryption Mode: None No.. Time Source oeuination ProtocOI
1 0. 000000 AsustekC_eb:Ol:d9 Broadcast ARP 2 0.000388 00:23:69:f7:3e:b3 Asustekc_eb:Ol:d9 ARP 3 0. 000412 192 .168.1.100 192 . 168 .1.1 ONS
• I Wi1el~~ Setrng~.
11\IO llllo has 192.168.1 192.168.1.1 ;sat Standard query A
4 0. 022679 192.168.1.1 t--a1J11P.fli¥E iPl.WliJ!9WUl•J 6 0 . 174387 208.80. 152.2 7 0. 174555 192 .168.1.100 8 0.175301 192.168.1.100 9 0. 325322 208.80.152.2
10 0. 325655 208.80.152.2 11 o. 326454 208.80.152.2 12 0. 327065 192.168.1.100
192 . 168.1.100 ; .;:9:pa•1•1- 192 . 168.1.100 208 . 80 . 152 . 2 208 . 80.152.Z 192 . 168 . 1.100 192 . 168 . l.100 192.168.1.100 208.80.152.2
DNS re:
TCP TCP ITTTP TCP TCP TCP TCP
!!ll•lll!S~t~.i~nE]da1rl!,d query rei JWDl'ffllJIIQ'BI http> 51763 [S'I)\ 51763 >http[~ GET/ HTTP/1.l http> 51763 [ACK [TCP segment of~ [TCP seg,oent of~ 51763 >http[~. ,..,,.n ------ ... ,& .,; 'I.::> A --..1 7~n-t--. no on .,~ 1n~ 'l~CI 'I ,nn Tro
' Ill ' o Frame S (66 byres on w1rll:, 66 byt~ captured) Iii Ethernet II, Src: Asustekc_eb :Ol:d9 (OO:la:92 : eb :01:d9J, Dst: 00 : 23:69: 7:3e:b3 (00 : 23: [a Internet Protocol, src : 192 . 168. 1.100 (192 , 168 ,1.100), Ost: 208.80.152.2 (208.80, 152.2)
version: 4 Header length: 20 bytes
oo Oifferentiated Services Fiel d: OxOO (OSCP OxOO : Default ; ECN: OxOO) Tot.il Length : S2 Ident;f;cat;on: Ox0026 (38)
m Flags: Ox04 (Don't Fragment)
•
Fragment offset: 0 E Tille to live: 128 Protocol : TCP (Ox06)
w Header checksum: Oxd03e [correct) source: 192. 168 . 1.100 (192. 168. 1 .100) Destination: 208.80.152.2 (208.80.152.2)
le Transmission control Protocol, src Port: 51763 (51763), Ost Port: http (80), seq: 0 1 Le source port: 51763 (51763) Destination port : http (80) Sequence number: 0 ( r e l ative sequence nu mber ) Header length: 32 bytes
w Flags : Ox02 (SYfl) • <
0000 0010 0020 0030 0040
"' e a e 1
oo 34 oo 26 40 oo so 06 do 3e co as 01 64 dO 5(1 98 02 ca 33 00 50 dO f4 e2 11 00 00 00 00 80 02 lO 00 a 7 ?c 00 00 07 04 05 h4 01 Ol OJ 07 01 01 04 0/
frame ( frame>. 66 t>ytes
FIGURE Sa- 3 Collecti ng Data
• .Hl. > •.••.•••. E. .4.&0 .... > ••• (LP ... 3 . p. . . .. .. . . . . . ' . . . . . .
1 Pro11te: Default
you and the host specified in the URL. These appear on the window below the controls, as shown in Figure 8a·3.
Stopping Data Collection
To stop the data collection, click on the Capture menu iten1, as Figure 8a-4 shows. When the dropdo\,•n menu appears, select Stop. You now have a packet stream to analyze.
filter.
802.11 Chan
No . .
FIGURE Ba-4 Stopping t he Da ta Collectio n
Looking at Individual Packets
Chapter Sa • Hands-On: Wireshark Packet Capture 289
ter Driver: Capturing • Wires
Statis1ics .!::!elp ---=
Ctrl+K
Filter.
Now you can begin looking at individual packets. To see ho\,, to d o this, look again at Figure 8a-3.
Packet Summary Window In the upper window in the d isplay area, you can see the packets o ne at a tin1e. The capture begins \,•ith two ARP packets, which iden tify the d ata link layer address of the host w ith IP address 192.168.1.1.
Th en con1es two DNS packets. In the exam p le, the a u th or typed the host nan1e Wikipedia.org in the URL. The au thor 's com pu ter (192.168.1.100) sen t a DNS req uest n1essage to its DNS server to get the IP ad dress for Wikiped ia.org. Th e DNS sen t back the requested IP add ress.
Now, the author's compu ter o p e ned a connection to 208.80.152.2, which is Wireshark.org's IP add ress. 1 It fi rst sent a TCP SYN segn1ent to 208.80.152.2. This is Frame 5. In F igure 8a-3, th e frame has been selected .
In form a tion abou t the contents of this particular frame is sho\,•n in a window belo\,, the \,•indo\,, showing each fra me o n a single line. First, the windo\,, shows infor- n1ation on the Ethernet header and trailer. Next comes information abo ut the IP packet, follo\,•ed by inforn1ation about the TCP SYN segn1ent contained in the packet.
Window with Detailed Information on the Selected Packet The Ethernet informa tion has been n1inin1ized. O nly the source and destination MAC addresses are shown. However, inforn1ation about the IP packet has been maximized. You can see the va lues of the individual fields in the selected packet. For exam ple, note that the Ttme to Live Field in this packet has the value 128. In addition, the protocol fie ld va lue indica tes that the d a ta fie ld contains a TCP segn1ent.
1 JI yo u try this, you may get a different IP address. Many firms have multiple physical wcbscrvers that they associate with a host name. A DNS response message returns the CP address of one of these physical servers.
290 Chapter 8a • Hands-On: Wireshark Packet Captu re
The TCP segn1ent informa tio n also is expanded, although only th e firs t fe\,v fields are sho\,'11 in the window. Note that the destina tion port is 80, indicating that the author was contacting the Wireshark.org webserver. Note also that the Flag Fields information says that the SYN bit is set, as one would expect.
To make life easier for you, Wireshark does as much translation as possible. For example, it interprets the informatio n in the protocol field as indicating that there is a TCP segn1ent in the packet's data field. It also ind icates that Port 80 is HTTP.
The informa tion on seq uence number is highly sin1plified compared to the d is- cussion in Chapter 2. This is the first TCP segment being sen t. It is g iven the va lue 0 rather than its complex rea l value.
Hex W indow The lowest window shows the con tents of the packet in hexa- decin1al (Base 16) forn1at. Hex is difficult for new ana lysts to interpret, but it is very con1pact compared to the information in the n1idd le \Vindo\,•. Experienced packet ana- lysts quickly learn the positions of important fields and learn to read the hex symbols for that fie ld.
Options
Figure 8a-5 s hows tha t Wireshark capture op tions allow you to con trol what packets are captured. If you are connected to multiple external servers simultaneously, this can allow you to capture only packets for a partic ular connection.
II WireSharle Qipture Os>ttons i.;: :-~ Capture
lnlerfate: NVIDIA nforce MCP Netwo,king Adapter Oriyer: \ Device\NPF ..f428844E4-5877-489f-89BF-109f0291398E) 8 IP add,e,s 192.168.1.100
Link•layc-r hc<Klef type: [ Ethernet Fl Buffer size: l ~ megabyte{$) Wireless Settings Ill Capture packets in e-omisruous mode - . I . _,, 1, ..... m,,r.l L El
.,., Display Options
file laro..,._I Gll UPdate list of packets in ,eat time 0 Use multiple files l-' NelC'I 111e every 1, } 1 me9abyte(s) - PJ Automatic scrolling in live capture ( Next 111e every
,, JI m nvte(s) . QI t!.ide c.apue info dialog - IL Ring buffer "1th
1: t'"" L Stop capture after f Name Resolution :: file( s) rStop Capture, .. 0 Enable MAC name resolution
C) _, after [1 ) p&<:ket(S) D Enable network name resolution D -. .after [1 ~ megab,ie(s) • CJ _. after [1 ~ m1NJte{$) .. ~ [Ill Enable transport name resolution
Help I I Start I [ Cancel I FIGURE Sa-5 Wireshark Options
HANDS-ON EXERCISES
1. Do the fo llowing:
• Download Wireshark. • Start Wireshark. • Tum on Wireshark captu re. • Type a URL in your browser
w indow (not Wikipedia.org). • After a few seconds, stop the capture. • Answer the fo llowing questions:
la. What URL did you use? What was the rP address of the web- server?
lb. Find the frame in which your PC sent the SYN packet. List the source and destination IP ad- dress, the source and destina tion por t numbers, and the header checksum .
Chapter Sa • Hands-On: Wireshark Packet Capture 291
le. Select the SYN/ ACK packet. List the source and destination rP ad- dress, the source and destination port numbers, and the header checksum.
Id. Select the packet that acknowl- edges the SYN/ ACK segment. List the source and destination IP address, the source and des- tination port numbers, and the header checksum.
2. Change the options so that only packets you send are recor ded. Do a capture. Click on the window containing Wire- shar k and hit Alt-Enter. This captu res the w indow to your cli pboard. Pas te it into your homework.
This page intentionally left blank
Chapter 9
TCP /IP Intemetworking II
LEARNING OBJECTIVES
By the end of this chapter, you shoul d be able to: • Explain IPv4 subnet p lanning and do the calculations needed for working \Vi th
subnet and host parts and deciding on part lengths.
• Do the same for IPv6.
• Explain the purposes of Network Address Translation (NAT) and how NAT operates. • Explain in more detail than you learned in Chapter 1 how the Domain Name
System (DNS) and the Dynamic Host Configuration Protocol (DHCP) operate.
• Describe the object model in the Simple Network Management Protocol (SNMP) and describe the enabling value of good security in the use of Set commands.
• Describe ho\v the DNS was modified to deal with IPv6 addresses for host names.
• Describe ho\v dyn amic routing protocols work and ho\v to select among alternative dynamic routing protocols .
• Describe the Internet Control Message Protocol (ICMP). • Explain central concepts in IPsec (IP security), including its strategic importance,
transport versus tunnel mode operation, ESP versus AH protection, security associations, important cryptographic methods and options, session initiation with IKE, and how IPsec compares to SSL.
INTRODUCTION
Chapter 8 coven.>d core TCP /IP concepts. No\v we focus on management and security. Although switched networks are (generally) capable of operating for long periods \Vith- out intervention by network managers, TCP /IP internets require constant tuning and
293
294 Chapter 9 • TCP /IP Internetworking II
support. Designed to operate a worldwide service, TCP /IP supervisory p rotocols are extensive and complex. In addition, the TCP /IP p rotocols \Vere born \Vithou t security. Adding security retroactively has been difficult, but IPsec promises to add security stra- tegically at the internet, transport, and application layers. IPsec \Vill not solve all security problems, but its abilities are impressive.
IP SUBNETTING
1Pv4 Subnet Planning IPv4 addresses are 32 bits long. We Sa\v in the last chapter that each organization is assigned a networking part. Organizations usually divide the rem aining bits into a sub- net part and a network part. Figure 9-1 shO\VS the network parts assigned for the Uni- versity of Hawai 'i and a hypothetical ISP and how each decided to divide the remaining bi ts, over \Vhich they had control, into a subnet part and a host part. The University of Hawai'i divided the remaining bits into 8/8 subnet and host parts. The ISP divided its bits 16/8. However, these \Vere choices. The university could have divided its 16 bits 6/10, and the ISP could have divided its 24 bits 12/12. In this section, \Ve w ill see w hy the organization's choice of how m any bits are assigned to its subnet and host parts is an important decision.
The N = 2b- 2 Rule With b bits, you can represent 2b p ossibilities. Therefore, \vith 8 bits, you can represent 28 (256) possibilities. This \VOuld suggest that the univer- sity can have 256 subnets, each with 256 hosts. However, a nehvork, subnet, or host part cannot be all Os or all ls.1 Therefore, the university can have only 254 (25~2) subnets, each \Vith only 254 hosts. Figure 9-2 illustrates these calculations.
Ba lancing Subnet and Host Part Sizes Selecting the sizes of the subnet and host parts is impor tan t. The larger the subnet part, the m ore subnets there w ill be. However, th e larger the number of subnets there are, the fewer hosts each subnet can have. Finding a golden ratio of the two IP address part sizes requ ires careful thin king.
The University of Ha\vai'i 's choice of 8-bit subnet and host parts was acceptable for many years because no college needed more than 254 hosts. In addition, the subnet
Organization Network Part Subnet Part Host Part Total Bits
Un iversity of Hawai' i Host 128.171 (16 b its) 17 (8 bits) 13 (8 b its) 32
Hypothetical ISP Host 60 (8 bits) 33.22 (16 b its) 5 (8 bits) 32
FIGURE 9-1 Network, Subnet, and Host Part Length in an 1Pv4 Address
1 If you have all ls in an address part, this indicates that broadcasting should be used. All Os parts arc used by computers when they do not know their own addresses., All-zero address parts are only used as the source IP addresses in messages sent from a client to a DHCP server.
Chapter 9 • TCP / IP Jntemehvorking TI 295
Step Description Example
1 Total size of IP address (bits) 32
2 Size of network part assigned to 16 8 firm (bits)
3 Remainin g b its for firm to assign 16 24
4 Selected subnet/host part sizes (b its) 8/8 6/ 10 12/1 2 8/1 6
5 Possible number o f su bn ets (2"-2) 254 62 4,094 254 (28 - 2) (2' -2) (212 -2) c2•- 2i
6 Possible number o f hosts per 254 1,022 4,094 65, 534 su bn et (2•- 2) (28 -2) (2 10 -2) (212 -2) (2" -2)
AGURE 9 -2 1Pv4 Subnetting
n1ask (255.255.255.0) was very simple, breaking at 8-bit boundaries. This n1ade it easy to see \,•hich hosts were o n which subnets. The host at 128.171.17.5, for instance, was o n the 17th subnet. If the subnet mask did not break a t an 8-bit boundary, this would not be possible, as we w ill see later.
Today, ho\,•ever, n1any colleges in the university have n1ore than 254 con1puters, so the limit of 254 hosts has become a problem. Severa l colleges have now been given two subnet numbers. These colleges n1ust connect their h,•o subnets \,•ith a router so hosts on the two subnets can con1municate. This is expens ive and a little a\,•k\,•ard.
The university mig ht have been better served had it selected a smaller subnet part, say 6 b its. As F igure 9-2 shows, this wou ld have a llowed 62 college subnets, which probably wou ld have been sufficient. A 6-bit subnet part would give a 10-bit host part, allo\,•i ng 1,022 hosts per subnet. This ½' ou ld be amp le for several years to come. However, it wou ld no longer be possible to look at an IPv4 address in dotted decin1al notation and see immediately what su bnet it is on.
Test Your Understanding
1. a) If a subnet part is X bits long, ho\,v many subnets can you have? b) If you have a subnet pa rt of 9 bits, ho\,, many subnets can you have? (Answer: 510 su bnets) c) If you have a su bnet part of 6 bits, how m any subnets can you have? d ) If your network part is 16 bits long, ho\,, many hosts can you have per subnet?
2. a) Your firm has an 8-bit neh,•ork part. If you need a t least 250 su bnets, \'l'ha t must your subnet part size be? (Check figure: 8 bits) b) Continuing the last ques- tion part, ho\,v many hosts can you have per subnet? (Check figure: 256 hosts per subnet) c) If your fim1 has an 18-bit neh,vork part and you need at least 16 sub- nets, \,•hat n1ust your subnet part size be? d ) Continuing the last question part, how many hosts can you have per subnet? e) Your fim1 has a 22-bit network part. What subnet part \'l'ould you select to give at least 10 subnets? f) Continuing the last question part, how many hosts can you have per subne t? g) If the University of Hawai'i had chosen a 6-bit su bnet size, how n1any su bnets could it have had? h) How n1any hosts per subnet? i) If the ISP had chosen a 10-bit subnet size, how many subnets could it have had? j) How many hosts per subnet?
296 Chapter 9 • TCP / IP lnternetworking n
Terminology
1Pv6 Part length fo r Global 1Pv4 1Pv6 1Pv4 Part Length Unicast 1Pv6 Address
Network Part Routing Prefix Variable Variable
Subnet Part Subnet ID Variable Variable
Host Part Interface ID Variable 64 bits
Total: 32 bits Total: 128 bits
Routing Prefix and Subnet ID
Subnet ID has a fixed length of 64 bits Total length of routing prefix and subnet ID is 64 bits If the routing prefix is 20 bits, the subnet ID must be 44 bits long
FIGURE 9-3 1Pv6 Subnetting
1Pv6 Subnetting
Subnetting in 1Pv6 is sin1ilar, but terminology a nd som e concep ts are quite different. Figure 9-3 sumn1arizes key changes in h ow IPv4 and 1Pv6 are d ivided into three parts. In m os t cases, this is just a n1atter of terminology. However, there are additional consid- erations in su b netting.2
The Three Parts Figure 9-3 sho\,•s the 1Pv6 counterpart of the 1Pv4 network part, subnet part, and host part. It uses sin1ilar concepts.
• The counterpart of the network part is the routing prefix. The rou ting prefix lets routers on th e Internet route packets to an organization. It is a prefix b ecause it is the firs t p art.
• The equiva lent of the 1Pv4 su bnet part is the subnet ID. The s u b net ID lets routers within a firm deliver packets to the correct subnets within the fim1.
• The eqttivalent of the IPv4 host part is the interface ID. The interface ID identifies an individual h ost in th e firm.3
The Fixed -Len gth 64-Bit Int erf ace ID In 1Pv4, the size of the host part var- ies. In con trast, the size o f the interface ID in g loba l unicast 1Pv6 add resses is fixed at 64 bits. It n1ay seen1 wastefu l to " use up" half of all bits in the 1Pv6 addresses to des- ignate a h ost. Ho\,•ever, w ith 64 bits left for the routing prefix and the subn et ID, there are s till 1.8 X 1019 poss ibilities for the routing prefi x and s ubnet ID.
Th e size of t he interface I D in global unicast /Pv6 addr esses is f ixed at 64 bits.
2 Technically speaking, this section refers to 1Pv6 global unicast addresses, which arc addresses for a packet going from one host to another across the global 1Jl.tcrnct. There are other types t?f addresses, s uch as multicast addresses, which arc sent from one host to multiple destination hosts. Nearly aU 1Pv6 addresses on the internet, however, arc global un.icast addresses. 3 A host can have multiple interfaces to the Internet. This is not common for clients and servers. It is a lmost always the case for routers. Each router in terface connects to a d ifferent network or subnet.
Chapter 9 • TCP /IP lnternet working n 297
Routing Prefix and Subnet ID Figu re 9-3 indica tes that the rou ting prefix and s ubnet ID are variable in length, a lthough their tota l mus t be 64 bits because the interface ID has a lready consu,ned 64 of the 128 bits. For example, if the routin g prefix is 20 bits, the s ubnet ID n1ust be 44 bits (64 bits- 20 bi ts). If a n address registrar gives a firn1 a s hort ro uting prefix, then the con1pany can have a large subnet ID a nd can therefore have many subnets. Smalle r firms, need ing fewer subnets, are given longer routing prefixes.
Creating the 64-Bit Interface ID Return ing to the 64-bit interface ID, it would be nice to be able to use a host's data link layer address as the interface ID. Ho"'ever, the mos t common type of data link layer address, the EUl-48 address, is only 48 bits long. For 1Pv6, the IEEE 802 Comn1ittee has defined a "'ay to create a 64-bit n1odified extended unique identifier (EUI-64) based on the 48-bit EUJ-48 address. This modified EUl-64 address fits the interface ID part.
Crea ting a modified EUJ-64 address with 16 more bits fron1 a EUl-48 address requires a series of steps, ,vh ich Figure 9-4 illustrates. These steps are straightforward, and there are good technical reasons for each step. However, these technical reasons are complex and irrelevant to information systems professionals.4
• First, express the EUl-48 address in hexadecima l notation, remove the dashes, and change all letters to lo,ve rcase. So A0-B1-C2-D3-E4-F5 squashes do"'n to a Ob 1 c2d3e4f5.
• Second, d iv ide the 48 bits in ha lf. Each ha lf has 24 bits. In this case, the fi rst half is a0b1c2 and the second half is d3e4f5.
• Third, insert the hex symbol f.ffe bet,veen the t\vo ha lves.5 This raises the 48 bits to 64 bits.
Firs t Half: a0b1c2
EUl-48 Address: AO-B1-C2-D3-E4-F5
+ Converted to lowercase, Dashes Removed:
~ a0b1c2d3e4f5 ~
Insertion in the M iddle:
Second Half: d3e4f5
ffle /
Combined~add colons ,,' Modification: a0b 1:c2ff:fed3:e4f5 ,, aO = 10 100000
.L ........ ......... .... Invert 2nd least-significant brt T ,,
Modified EUl-64 Address a2b 1:c2ff:fed3:e4f5
in the first octet
10100010 = a2
FIGURE 9-4 Converti ng an EUl-48 Address i nto a Modified EUl-64 Address
' 1 Just think of them as arcane mystical protocols for joining an obscure secret society. 5 Scc previous footnote.
298 Chapter 9 • TCP /IP lnternetworking n
• Fourth, \Vrite the first half, the new group, and the second half together. Now regroup them into four fields with four hex syn1bols apiece. Insert colons to separate these fields. The result is n0b1:c2fffed3:e4f5. (Note that a colon sepa- rates the ff and the fe. Use this as a crosscheck to n1ake sure you have done things r ight.)
• Fifth, now we con1e to the modified part of the name. In this final step, the second least-significant bit (the second bit fron1 the right end) in the first octe t is inverted. For instance, the EUI-48 address in our example begins \,•ith aO. These h,•o hex symbols constitute the first octet. In binary, they are 1010 0000.6 This n1ust be changed to 1010 0010 by inverting the second least-significant bit-the bit that is the second from the right. (Inverting a bit n1eans changing it to 1 if it is O and changing it to O if it is 1.) The inversion gives a2 instead of nO. So the final n1odified EUI-64 is a2b1:c2fffed3:e4f5.
Canonical Text Representation and Modified EUl-64 Addresses In Chapter 8, we sa\,, that !Pv6 addresses should be written in canonical text representation to provide a single standard way to reduce the length of \vritten !Pv6 addresses. In this chapter, \Ve saw ho\,, to write the 64-bits interface ID of the !Pv6 address in EUI-64 fom1at.
Some students are ten1pted to go to canonica l text representation immediately to shorten these 64-b it interface IDs as soon as they create them. However, the entire IPv6 address shou ld be \,•ritten without reduction before canonical text represen- tation is used to shorten the address. Shortening the interface ID firs t can result in \,•rong choices being n1ade in reducing consecutive 0000 fie lds to a single "::" abbreviation.
Do not convert the interface ID to canonical representation; only do so to full IPv6 addresses.
Test Your Understanding
3. a) What field in an IPv6 g lobal unicast address corresponds to the neh-vork part of an IPv4 address? b) What field in an IPv6 global unicast address corresponds to the subnet part of an IPv4 address? c) If the subnet ID is 16 bits long, how long is the routing prefix? d) If you are a large company, do you wan t a long routing prefix or a short routing prefix? Exp lain. e) If your routing prefix is 16 bits, how long is your subnet ID? (Ans\-ver: 48 bits) f) If your routing prefix is 32 bits, ho\'I' long is your subnet ID?
4. a) What field in a g lobal unicast IP address corresponds to the host part of an !Pv4 address? b) How long is this field? c) Convert the following EUI-48 address to a modified EUI-64 address: AA-00-00-FF-FF-OO. (Ans\-ver: aeOO:OOff:feff:ffOO) d) Repeat for this EUI-48 address: 98-ES-33-21-FF-0D.
5. Shou ld you use canonica l text representation to reduce the n1odified EUI-64 interface ID by itself, or shou ld you do it only for the entire !Pv6 address?
6 Sec previous footnote.
Chapter 9 • TCP / IP Jntem ehvorking TI 299
OTHER TCP/IP STANDARDS
In this section, \,•e look briefly at severa l o ther in1portant TCP /IP standards that network administrators need to n1aster.
Network Address Translation (NAT)
For security, firms must d ecide whether to allo\,v people outside the corporation to learn their internal IP add resses. Doing so is a secu rity risk. If attackers know interna l IP ad dresses, this allows them to send attack packets fro m the outside world.
To prevent this, companies can use Network Address Translation (NAT), \'l'hich uses external IP ad dresses that a re d ifferent fron1 internal IP addresses used w ithin the firm. If a sniffer learns these addresses, it cannot use this information to send a ttack packets to the interna l IP address of a host.
NAT Puts false source IP addresses and port number in packets going out of the network
Expanding the Number of Available IP Addresses
Companies receive a limited number of IP addresses from their ISPs
There are roughly 4,000 possible ephemeral port numbers for each IP address
So for each IP address, there can be 4,000 external connections
If a firm is given 254 IP addresses, there can be roughly one million external connections (254 X 4,000)
Even i f each internal device averages several simultaneous external connections, there should not be a problem providing as many external IP connections as a firm desires
Security Reason for Using NAT
External attackers can put sniffers outside the corporation
Sniffers can learn IP addresses
Attackers can send attacks to these addresses
With NAT, attackers only learn false external IP addresses
Private IP addresses
Can only be used inside firms
10.x.x.x
192.168.x.x (most popular)
172.16.x.x through 172.31 .x.x
Transparency and Problems
Transparent to the two hosts operating systems; each operates normally without knowing that NAT is used
However, some applications have troubles with NAT
There are work-arounds to these problems, but implementing NAT requires knowledge
FIGURE 9-5 Networ k Address Translation (NAT) (St udy Figur e)
300 Chapter 9 • TCP /IP lnternetworking n
From 192.168.5.7, Port 3333
Client 192.168.5.7 Port 3333
NAT Firewall
To 192.168.5.7, Port 3333
Translation Table
From 60.5.9.8, Port 4444
Internal IPAddr
192.168.5.7 . . .
Port 3333 . . .
AGURE 9 -6 Network Address Translation (NAT) Operation
Internet
- 3
Server Host
To 60.5.9.8, Port 4444
External IPAddr Port 60.5.9.8 4444
. . . . . .
NAT Operation Figure 9-6 shows ho\,• NAT works.
• An interna l client host, 192.168.5.7, sends a packet to an external server host. The clien t operating systen1 randomly gen era tes the source port nun1ber 3333. As we sa\,• in Chapter 2, this is an ephemera l po rt number that th e source client host n1ade up for this connection.
• The source socket in this packet is therefore 192 .168.5.7:3333.
• When the NAT firewall a t the border receives the packet, it makes u p a new row in its transla tion table. It places the internal IP add ress and port nun1ber in the table. It then genera tes a new external source IP address and external source port nun1ber. These are 60.5.9.8 and 4444, respectively.
• Finally, the NAT fire\,•all sends the modified packet to the externa l host.
Packets sent back fron1 the external host have 60.5.9.8 in their destination IP add ress fi elds and 4444 in their destination port number fields. The NAT fire\,•all looks these values up in its translation table, replaces the external va lues w ith the internal values, and sends them o n to the client PC.
NAT and Security Figure 9-6 sho\,•s how NAT brings security. An attacker m ay be able to install a sniffer p rogram beyond the corporation's NAT firewall . This sniffer will be able to read all packets coming out of the fi rm.
With NAT, an eavesd ropper o nly learns false (external) IP addresses and false port nun1bers. If an attacker can attack in1media tely, it can send packets to the external IP add resses and port nun1bers, a nd the NAT fire\,•all will pass them o n to the intern al host. However, it is rarely possible to act imn1edia tely, and NAT rows are only kept active for a fe½' seconds or n1inu tes. NAT provides a surprising amount of security despite its sim ple operation. Security professionals note that this is not very strong securi ty, like encryp tion. Ho\,•ever, it prov ides a substantia l protection unless the attacker mounts a very sophisticated attack.
Expanding the Effective Number of IP Addresses An equa lly importan t reason for using NAT is to pern1it a firm to have many m ore interna l IP addresses than
Chapter 9 • TCP /IP Jntemehvorking TI 301
its ISP gives it. Suppose that an ISP only g ives a firn1 254 IPv4 addresses by giving it a network part with 24 bits. In this case, the firm \,•ould not do subnetting. It \,•ould use all 8 bits for the host part. Without NAT, the firm can only have 254 PCs sin1ultaneously using the Internet.
However, there are approxin1ately 4,000 ephemeral client port numbers and there- fore 4,000 possible external connections for each of the 254 public IPv4 addresses. This gives a n1illion external connections (4,000 tin1es 254). NAT can map these millions of connections into any combination of hosts and connections per host that it \,•ishes. For example, it could n1ap these connections to 100,000 internal hosts, each with 10 external connections.
Using Private IP Addresses To support NAT, the Internet Assigned N umbers Authority (!ANA) has created three sets of private IP ad d ress ranges that can only be used within fim1s. These are the three ranges:
• 10.x.x.x
• 192.168.x.x
• 172.16.x.x throug h 172.31.x.x
The 192.168.x.x private IP address range is the n1ost popular because it allo\,vs con1panies to use 255.255.0.0 and 255.255.255.0 network and subnet masks, respectively. These break at convenient 8-bit boundaries. However, the other two private IP address ranges also are \Videly used.
Transp arency and Problems A nice result of the way IPsec opera tes is that it is transparent to the operating systen1s of the two hosts involved. The source host merely transmits normally, and the destination host does the same. There is no need to modify the hosts in an y way.
At the san1e time, son1e applications have problems with NAT. These applications need to know the true IP addresses of the interna l host. One exan1ple is IPsec, which we w ill see later. There are work-a rounds for all these problems, but NAT requires con- siderable kno½•ledge to use it effectively in corpora tions. Your hon1e access router also uses NAT to allow you to have n1ore than one internal host, but few problen1s occur.
Test Your Understanding
6. a) Describe NAT o peration. b) What are the two benefits of NAT? c) How does NAT enhance security? d) How does NAT allo\,, a firn1 to deal \,•ith a shortage of IP add resses given to it by its ISP? e) Ho\,v are private IP address ranges used? f) Is NAT transparent to the operating systems of the two hosts involved? g) To all a pplications?
The Domain Name System (DNS)
We sa\,, in Chapter 1 that w hen a user types a target host's host name, the user's PC \,•ill contact the local Don1ain Name System (DNS) server. This local DNS server will send the IP address for the target host back to the originating host. The user's PC can then send IP packets to the target host. In this chapter, \,•e ½•ill add a fe\,, more elen1ents to the picture.
302 Chapter 9 • TCP / IP lnternetworking n
ONS Table Host Name IP Address
Voyager.shidler.hawaii.edu 128.171 .17 .13
1 ONS Request Message:
t--"Th- :-h-~-~-t-:a-:-_-~-i:-~-~---in_:-~-~-~-~-~-~--~-o-~-~---_-_-_- _- _-_-_-_-_-_-_- _~ __ The IP address is 60.32.6.87 Hawaii.edu Originating
Host / DNS Hawaii.edu ONS server lacks this information; 2 ~ Server
forwards ONS request to the -_,,.,,,-- authoritative ONS server for puk.anui.com
Authoritative ~~~p address is 60.32.6.87 ONS Server
for pukanui.com
FIGURE 9 -7 Domain Name System (DNS) Lookup
IP Address Lookup Figure 9-7 looks at how a DNS p rovides an IP address w hen a host sends a DNS request message specifying a host nan1e. In the figure, the host nan1e is dakine.pukanui.con1.7 In n1any cases, as we saw in Chapter 1, the local DNS server w ill kno\v the IP address and send it back.
For a host nan1e in another d omain (pu kan ui.con1 instead of hawai i.edu), how- ever, the local DNS host may not know the target host's IP address. (DNS servers are only required to kno\,• host names in their own domains, a lthough they know n1any o thers.) In this exan1ple, the Ha\,vaii .edu DNS server d oes not kno\,• the IP address of dakine.pu kan ui.con1. To sa tisfy the originating host's request, the Hawai i.edu DNS server fi nds the authoritative DNS server for the d omain containing the host name. In the fi gure, dakine.pu kan ui.con1's DNS server is authorita tive for the pu kanu i.con1 don1ai n. The loca l Ha\,•a ii. edu DNS server will pass the DNS request message to this au th oritative server. The pu kanu i.com DNS server will look up the IP address for dakine.pukanu i.con1 and send it back to the local DNS server. The Hawaii.edu DNS server will in turn send the IP address to the originating host th at sent the DNS request.
Test Your Understanding 7. a) Wha t server \¥ill your local DNS server contact if it does not kno\,• the IP
address of a host? b) Does the client know tha t hls or her local DNS server con- tacted another DNS server to o btain an IP add ress? (This requires some thoug ht and an answer beyond a simple yes or no.)
7 I'vc been asked to explain this. Dabue in Hawari's Pidgeon is "'that kind," a term to use when you can't remember what something is called ("'Eh, hand me dakinc."). [tis pronounced "duh kin'' with a long I and emphasis on the second syllable. In Hawarian, puka is a hole or empty space f'l have a puka in my shirt). Nm means big (opunuinui is an extra-big stomach.) So pukanui is big empty space. The first author actualJy owned pukanui.com. In my dcfonsc, it was cheap and I needed an example for the book.
Chapter 9 • TCP / IP Jntem ehvorking TI 303
Top-1.Bvel Domain Names
_J hawaii.edu
Second-Level Domain Names
shidler.hawaii.edu
I
.ie
voyager.shidler.hawaii.edu Host Names ntl.shidler.hawaii.edu
FIGURE 9 -8 Domain Name System (ON S) Hierarchy
.ch .uk
Generic TLDs gTLDs .ed u .com .museum
Country TLDs cTLDs .au .uk
What Are Domains? F igure 9-8 shows that the Domain Name System (DNS) and its servers are not limited to providing IP addresses fo r host names. More generally, DNS is a general system for nan,ing doma ins. A domain is a group o f resources (rout- ers, single neh,•orks, and hosts) under the con trol of an organization.
A domain is a group of resources (routers, single netw or ks, and hosts) under t he con trol of an organizat ion.
Root The figure sho\,•s tha t domains fo rm a hierarchy, \,•ith host names at the bottom of th e hierarch y. A t the top of the DNS hierarch y is the root, w hich consists of a ll don, a in names. Thirteen root DNS servers keep overview information fo r the system.
Top-Level Domains Under the root are top-level domains (T LDs) that categorize the d omain in o ne of h,•o ways.
• Country top-level domains (cTLDs) specify the country of the don,ain owner. Exan,p les are .uk, .ca, .ie, .au, .jp, .nl, .tv, .md, and .ch.
• Generic top-level domains (g TL Ds) specify th a t th e organization owning the name is a particu lar type of organization. The first gTLDs included .com, .edu, .net, .info, .gov, and .org. Later, the IANA added several more gTLDs, such as .name and .n, useum. In 2012, !CANN o pened the naming system \vid ely, pern,it· ting any organization to propose new generic top-level doma ins.
Note the distinction between the root and top-level d omains. The root consists of all dom ains. It is not named as a level, however. If you are familiar with the UNIX oper- ating system, the root directory concept is similar.
304 Chapter 9 • TCP /IP lnternetworking n
Also, note that it is possible for a domain to have two top-level designations, for instance, AAAA.con1.ie. Most organiza tions, ho\,•ever, tend to use either a country TLD or a generic TLD.
Second-Level D omains Under top-level domains are second-level d omains, which usually specify a particular organization (microsoft.com, hawai i.edu, tulsa. edu, cnn.com, etc.). Sometimes, ho\vever, specific products, such as n1ovies, get their own second-level domain nan1es. Competition for good second-level domain names is fierce. Organizations and individuals compete fierce ly to get men1orable second-level domains because this is ho\,• the public \,vill reach them.8
Organizations and individuals compete fiercely to get second-level domains because this is how the public will reach them.
Con1panies get second-level don1ain names fron1 domain registrars for non1inal fees. Ho\,vever, getting a second-level domain name is only the beginning. Each orga- nization that receives a second-level don1ain name must have a DNS server to host its domain nan1e informa tion. Large organizations have their o\,•n internal DNS servers that contain information on all subnet and host nan1es. Ind ividua ls and small busi- nesses that use webhosting services depend on the webhosting con1pany to provide this DNS service.
In add ition, of course, a second-level don1ain name does nothing for the firm until the firm buys or rents a webserver, builds a \vebsite, and pays an ISP to connect the website to the Internet. Then, of course, there is the n1atter of building the website.
Lower-Level Dom ain s Domains can be further qualified. For instance, w ithin ha\,•a ii.edu, which is the University of Hawai' i's second-level domain, there is a sh idler. hawaii.edu don1ain. This is a third-level domain. It is the Shid ler College of Business. Within shidler.hawaii.edu is voyager.shidler.hawaii.edu, \,•hich is a specific host within the college. It is a fourth-level domain.9
Test Your Understanding
8. a) Is the Domain Name Systen1 only used to send back IP addresses for given host names? Explain. b) What is a don1ain? c) Distinguish between the DNS root and top-level domains. d) What are the two types of top-level domains? e) Which level of domain name do corporations n1ost w ish to have? f) Wha t are DNS root servers? g) Ho\,v does a con1pany or individual obtain a second-level domain name? h) What does a company need beyond obtaining a second-level domain name to have a website?
8 The first author frequently gets requests to sell panko.com, usually from Japanese firms. I know. Bread crumbs. Japanese got bread from the Portuguese, and pan is the Portuguese word for bread. Ko, in Japanese, means little. Many Japanese girl's names end in ko. So panko is little bread. 9 Host names arc called fully qualified domain names (FQDNs).
Chapter 9 • TCP /IP Jntemehvorking TI 305
Record Type I nfor mation in the Record
A Host Name-1Pv4 Address Pair
AAAA Host Name-1Pv6 Address Pair
FIGURE 9-9 Two IP A ddress Lookup DNS Records fo r a Domain (Can Be a Single Host)
Domain Records We have seen DNS used for IP address lookups fo r particular host names. However, the Domain Name Systen1 holds much more information. For each don1ain, which can include an in dividua l host, th e DNS database contains mu l- tip le records. Each record serves a differen t purpose. Figure 9-9 sho\VS the records used to look up IP add resses given host names. These are the A record for IPv4 addresses and the AAAA record for IPv6 addresses.10
To find an IP address fo r a host nan1e, th e DNS server searches through its records to find a ma tch o n the host name. It sends back both the IPv4 address and the IPv6 address associa ted with the host nan1e, unless the host only has one address, in \,•hich case, the DNS server sends that address.
Test Your Un derstanding
9. a) Does a DNS server have one record fo r a particular domain (including a host), or does it have more than o ne? b) What is the purpose of the A record? c) What is the purpose of the AAAA record ?
DHCP Servers
In Chapter 1, \,•e saw that client PCs usually get their IP addresses from Dynamic Host Configura tio n Protocol (DHCP) servers. No\,, that we have looked at TCP /IP in n1ore detail, \,•e will see tha t DHCP servers d o n1o re than hand ou t IP addresses.
• Figure 9-10 shows that DHCP also provides the IP address of the defa ult router-a rou ter to send packets to if it does not have m ore specific informa tion for sending a packet beyond the local subnet.
Client Host
Please give me configuration information
Dynamic IP address IP address of default router IP addresses of DNS servers, Subnet mask, etc. ---
DHCP gives a client updated configuration data eac h time it boots up .
DHCPServer
Configuration Information Database
FIGURE 9 -10 Configuration Information in t he Dynamic Host Config uration Prot ocol (DHCP)
1° Four times as long, so AAAA instead of A. Standards people get bored a lot.
306 Chapter 9 • TCP /IP lnternetworking n
• It a lso tells the h ost on e or n1ore DNS server IP addresses. (Given the critical impo rtance of DNS, most firms have multiple DNS servers.)
• Finally, DHCP tells the h ost its subne t mask, so that th e host w ill kn o\,• w hic h IP addresses are in its own s ubnet a n d w hich re quires sen ding the packe t to a router for delivery beyon d the subne t.
Up-to-Date Con figuration Information DHCP gu aran tees that they have current configuration info rma tio n each tim e they b oot u p, even if some aspects o f th e network have ch anged b e fore booting up o r if the d evice is n1oved to a d ifferen t part of the n e h,vork. If this configura tio n information had to b e managed n1anu ally, all c hanges would cause serious extra \'l'ork.
Test Your Understanding
10. a) What fo ur p ieces of configura tion information d oes a DH CP server typica lly p rovide? b ) Why is it useful to configure a client every tim e it b oots up?
Simple Network Manage ment Protocol (SNMP)
We saw the Simple Network Managen1ent P rotocol in Chapter 4. We now look at the Simple Network Managemen t Pro tocol (SNMP) in n1ore d etail, focusin g on the sch e ma o f th e m an agen1ent info rma tion b ase (MIB) a nd the secur ity implica tions o f th e Set conm1and .
Th e M an ag ement Info rma t ion Base (MIB) When the manager re trieves info rma tio n from agents on man aged d evices, it stores this infom1ation in a d atabase ca lled the management information base (MIB). As in d a ta bases in genera l, "M IB"
SNMP Objects (see Figure 9-12) Not the managed devices themselves
Objects are specific pieces of information about a managed device
Information is stored in the management information base (MIB)
Set Commands
Dangerous if used by attackers
Many firms disable Set to thwart such attacks
However, they give up the ability to manage remote resources without travel
Security as Enabler
If a company has good security, it can enable Set
This will save money In general, good security enabl es many network management tools that can save money
and bring other benefits
It can also enable applications that help employees do their jobs better
FIGURE 9- 11 Simple Netw ork Management Pro tocol (SNMP) (Study Figure)
Chapter 9 • TCP /IP Jntemehvorking TI 307
refers both to the physical database and also to the schema (organization) of the infor- n1ation in the database. We \,•ill focus on the latter.
The MIB sch en1a is not relational. Instead, the SNMP MIB schen1a is organized as a 1,iernrchy of objects. The tern1 object is a little confusing at first. An object is a piece of infom1a tion abou t a managed device. Th e n1anaged device itself is not an object. Figure 9-12 shows the basic schema for organizing SNMP objects.
An object is a piece of information about a managed device. The managed device itself is not an object.
• There is one set of objects for the systen1 (s\vitch, router, host, etc.) as a \,•hole. For exan1p le, the manager may ask a rou ter its system uptin1e-how long it has oper- ated since its last reboot. If this is o nly a few minutes, the router n1ay be suffering intermittent failures that cause it to crash and reboot frequently.
• There is a lso one set of IP objects, TCP or UDP objects, and ICMP objects. For example, the n1anager can ask the agent for a router if its routing object is O n. If it is not, the router cannot act as a router. Rows d iscard ed because of lack of men1ory is another useful object value to kno\,•. Also, if a router is d iscarding more than a tiny number of packets because its n1emory is full, it is tin1e to add more men1ory. The number of errors ½•ill grow as traffic increases further, causing many retransmissions.
• A router may have multiple interfaces, and so will a switch (a lth ough S\Vitches usually call interfaces ports.) Each interface will have its own set of objects, includ- ing its speed and the nun1ber of errors it has experienced. If an interface has too many errors, it n1ay have problems that need attention.
SNMP Set Security The SNMP Set command is very powerful. The manager can use Set to tell an agent to change the configuration of a managed device. If a router interface seems to be malfunctioning, for example, the n1anager can tell fue agent to set the value of an interface to "testing." There is no need to travel to the object.
By allowing adnunistrators to change devices ren1otely, fue Set command can save compan ies a great dea l of money by avoiding travel to fix problen1s. U nfortunately, n1any firms are reluctant to use Set con1mands beca use of security dangers. If attackers learn how to send Set conm1ands to managed devices, fue results could be catastrophic.
Compa nies that have strong security can en able Set and reap th e ben efi ts. Too often, strong secu rity is viewed as a cost. However, strong secu rity is also an enabler of SNMP and other systems that ca n save or make the orga nization a great deal of n1oney.
Test Your Understanding
11. a) Explain the d ifference between managed devices and objects. b) list o ne object in each of the following areas: the system, IP, TCP, UDP, ICMP, and an interface. Explain ho\,v it n1ight be used in network management. c) Why a re fi m 1s ofte n reluctant to use Set con1mands? d) Ho\,v can good security be an e nabler \,•ith SNMP?
308 Chapter 9 • TCP /IP lnternetworking n
Objects Are Pieces of Information About a Managed Device Objects are not the physical managed devices The SNMP MIB is organized as a hierarchy rather than as a relational database
System Objects System name System description System contact person System uptime (since last reboot)
IP Objects Forwarding (for routers). Yes if forwarding (routing), No if not Subnet mask Default time to live Traffic statistics Number of discards because of resource limitations Number of discards because could not find route Number of rows in routing table Rows discarded because of lack of memory Individual row data
TCP Objects Maximum/minimum retransmission time Maximum number of TCP connections allowed Opens/failed connections/resets Segments sent
Segments retransmitted Errors in incoming segments No open port available errors Traffic data on individual connections (sockets, states)
UDP Objects Errors: no application on requested port Traffic statistics
ICMP Objects
Number of errors of various types
Interface Objects (One per Interface) Type (e.g., 71 is 802.11) Status: up/down/testing Speed MTU (maximum transmission unit- the maximum packet size) Traffic statistics: octets, unicast/broadcast/multicast packets Errors: discards, unknown protocols, etc.
FIGURE 9- 12 SNMP M IB Hierarchical Obj ect M odel
Chapter 9 • TCP / IP Jntem ehvorking TI 309
Dynamic Routing Protocols
How does a router get the information in its routing table? It is possible to enter routes n1anually. However, that approach d oes not scale to the enorn1ous size of the Internet. Instead, as Figure 9-13 shows, routers constantly exchange routing table information with o ne another using d ynamic routing protocols.11•12
Interior D ynam ic Protocols: OSPF and EIGRP Reca ll from Chapter 1 that the In ternet consists of many networks owned by d ifferent organiza tions. Within an individua l organization's neh-vork or internet, the organization decides w hich interior dynamic routing protocol to use for its internal rou ters, as sho\vn in Figure 9-13. There are two p opula r interior dynamic ro uting protocols.13 Each has relative strengths and weaknesses.
• Open Shortest Path First (OS PF). For interjo r routing, the IETF created the Open S hortest Path First (OSPF) dynamic ro uting protocol. OSPF is very effi - cient, having a con1plex n1etr ic based o n a n1ixture of cost, th roughpu t, and traffic delays. It also offers strong secur; ty. However, it only does TCP /IP rout- ing. Although TCP /IP is dominant tod ay, many corporations still have legacy p rotocols from other s tandard s architectu res, such as IBM's SNA architectu re and Novel's SPX/IPX. Corpora tions cannot use OSPF fo r ro uting in these o ther architectures.
3
Organization chooses its Interior Dynamic Routing Protocol:
OSPF for exclusively TCP/IP com munication
EIGRP for m ultistandard comm unication (IPX/SPX, SNA, etc.)
1
Internal Routing Table
Q ,. Router Internal Router CJ .. __, --- .. [] " ;.J
Dynami! Routing --;.:,, ......____,_ t Protocol Exchanges to \ ~ r7
Ro • ~ ,..,."-._J
Update utmg ,ables , .,
~nternal Router • ~------------------..... ~· ~---------~
Organization's Network Border . ~
Border Router
Router BGP Is the Extenor Exterior Network (Usually an ISP) Dynamic Routing Protocol ~------------~ --o·. FIGURE 9- 13 Dynamic Routing Prot ocols
11 Note that TCP / lP uses the term routing in two different but related ways. First, we saw earlier that the process of forwarding arriving packets is called muting. Second, the process of exchanging information for building routing tables is also called routing. The IETF sometimes is not fastidious about tenninology. 12 To give an analogy, college students talk to other s tudents to determine which classes they should take or avoid. 13 A third interior dynamic routing protocol is RIP, the Routing Information Protocol. RIP is simpler than OSPF or EICRP and was once popular. However, its almost complete lack of security features makes it an unacceptable choice today. It is commonly rcforrcd to today as '"rest in peace."
31 0 Chapter 9 • TCP /IP lnternetworking n
• Enhanced Interior Ga teway Routing Protocol (EIG RP) . Cisco Systems is the don1inant manufacturer of routers. Cisco has its own proprietary interior dynamic routing protocol for large internets-the Enhanced Interior G ateway Routing Protoco l (EIGRP). The term gateway is another term for router. EIGRP is con1parable to OSPF, b ut unli ke OSPF, it can also route non-TCP /IP traffic.
Ext e rior D ynam ic Protocol : BGP For con1munication o u tsid e the orga ni- zation's net\,•ork, the organiza tion no longer has a c hoice. It must use th e exterior dynamic ro uti ng p ro tocol req uired by the external net\,•ork to \,•hic h it is connected. (This ex terior net\,•ork is usually a n ISP.) Th e aln1ost-universal ex terior dynamic rou ting protocol is the Bo rde r Ga teway Pro tocol (BGP). Again, gateway is a nother term for rou ter.
"Gateway" is ano ther term for "ro uter."
Tes t Your Unders tanding
12. a) What is the purpose o f dynamic rou ting protocols? b) For its own network, can an organization choose its in terior dynamic rou ting p rotocol? c) What is the IETF interior dynan1ic rou ting protocol? d) When n1igh t you use EIGRP as your in terior dynan1ic rou ting protocol? e) May a con1pan y select th e rou t- ing protocol its border rou ter uses to con1municate with the ou tsid e \,•orld? f) What is the almost-universal exterior dynamic rou ting protocol? g) Wha t is a ga teway?
Internet Control Message Protocol (ICMP) for Supervisory M essages at the Inte rnet Layer
Supervisory M essages at the Internet Layer IP is only concerned with packet delivery. For su pervisory messages at the internet layer, the IETF created the Internet Control Message Pro tocol (ICMP) . IP and ICMP \Vork closely together. As Figure 9-14 sho\'l'S, IP encapsulates ICMP messages in the IP data fie ld, delivering then1 to their target host or rou ter. There are no higher-layer headers or n1essages.
Error Ad visement IP is a n unreliable p rotocol. It offers no error correction. If the rou ter or the destination host fin ds an error, it d isca rds the packe t. Although there is no retransn1ission, the router or host that finds the error may send an ICMP error n1essage to the sou rce device to inform it that a n error has occurred, as in Figure 9-14. The ICMP error advisement message contains type and code values ind icating what the problem is. For example, a host unreach able n1essage is Type 3/Code 1.
Error advisement is not error correction. There is no n1echanisn1 within IP or ICMP for the retransmission of lost or damaged packets. ICMP error messages are o nly sen t to help the sending process or its hun1an user diagnose problems. They do not n1ake IP reliable.
Chapter 9 • TCP /IP Jntemehvorking TI 311
2
ICM P Error Advisement Message Host Unreachable
~'* Router .,,, .. (Type 3/Code 1)
' ICMP Echo )..\ ICMP Echo \ Request Message
Reply Message \, 3 (Ping) 1
Data Field
IC MP Message
IP Header
Source IP address reveals the IP address
of the transmrtting device (possible security violation)
FIGURE 9 -14 Internet Control Message Protocol (ICMP) For Supervisory Messages at the Internet layer
Sending error advisement messages is no t n1andatory when errors occur. For secu- rity reasons, n1any firn1s filter out ICMP error advisement n1essages a t their borders because hackers can exploit the infom1ation contained in them. Most obviously, the ICMP n1essage will be carried in a packet that contains the IP address of the sending router or other device. If adversaries have an exploit (attack method) to use against routers, they have a target IP address for their attacks.
Echo (Ping) ICMP a lso offers ICMP control messages, \,•hich d irect a device to change how it operates. The most w id ely used ICMP control n1essages are the ICMP echo request and echo reply messages. As \Ve sa\,v in Chapters 1 and 4, o ne host can use these messages to "ping" another host. As in the case of error response n1essages, the IP header for the echo reply message reveals the presence of a potential target a t the source IP address. Again, many firms do not allow ech o reply messages to go ou tside the corporation.
Test Your Understanding
13. a) For what general class of n1essages at what layer is ICMP used? b) Distin- guish bet\-veen ICMP error advisen1ent a nd control messages. c) What two ICMP message types are used in ping? d ) What security concern do ICMP error advisement messages and echo response messages bring?
IPsec
The Internet was born without a plan for security. Jon Postel, who edited the Internet Protocol RFC and severa l others, once ren1inisced that security threats \,•ere infrequent in the late 1970s a nd ea rly 1980s. Just getting the basic protocols \-Vorking took all the energy that developers had. Today, of course, security is critical, and although security in Internet protocols has improved, the standards are not everything \,•e \-Vant, products do not implement everything the standards provide, and individual organizations have a d ifficult tin1e not n1aking mistakes in in1plementing the complex secu rity facilities that are available.
312 Chapter 9 • TCP / IP lnternetworking n
Core IPsec Principles
Today, the Internet Engineering Task Force is n1oving at full speed to integra te strong security into its standards. Every ne\,• Request for Con1ments (RFC) must have a secu- rity section that lays out wha t security is available and wha t security issues ren1ain unaddressed for the standard . More important, security has been enhanced in a broad spectrun1 of Internet standards. Ho\vever, a piecemeal approach is confusing and leaves gaps for attackers. Many believe that the key security standards for the Internet \,•ill be those that are collectively called Internet Protocol security (IPsec).
En cap su lating Security Pa y lo ad (ESP) and Aut henti cation Header (AH) Figure 9-15 sho\,•s that IPsec offers two basic protection n1echanisn1s. One is the Encapsulating Security Protocol (ESP). The other is the Authentication Header (AH). The figure compares the protections they offer.
After looking at the figure, you are probably thinking, "Why on earth would anybody use AH?" ESP offers far more protections, and it includes authentication and integrity, w hich is the only protection offered by AH.14 The ans\,ver, as you n1ig ht suspect is, "They seldom do. " Given the infrequency of AH u sage, \,•e \,viii focus on ESP.
Given the infrequency of AH usage, we will focus on ESP.
ESP Transport and Tunne l Modes F igure9-16 illustrates ho\,• IPsec protects communication using ESP (and AH, by the way). These are transport n1ode and tun- nel modes. Figure 9-16 sho½'S h,•o packets. Both have an IP header and a data field. In both cases, the header is not protected bu t the data field is. Everything in it is protected wi thout having to do anything to the d ifferent layers of content in the data fie ld .
Encapsulati ng Security Protection Payl oad (ESP) Authentication Header (AH)
Authentication (and Integrity) v v Confidentiality v Anti-Replay Protection v Other Protections v
FIGURE 9- 15 IPsec Encapsulating Security Payload (ESP) versus Authentication Header (AH)
14 Historically, there were hvo main reasons to use AH. The first was that ESP's original design did not include authcnHcaHon (which automatically gives message integrity). lf you wanted. both encryption and authentication, you had to use both AH and ESP. However, this has not been true for a long time. A more practical reason was that some countries outlaw encryption for confidcntialityi allowing only authentication. This is rarely true today, although some countries require weak encryption. JPsec experts note that AH has some technical advantages that may be useful in specific circumstances, and they note that sometimes it is desirable to use both AH and ESl~ but these situations arc rare.
No Protection
IP Hdr of packet to be protected
No Protection
IP Hdr of packet that tunnels the packet to be protected
Chapter9 • TCP/IP !ntem ehvorkingTI 313
ESP Protection in Transport Mode
Data Field: TCP, UDP, ICMP, application data, etc.
ESP Protection i n Tun nel M ode
T he entire p acket to be protected is tunneled (encapsulated) in the data field
Nothing needs to be done to the contents of the data field to give them protection.
FIGURE 9-1 6 ESP Prot ection in Transport and Tunnel M od es
So how are things different between the h,•o? look at the data fields.
• In transport mode, the data fie ld ho lds the usua l contents of an IP packet. It n1ight contain a TCP head er, a UDP header, app lica tion data, or anything else, such as an ICPM con1mand.
• In tunnel mod e, the d a ta fi eld has the enti re packet p rotected. Tunnel n1od e p laces this packet inside an other packet, w hich \'\'e will ca ll the ou ter packet. Th is is called tunneling or encapsulating the packet to be protected.
Transport n1od e, then, leaves the header of the packe t witho ut protection. Tunnel n1od e fixes this limita tion. Tunnel n1ode is the d efault in m ost IPsec im plementa tio ns, b ut transport mode is also used somewhat.
Test Your Understanding
14 . a) How d oes IPsec p ro vid e a grea t deal of p rotection? b) Why d o we focus o n ESP and not on AH? c) What is tunneling? d ) Whic h pro tects more of the original IP packet, transport m od e or tunnel mod e? Explain how n1uch n1ore protec tion tunnel m ode provid es.
VPN s IPsec crea tes a secure flow of packets between rn•o endpoints. This secu re flow is a virtual priva te network (VPN). We already saw VPNs in Chapters 4 and 7. Th e two e ndpoints effectively have a secure p riva te neh,•ork connecting then, . This "private network," of course, is only virtual. Fig u re 9 -17 illus tra tes the three e ndpoint pa irs that IPsec is designed to connect and p rotect.
• Host-to-host VPNs connect h,•o hosts, often in the san1e site. In Figure 9-17, the VPN connects Client X ½•ith Server X. The security is hand led by the h,•o hosts, \,•ith no additional help.
314 Chapter 9 • TCP / IP lnternetworking n
Corporate Site A
3 Site-to-Site
VPN
Multiplexes many p rotected conversations
between the sites
Corporate SiteB
Server Y IPsec Gateway A
2 Host-to-Host
VPN
I
• 1
Client X A virtual pri vate network (VPN) is a
cryptographically secured transmission path through an untrusted network.
FIG URE 9- 17 IPsec VPNs
IPsec Gateway B Client W
4
Host-to-Site (Rem ote Access)
VPN Remote
Corporate Client Z
• Site-to-s ite VPNs connect two corpora te sites.15 The site-to-site VPN in the fi gure connects Corporate Site A and Corpora te Site B. Host-to-Host VPNs only carry the traffic of the two hosts in volved . Site-to-site VPNs, in contrast, n1ultiplex n1any host-to-host transn1issions between hosts a t the h,•o sites. The thicker box around the site-to-site network e mphasizes this greater traffic.
• Finally, host-to-site VPNs p rotect traffic between a site and a ren1ote corporate client who n1ust reach the site via the Internet. Traffic is protected all the way beh,•een the remote corporate client and the site. This is also called a remote access VPN .
IPsec Gatew a ys When o ne VPN endp oint is a site, the termination point is a device called an IPsec gateway. Site-to-site VPNs d irectly connect the IPsec gateways at the h,•o sites. Host-to-site neh,•o rks connect a ren1ote client to the site's VPN gateway. VPN gate\,•ays can terminate many remote clients sin1ultaneously.
Test Your Understanding
15. a) What th ree types of VPN does IPsec support? b) What no nhost d evice is a tem 1inating point in site-to-site VPNs and host-to-site (ren1ote access) VPNs? c) What is a nother tern, for "gateway?"
Applying ESP Protections
Error! Reference sou rce not found. showed ESP protections broadly. In this subsection, we look at ESP in m ore deta il.
ESP in Tran sport Mode Figure 9-18 shows ho\,• ESP is a pplied in transpor t n1od e. It sho\'l'S tha t the sender add s a n ESP header, an ESP trailer, and a n integrity check value (I CV). The ESP header comes a fter the IP packet's head er, before the packet's da ta fi eld . The ESP trailer a nd ICV come after the d ata fi eld.
15 It is also called a LAN· to-LAN or nctwork· to-network VPN.
Chapter9 • TCP/IP!ntemehvorkingTI 315
Unprotected
IP Header
ESP Header
Original IP Packet
Encrypted
Authenticated
Transport Header/ Application Data
ESP Trailer
Integrity Check Value
In transport mode, the packet is sent with additional fields for securi ty. In networking, transport means transmission.
The original packet is transported. The IP header has no protection.
It can be read and changed en route.
AGURE 9 -18 ESP Additions to 1Pv4 in Transport Mode
Note that encryption only begins w ith the data field. ESP does not encrypt the IP header, the ESP header, or the ICV. The routers along the packet's path must be able to read the entire IP header to do their work. In tum, the destination host must be able to read the entire ESP header and integrity check value to authentica te and then decrypt an arriving packet. The ESP header is, however, authenticated.
ESP Add itions in Tunnel M ode Figure 9-19 sho\'l'S the additions that are made to implement ESP in tunnel mode. These again consis t of an ESP header, an ESP trailer, and authentication data . The ESP header comes after the outer IP packet's header, before the outer packet's data field. The ESP trailer and authentication field come after the outer packet's data field.
This is exactly the \,vay that EPS is implen1ented in transport n1ode. The difference is what infom1ation lies in the data field. In tunnel n1ode, again, the data field contains the entire original IP packet to be protected. Consequently, ESP in tunnel mode provides total protection for the protected packet.
In tunnel mode, the outer packet's header is sent in the clear. This n1eans that each outer packet will reveal the IP address of the gate\,vay to which the packet is going.
Protected Original Pac ket
New IP ESP Header Header
Original IP Packet
Encapsulating (Outer) Packet
ESP Trailer
Integrity Check Value
Tunneling is encapsulating a message inside another message for delivery. In IPsec, the message being tunneled is the orig inal IP packet.
(Tunneling is not about providing a secure "tunnel" through the Internet.) Source and destination IP addresses in the original packet remain confidential.
FIGURE 9-19 ESP Addit io ns to 1Pv4 in Tunnel Mode
316 Chapter 9 • TCP / IP lnternetworking n
P\16Main Header
/ Extension Headers
for Routers
Extension Headers
ESP Header
t ESP
Extension Header
Protection
"' Extension Protected Payload
Headers for Destination
Host
FIGURE 9 -20 ESP Addit ions to 1Pv6 Packets i n Tunnel M od e
ESP Trailer
ICV
Integrity Check Value
However, gateway addresses are usually easy for attackers to learn anyway. Con1panies kno\,, that their IPsec gateways are critical single points of fail ure that are kno\,•n to be very risky, so they are exceptionally hardened.
ESP Addit ion s in 1Pv6 Figure 9-18 and Figure 9-19 show ESP additions for IPv4. Figure 9-20 sho\,'S that the n1ain change in IPv6 comes in IPv6 extension head ers. Son1e extension headers need to be read by routers along the packet's route. O thers are only read by the destination host. The figure sho\,'S that the ESP header is norn1ally p laced after the hop-by-hop extension headers but before the destination host head ers. This allows it to protect the data fi eld (payload) p lus any destination headers tha t rou ters along the way do not need to know.16
Test Your Understanding
1 6. a) Wha t are the th ree add ed fie lds \,vhen IPsec ESP is used? b) Wha t do they su rround in transport n1ode fo r IPv4? c) What do they surround in tunnel mode for IPv4? d ) Where is the ESP header placed in 1Pv6?
Security Associations (SAs)
Meth o d s and Option s When organizations implemen t IPsec, they want to be able to tailor it to each connection's specific situation. This requires choices, not o ne- size-fi ts-all protection. These op tions include ½•hether ESP or AH \,•ill be used, w hether IPsec will o pera te in tunnel or trans port mode, what encryp tion n1ethod confidentiality will use, and w ha t hashing17 method authentica tion uses. Figure 9-21 sho\,'S IPsec's n1ain encryption methods. Figure 9-22 does the san1e for hashing, which is a core part of authentication. Most cryptographic methods offer fu rther options. For exam ple, the
16 ESP (and AH) headers were c-rcatcd as extension headers for 1Pv6. They were later added to IPv4 17 Authentication methods require extensive processing, and this processing is directly correlated to the size of the message. Hashing addresses this problem by creating a string of bits that is much smaller than the entire packet. Hashing is applied to the long packet to produce a small bit string of fixed lengt h (128 to 512 bits). An authentication method is lheu applied to lhe hnsh, instead of lhe full pnckel. This seems like a trick, but it gives about the same level of protection that authenticating the entire packet would do. The longer the hash, however, the greater the protection (and the longer the processing time).
Chapter9 • TCP/IP!ntemehvorkingTI 317
Key Length Option Name (bits)• Remarks
AES- 192 Advanced Encryption Standard 192 Extremely strong
AES-256 Advanced Encryption Standard 256 Far st ronger than AES- 192
3DES Triple Date Encryption Standard 168 Very strong but inefficient legacy standard
DES Date Encryption Standard 56 Weak legacy standard Should not be used
'*Each additional bit doubles the time needed to crack a key.
FIG URE 9-21 Common Encryption Methods and Opti ons for Confident iality in IF'<ec
Hash Length Option Name (bits)• Remarks
MD-5 Message Digest 128 Weak legacy standard Should not be used
SHA-1 Secure Hash Algorithm 160 Weak legacy standard Should not be used
SHA2-224 Secure Hash Algorithm 224 Strong to extremely strong
SHA2-256 Secure Hash Algorithm 256
SHA2-384 Secure Hash Algorithm 384
SHA2-512 Secure Hash Algorithm 512
"Longer hashes provide better authentication.
FIG URE 9-22 Common Hashing Methods and Options for Authentication in IPsec
AES encryption method can optionally have 128-bit keys, 192-bit keys, or 256-bit keys. These options can have n1ajor impact on the security that a method provides.
Security Association s A securi ty association (SA) documents how the t\,•o parties \,•ill implen1ent IPsec protection, including w ha t methods they will use for different cryptographic purposes and what options w ill be used \,•ith these methods.
A security association (SA) documents how the two parties will implement /Psec pro- tection, including what methods they will use for different cryptographic purposes and what options will be used with these methods.
Figure 9-23 shows security associations bet\,•een two hypothetica l hosts.
• For transmission fron1 Host A to Host B, the SA specifies that Host A \,vill use ESP in tunnel mode. For confidentiality, Host A w ill encrypt \,•ith AES-192. Host A w ill use SHA2-224 for authentication. (Yes, we ½•ill look at what these tern1s mean a little la ter.)
318 Chapter 9 • TCP /IP lnternetworking n
] Host A
1 Security Association (SA) for transmissions from Host A to Host B ESP Tunnel AES-192, SHA2-224, etc.
~------------------------------------- 2 Security Association (SA) for
transmissions from Host 8 to Host A ESP Tunnel AES-256, SHA2-384, etc.
(Can be different than Host A to Host B)
FIGURE 9-23 Security Associations (SAs) in IPsec
HostB
• For transn1ission from Host B to Host A, the SA specifies that Host B \,•ill use ESP in tunnel mode. For confid entiality, Host B w ill encrypt \,•ith AES-256. For authentication, Host B \¥ill use SHA2-384.
Security Associatio n s Can Be Asymmetric Note th a t the two security asso- cia tions in Figure 9-23 are asymmetric (d ifferent in the two directions). The SA from Host A to Host B is \,•ea ker than the SA from Host B to Host A. (To see w h y this is true, 192 224, 256, and 384 a re key lengths, and longer keys give stronger securi ty even when the cryp tographic method is the same.) The SAs in th e t\,•o directions a re often syn,m etrica l (the same in both directions). However, they do not have to be. Sometimes, condi tions call for asymme trical security.
Security associations are often asymmetric, providing different security in the two directions.
Tes t Your Und ers tanding
17. a) D istinguish between cryptographic methods and options. b) What is an SA? c) In Figure 9-23, \'\'hat elements are standardized in the SAs?
Creating Security Associations
In IPsec, SSL/TLS, and o ther cryptographic systen\S, there are nearly always two stages. Figure 9-24 shows that the first is an initial handshaking (negotia ting) stage. This is a very short stage in which th e tv.•o parties do three things:
• Negotia te the security methods (and options) they w ill use in o ngoing cornn1uni- ca tion. This is the negotia tion of the security associations the two parties w ill use.
• Authenticate each other.
• Securely exchange the keys they \¥ill use for ongoing con,munication.
Figure 9-24 shows that in IPsec this initial handshaking is governed by the Internet Key Exchange (IKE) protocol. IKE is an extren,ely complex protocol. Fortuna tely for you, it is well beyond what an introductory class can cover. With IKE's \,•ork d one, the security associations are established, and ongoing con,munica tion begins. This stage, which accounts for nearly the entire communication session, in1plements the IPsec SAs negotiated by IKE.
IKE Negotiations
Internet Key Exchange (Create a Secur~y Association)
1. Negotiate Methods and Options 2. Initial Authentication
3. Keying
Chapter9 • TCP/IP!ntemehvorkingTI 319
IPsec Protection
Ongoing Protection with a Security Association (Specific Set of Methods and Options)
Packet-by-Packet Encryption Packet-by-Packet Authentication
etc.
FIGURE 9-24 St ages in IPsec Communication
Weak Method s and Opti on s in Security Association s We have seen that IPsec offers m ultiple encryption n1ethods and options. Some o nly provide weak secu- rity and have been cracked in practice, sometimes easily. For example, a n1inin1um key length for encryption tod ay is 128 bits, bu t DES o nly offers a 56-bit key. (In 1977, \,•hen DES \,•as created, it \,•as strong.) In authen tication, bo th MD-5 and SHA-1 are weak and crackable today.
Con1panies mus t estab lish policies for no t using weak a lgorithn1s in SAs. In n1any cases, these pol icies can be en forced in the technology. For exan1ple, companies that employ Microsoft servers ca n use Microsoft Group Policy Objects (GPOs) that enfo rce policies o n differen t hosts, such as general client hosts, client hosts in hig hly r isky operations, and so for th. Th ese client hosts may r un Windows or a Macintosh o perating systen1. Assign ing a host to a predefined group \,• ill require that host to respect the con1pany's relevant policies for security and other matters.
Tes t Your Understanding
18. a) What are the two stages in IPsec protection? b) What standard is used in the fi rst s tage? c) In \,vhich stage is the SA negotiated? d) In which stage is the SA used to provide protection? e) Can SAs be d ifferent in the h,vo directions? f) Why is it importan t to have and enforce p olicies for \,vhat cryp tographic methods and o ptions n1ay be used in an o rganization?
SSL / ns VPNs
A ltho ug h IPsec is a n enorn1ous ly po\,•erfu l tool for creati ng highly secu re VPNs, IPsec is expensive to imp lement. For n1a ny pu rposes, compa nies in1plem ent VPNs usi ng SSL/TLS, w h ich \,•e saw briefly in C hapter 4. Fig u re 9-25 com pares IPsec w ith SSL/TLS. I t sho\,•s that IPsec is a general approach to secu ri ty protec tion, whereas SSL/TLS ca n o nly be used in som e circums tances. One of these circun1- stances, of course, is in te ractions between bro\vsers and \,•ebservers, \,•hich is very common.18
18 JPscc is transparent, so a browser has no way of knowing if IPscc is being used to protect browser-server communication. This causes companies to implement SSL/TlS for many applications that can use it and require security even when JPscc is almost certainly being used.
320 Chapter 9 • TCP /IP lnternetworking n
Characteri stic of VPN Technology IPsec SSL/TLS
Standards Organization IETF IETF (created by Netscape as SSL, renamed TLS by the IETF)
Layer Layer 3 Layer 4
Built into Browsers, WebseNers, No Yes and Mail SeNers. So Protects These Applications at Little or No Cost.
Can protect any application Yes (also protects transport- No (only SSl/TLS-aware layer header and some of applications such as web the IP header) and e-mail)
Type of VPNs Supported in the Host-to-Host Host-to-Host Standard Remote Site Access
Site-to-Site
Strength of Security Excellent Good
FIGURE 9-25 l l'sec versus SSL/TLS VPNs
Test Your Understanding
19. a) List the streng ths of IPsec compared to SSL/TLS. b) Wha t is the attraction of SSL/TLS compared to IPsec?
END-OF-CHAPTER QUESTIONS
Thought Questions
9-1. Both DNS sen •ers and DHCP server s send your client PC an IP address. What is different about these t wo addresses?
9-2. Assume that an averageSNMP response message is 100 bytes long. Assume that a manager sends 4,000 SNMP Get com- mands each second. a) v\lhat percentage of a I Gbps LAN link's capacity would the resulting response t raffic represent? b) What percentage of a 10 Mbps WAN link would the response messages rep- resent? c) What are the management implications of your answers?
9-3. A firm is assigned the net wor k pa rt 128.171. It selects an 8-bit s ubnet part. a) Write the bits for the fou r octets of the IP address of the first host on the
first s ubnet. b) Convert this answer to dotted deci mal notation. (If you have fo rgotten how to do th is, it was cov- ered in Chapter 1.) c) Write the bits for the second host on t he third subnet . (In b inary, 2 is JO, and 3 is 11.) d) Con- vert this in to dotted decima l notation. e) Write the bits fo r the last host on the t h ird subnet. f) Convert th is answer i n to do tted deci ma l nota tion. Can you tell the s ubnet a host is on just by looki ng at the dotted decimal notation representation?
9 -4. A firm is assigned the network par t 128.171. It selects a 10-bit s ubnet part. a) Draw the bits for the fou r octets of the IP address of t he firs t host on the
fir st subnet. b) Convert th is answer in to dotted deci mal notation. (Hint: Use Windows Calculator.) c) Draw the b its for the second host on the th ird s ubnet. (In binary, 2 is 10, and 3 is 11.) d) Con,•ert this into dotted deci mal notation. (Hint: Use Windows Calcula- tor.) e) Draw the bits for the last host on the t hir d subnet. f) Convert th is answer into dotted decimal nota tion. Can you tell the subnet a host is on jus t by looking at the dotted decimal nota- tion representation?
Troubleshooting Question
9-9. Your compu ter sends a DNS request message to your local DNS ser ver. After an unusually long time, your computer receives a DNS response message that the host name in your request message does not exis t. This is a host you use
Hands-On Project
9-10. After Sal Aurigemma received his PhD from the Uni versity of Hawaf' i, he became a professor at the Uni versity of Tu lsa. There, he introduced the school to Aloha Friday, when people come to work in thei r color ful Aloha shirts. He got the idea of creating Aloha shirts w ith Tulsa's school colors and an emblem of the university on the shirt pocket. Sup-
Perspective Questions
9-11. What was the most s urpr isi ng thing you learned in this chapter ?
Chapter 9 • TCP / IP Internehvorking TI 321
9-5. a) What are the th r ee ranges of pri- vate IP addresses? b) If a fir m chooses 10.x.x.x fo r its internal IP add resses, how many hosts can it have in ternally? c) Repeat for 192.168.x.x. d) Repeat for 172.16.x.x through 172.31.x.x.
9-6. Pick one category in each category in Figure 9-12. Say how it would be used in neh vork management.
9-7. Redo Figure 9-20 for transport mode. 9-8 . After you get a second-level doma in
name, what mo re mus t you do to have a wor king website for your company?
every day. a) Lis t problems that may ha,•e happened. (Draw the pictu re.) b) Which is the most likely to ha,•e cause the long delay and fa ilure to find your host's IP address? c) How wou ld you test it?
pose that he wants to create a company to sell school-specific A loha shirts to other uni versities. He w ill need a com- pany name and a second-level domain name. Go to an Internet domai n name regis tr ar. Thoughtfu lly come up with three appropriate and available domain names. Explain why each is good. Select one and explain why it is best.
9-12 . What was the most di fficult thing for you in the chapter? vVhy was it difficult?
Chapter 9a
Cisco's IOS Command Line Interface (CLI)
COMMAND LINE INTERFACES (Clls)
When dun1b terminals ru led the desktop (roughly when dinosaurs roamed the earth), they presented their users wi th command line interfaces. F igure 9a-1 shows a brief fragment fron1 a CLI interaction. It shows that in a command line interface (CLI) the systen1 gives a pron1pt and the user types a one-line cornn1and.
In a command line interface (CL!), the system gives a prompt and the user types a one- line command.
This exan1ple sho\VS a small part of Cisco's CLI for IOS-Cisco's operating sys- tem for s\,•itches, routers, firewalls, and other devices. Configuration and management work on Cisco devices is still done prin1arily through this command line interface. A device adn1inistra tor Telnets into the device or p lugs a PC into the router. In the latter case, sofh,•are then turns the administrator's expensive PC into a cheap dumb terminal.
Prompt (user EXEC m ode) Command Type Enter to complete the command
l l / routername>enable(Enter] usually enter password here routername#
t Prompt in Privileged EXEC mode, which allows you to take potentially dangerous actions, su ch as changing the configuration of the router
FIGURE 9 a-1 Cisco 10S Command Line Interface (CU)
322
Chapter 9a • Cisco' s !OS Command Line Interface (CLI) 323
Test Your Understanding
1. a) what is a CLI? Just s pell it out. b) What is the defining characteristic of a com- mand line interface? c) What is Cisco's operating system for routers, switches, and o ther devices? d) How is configura tion and n,anagemen t \'l'Ork done prinlarily in this opera ting system?
CLI Essentials
The fi rst line of the interaction in Figure 9a-1 shows the th ree elements in Con,mand Line Inter face (CLI) commands.
• First, there is the prompt. This is sho\,•n on the screen by the operating systen, . In the fi rst row, the prompt is ro11tername>, \,•here router name is the nam e o f the router being configured. The prompt ends \,•ith a right angle bracket (>). This tells the user that he o r she is in user EXEC mode, \,•hich can execute only son, e IOS commands.
• Second, there is the con,mand the ad n1inistrator types. The comn,and on the first line is a single text string, "enable." This tells IOS that the ad n1inis trator w ishes to enter privileged EXEC mode, which allo\,•s an administrator to enter all IOS CLI commands.
• Third, the user hits the Enter key to comple te the command. The n1ost comn1o n mistake that ne\'I' CLI u sers m a ke is forgetting to hit enter. They sit and wonder \,•hy nothing is happening. After a couple of minutes, they realize that they forgot to hit Enter. Again.
Command M od es After the user types the fi rst comn,and, the system gen er- ally prompts the user fo r a pass\,•ord. Entering the enable com n,and and successfully e n tering the password p u ts the administra to r in privileged EXEC mode. To indicate this, the prom pt ending changes from > to# to indicate that the adm inistrator is in p rivileged EXEC n1od e.
In the EXEC mod e, the prompt en ds with >. In privileged EXEC mode, the promp t en ds wit h #.
Command mode is a core idea in Cisco's IOS CLI. The user is always in one of several con, mand mod es. Each comn,a nd m ode a llows the ad n1inistrator to take a s pecific set of actions. Differen t modes offer differen t sets of actions.1
Each /OS mode allo ws the administrator t o tak e a sp ecific set o f actions.
1 You can think of them as avatars with dHforent powers in a computer game.
324 Chapter 9a • Cisco's !OS Command Line Interface (CLI)
Test Your Understanding
2. a) What are the three things that appear on a CLI line? b) What is a cornn1and n1ode? c) In what conm1and mode does the administrator start upon connect- ing to a router? d ) In what command n1ode must the administrator be to give all conm1ands? e) Ho\,, does the pron1pt end in the user Exec conm1and mode? f) Ho\,, does the pron1pt end in the privileged Exec con1mand mode? g) Why does the administrator have to always keep in mind \'l'hat command n1ode he or she is in? This will require you to draw an inference fron1 the material in this section.
A More Complex Cisco 105 Interaction
Figure 9a-2 shows part of a (slightly) more con1plex interactio n. In the figure, the client logs in, goes into privileged EXEC command mode, changes the name o f the router, and configures an interface. Configuring an interface requires going into a differen t com- n1and n1ode, Config11rntion Interface Command Mode, abbreviated as config-if. Recall that a router will norn1ally have several interfaces (plugs) that connect to its network, so you n1ust s pecify a particular interface before you configure it.
In this session, the administra to r issues a series of commands. 2
Prompt Command Description
routername> Enable The current name of the router is routername. ">" indicates that the user is in the restrictive user
EXEC Mode. User w ishes to be in Privileged EXEC Mode. W ill be
prompted for a password.
routername# Config Now in Privileged EXEC Mode (# prompt). Command to go into Global Configuration Mode.
routemame(config)# hostname Bob In Global Configuration Mode, prompt ends in (config)#. Hostname command changes the router's name to "Bob."
Bob(confi g)# interface e 1 Enter Config-lf (interface) Mode to configure one of the router's interfaces-the second Ethernet interface. (Interface counting begins with 0, not 1.)
Bob (config-if)# ip address Now in Interface Configuration Mode, the prompt ends 172.30.3.100 with (con fig-if)#. 255.255.255.0 Command assigns to the second Ethernet interface
the IP address 128.171 .17 .1 3, with t he subnet mask 255.255.255.0.
Bob (config-if)# End Ends interface configuration, goes back to Global Configuration Mode.
Bob(confi g)# . . . More 10S commands .
FIGURE 9a-2 A More Complex Cisco 10S Interaction Sequence
2 Commands arc normally shown in lowercase. However, case is not important in CLI commands.
Chapter 9a • Cisco's !OS Command Line Interface (CLI) 325
• The adn1inistrator goes into Privileged EXEC Mode \,•Hh the enable comn1and and the correct password (not sho\,•n).
• The adn1in gives the Config comn1and to enter Globa l Configuration Mode.
• The administrator renan1es the router using the hostname command. He or she changes it to "Bob."
• Bob then gives the interface conm1and, stating that he or she w ishes to configure interface el. Thee indicates that this is an Ethernet interface. Numbering begins at 0, so el is the router's second Ethernet interface.
• Now in Config-if Con1mand Mode, the adn1inistrator gives the interface an 1Pv4 address and a subnet mask.
• End returns you to the next-higher mode. In Config-if Mode, the administrator types the End conm1and. This puts the adn1inistrator back into Global Configura- tion Mode.
Note that the administrator frequently moves between n1odes. Fron1 the Global Configuration Mode, the adminis tra tor can switch n1odes to configure the rou ter as a DHCP server, add in an access control list, specify a certificate authority to use pub- lic key authentication, and do many other advanced tasks. Mastering Cisco's CLI is a n1ajor challenge. Beyond that, knowing ho\,• to configure a router to work in complex or unusual environments takes years to master.
Test Your Understanding
3. a) If the adn1inistrator is in the Privileged EXEC Mode, \,•ha t n1ust he or she do to be able to do configuration \,•ork? b) What con1mand mode will the adminis- trator be in to n1ake configuration c hanges? c) How does the administrator get from the Privileged EXEC Mode to the Globa l Configuration Mode? d) Give the syntax for the command to change the router 's name. e) While in the G lobal Configuration Mode, give the comn1and the administrator n1ust use to begin configuring the first serial interface. (This \,•ill take you a little beyond the text.) f) To \,vhat will this change the pron1pt? g) What is the con1mand to set an IP address and subnet n1ask for this interface? h) Give the comn1and to do this for a subnet mask of sixteen ls followed by sixteen Os. i) How does the adn1inistra- tor go from this mode back to the G lobal Configuration Mode?
ACTIVITY
9a-1. Write the CLI prompts and commands you would use as an adminis trator in a session to change the thi rd serial inter-
faces' IP address. Do not include unnec- essary commands.
Th is page intentionally left blank
Chapter 10
Carrier Wide Area Networks (WANs)
LEARNING OBJECT IVES
By the end of this chapter, you should be able to:
• Contrast LANs and WANs in terms of technology, diversity, econonucs, speed, and need for optin1ization.
• Describe the three carrier WAN con1ponents and the h,•o typ ical business uses for carrier WANs.
• Describe how the telephone systen, is organized, including its hierarchy of S\'l'itches. (Most carrier WAN neh,•orks use the public switched telephone neh,•ork for son,e or all of their corrununication.)
• Explain and con1pare the ADSL and cable n1odem residential Internet access services and how fiber to the home is changing the residential access market.
• Discuss trends in cellular data transmission speeds.
• Distinguish beh'l'een access lines and leased lines. Select a leased line for a given application speed requiren,ent. Explain ho\\' companies use leased Jines in Internet access.
• Exp lain how neh,•orks of leased lines, carrier Ethernet, and MPLS can be used for site-to-site comn,unication within a firn,. Discuss the relative advantages and d isadvantages of each.
• Exp lain the capabilities of WAN optin1ization devices.
Albert Einstein was reportedly asked how the telegraph worked. He said it was like a very long cat with its head in one city and its tail in another. When you pull on the tail in one city, it howls in the other city. Wireless transmission is exactly the same but without the cat.
327
328 Chapter 10 • Carrier Wide Area Networks (WANs)
Category
Abbreviation
Service Area
LANs AND WANs (AND MANs)
One of the m ost fun da m ental d istinctions in neh,•o rking is the o ne ben,•een local a rea networks (LANs) and w ide area ne h,•orks (WANs). Figure 10-1 shows ho\,• these two types of networks d iffer. We will also see how they con1pare to intem1ediate-clistance networks called metropo litan area neh,•orks (MANs).
LANs versus MANs and WANs On and Off the Cust omer Prem ises Son1e authors base the d ifference between
LANs and WANs o n physica l distance. For instance, son1e say that the d ividing line ben,•een LANs and WANs is o ne mile or o ne kilometer. Ho\,•ever, the real d istinction appears to be tha t local area nehvorks (LAN s) exist w ithin a company's site, \,vhereas wide area nehvorks (WAN s) connect d ifferent sites w ithin an o rganization o r between organizations.
Local area n etworks (LANs) exist within a company's site, whereas wide area n e tworks (WANs) connect different sites within an organization or between organizations.
For LANs, then, the company owns the prope rty and can do a n y thing it \,•ants. It can choose any LAN technology it wishes, a nd it ca n in1p lemen t it a n y way it wishes.
There is no such freedom for WANs. A compan y cannot legally lay \,•ires between two of its sites. (Consider how your neighbors \Vould feel if you started laying wires
Metropolitan Area Local Area Network Network W ide Area Network
LAN MAN WAN
On customer premises Between sites in a Between sites in a region, (home, apartment, office, metropolitan area. a count,y, or around the building, campus, etc.) (city and its suburbs) world.
A Type of WAN
Implementation Self Carrier Carrier
Ability to Choose Technology High Low Low
Who Manages the Network? Self Carrier Carrier
Price Highly related to cost Based on pricing Based on pricing strategy. Highly strategy. Highly unpredictable unpredictable
Cost per Bit Transmitted Low Medium High
Typical Transmission Speed 1 Gbps and more 10 Mbps to 1 Gbps 1 to 100 Mbps
Diversity of Technologies Low: 802.3 and 802.1 1 Medium High
FIGURE 10-1 LANs versus WANs (and MANs)
Chapter 10 • Carrier Wide Area Networks (WANS) 329
across their yards.) The government gives certain con1panies, called carriers,1 permis- sions (rights of ,vay) to lay wires in publ ic areas and offer service to customers. In return, carriers are subject to government regulation.
When you deal \'l'ith carriers, you can only get the services they offer, and you n1ust pay their prices. Al though there may be multiple carriers in an area, the tota l nun1ber of service choices is likely to be quite lin1ited.
On the positive s ide, you do not need to hire and maintain a large staff to dea l with WANs because carriers handle nearly all of the details. In contrast, if you install a LAN, you also have to n1aintain it. As the o ld saying goes, anything you own ends up O\-\'rung you.
Econ omi cs Another fundan1ental difference beh,•een LANs and WANs sten1s from econonucs. You know that if you p lace a long-distance call, it \,•ill cost more than a local call. An international call \,•ill cost even more. As d istance increases, the price of trans- n1ission increases. The cost per bit transmitted therefore is hig her in WANs than in LANs.
You know from basic econon1ics that as unit price increases, fewer units are demanded. Or, in normal English, when the price of an item increases, you usually buy less of it. Consequently, companies tend to purchase lo\,•er-speed WAN links than LAN links. Typically, LANs bring 1 Gbps to each desktop. WAN speeds more typically vary fron1 1 Mbps to about 100 Mbps. MAN speeds fall beh'l'een the h'l'o.
In addition, con1panies spend n1ore tin1e optimizing their expensive WAN traffic than their relatively inexpensive LAN traffic. For example, companies may be some- wha t tolerant of looking at You Tube videos on LANs, but they usually clan1p down on this type of information on their WAN links. They a lso tend to compress data before sending across a WAN so that it can be handled wi th a lower-capacity WAN link.
Another aspect of econon1ics is pricing. For LANs, you have a good idea of what installing and using a w ired or wireless LAN will cost you. In carrier WANs, ho\,•ever, the price of services is only some\,•hat related to costs. Carriers change their prices strategically, for exan1ple, to encourage users to s\,• itch fron1 one service to another. Consequently, price changes for WANs are less predictable than they are for custon1er- O\,•ned LAN teclmology.
Techno logies Another difference beh'l'een LANs and WANs is that LAN tech- nology has largely settled on two related families of s tandards-Ethernet (802.3) for wired LANs and W i-Fi (802.11) for wireless LANs. As \,•e sa\,, in Chapter 6, 802.11 WLANs are primarily used today to extend corporate Ethernet wired LANs to mobile devices.
The technological s ituation is more complex in wide area networking. Mul- tiple techno logies are used, including leased line data neh,vorks, public switched da ta neh'l'orks, and w ireless neh,•orks. Within these ca tegories are multiple options. Furthern1ore, WAN technologies are at d ifferent s tages in their life cycles, \'l'ith some increasing rapidly in use and others decl ining.
1 Carriers were originally called common carriers. The name reflected the fact that these carriers were required by law to provide service to anyone or any orga1\lzation requesting services. Regulation was originally insti- tuted in the railroad industry because many companies that owned railroads also owned other companies and refused to provide services to competitors of these other companies.
330 Chapter 10 • Carrier Wide Area Networks (WANs)
Test Your Understanding
1. a) Distinguish between LANs and WANs. b) What are rights of way? c) Wha t are carriers? d) Why do you have m ore flexibility with LAN service than w ith WAN service?
2. a) Why are typical WAN s peeds slower than typical LAN speeds? Give a clear a nd complete argument. b) Wh y are fu ture WAN prices d ifficu lt to p red ict? c) Compa re the d iversity of techno logies in LANs a nd WANs.
Other Aspects of WANs
M etropolit an Area Network s (MANs) All WANs connect sites between cus- ton1er premises and cost more per bit tra nsnutted than LANs. Ho\,•ever, WANs d iffer considerably in the distances they span . Some are international and o thers span single nations. A t the sn1all end, son1e WANs a re metropolitan area networks (MANs), \,•hich connect sites in a city and its suburbs.
Although MANs are WANs, their relatively short d istance s pa n means tha t the cost per bit transn1itted is lo\,•er than it is in national and international WANs. Conse- que ntly, typical transn1ission s peeds are faster. If you have a smartpho ne or tablet with 3G or 4G cellular access, then you already use a MAN. Cellular networks alm ost a lways span a single MAN o r even a single city. Ho\,•ever, we \,•ill see tha t wired MANs are important for corporations because s ite-t<Ysite traffic is large and is m ore efficiently transmitted over wires.
Single Networ ks versu s lntem ets Son1e peop le think that LANs are single networks and that WANs are intemets. Ho\,•ever, as Figure 10-2 sho\,•s, that is not the case. Sn1all LANs usually \,•ill be single networks, b u t a larger LAN, such as o ne o n a university can1pus, is likely to be a local internet.
For WANs, there also can be single networks or internets. O f cou rse, the globa l Internet is a WAN, and \,•e w ill see that man y companies use it extensively for da ta transmission among their premises. We a lso \,•ill see that com pan ies use \,•id e a rea single switched networks. These are large networks, but they are still s\,•itched single networks.
Test Your Understanding
3. a) Wh y do MANs have higher typ ica l s peeds than broader-scope WANs? b) Are LANs single networks or internets? c) Are WANs single networks or interne ts? d) Is the Internet a WAN?
Technology LAN WAN
Can be a single switched or wireless network? Yes Yes
Can be an internet? Yes Yes
FIGURE 10-2 Single Networks versus lnternets
Chapter 10 • Carrier Wide Area Networks (WANS) 331
Carri er WAN Components and Business Uses
Figure 10-3 sho\,'S that there are three bas ic componen ts to carrier w ide area networks:
• First con1es the cus tomer pren1ises \,•ith the customer premises equipment (CP E) needed to connect to the WAN. With n1obile devices, your customer pren1- ises is wherever you are, and your n1obile device is your customer premises equipment. For connecting corporate sites to \,•ired access lines, the custon1er premises equ ipn1ent is likely to be a border rou ter.
• Access links connect the custon1er prem ises to the neh,•ork core of the WAN. We \,•ill focus on wired access links because they are so prevalent. later in the chapter, \,•e \,•ill look at wireless access links.
• The network core connects access links to other access links. Again, we sho\,v it as a cloud because custon1ers do not have to understand how it works in detail. The carrier takes care of the neh,•ork core. Of course, as an IT professional, you have to understand what happens inside the cloud, and we will spend time looking at neh,•ork core technologies.
The Internet connects everyone to everyone e lse. In contrast, carrier WANs primarily see two business uses. As Figure 10-3 sho\,•s, companies use carrier WANs to link their sites to the Internet and to connect their own s ites together. Carrier WANs are no t frequently used to connect multiple companies together because all n1us t be customers of the sa me carrier WAN. When multiple con1panies connect with a carrier WAN, it is generally because they need more security than the Inter- net provides.
Test Your Understanding
4. a) List the three basic con1ponents of wide area neh,•orks. b) Are access links \,•ired or wireless? c) What is CPE? d) What are the two con1mon business uses for carrier WANs? e) D istinguish between the Internet and carrier WANs. f) Why are carrier WANs not often used to link multiple firms together?
'N.
~ ::: ~ ::: ::: ~ ' ::: ~ ~
~ ~ ~ ~ ~
""
Customer Site 1
. 1 Customer
Premises Equipment
Customer Site2
3 POP
(Point of Presence)
4
Carrier WAN Core
FI GURE 10-3 Basic Carri er WAN Components and Business Uses
The Internet
332 Chapter 10 • Carrier Wide Area Networks (WANs)
The Te le phone Syst e m
The world \,•ide telepho ne sys te m \,•as crea ted by voice. Ho\vever, telep hone car- r iers no\,, provide da ta service to res identia l a nd business c us tomers. In add ition, other WAN carrier provid ers typica lly fi nd it a ttractive to lease their tra nsn1is- sion lines fron1 telephone con1pan ies. This allo\,'S WAN providers to focus o n data switching.
Figure 10-4 sho\,'S the Public S,vitch ed Telephone Network (PST N), \,•hich is the official name of the telephone systen1. Per our discussion earlier, there is a cen tral core, and there are access lines. The access portion of the PSTN is the local lo op . It extends fron1 the final telepho ne company switch to the customer p remises.
The PSTN Core is a m od ified hierarchy of switches. End o ffi ce swi tc hes con- nect the PSTN to the custon1er. These are usually Class 5 switches-the lowest in the hierarchy. For perspective, there are about 100 Class 5 end offi ce switches in the sta te of Hawaii. There are fe\,•er s\,•itches a t each subseq uent level. For exan1ple, Ha\,•ai i has a single Class 3 switch.
The PSTN is a n1od ified hierarch y in the sense that, unl ike Ethern e t, the PSTN includes bypass trunk lines between switches that are a t the same level if there is a n unusually large volu me of traffic between those switc hes. It is more efficient for such pa irs of switches to comn1unicate directly rather than involving a higher-level switch.
Test Your Understanding
5. a) Why is the PSTN in1portant in WAN data transn1ission? b) Wha t is the local loop? c) What class of switches are n1ost en d office s\,•itches? d) What is the structure of the PSTN core?
Trunk Une
Trunk Line
C lass 4 Switch
4 Trunk line
Carrier Fiber Multiplexes voice calls
and high -speed data connections
Trunk Line
3 Residential Access Line 1-Pair Voice-Grade UTP
(Sometimes Fibe, to the Home) Dial-up voice service, DSL
End Office Swrtch (Class 5)
FIGURE 10-4 The Public Switched Telephone Networ k (PSTN)
1
2
The links between the customer
premises and the end office switch
are called the local loop
Business Access Line Carrier Fiber
Muttiplexed voice calls and data connections
Chapter 10 • Carrier Wide Area Networks (WANS) 333
RESIDENTIAL WIRED INTERNET ACCESS
We begin our discussion of WAN technology with resid en tia l In ternet access. This will permit us to star t wi th something familiar to most read ers and g ive us a base of kn owled ge for looking at corpora te WAN tech nologies.
Residential Asymmetric Digital Subscriber Line {ADSL) Service
Some read ers a re d irectly fan1iliar \,•ith residen tial ADSL services. Figure 10-5 sho\,'S that asymmetric digital subscriber line (ADSL) services p rovide sim ultaneous voice and data to residential customers. Data transmission s peed is asyn1metric, \,•ith faster download speed than u pload speed. This is reasonable. Websi te d ownloading often requires a great dea l of d ownstrean1 s peed. So does video streaming. In contrast, few residential applications require full two-way high-speed service.
Digital Subscribe r Lines Telephone com pan ies have trad itiona lly served residential customers w ith one-pair voice-g rade (lPVG ) UTP in the local loop . This single unshielded pair was crea ted for voice, not data. It is o nly twis ted about o nce a foot. However, advances in signaling algorithms have allo\,•ed telephone con1panies to transmit d a ta at high speeds over these lines-\vhile continuing to deliver voice at the san1e time.
The line between the end offi ce switch and the customer is called the su bscriber line. When the telephone compan y transn1its d igital signals over it, it is called a dig ital subscriber line (DSL). These are also called DSL lines, d espite the fact that expanding the acronyn1 gives "digital subscriber line lines."
Sending data over 1-pair voice grade UTP is important because su bscriber lines using this technology already run to every home and business. They have been used since the 1880s to deliver voice telephone service. There is no need to run ne\v subscriber lines to homes in order to provide data transn1ission. In contrast, the business-focused leased lines that \-Ve \,viii see later req uire carriers to run ne\,, transmission lines to each o rganization. This is extren1ely expensive.
Cus tomer Premises 3
Downstream data (faster)
Upstream data (slower)
1
Telephone Company
5
DSL Access Multiplexer (DSLAM)
Single-pair voice-grade UTP Splitter':;::=-"'IL-__::.::.:.:::.=...::..=:...:..:::.:..::....:.=:....::..:..:__--( -<
2
Ordinary telephone service
FIGURE 10-5 Asymmetric Digital Subscriber Line (ADSL) f or Resident ial Access
PSTN
334 Chapter 10 • Carrier Wide Area Networks (WANs)
Residential Cu stom er Equipmen t a nd Service For ADSL service, a residen- tial customer installs ADSL modems, a lthough it is best to install splitters in each outlet. These splitters have two jacks-one for voice and o ne for data. Splitters separate voice and data signals, preventing possible transn1ission impairment.
How fast are transm ission speeds in ADSL? The an swer changes by the n1in- ute. In n,id-2004, the first author was getting downstrean, s p eeds of just u nder 10 Mbps and upstrean, speeds a little over 2 Mbps. This is fast e nou g h even for a high-definition movie do\,•nload. ADSL vendors hope to raise do\,•nstrean, speeds to 100 Mbps or more in the near future. Th is ½• ill pern,it several h igh-d efinition telep hone streams into the ho use. Faster upstream s peeds will make online bac kup for hard disks reasonably painless.
Car ri er End Off ice Equipm ent To provide ADSL, the carrier has to insta ll a ne\,, piece of equipn1ent at th e end office s\,•itch. This is a DSL access multiplexer (DSLAM) . When the custon,er transm its, the DSLAM directs voice signals to the p ublic switched tele phone. However, when da ta s ign als arrive, the DSLAM sends it on to an ISP. The DSLAM multip lexes incoming voice and data signals onto the subscriber line.
Fiber to the Hom e (FTTH) Alth ough DSL speeds today are quite fas t, sub- scribers \,•ant to bring high-definition video into their hon, es, and they want multiple ch annels at a tin,e. Al though 1-pair voice-grade UTP is a lready installed , its limits a re being reached. For s peeds beyond abou t 100 Mbps, carriers are beginning to bring fiber to the home (FTfH)-running optical fiber from the end o ffice switch to resi- den tial households.
Running new fiber to each household is expensive, so in1plementation \,•ill take tin, e. However, by converting e n tire neighborhoods to FTTH a t one time, carriers have been ab le to lower the ir per-house installation costs and o ffer more reasonable pn ces.
Test Your Unders tanding
6. a) Does residential DSL offer simultaneous voice and d ata service? b) Why is asymmetric speed acceptable in residen tial ADSL service? c) What is beneficial about transmitting data over 1-pair voice-grade UTP? d ) What equipment does the customer need in his or her home? e) What is the purpose of the DSLAM? f) Why is FI I H a ttractive? g) How are carriers atten1pting to reduce the cost o f installing FTTH?
Cable Modem Service
Telephone Serv ice an d Cab le TV In the 1950s, cable television con1panies sprang up in the United Sta tes and severa l other countries, bringing television into the hon,e. Ini tially, cable only brought over-the-air TV to rural areas. later, it began to pen- etrate urban areas by offering fa r n,ore channels than urban subscribers could receive over the air. In the 1970s, n,any books and articles forecast a "wired nation" in \,•hich two-way cable and the advent of 40-channel cable systen,s would soon turn cable into an infom,ation superhighway. (After all, it would be impossible to fill 40 channels just
Chapter 10 • Carrier Wide Area Networks (WANS) 335
6
Thick Coaxial Cable in Neighborhood (shared throughput)
7 Thin Coaxial Cable Drop Cable
Subscriber Premises
. 7 • - -41 UTP Cable
Modem
FIGURE 10-6 Cab le M odem Service
Neighbo<hood Splitter
5
4
Optical Fiber to
Neighborhoods
3 ISP
Internet
Cable Television Head End
with television, \,•ouldn't it?) However, ava ilable services d id not justify the heavy investment to m ake cable a two-\-vay service until n1any years later.2
Figure 10-6 sho\¥S ho\v cable television operates. The cable television operator has a central d istribution point, called a hea d end . F ron, the head end , signals travel out to neighborhoods via optical fiber.
From neighborhood splitters, signals travel through coaxial ca b le. The transmis- sion o f an e lectrical signal ah,•ays requires two conductors. In UTP, the n,•o conductors are the two wires in a pair. Figure 10-7 s h ows that in coaxial cable, the firs t con ductor is a \,•i re running through the center of a coaxial cable. The second conductor is a n1esh wire tube running along the cable. The two conductors have the same axis, so the tech - nology is called coaxial ca ble. Before the advent o f high-definition HDMI cables, you typically connected your VCR to your television \Vith coaxia l cable.
Inner Conduct°'
FIGURE 10-7 Coaxial Cab le
Outer Conductor
Mesh w~hin jacket.
Solid ring at end.
Insulation
7 Jacket
2 This was proven in the dissertation of a Stanford PhD student. The s tudent received. a contract from the \+\fhjtc House to do the study. Unfortunately, when the study was finished, Richard Nixon was being impeached, and the Executive Office of the President of the United States refused to release the s tudy-despite the fact that the results of the study were already widely known. The study was released a year later., anO the student was able to get his doctorate.
336 Chapter 10 • Carrier Wide Area Networks (WANs)
The cable television com pany runs signals through the neighborhood using thick coaxial cable that looks like a gard en hose. The access line to individual h omes is a thin coaxial cable drop cab le . The residen t connects the drop cab le to his o r her television .
cable Modem Service Cable television companies eventually moved beyond one-\vay television service to twO•\vay broadband (fast) data service. Fo r television, the repeaters that boost signals periodically along the cable run only had to boost tele- vision signals traveling downstream. Data transmission required cable companies to install two-way amplifiers, w hich could carry data in both directions. Although this \Vas expensive, it allowed cable companies to compete in the burgeoning market for b roadband ser vice. As in the case of ADSL, cable television service \Vas asymmetric, offering faster downstream speeds than upstream speeds.
Instead of having a DSL m odem, the subscriber has a cable modem. In general, this cab le d ata ser vice is called cable modem service . The coaxial cable d rop line goes into the cable modem. The cable m odem has a USB port and an Ethernet RJ-45 connector. The s ubscriber plugs a computer o r access rou ter into one of the two ports.
At the cable television head end, the cable television company connects to an Internet service p rovider. This allows subscribers to connect to hosts on the Internet.
Test Your Understanding 7. a) What transmission media d o cable television com panies use? b) Why is
coaxial cable called "coaxial?" c) Distinguish between the coaxial trunk cable and d rop cable. d ) What types of amplifiers are needed for cable data service? e) What device do customers need for cable modem service?
ADSL versus Cable Modem Service
Telep hone carriers and cable television companies constantly argue about the relative advantages of their nvo technologies. In reality, ho\vever, things boil d o\vn to speed and cost. The situation is changing rapidly. Both are increasing speeds frequently, and both are moving to FTTH. At most points in time, ADSL has been a little cheaper and a little slo\ver. It \Viii be inter<.>Sting to see ho\v competition driv~,s them to improve in the future.
Test Your Understanding
8. a) What are the important things to consider when deciding benveen ADSL and cable modem service for your residence? b) In the past, how has ADSL compared to cable modem service? c) Which of these two services is moving toward F I"IH?
CELLULAR DATA SERVICE
ADSL and cable m odem service provide wired access to the Internet by linking users to their ISPs. Cellular telephony now connects users to their ISPs w hile they are away from home, in the office, or in hotspots. Businesses use cellular telep hone service the same w ay.
Chapter 10 • Carrier \.Vide Area Networks (\.VANs) 337
Cellular Service
Nearly everybody today is familiar with cell ular telephony. In most industrialized countries, "'ell over half of all households no"' have a cellular telephone. Many now have only a cellular telephone and no trad itional wireline p ublic switched telephone network phone.
Cells and Cellsites Figure 10-8 s hows that cellular telepho ny d ivides a ,net- ropolitan service area into sn1aller geographical areas called cells. A city the size o f Honolulu ",jll have a fe"' hundred cells.
The user has a cell ular telep h o ne (a lso ca lled a mobile phone, n1obile, or cellphone). Near the n1idd le of each cell is a cellsite, \Vhich conta ins a transceiver (trans,n itter/receiver) to receive n1obile phone signals and to send signa ls o u t to the mobiles. The cellsite also superv ises each mobile pho ne's opera tion (settin g its po"'er level, initiati ng calls, terminati ng calls, and so forth).
Mobile Tel ephone Switching Office (MTSO) All of the cellsites in a cellula r syste,n connect to a mobile telephone s~tching offi ce (MTSO), ,vhich connects cellular custo,ners to one another and to ",jred telephone users.
The MTSO also controls \Vhat happens at each of the cells ites. It determines what to do "'hen people n1ove fron1 o ne cell to another, includ ing deciding "'hich cellsite s hould handle the trans,nission when the caller \Vishes to place a caU.3
Cellsite Figure 10-9 s ho"'S a typical small cellsite o n top of a residential building. The three large "paddles" are cellular antennas.
Handoffs If a subscribe r moves from one cell to another \Vi thin a city, the MTSO "'ill implement a handoff from one cellsite to another. For instance, Fig ure 10-8 s ho,vs
Mobile Telephone Switching Office (MTSO)
To Cellular / .. ---------- ""'-'.- .:;::::··------- - Phone Channel 47 2
I I To Wireline Initiate ·- . 'II ----. ._ '11 ..______ Channel Reuse
Ph Call , 4 C 3 • Permits Many
- one ', ar ' ~ ~ Subscnbers
CellASite ' Cell B .,.- '1 Cell E -~- / "Wireline" Phone ---.J.l' L ----i -
1 , 1 , t ~ , Cha\7
Car 1 # Cell A Cell D ~· Cell F ~ 1
"Cell" is a geographical area. .. CeU Site" is radio equipment.
FIGURE 10-S Cellular Teleph one Service
'II ,._. ;ti_-::::_ 3 ~ doff l ': / \ CellF' Car2 Cell C -
3 Scvcral cc.llsitcs may hear the initial request at different loudness !eve.ls; if so, the MTSO select,; a service cclls itc based on s ignal strength, not physical distance-.
338 Chapter 10 • Carrier Wide Area Networks (WANs)
A GURE 10-9 Ce llsite with Paddle Antennas
a hand off from Cell O to Cell P. The mobile phone \,•ill change its sending and receiving channels d u ring the handoff, b ut this occurs too rapidly for users to notice.4
Test Your Understanding
9. a) In cellular techno logy, w hat is a cell? b) What is a cellsite? c) What are the l\,vo func tions of the MTSO? d) In a cellular systen1, d istinguish beh'l'een hand offs and roaming.
Why Cells?
Why not use just o ne centra l transn1itter/receiver in the midd le o f a metropolitan area? Early pre-cellular rad io telephone systen1s did use a single antenna, and this \,•as m uch cheaper than using m ultiple cellsites.
The answer is channel reuse. The number of channels permitted by regulators is limited, and subscriber dem and is heavy. Cellular telephony uses each channel n1ultiple tin1es, in d ifferent cells in th e network. This mu ltiplies the effective channel capaci~, allowing m ore subscribers to be served w ith the limited number of channels available.
Test Your Understanding
10. a) Why d oes cellular telephony use cells? b) What is the benefit of charmel reuse?
4 ln contrast, if a subscriber leaves a metropolitan cellular system and goes to another city or countryi this is roaming. To col\fusc matters, many carriers only call going to another city roaming if the home carrier docs not offer service there. 5 Jn a sense, enterprise wireless LANs with many access points arc Hkc cellular technologies. They allow users to employ the limited number of frequencies available in WLANs many times within a building.
Chapter 10 • Carrier Wide Area Networks (WANS) 339
Cellular Data Speeds
One problem in evaluating the speeds of differen t cellular carriers is tha t throughput is always considerably lower than advertised speed and varies widely within a system. There are several reasons for this.
• There is extensive overhead in cellular transmission. The da ta transn1ission rate is ah,•ays less than the bit transmission rate.
• If the user is riding in a car, throughp ut will fall.
• If n1ore customers use a cellsite, the cellsite n1ay have to decrease the transmission speed to each. In particular, speed \,•ill depend on time of day.
• If the user travels into an area w ith an overloaded cellsite, s peed w ill be lower. • At greater distances from a cellsite, speed falls, just as in Wi-Fi.
• Weakened signal s treng th caused by transmission through buildings w ill a lso reduce speed.
Test Your Un derstanding
11. What fa ctors affect what through pu t an ind ivid ual user will receive?
CELLULAR GENERATIONS: 3G, 4G, AND SG
Cellular telephony has been transformed repeatedly since its birth in the 1980s. It is com- n1o n to describe this evolution as a series of generations, with each generation bringing n1ore speed and other benefi ts. Cellular carriers report that we are now buying fourth- generation (4G) phones and are about to see fifth-generation (5G) cellular systems.
The idea of generations began \,•ith s tandards agencies led by the In terna tiona l Telecommunications Union (ITU), which crea tes and authorizes standards for cel- lu la r te lep hony. Unfortunately, cellu lar carriers have largely ign ored these officia l generations. Carrier marketing departments, for examp le, have used the term 4G for services that are 100 times slower than ITU's 4G standards req uire. Carriers are now preparing to market 5G systems; this is interesting because the ITU has not created SG standards yet.
Corporations deal \,•ith carriers ra ther than the ITU-T, so \,•e \,• ill (reluctantly) discuss genera tions as carriers do. F igure 10-10 shows th at carrier generations have come roughly every decade since the 1980s. It a lso shows their typical data speeds and the ne\,, applica tio ns that each generation n1ade possib le.
• The first generation appeared in the early 1980s. Th ese systen1s were lin1ited to voice comn1un ication. Ju st being able to talk w hile walking around \,•as revolutionary.
• The 1990s brough t 2G systen1s. These \,•ere still primarily telephones, but they \'\'ere entirely d igital services. They could carry data-but only a t the incredibly slo\,, speed of 10 kbps. (This is not a typographical error. This at least permitted text n1essaging and text-only e-mail.
• The new cen tury introduced n1obile phones that \,•ou ld be fan1iliar to today's users. 3G systems brough t Internet access wi th speeds that at least n1ade some
340 Chapter 10 • Carrier Wide Area Networks (WANs)
Carrier Typical Data Application Generation Dates Speed Now Possible Remark s
1G 1980s Voice-on ly Voice telephony
2G 1990s 10 kbps Texting and First generation of Text-Only digital devices and E-Mail digital transmission
3G 2000s A few hundred Web Surfing kilobits per second
4G 2010s (current) 10 Mbps Video Uses IP for transmission. Streaming
SG 2020s 100 Mbps Low -power mode for loT devices
Low-latency for responsiveness
FIGURE 10- 10 Cellular Generations (Carrier Terminology)
sense-a fe\v hundred kilob its per second. This \'l'as far from perfect, but even slowly loading \,•ebpages on a phone were welcon1e. From a technica l stand- poin t, all 4C systems run over IP. This integrates cellu lar data service with n1ainstream networking.
• We are currently in the fourth generation of cellular phones. Throughputs of 10 Mbps are con1mon. Surfing the Internet is no\,, con1fortable. Beyond that, we can no½' strean1 television, n1ovies, and videos of kittens.
• We are about to see a ne\,, generation of service. Most obviously, SC shou ld boost speed by ano ther order of n1agn itude. It ½•ill also have many other technical advances. For one thing, i t will offer lo\,•-speed, lo\,•-power modes to br ing the In ternet of Thi ngs into the cellular world. In addition, SC cellu lar should slash latency. This will n1ake interactions with remote soft- ware far more natural, s lashing the las t n1a jor imped in1ent to working with remote systems.
Test Your Und erstand ing
12 . a) What does "C" stand for in cellu lar telephony? b) Which generation first brought d ecent Web access? c) Which generation is now bringing speeds of about 10 Mbps? d) What speeds can we expect from 5C? e) Why w ill SC also bring energy-efficient lo\,v speeds? f) When carriers use the terms 4C and SC, do they use it consistently with the formal standards for 4G and SC?
WIRED BUSINESS WANs
To con1municate w ith customers and for access to remote en1ployees, companies use the Internet. However, they still need to use carrier WANs to reach the Internet and to connect their sites to one another. Figure 10-11 illustrates this situation.
Chapter 10 • Carrier Wide Area Networks (WANS) 34 1
Most corporations link their sites using multiple carriers and multiple types of WAN .
Corporate Site B
Leased line 1
Corporate Site A
Corporate SiteC
Leased Line3
leased Line 4
Leased Une6
Corporate Site D
FIG URE 10-11 The Internet and Wired Carrier WANs fo r Business
Leased Lines
To connect to the Internet, Figure 10-11 shows that companies typically use leased lines from a carrjer, n1ost con1m only the loca l telephone con1pany. Leased lines are fast, point-to-point, a lways-on connections. As the name suggests, if a company wishes to use a leased line, it must sign a lease for a specified d u ration. Specifying the wrong speed \,•hen a leased line is ordered creates a persistent problem.
Figure 10-12 shows that a leased line is really a complex transmission path between the two points it connects. This path passes th rough c ustomer access lines a t the h,vo ends and trunk lines between carrier switches along the path. To the user, however, the access line seems to be a sin1ple d a ta pipe all its own.
...,,.. ... , ...... ',,
', ',,
End Office
',,, ________ _
',
Intermediate Swttches
Leased Line Circuit ',, Acts like a physical link between sites ',,
', ',
The customer must have a CSU/DSU at each corporate site. This is customer premises equipment.
End Office Switch
CSU/DSU
~ Line ',, ' -~
FIGURE 1 0--1 2 Leased Line, Trunk Lines, and Access Lines
342 Chapter 10 • Carrier Wide Area Networks (WANs)
To use a leased line, a company needs a p iece of custon1er premises equipn1en t called a CS U/DS U.6 The p urpose of trus d evice is to translate the physical layer signals of neh,•ork devices on the customer premises into physical layer signals in a format that leased lines require.
Test Your Understanding
13 . a) Wha t are the characteristics of leased lines? b) Distinguish between leased lines and access lines. c) Wha t d evice must a cus tom er have at its site to connect to a leased line?
Reaching the ISP via a Leased Line
A com pany needs to connect to its ISP. The simplest way to do this is to run a leased line from the company to the ISP's nearest access location. We kno\,• tha t this access line \-Viii pass through severa l transmission lines and switches, b ut networking pro- fess iona ls usually draw leased lines as th ey appear to be, nan1ely a poin t-to-point transmission link. Figure 10-11 illustrates this approach.
Test Your Understanding 14 . When a c uston1er uses a leased line to connect to its ISP, w hat two points does
the leased line connect?
Leased Line Private Corporate WANs
Companies need to communicate with their ISPs. If they have n1ultiple sites, they also need to connect these s ites into a coheren t neh,•ork for interna l comm unication. Figure 10-13 sho\,•s that they can d o trus by build ing a leased line neh,•ork th a t \,•ill create a private in ternal WAN. Site routers rou te packe ts a m ong the sites.
Figure 10-14 shO\'\'S that leased line speeds vary \,•idely. Under 50 Mbps, leased line speed standards were set regionally. The United States and Canada use the North Amer- ican Digital Hierarch y Standard. Europe uses the CEPT H ierarchy. Other countries m ay use d ifferent standards. Fortunately, it is possible to translate bel\,•een d ifferent leased line hierarchies, but the d iversity of sta ndards d oes cause minor problems.
Above 50 Mbps, carriers have standard ized on a sing le standard that is called Syn chronous Op tical Network (SONET)7 or Synchronous D igita l H ierarch y (SDH). SONET and SDH use differen t nam ing conventions for thei r lines. For example, SONET labels its lines w ith OC (op tical carrier) num bers, while SDH u ses STM (sync h ronous transport module) desi~na tio ns. Other than nan1ing differences, their serv ices are identical a nd compatible.
The line naming conventions a nd speeds are easier to understand if you under- stand tha t all SONET /SDH speeds are n1u ltip les of 51.84 Mbps. The slo\,•est OC line
6 Channel Scnricc Unit/ Data Service Unit. Not very informative. 7 SONET is the terminology used in tho United States and Canada. The rest of tho world uses tho SDH nomenclature. 8 Apart from a fow w1important differences.
Chapter 10 • Carrier Wide Area Networks (WANS) 343
Leased Line 1
Site D
/ /
Router D
1
Leased Line 2
Sites within an organization are connected by leased lines.
Leased
Router E
Router F
Leased Lines
FIGURE 10-13 Leased Line Pr ivate Corporate WAN
Router C
2 Leased Line Dat a
N e tworks have one o r more routers
a t each site.
that carriers offer is OC-3, which is th ree tin1es the base speed. SDH carriers call this STM-1 because it is the first (slowest) speed they offer.
Appl ying Figure 10-14 Applying the inforn1a tion in Figure 10-14 is straight- forward. If you have a requ irement for a particular speed between h,vo points, you select a leased line sufficient for tha t speed. For examp le, if you require a speed of 100 Mbps, you select an OC-3 or STM-1 line.
Carriers often offer more choices, predon1inantly a t lower speeds. WAN line speeds tradi tionally were slow, aroun d one to h'l'o megabits per second. Th is \'l'as roughly Tl/El speed. Given freque nt deman d for a fractio n of a Tl or El line, car- r iers typically offer fractional T l /El speeds for a fraction of the cost of a full T l /El line. If you need 200 kbps, you cou ld get a fractional Tl line run ning a t 256 kbps, which is 16.5% of a T l line. As you might suspect, carriers \'l' ill charge more than 16.5% of w hat th ey ch arge for a full Tl line.
Carriers also a llow a cus tomer to bond t\,•o or more Tl/El li nes together beh,•een a pair of sites. For exan1ple, if you need 2.8 Mbps beh'l'een a pair of sites, you might bond h'l'o Tl or El lines.
Tradi tionally, Tl/El leased lines required running a new 2-pair da ta-grade UTP line to the customer's prem ises. This is expensive. In add ition, the telephone system already runs 1-pair voice-grade UTP to all premises, including bus iness premises. We saw earlier in this chapter that carriers run asymmetrica l d ig ital subscriber line (ADSL) services over these lin es. We a lso sa\,, that ADSL today is n1uch fas ter than Tl/El speeds. Consequen tly, many carriers \,•ho offer "Tl" a nd "El" lines today are really offering DSL service over 1-pa ir voice-grade UTP.
344 Chapter 10 • Carrier Wide Area Networks (WANs)
North American Digital Hierarchy
l ine Speed Typical Transmission Medium
T1* 1.544 Mbps 2-Pair Data-Grade UTP
T3 44.736 Mbps Carrier Optical Fiber
CEPT Hierarchy
l ine Speed Typical Transmission Medium
E1* 2.048 Mbps 2-Pair Data-Grade UTP
E3 34 .368 Mbps Carrier Optical Fiber
SONET/SDH Speeds
line Speed (Mbps) Typical Transmission Medium
OC3/STM1 155.52 Carrier Optical Fiber
OC12/STM4 622.08 Carrier Optical Fiber
OC48/STM16 2,488.32 Carrier Optical Fiber
OC 192/STM64 9,953.28 Carrier Optical Fiber
OC768/STM256 39,813.12 Carrier Optical Fiber •often offer synchronous OSL over exjsting 1. pair voice grade UTP rather than offering traditional T1 and E1 service over 2.pair data grade UTP, which must be pulled to the c:ustomel''s premises.
Fractional Tl speeds are often offered by carriers. These typkally include some subset of the speeds 128 kbps. 2S6 kbps, 384 kbps, 512 kbps, and 768 kbps.
T1 and El lines can be bonded to provide double, triple, or quadruple the capacity of a single line.
AGURE 10- 14 l ease d line Spee ds
However, carriers d o not offer asyn1metric DSL service to organizations because b usinesses need symn1etric speed-the sam e sp eed in both directions. Conseq uently, carriers offer s ynchronous DSL services to businesses. Businesses also require quality- o f-service (QoS) guaran tees, so these synchronous DSL lines con1e w ith service level agreen1ents. SLAs n1ean th at th e DSL services o ffe red to bu sinesses are more expensive per b it transn1itted than residentia l ADSL service.
M anaging the W AN Leased line corp o rate WANs do not design and op era te then1selves. A company th at uses leased line neh-vorks to connect its s ites faces sub- s tantial labor and c uston1er p remises e q uipm ent costs.
Test Your Understanding
15 . a) If you need a s peed o f 1.2 Mbp s beh-veen h,•o p oints in the Uni ted States, what leased line \,•ould you s p ecify in the United States a n d in Eu rope? b ) Repeat fo r 160 Mbps. c) Repeat fo r 3 Mbp s. d) Why d o carriers offer lo\,•- s peed "leased lines" that a re really DSL lin es? e) Ho\,v d o business DSL lin es d iffer from resid entia l DSL lines? f) Why is the need to man age th e leased lin e neh,•ork a n issu e?
Chapter 10 • Carrier Wide Area Networks (WANS) 345
CARRIER WAN SERVICES
It is p ossible for corporations to d o all their interna l wide area networking using leased lines. But bu ilding an d managing con1plex networks of leased lines is a great deal of work that requires a networking staff with high expertise. Instead, most firn15 tum to carriers, w ho offer complete Layer 2 and Layer 3 WAN services. There are large econ omies o f scale in managing such networks, so carriers can offer them a t an attractive price p er b it transnutted. Two technologies dominate these carrier WAN services today. These are car- rier Ethernet and Multiprotocol Label Switching. We now look at critical features of both.
Carrier Ethernet
In the 1980s, there were n1an y LAN technologies. However, Ethernet alone s u rvived, thanks to its low-cost operation and its ab ility to grow to ever-faster speeds. Today, Ether- net is available in \,•ide area neh,•orking. This extension of traditional Ethernet was origi- nally called n1etropolitan Ethernet. Today, it is called carrier Ethernet. Carrier Ethernet is not exactly the same as Ethernet for LANs. Carrier Ethernet requires son1e extensions, but they are no t large. If you know traditional Ethern et, it is straightfonvard to extend your expertise to carrier Ethernet. Carrier Ethernet services are d eveloped by MEF (fom1erly the Metrop o litan Ethernet Forum), and detailed technical standards are created by the IEEE 802.3 Working Group. Figure 10-16 shows that n,•o of these services have donunated so far.
• E-Li n e Service is a s ite-t~site service. It con1petes d irectly with leased lines but handles fran1e fom1atting and other Layer 2 functionality.
• E-LAN Service essen tially exten ds the LAN to th e \,•ide area. Sites can use Ethernet to conmu micate back and forth as if the Carrier Ethern et \,•as sin1ply a set of trunk lines between s\,•itch es.
In b oth services, and in severa l oth er carrier Ethern et services, the leased line carrier service term ina tes in a CSU/ DSU that is connected to an Eth ern e t S\'l'itch instead of a rou ter. This means that the service d oes no t require TCP /IP expertise or become in volved \'l'ith the con1plexities of TCP /IP. E-lin e service essentially offers a long-d istance trunk lin k bel\,veen Ethernet swi tches. E-LAN service, in turn, acts to connect Eth ernet s ite LANs into w h a t is effectively a super LAN.
Traditional Ethernet Carrier Ethernet
Use Case LANs WAN connections, mostly in metropolitan areas
Operates at Layers 1 and 2 1 and 2
Standards Creation Standards are created by the Seivices defined by MEF. IEEE 802.3 Working Group. Standards extensions created by the
IEEE 802.3 Working Group.
Standards Scope Core Ethernet 802.3 standards These, plus some extensions developed by the IEEE 802.3 Working Group.
FIGURE 10-1 5 Traditional Ethernet versus Carrier Ethernet (Study Figure)
346 Chapter 10 • Carrier Wide Area Networks (WANs)
Site 1
DSU CSU/1
lilt
Sites are connected by
Ethernet at layer 2 over Leased Lines
at layer 1
Site 100
E-Line Service Site 101 / E-l.AN Service -:-----~
Site2 .-...: - Any host in any site can talk to
any host in any other site.
Site 102
FIGURE 10-16 Using E-Line and E-LAN Carri er Ethernet Services to Extend Ethernet LANs
Carrier Ethernet has a number of attractions.
• Cost. Using Ethernet's familiar low-cost MAC layer functionality, carrier Ethernet 1s inexpensive.
• Fnmilinrity. Sites o nly have to p lug carrier tern1ination equipn1ent into an Ethernet s\,•itch port. There is no need to learn a ne\,, techno logy.
• Speed. Companies that need fast connections can get 100 Mbps, 1 Gbps, or 10 Gbps at attractive cost.
• Speed Agility. If companies need extra capacity for a limited period of tin1e, such as a year-end crunch, carrier Ethernet carriers can usually reprovision their services qttickly.
• Quality of Service. Carrier Ethernet can offer quality of service Ethernet guarantees for speed, availability, fram e delay, fran1e jitter, and frame loss.
• Security. Although Carrier Ethernet does not include cryptographic p rotections, the traffic of d ifferent customers is kept separate to prevent eavesdropping. Only some offer cryptographic security beyond this traffic segrega tion.
Test Your Und erstanding
16. a) Why is it attractive for companies to use layer 2 and Layer 3 WAN services offered by carriers? b) Ho\'I' does carrier Ethernet differ from traditional Ethernet? c) What is the d istinction between E-line and E-LAN services? d) What are the attractions of carrier Ethernet for corporations? e) What is speed agility?
Low cost per bit transmitted Uses familiar Ethernet t echnology
High speeds available Speed agility: increases in speed can be provisioned rapidly
Quality of service
Security by segmenting customer traffic but not always cryptographic security
FIGURE 10- 17 Carrier Ethernet Attractions (Study Figure)
Chapter 10 • Carrier Wide Area Networks (WANS) 347
Multiprotocol Label Switching (MPLS)
M aking Rou ting M ore Effic.ient In Chapter 8, we saw that routers look at an incoming packet's destination IP address. They compare that IP address to every ro\,• in the routing table, select the best match, and send the packet back out a certain port to a certain IP address. The next packet to arrive gets the same treatment-even if it goes to the same IP address.
Many routers can do decision caching, in which they remember their decisions for certain IP address ranges. We saw that this is dangerous. Fortunately, there is a n1ore robust \,•ay to avoid having to look at all rows for all packets. This is Multiprotocol Label S,vitching (MPLS), which Figure 10-18 illustrates.
Op eration When two hosts s tart to converse, an MPLS neh,•ork first deter- n1ines the best path for the packets. This is the la bel switched path. Routers \Viii send all packets a long this path rather than making traditional routing decisions for each packet at each router.
As Figure 10-18 sho\'l'S, after the label switched path is established, the source host transnuts packets normally. The first router is a la bel switching rou ter. It inserts a 32-bit label header in front of the IP header and after the frame header. The IP packet syntax and the fran1e syntax are unchanged.
The label header's label number identifies the label s\,•itched path selected for this conversation. The first label switched router and all others a long the label s\,•itched path have MPLS lookup tables. These tables allow rou ters to look up the label nun1ber, read the corresponding interface, and send the packet out the indica ted interface. For exan1ple, if the label nun1ber is 47, the router in Figure 10-18 w ill send it out Interface 1. Table lookups are fast because only one row will match the destination IP address. There is no need to look at all routing table ro\,•s to select the best interface to send a packet back out. The hard work was done ½•hen the label switched path was crea ted.
1 IP
Packet
1 I
label-Switched Path
Label-Switching Router 3
Label # Interface
47 1 123 1 752 3
2 label-Switching Router 1
Adds label
Label-Switching Router 2
~---------- ~-, .. -..-:"lo.. label /.
~- IP / ' • Packet Label
/
Label- ! I Switching "'- 5
-..- Router3 ____ ' ._.., IP _, ..._- Routes ,r- ,., - ;:;:'::','.~ P~a~c~ke~t
label- o n Basis Label-Switching I I Switch ing 01 Label Router 5 Router 4 Remo·ves Label
MPLS reduces fo rwarding costs and permits traffic engineering, including quality of service and traffic load ba1ancing,,
FIG URE 10-18 Multiprotocol Label Switchi ng (MPLS)
348 Chapter 10 • Carrier Wide Area Networks (WANs)
The last label switching router ren1oves the label. Note that neither the source host nor the d estination host kno\,•s th a t label switch ing was done. MPLS operation is transpar- ent to hosts.
Often, all traffic beh,•een h,•o sites is assigned a single label nun1ber. Or, traffic between h,•o s ites might receive one of a handfu l of label numbers. D ifferen t label nun1bers might correspond to label S\-vitched paths wi th different quality of service ch aracteristics.
Benefits MPLS offers three major benefi ts.
• First, MPLS slashes the work each router n1ust d o a nd therefore s lashes a com- pany's rou ter costs.
• Second, as we just noted, MPLS can be used to assign paths based o n th e QoS requirements of different packets.
• Third, MPLS can d o traffi c engineering, that is, manage how traffic \,•ill travel through th e network. One traffic eng ineering capability is load balancing, that is, n1oving some traffic from a heavily congested link between h,•o routers to an al terna tive route tha t uses d ifferen t and less-congested links.
Carrier MPLS Compa nies can create the ir own MPLS nel\,•orks, bu t they typically use carriers to provide MPLS for their WAN comm u nication. Many o f these carr iers are Internet service prov iders \,•ho already use MPLS within their o\,•n internets. They ex tend the benefits of MPLS to the ir customers. Tha t is impos- sible for the Internet as a \Vho le because there is no cen tral control organization for the In tern et.
An Expensive Service Given tha t MPLS should reduce rou ter costs \'\'hen delivering individ ua l packets, you n1ight think that MPLS wou ld be a n inexpensive serv ice compared to just using the Internet. Unfortunately, that is not the case. The n1ain attraction of MPLS for corporations is its ability to im p lemen t strong QoS ser- vice level agreemen ts (SLAs). Corpora tions cannot live with the "best effort" lim i- tations of the core In tern e t for many of the critical transmission needs in the core transaction processing appl ications that drive firms. MPLS allows network admin- istrators to control traffic priorities in a flex ible way, e nsu ring tha t critical services get the service they require. Companies pay high prices for this manageability, and al tho ugh they are not happy abou t these prices, they need MPLS to sa tisfy th eir QoS needs.
Extendibility If MPLS is so good, why not use it everywhere o n the Internet? The answer is that MPLS reqttires a single adn1inistrator to manage the entire neh,•ork of label switched routers.
Tes t Your Understanding
17. a) In MPLS, is selecting the best interface for each packet at each router d one when the packet enters the neh-vork or before? b) Why is this beneficial? c) What is the name of the path selected for a particu lar conversation? d ) When
Chapter 10 • Carrier Wide Area Networks (WANS) 349
a sou rce host firs t transn1its to a d estina tio n host after a label switched path is established, what \'l'ill happe n? e) Do label switching routers along the MPLS path look at the packet's IP ad dress? The answer is not explicitly in the text. Explain your reasoning. f) On w hat basis does each label switched router base routing d ecisions? g) Why is MPLS transparent to the source and destination hosts? h) What are MPLS's attractions? i) What is traffic engineering? j) Can MPLS p rovide tra ffi c load balancing? k) Ho\,v does the price o f us ing MPLS compare w ith the price of simply sending tra ffic over the Internet? l) Wh y do firms pay this price d ifference?
WAN Optimization
Given the high cost of long-distance transmissions, con1panies need to squeeze out every bit of performance improvement they can fin d for data over WANs. Figure 10-19 shows that one a pproach is to install WAN optimization devices a t each end o f important shared lines between sites.
Compression The most important action tha t WAN optimization devices take is to compress all data being transmitted into the line and d econ1press the d a ta at the o ther end. Compression is p ossible because aln1ost all d a ta contains red undancy that can be reduced through encoding. For n1ovies and voice, compression can be substan- tial. For \'l'ord processing d ocun1ents and spreadsheets, com pression is less effective. In the figure, the WAN o ptin1ization devices can provide an average of 10:1 com pression. Sou rce A is transn1itting at 3 Gb ps, and Source Bis transmitting a t 5 Gbps. Thls is a total of 8 Gb ps arriving at the WAN optimization device. However, \,•ith 10:1 compression, the transn1ission line only has to carry 0.8 Gbps. This w ill fi t in a 1 Gbps transmission line. Without compression, the company would need a n1uch m ore expensive 10 Gbps transmission line.
Caching Another \,vay to red uce the number of bits flowing through the transnlis- sion line is caching. (See Figure 10-20.) Suppose the con1pan y produces a large annua l report. The server hold ing the report is in Source A. The annual report is likely to be trans- n1itted multiple times fron1 Sou rce A to recipients in Sou rce C and Source D. With a WAN
Source A
Gbps
WAN OptimizatiOn
Device (10:1)
1 Gbps Une
800 Mbps (8Gbps
without compression)
FIGURE 10-19 WAN Opti mizat ion: Compressio n
WAN Optimization
Device (10:1) 3
__...,. G~
Gbps
Destination C
350 Chapter 10 • Carrier Wide Area Networks (WANs)
XYl XYl
Compressed
~ Receiver
decompresses XYZ, Delivers XYZ
Copies to Cache
Deliver XYZ
XYZ
----~ ~ ~ z
Cache
Sender transmits "Deliver XYZ"
Receiver delivers it ~ from the cach_._ / .:J XYl
Cache
AGURE 10- 20 WAN Opti mi zation : Caching
optinuzation device that has caching, when the annual report is first delivered, it is copied onto the receiving WAN optin1ization device's disk cache. later, when the annual report is to be transnutted again, the WAN optin1ization device near Source A and Source B \,•ill not transnut the entire file. Instead, it will send a brief message to the WAN optinuzation device near Source C and Source D. This n1essage asks the WAN optinlization device o n the right to retrieve the annual report from the cache and send it to the receiver. Avoiding the retransmissio n of frequently transmitted files can reduce traffic considerably.
Traffic Shaping In many cases, unfavored app lications take up too much capacity. U nfavored applica tions may include YouTube, Netflix, and BitTorrent for file sharing. Son,e WAN optinuzation devices do traffic shaping. (See Figure 10-21.) When undes ired traffic reaches a n op timization device, the device may simp ly prohibit
Unfavored Applications (YouTube, Netflix, BrtTorrent, etc.)
Blocked or Rate Limited
Approved Applications (E-Mail, Database, etc.)
Permitted
Traffic Shaping Avoids Congestion
Application and Network Protocol ""'-;;;°' Acceleration through Tuning
to Reduce Latency
AGURE 10 -21 WAN Opti mization: Traffic Shaping and Application and Network Protocol Acceleration
Chapter 10 • Carrier Wide Area Networks (WANS) 351
it. The device can also take a less d rastic action-limiting th e a p p lication to a small percentage of the total traffic. Both can dram a tically red uce overall traffic, allowing the firm to avoid u pgrad ing its transn1ission lines.
A pplication and Network Prot ocol A cceleration (Tuning) Many app lica- tions and network protocols are somev>'hat inefficien t \,•hen they transmit over long- d istance lines. TCP, for example, tends to have conservative transmission defau lts that slow transmission. It n1ay be possible to tune TCP by adjusting such things as time s pent waiting for ackno\,•ledgments before retransmi tting a TCP segment. To give another example, when a WAN o ptin1ization device receives a TCP SYN segment, it m ay send back an ACK even before it passes th e segment o n to its intended host. Application and neh,•ork acceleration is a family of tactics the WAN optin1ization d evices can use to reduce latency, w hich tends to be a p roblem \,•hen signals m ust travel long distances. Althoug h tuning can take place o n hosts, WAN o ptin1ization devices provide a centra l point for tuning and tuning tools.
Applica tion an d n etw ork accele ration is a family of tactics the WAN optimization devices can use to reduce lat ency, wh ich tends to be a problem whe n signals must trave l long distances.
Test Your Understanding
18. a) Where are WAN o ptin1ization devices found? b) List the fou r n1echanisn1s we d iscussed for optimizing transmissio n over a transn1ission link. c) Ho\,, does compression reduce traffic? d ) How d oes caching reduce traffic? e) Exp lain traf- fic shap ing. f) Ho\'I' d oes traffic shaping red uce tra ffic? g) What is the n1ain benefit of applica tion a nd network protocol acceleration?
END-OF-CHAPTER QUESTIONS
Thought Questions
10-1. D istinguish between dial-up te lephone service you u se as a consumer and leased line services used i n business. (You w ill have to extrapolate from your own experience with dia l-up lines.)
10-2. If you have a nehvork of leased lines, you have options for how many sites you connect. Sites can communicate directly or through intermediate sites. a) In a full mesh, every pair of sites will be d irectly linked by a leased line. If there are N s ites, there w ill be N"(N-1)/ 2 connec- tions. In Figure 10-13, how many leased lines would be used in a full mesh? b) In a hub-and-spoke net wor k, there is
a central site, and a leased line radiates from it to each other site. In Figure 10-13, how many leased lines would be used in a hub-and-spoke networ k w ith the hub located at Site A? c) What is the benefit of full mesh networks over hub-and-spoke nehvorks? d) What is the advantage of hub-and-spoke nehvorks over h ill mesh nehvor ks? e) How would you use this information about advantages to advise a com pany about what to do when it installs a nehvork of leased lines?
10-3 . In ADSL service, there is a s ingle UTP pair running from the end office switch to the i ndividual household . In cable
352 Chap ter 10 • Car rier Wide Area Networks (WANs)
m odem service, the thick coaxial cable in the neighborhood is shared by many subscribers. Yet, typically, cable modem service provides faster service to indi- vid ual customers than ADSL. H ow can this be? Hint: Draw a p icture of the entire situation fo r both ADSL and cable modem service.
Hands-On
10-5. If you have a smartp hone, d ow nload an app to tell your data transmission throughput. What did you find?
Perspective Questions
10-6. Wh at was the m ost surprising thin g you leam ed in this chapter?
10-4. a) What two wired WAN technologies are growing rapidly? b) Compare their rela tive attractions and m ain uses. c) Why will leased lines continue to be important e ven if networks of leased lines a re no longer used?
10-7. What was the most difficult part of this chapter fo r you?
Chapter 11
Networked Applications
LEARNING OBJECTIVES
By the end of this chapter, you should be able to: • Explain core concepts in nenvorked applications and application architectures.
• Describe ho\v taking over an application can give an attacker the ability to control the computer.
• Describe ho\v Netflix uses cloud computing and how this illustrates the importance of host technology (and cloud computing specifically) as a driving force for nehvorking.
• Describe the World Wide Web in terms of standards and explain how a \Vebpage with text, graphics, and other elements is downloaded.
• Describe electronic mail standards and security.
• Describe voice over IP (VoIP) operation and standards. • Explain \vhy peer-to-peer (P2P) computing is both desirable and dangerous.
INTRODUCTION
We finally arrive at Layer 5, the application layer. This is the only layer users care about. (Lo\ver layers come to the attention of users only when they fail.) Of course, improve- ments in lo\ver layers have a major impact on application design. However, application quality and performance are always the litmus tests for users.
353
354 Chapter 11 • Networked Applications
Networked Applications and Application Architedures The first computers were mainframes that worked with dumb terminals that were remote keyboards plus attached printers or displays. (This \Vas before microproces- sors, so terminals were not smart.) All applications used stand-alone processing on the central computer. PCs also began as stand-alone devicl-'S in which a program ran on a single machine.
In stand-alone processing, all application processing is done on a single machine.
Today, however, most applications are networked applications, which are sets of interacting programs running on two or more hosts. When a software developer w rites a program, it is usually a program designed to talk to another program on a different host. This radically changes the \Vay programs are w ritten, tested, and deployed. We \Vil! focus on networked applications.
Nehvorked applications can use an infinite number of alternative interaction pat- terns. However, two have dominated, and l\vo more are emerging. We call patterns of interactions between networked applications on different machint,s application archi- tectures. Figure 11-1 lists four application architectures.
Application architectures are patterns of interactions between networked applications on different machines.
• As just noted, the first computers were large mainframes connected to dumb terminals. They did stand-alone processing.
Netwol11ed Applications Netwol11ed applications require netwo111s to operate World Wide Web, e-mail, etc.
Application Architectures How application layer functions are spread among computers
Driven In part by growing client processing power, memory, etc. Stand-alone computing CllenVserver architecture Peer-to-peer architecture Distributed computing architecture
Changing Programming and Server Locations
Programmers now write software on one machine that interacts with software on other machines
Programmers must understand application architectures and networking Falling networking costs are resulting In the consolidation of servers
FIGURE 11-1 Basic Networked Appl ication Concepts
Chapter 11 • Nehvorked Applications 355
• Wh en PCs began to appear, their processing po\,•er, memory, and commu ni- ca tion ab ilities \,•ere rud imentary. Progran1mers aga in wrote stnnd-nlone pro- grnms, this time runnjng on desktop PCs and later on laptops. O ne stand-a lone application emulated a dumb term inal, allo\,•ing PC users to comn1urucate \,•ith mainframes over d ial-up telephone modems that usually sent and received at a mere 9,600 bps or less. Term inal emulation software turned expensive PCs into cheap dumb terminals. The n1a infran1e, unaware that the device at the end of the transn1ission line had son1e intelligence, continued to run stand-alone programs.
• As PCs gre\,• more powerful, \,•e saw the rise of the programs that were true net- \,•ork applications. These in1plemented the cl ient/server architecture in \,•ruch the no\,•-smart PC shared processing chores with servers. The World Wide Web \,•as the driving force berund the client/server architecture.
• La ter, clients grew as po\verful as older servers. This meant tha t a client could provide server capabilities to another client, elin1inating the need for a server. PCs s it idle most of the tin1e, so this peer-to-peer computing had the potential to greatly reduce the number of servers a company needed to buy and manage.
• We seem to be moving toward an era of distributed computing architecture, in wruch a program running on one machine calls multip le programs on other macrunes, \,•h ich n1ay call progran1s on yet o ther mach ines. After calling other programs, the calling progran1 uses results from the called progran1s in its own logic flow.
Programming Networked Applications As applica tion architectures grow n1ore con1plex, the job of writing programs to run on them also becon1es n1ore con1- p lex. Today's programn1ers n1ostly write progran1s that call o ther programs on other n1achlnes to do their \,•ork. In this sense, neh,•orking has revolutionized programn1ing. At the same time, more con1plex architectures create greater challenges for networking professionals because growth in cl ient/server computing and oilier innovations p laces demands on neh-vorks fuat are greater in terms of speed and often in other character- istics, such as latency. When you talk to your voice assistant on your phone, tablet, or computer, back-end servers must do soprusticated artificial intelligence processing before your local device replies. Trus and o ther application development trends require slasrung latency in round-trip response time to a fe\,v ntllliseconds.
Changing Server Locations Today, network transn1ission costs are fa lling rap- idly. As they do, the economic need to keep interacting computers very close together continues to fade. For severa l years, companies with dozens of local server roon1s have been consolidating in a fe\,• regional locations to take advantage of econon1ies of scale and inexpensive rural areas. Tahlng advantage of this trend, cloud computing involves outsourcing the ownersrup and managen1ent of servers, programs, or both to a cloud service provider such as An1azon Web Services or Microsoft Azure. We look at an exam- p le of cloud computing in the next section so you can understand its far-reaching impli- cations for networking. We a lso look at cloud computing because it is important in and of itself to IT professionals.
356 Chapter 11 • Nehvorked Applications
Test Your Understanding
1. a) What is a neh,vorked a p plication? b) What is an application architecture? c) Which a p plication architecture is don1inant today? d) What host innovation brought it abou t? e) Wha t is the m ajor d riving force behind the peer-to-peer (P2P) a pplication architecture? f) How is p rogran1ming changing because of new application architectures? g) Wha t change is falling network cost driving?
Application Security
In the past, hackers foc used p rin1arily o n vu lnerabilities in the operating systen1 to break into con1pu ters. Today, however, hackers prim arily attack ind ividual applications running on the con1puter.
The reason for this is shown in Figure 11-2. If a hacker can take over an app lica- tion, then he or she receives all the perm issions that the operating systen1 gives the applica tion. Many app lications run with root privileges, which m eans that they can do anything on the con1p u ter. Taking over such an a p plication gives the hacker total control over the con1p uter.
If a hacker can take o ver an application, then h e or sh e r eceives all the permissions tha t t h e op erat ing system gave t h e applica tion.
Attackers no\v agree tha t find ing a vulnerability in the operating system is very difficult today. However, \,•ith the n1any applications running on most con1puters, a nd with inconsis tent security quality across app lications, the probability of find ing a vul- nerable a p plication on a computer is high. Security vu lnerabilities in specific applica- tions are listed in man y hacker forun1s that are readily available to attackers.
Unhacked Application
@ \/ Vul nerable Application
@ operati ng ..
I System. 2
If a hacker takes over a vulnerable application program, he or she receives the privileges of that program.
If the hacked program has root p rivileges, the hacker can do anything he or she wishes on the computer.
The hacker effectively "owns the box."
Hacker Receives the Hacked Program's Privileges on the Computer
1l----' Hardware
FIGURE 11· 2 Applicat ion Hacking
Spear Phishing E-Mail
From : [email protected]
Subject: Solution at Devour.com
Chapter 11 • Nehvorked Applications 357
Bob, I think that Devour.com may have what we need for the Greed is Good project. The following link will take you to the appropriate part of their site.
Apparent Link --- www.devour.com/ perce ptions/
Pat
Actual Link http://devour.com/ Default.aspx?name=
< script>a le rt('Hacked!')</scripb
FIGURE 11-3 Cross-Site Scripting (XSS) Attack Using Reflection
In particular, we are seeing an explosion in a pps-sn1all applications created for n1obile devices. In addition, we are seeing diversity in n1obile operating systen1s. The newness of n1obile operating systems and n1obile applications has led many inexperi- enced developers to create applications with severe vu lnerabilities. Coupled w ith a lack of corporate control over mobile devices, this lack of experience has created a flood of application (and operating system) vulnerabilities.
Cross-Site Scripting (XSS) There are many ways to hack application progran1s. One popular attack vector is the cross-site scripting (XSS) a ttack. In these attacks, the application asks a user for an input variable such as his or her name. The user n1ay enter the name "Pat." The website then crea tes a \,•ebpage tha t says something like "Hello Pat." This is called reflectio n . It is dangerous because the webpage w ill contain what- ever the user chooses to input.
Figure 11-3 shows why reflection is dangerous. In this example, the attacker sends the CEO of a corporation an e-mail message tha t purports to be fron1 a subordinate. The n1essage contains an apparently safe link to devour.con,. Presumably, the con1pany uses devour.con, extensively, so the CEO sees the site as "safe."
In HTTP, the text that appears for a link may not be the true link. In Figure 11-3, the actual link is http://www.deuo11r.com/Defa11lt.aspx?name=<script>alerl('Hacked!')</script>. The link does take the victim to default.con,. However, the problem is that it does n1ore than that.
Most important, it will pass infom1ation to a particular program on Devour.com, Default.aspx. Default.aspx expects an input string for its name variable. Not shown in the figure, Default.aspx \,•ill reflect this name on a \,•ebpage. Probably, it will include something like "Hello name" on the webpage.
Given the e-mail message's crafted URL, ho\,vever, the webpage being vis ited will reflect the script <scripl>alert(Hacked!')</script> on the webpage. When scripts are p laced on a \,•ebpage, the user does not see them. However, the script executes \,•hen the page is rendered. This script is not dan1aging. The user \,•ill see a pop-up alert box that contains the n1essage "Hacked!"
358 Chapter 11 • Nehvorked Applications
Most XSS attacks are extremely dan1aging. For exan1ple, the script may steal the user's login cookie and send it to the attacker. This may give the attacker the victim's usernan1e and password. XSS attacks can also redirect the victin1 to another \,•ebpage and install malware while making it look like nothing has occurred.
Cross-site scripting attacks do not always use e-mail or \,•ebsites w ith deceptive links. For exam ple, suppose a legitimate si te allows user comments on webpages. Typi- cally, the user en ters text in a dialog box. The \,•ebsite then writes the comments o nto the bottom of the \Vebpage. If the con1m ent contains a script, the script \,•ill execute every time son1eone visits the webpage afterward .
How can \,•ebsite designers thwart XSS attacks? At the broadest level, progran1- n1ers should never trus t user input. If inforn1ation is to be reflected onto a \,•eb page, the progran1mer must test the user input. It may seem sin1ple to iden tify <scripl>and</ script> tags, b ut scripts can be obfuscated (mad e less obvio us). Also, there are n1any cross-site scripting attacks that do not use scripts. Th warting cross-site scripting attacks is a difficult skill. This m ay explain why XSS vulnerabilities are pan demic o n websites.
Programmers sh ould ne ver trust user input.
Tes t Your Unders tanding
2. a) Why are hackers now focusing on taking over applications? b) What can hackers do if they ta ke over an application w ith root privileges? c) Why is the explosion of "apps" on small mobile devices a concern?
3. a) Why is reflecting a user's input d angerous? b) What a ttitude should pro- gran1mers have about user inpu t?
NETFLIX DIVES INTO THE AMAZON1
As noted in the introduction, cloud compu ting is o ne of the main d riving forces in net- working tod ay. We introduce cloud computing \,•ith an illustra tive case. This case does not focus d irectly o n neh,•orking. As also noted earlier, cloud com puting is radically changing the locations of servers, and is d oing so in con1plex ways tha t radically ch ange nehvork traffic.
1 Sources for this section include Brandon Butler, '"Three Lessons from Nctflix on How to Live in a Cloud," NelworkWorld, October 9, 2013, http:/ /www.nctworkworld .com/ncws/2013/100913-nctflixdoud-274647. html; Matt Petronzio, "Meet the Man Who Keeps Nctflix Afloat in the Cloud," mnshnble.co111, May 13, 2013, http: //mashable.com/ 20J3/ 05/13/nct0ix-drcam-job/; Kevin Purdy, " How Nctflix is Revolutionizing Cloud Computing Just So You Can Watch 'Teen Mom' on Your Phone," wwzu.itworld.com, May 10, 20 13, http://www.itworld.com / cloud-computing /355844 / net fHx•rcvol utionizi ng-computcr-just-scrvc-you- movics; Ashlee Vance, "Nctflix, Reed Hastings Survive Missteps to Join Silicon Valley's Elite," Business Week, May 9, 2013, http://www.businessweek.com/ articlcs/2013-05.()9 / nctflix-rccd-hastings-survivc-misstcps· to-join-silicon-valleys-elite.
Chapter 11 • Nehvor ked Applications 359
Netflix
You personally know how individuals use the Internet. Th e corporate experience is very d ifferent. We \,•ill illustrate this by looking at Netfl ix's use o f the Internet. Netflix is a s treaming video service with over 100 million subscribers around the world. Streanung video needs m assive network capacity. A h,•o-hour high-definition movie must d e liver 5 n1illion bits each second . This is 9 gigabytes for that o ne n1ovie. On any given n igh t, Netfux accounts for roughly a third o f the Internet traffic going into U.S. hon, es. When s ubscriber numbers begin to reach the billions for Netflix and other s treaming services, network capacity w ill have to gro\,v massively.
Requirements Users expect high vid eo qua lity, and they will not tolera te delay o r unreliability. The Internet was not designed for th ese requiren, ents. The Internet is a "best effort" delivery system that o ften has insufficient speed and reliability and that o ften has too much delay for Netflix users. Netflix had to overcon, e these limita tions.
Th e Internet is a "best effort• de livery system.
Vid eo strean,ing a lso requires vast a m ounts of server p rocessing to d eliver video, bu t the need fo r heavy server cap acity extends \,•ell b eyond streaming.
• Each m ovie m ust be transcoded into m any streaming form a ts, and w hen a cus- tom er requests a m ovie, a strean,ing server n1ust select the b est transcod ed forn,at for that customer's equip ment, network sp eed, and other matters.
• In a d dition, a t the heart of Netfl ix's b usiness plan is a recommendation s ystem tha t crea tes p ersonalized viewing suggestions for individual customers. This requires the ana lysis of extensive data about th e custon, er's vie\,•ing habits an d the ch oices o f o ther customers \Vith sin1ilar vie\,•ing pro files.
Server Outsourcing In 2008, when Netflix o n ly delivered movies b y sending DVDs through the mail, th e com pany suffered a crip p ling server outage that stopped shipments for several d ays. Tha t was a ½•a keup call for Netflix. Management realized tha t reliab ility wou ld be critical for online delivery. It a lso realized that Internet delivery would b ecom e its core business, but managing servers wou ld not. Netfux decid ed to o utsource server o pera tion.
Netflix turn ed to Amazon Web Services (AWS). Am azon had leveraged its exper- tise in n, anaging vast server farms for its e-commerce needs into a cloud service th at custom ers like Netflix could use. Figure 11-4 s hows that AWS's enormous server farn, s had the capacity that Netfux n eeded for customer o rdering, tran scoding, and an alyzing vie½•ing pa tterns with extreme reliability. In a ll o f th ese cases, Netfux wrote th e a p plica- tions b ecause th ese supported their core business.
Content Delivery However, for the job o f streaming its n1ore than o ne petab yte o f movie con tent, Netfl ix rea lized that it could not o u tsource server operations because this was the most central part of its business. Figure 11-5 sho\,vs ho\,, Netfux delivers video content to individ ual custon, ers via its content delive ry network (CDN) Open Connect.
360 Chapter 11 • Nehvorked Applications
Amazon Web Services
AWS Regional Server Farm
Redundancy for Fail-Over
Customer h Ordering ~
AWS Regional Server
Processing Tasks: ~ --T.o.<.r Customer ordering
Content transcoding Video Recommendation system Content
Providers
FIGURE 11-4 Netflix and Amazo n Web Services (AWS)
Customer ISP1
1
Netflix Open Connect Content Delivery NetwO<k (CON)
Open Connect Appliance
2 at Peering Point
Streaming Content 3
Peering Point
Customer ISP 2
Stream in g
~ent
Customer ~
FI GURE 11· 5 The Netflix Open Connect Content Delivery Network (CDN)
~ ustomer
Open Connect Appliance on ISP Premi ses
To s trean1 con tent, Netflix crea ted its own network on t he Internet. Netfl ix is essentially an ISP, bu t it is a special one th at carries nobody e lse's content. This Open Connect net\,•ork is tigh tly managed by Netflix to ensure very high-qua lity service.
To d eliver streaming content, Netflix created its own \,•ebserver appliances. Each is a relatively small box that can fit into a stan dard equipment rack. These Open Con- nect appliances are a bou t 7 inches (18 cm) high and 2 feet (61 cm) deep. This sn1all powerhouse holds about 100 terabytes of data o n 36 hard d isk drives. Its micropro- cessor, in turn, is fast en ough to strean1 n1ovies simultaneously to between 10,000 and 20,000 customers. Netflix upd ates th ese CON servers about once a year wi th ne\,•er hardware to increase their capabilities.
Chapter 11 • Nehvor ked Applications 361
Figure 11-5 shows that the Open Connect nehvork \,•orks w ith individual ISPs to deliver content to subscribers. In some cases, Netflix p laces its Open Connect a ppliance very near the peering point, \Vhere the Open Connect network links to the customer's ISP. This m inin1izes d istance to the custon, er, thus n1inim izing delay and reliability risks. Many ISPs let Netscape install Open Connect app liances a t loca tions inside the ISP's neh,•ork to further red uce d istance to the customer.2
Test You r Understanding
4. a) Wh y d oes Netflix ma ke many transcoded versions of each movie? b) Why is the Netflix recon,mendation syste m critical? c) For what a pplications does Net- flix use AWS? d) For what major a pplication d oes Netflix manage the servers then,selves? e) How do content delivery networks reduce streaming d elays to cus tom ers?
Virtualization and Agility
Figure 11-6 sho\,'S that AWS uses virtualization to turn each physica l server into sev- eral virtual machines (VMs). Each VM is a sofh,•are program running o n the physical server. However, it acts like a real server in its connections w ith the outsid e \-Vorld. It has its o\,•n IP address as well as its o\,•n data. A VM is even m anaged like a p hysical server.
Virtual n,achines provide agility, which is the ability to ma ke changes qttickly- even very large changes. For example, An1azon can m ove VMs q uickly from o ne physi- cal server to another sim ply by transferring their files. In addition, Netflix can add V M
Three Physical Servers in Racks~
Rack-Mounted Physical Server .--~
~ ~ 1 t
One Physical Server Can Run Several
Virtual Machines (VMs). Each Acts as a Server.
2 l VMsCan Be Moved Easily
to Other Physical Servers.
Virtual Machines
(VMs)
New Instances of aVM
Can Be Created on Seconds.
Virtual machines give agility.
FIGURE 1 1-6 Physical Servers and Virtual M achines (VMs)
4
MoreVMs Can Be Added
Temporarily.
2 Even with massive s torage, Open Connect appliances can only hold a small portion of Nctflix's 1 petabytc of content. Consequently, Nctflix uses sophisticated analysis to identify the 100TB of content most likely to be demanded by the customers scnrcd by different Open Connect appliances. It installs this content on the indi· vidual CON servers. Of course, customer interests change rapidfy, so this content is rebalanced daily. Nctflix deletes content decHning in popularity and installs content of increasing demand.
362 Chapter 11 • Nehvorked Applications
instances (specific v irtual machines) in seconds. In fac t, a company can spawn (instan- tiate) n1any copies of the same virtual n1achine a t once, in no more time than it tak es to spawn a s ingle VM instan ce. P hysical servers offer nothing like this degree of agility. To n1ake virtualization even more attractive to c uston1ers s uch as Netfl ix, AWS provides a simple self-service application for customers to use to add ne\,, instances and to do n1any other things themselves, in real time.
Transcoding each movie into a hundred or more versions for d elivery is an enormous task. Whenever Netflix needs to transcode a n1ovie, it spins up (spawns) multiple VMs, splits the work up among then1, processes the d ata in parallel, and then spins then1 down.
Providing c uston1ized viewing recommendations to subscribers also requires an enorn1ous an1ount of processing p ower because it must analyze individu al user view- ing practices and the vie\,•ing practices of people who have viewed sin1ilar movies. This recomn1endation systen1 a lso requires Netflix to spin up and release large numbers of virtual servers th roughout the day as demand increases in th e evening hours and declines a t o ther times.
Tes t Your Und ers tanding
5. a) Distinguish between physical servers a nd virtual machines. b ) What can be done with virtual n1achin es that \'l'ou ld be d ifficult to d o w ith physical servers? c) What is VM instantiation? d) How does Netflix use the agility offered by Amazon Web Services?
Infrastructure as a Service (laaS) and Software as a Service (Saas)
We no\,, look in n1ore d e tail a t An1azon Web Services (AWS). Amazon is a cloud service provider (CSP), as Figure 11-7 illustrates. We saw earlier tha t the Internet and oth er networks are depicted as clouds. The figure s hows that CSPs a lso op erate th eir services opaq uely, forming a second layer of cloud.
Computing Cloud -----.J
N ~-~
Corporate Data Cente r
Customer
Amazon Infrastructure as a Service (laaS)
Cloud Service Provider
N etwork Cloud
Google Software as a Service (SaaS)
Cloud Service Provider
FIGURE 11·7 Cloud Service Providers, laaS, and Saas
Chapter 11 • Nehvorked Applications 363
Infrastructure as a Service The AWS service that Netflix uses is referred to, generically, as Infrastructure as a Service (laaS). This ungainly nan1e refers to the fact that AWS provides the computing infrastructure, \Vhich consists of servers and their operation, database managen1ent systems, and related services.
Netflix, ho\,•ever, creates and manages its own applications for user ordering, transcoding, persona lized viewing suggestions, and o ther matters. By outsourcing server operation to AWS, Netflix can focus its efforts n1ore fully on developing and extending its applications.
In addition, although Netflix does no t manage the servers in AWS, it tests its server/ app lication setups constantly. Netflix has developed a family of programs called the simian arn1y,3 which it uses to selectively turn off parts of the AWS system to test how well the system responds to outages. When a change is made in an appl ication that runs on many virtual machines, Netflix tries it out on just a few at first, then migrates it to the rest in a smooth manner.
Software as a Service An1azon is not the only cloud service provider that Netflix uses. Another is Google. Netflix uses Google Ma il for its internal con1munica- tion. In contrast to jus t offering IaaS, Google offers application software as well. This is called Software as a Service (SaaS) . Here, software refers to application software. SaaS has been popu lar for many years. For exan1ple, many con1panies use salesforce .con1 application software for sales force management and custon1er relationship n1anagement.
"As a Product" versus "As a Service" As a Service in IaaS and SaaS refers to pricing. Normally, a company buys servers like other products, such as automo- biles and apples. After purchase, the company o\,•ns the phys ical server and n1an- ages it.
In contrast, cloud services are sold like electrical service. You pay for the amount you use. This allows customers to avoid the capital expense (CapEx) of purchasing servers. This also avoids the risk of buying too n1uch capacity that would go unused. IaaS appears as an operating expense (OpEx), which can be n1anaged so that money is spent only \,•hen it must be. SaaS, in turn, changes applica tion programs from pur- chased products to per-use services.
Test Your Understanding
6. a) What is a CSP? (Do not just spell out the acronym.) b) Distinguish between IaaS CSPs and SaaS CSPs. c) Is AWS an IaaS provider or an SaaS provider for Netflix? d) Is Google an IaaS provider or an SaaS provider for Netflix? e) Who owns and manages the servers in IaaS and SaaS? f) Who o\,'11S and n1anages the applications in IaaS and SaaS? g) In AWS, what does Netflix manage and not manage? h) For e-mail, what does Netflix n1anage and not manage?
3 This name reflects the fact that individual programs have names such as Chaos Monkey and Chaos GoriUa.
364 Chapter 11 • Nehvorked Applications
1
,.: ~ > : :_~:_:_:_F-il_e_Ba_:- 7
ck-::_u-p_-_ - ~ & Synchronization
Host X 2
Saa$
SynchroniZed Access to All Personal Data Files,
Programs, and Personalizations
FIGURE 11-3 Client Compu1i ng in the Cloud
Clients Move into the Cloud
4
HostZ Sharing Files with Others
Netflix embodies ho\,, corporations use the cloud. Ho\,•ever, as Figure 11-8 shows, many client hosts also use the cloud. Most users today have n1ultiple devices. They want to work on a document on one device, move to another, and pick up exactly \,vhere they left off. As Figure 11-8 sho\'l'S, this requires storing work data and synchroniza tion data in the cloud. As users move beh'l'een n1achines, their data is imn1ediately available, and synchronization takes them inm1ediately to the exact s pot in their working document they last toumed on the previous mamine.
Often, the storage content of users' cloud services is offered by itself, through fi le storage services such as Dropbox and iCloud. (Individ ua l users rarely back up their stand-a lone devices.) Even if the user accidentally deletes a file on both the client's and the cloud storage server, it is usually possible to retrieve an earlier version.
The fact that data is stored in the cloud also fac ilities sharing. A user can con- trol who can see a particular fo lder and what they may do on the fi les stored there. In addition, son1e folders "on the user's con1puter" n1ay be shared fo lders under a group account \vith other users.
Often, instead of buying application sofh,,are and installing it on each n1amine, the user pays an annual fee that \,•ill offer application sofh'l'are on a ll of his or her n1amines. This is another case of SaaS. Ideally, there would be no need to download the sofh,•are, but for large applications such as \,•ord processing, a completely cloud-based service would be too slo\,•. Earn machine downloads some or all of the application. Ho½•ever, the sofh'l'are vendor frequen tly updates the files on earn computer to the newest version of the sofh'l'are and synchronizes configuration manges and other personalizations.
Test Your Understanding
7. a) With cloud services for clients, \,vhat happens w hen a user moves from o ne physica l client device to another? b) What protections are offered by fi le s torage services? c) In a fi le storage service, \,vhat can you d o if you accidentally delete a file on a client a nd the correspond ing file on the server is a lso deleted? d) In fi le sharing services, can the user allow others to share some files? e) In SaaS, why is the progran1 or part of the progran1 stored o n the client device?
Chapter 11 • Networked Applications 365
Risk to Corporate Data If the cloud service provider falls to protect data, the results can be disastrous Customer firm has no control over cloud service provider security
Due Diligence Is Necessary Must examine cloud service provider protections before using them Many companies fall to do this, enticed by low costs and agility
FIGURE 11-9 Cloud Security Concerns (Study Figure)
Rain Clouds: Security
Security must be a concern for every cloud customer. Companies must put critical cor- porate data on computers owned by other organizations. (In the case of Netflix, Ama- zon is actually a competitor in the streaming media market.) If cloud service providers fail to protect this data from hackers, the potential damage is enormous.
To deal \Vith security, companies must do extensive due diligence, looking in depth at ho\v cloud service providers handle security. However, there is no \Vay to understand everything about a cloud service provider's security. For the time being, many organizations are crossing their fingers, whistling in the dark, knocking on wood, and yielding to the attraction of cloud computing's low cost and agility.
Test Your Understanding
8. What concerns do customers have about cloud security?
Networks a nd The Cloud Nehvorks today must \vork extremely well, almost perfectly. They must do this \Vhile growing at unbelievable rates. And they must do this using standards older than most of today's nehvork engineers.
The demands of cloud computing create enormous stresses on networks. Cloud service providers themselves create massive and fast-changing network transmission
Cloud Computing Stresses Networks Traffic Is massive and quickly changing Massive sudden changes In Internet and local network traffic Reliability is crttical
latency Concerns Cloud computing may increase latency Very low latency is critical for many applications Important examples are speech input services (such as Echo) that rely on cloud-based Al to
understand user Input
FIGURE 11 ·1 0 Networks and the Cl oud (Study Figure)
366 Chapter II • Networked Applications
loads. Customers of cloud services also find themselves "'ith massive increases in Inter- net and local network traffic. In addition to gro\ving rapidly, networks are also facing increasing de,nands for reliability because a company that loses contact with its cloud serv ice providers for even brief periods of tin1e "'ill suffer heavy losses.
Latency is also critical for a growing number o f core services. For instance, speech input systems such as An1azon Echo, Cortana, Siri, and Google use cloud servers to do the heavy artificial intelligence (Al) processing needed to understand the user's voice a nd meaning. For use to be operational, the h,•o-\\•ay trans,nission as "'ell as the server processing n1ust be done in rea l time, w ith no appreciable delay.
Test Your Understanding
9. a) How is cloud cmnputing affecting nehvorking? b ) Why is latency a proble,n for artificial intelligence?
THE WORLD WIDE WEB
HTTP and HTML Standards
Having looked a t core networked applicatio n concepts and cloud computing, "'e tum to a series of key applications. Given its dominance, we discuss the World Wide Web first. Figu re 11-11 s hows that the Web is based on two prima ry standards.
• For file format standards, "'ebpages themselves are created using the Hypertext Markup Language (HTML). Once downloaded, tags in the HTML doC111nent are used to do\\•nload related files.
• Second, the transfer of requests and responses uses the Hypertext Transfer Proto- col (HTTP) to specify files to be retrieved a nd to describe file types for delivered fi les (HTML, JPEG, etc.).
Test Your Understanding
10. a) v\That are the two major sets of standards for the World Wide Web? b) How do they differ?
HTTP Request
Browser
t Client PC
HTTP Respon se
HTM L Document
HTTP is a fil e transfer standard. HTML is a file format standard.
FIG URE 1 1-11 World Wide Web (WWW) Standards
Webserver Application
Webserver
Browser
Client PC
HTML Document (Downloaded first)
~--it;-.
2 Graphics Files . ~ --
Chapter 11 • Networked Applications 367
Webserver Application
Webserver
FIGURE 11-12 Downloading a Webpage w ith Two Graphics Files
Complex Webpages Nearly all '\vebpages" really consist of several files-a master text-only H1ML file p lus graphics files, audio files, and other types of files. Figure 11-12 illustrates the download- ing of a \vebpage \vith two graphics files.
The HTML file consists merely of the page's text, p lus tags to show where the browser should render graphics fi les, when it should play audio files, and so forth.4 The HTML file is downloaded first because the browser needs the tags to kno\v what other files should be do\vnloaded.
Consequently, several HTTP request- response cycles may be needed to download a single \vebpage. Three request- response cycles are needed in the example shown in the figure.
To provide an analogy, when you download an e-mail message with attachments, you must read the message first. Then you must click on the attachments to download them.
Test Your Understanding
11. a) You are downloading a webpage that has six graphics and two sound clips. How many request- response cycles will be needed? b) Which file \Vil! be down- loaded first?
The Hypertext Transfer Protocol (HTTP)
HTl1', again, standardizes interactions between the browser and the webserver to ask for and deliver files.
' 1 For graphics files, the !MG tag is used. The keyword /MG indicates that an image file is to be downloaded. TI,e SRC (source) parameter in this tag gives the target file's directory and file name on the webserver. If the HTML document was not downloaded firs t., the browser would have no tags to determine what other files to download.
368 Chapter 11 • Nehvo rked Applicatio ns
1 Consists entirely of ~---------
Get / aviation/home.him HTTP/ 1.1 [CRLF] - 2
L ~r st: voyager.shidler.hawaii.edu [CRLFJ_ ..
4
keyboard characters
Request Line Get (this is a file request) /tasks/main.him (path to the file) HTTP/1/1 (version)
Other Lines: 3 Carriage Return/Line Feed Keyword (Host, Connection) Colon(:) Value (voyager.shidler.hawaii.edu, Keep-Alive) [CRLF)
FIGURE 11-13 HTTP Request Message
Move cursor to the start of the line Then move one line down (Starts a new line)
HTTP Request M essages Figure 11-13 shows the syntax o f an HTT P request message. As we sa\,, in Chap ter 2, n1ost o ther content transmission standards con- sist of bit strings tha t are not designed for peop le to read. In con trast, HTTP m es- sages consist entirely of alphanumeric symbols that can be typ ed on a keyboard. The characters are e ncoded into bit streams before being passed to the transport layer, but before tha t they are clearly readable. They are also readable in pla in text on the receiver.
In fact, they look like trad itional e-m ail messages. Most lines begin \,•ith a key- word, followed by a colon, then a va lue, and finally a carriage return / line feed (CRLF}. Carriage return takes the cursor back to the s tart of the c urrent line. Line feed n1oves the c u rsor one character down. This combination starts a new line. On o ld type\,•riters, the carriage return handle on the left sid e of the m achine combined these actions.
Carriage return and line feed (CRLF) together start a new fine .
The first line in the header has a different forn1at than other header lines. This is the Request Line.
• It begins w ith a method to indicate \,•ha t the sender \,•ishes to be done. This is usually Get, indicating that the requestor \,•ishes to get a file.
• This is followed by the loca tion of the file. This tells the receiver to begin at its \,•eb root directory, go one d irectory down to tasks, and retrieve the file main.htrn.
• Finally, the request line tells the \,•ebserver program tha t the client is the 1/ 1 version of HTTP.
HTTP Response Message Figure 11-14 sho\,'S an HTTP response n1essage. This is n1ore con1plex than the HTTP request message, but it has alm ost the san1e basic struc- ture. It starts with a status line, followed by multiple lines in the Keyword: va/11e[CRLFJ format.
Chapter 11 • Nehvor ked Applications 369
HTTP/1 .1 200 OK[CRLF] ----------- Status Line Date: Mon, 27 Mar 201712:33:22 GMT[CRLF]
Server: Apache/ ... [CALF) Last-Modified: Wed, 11 Mar 2017 15:48:22 GMT[CRLF]
Content-Length: 88[CRLF] Content-Type: text/html[CRLF)
Response Headers
[CRLF] ----------------- Blank Li ne <htm l> <body> <h1>Hello, Worldklh1> Body (File)
</body>
<!html>
FIGURE 11-14 HTTP Response Message
The status line a lerts the receiver to how the server has respond ed.
Header
Data Field
• It begins \,•ith the HITP version the \,•ebserver will use to talk to the bro\,•ser. This is HTTP 1/1, the same version the bro\,•ser signaled.
• It then gives a status code to indicate how it has responded to the request. The cod e is 200, \,•hich indicates tha t the request has been accep ted and executed. There are n1a n y sta tus codes, such as the fan1ous 404 s ta tus code: Page Not Found.
• The status line continues \,•ith a reason phrase, w hich is an expression to help a user understand \,•ha t the status code n1eans. In this case, the reason code is simply "OK."5
Follo\,ving the status line are HTML response headers. These give the date the response n1essage \,•as sent, the operating system of the \,vebserver ( . . . ind icates n1issing content), the date and tim e the file \,•as last m odified, the data field length in by tes, and the type of data in the data fi eld.
For exan1ple, the Content-Length field gives the length of the da ta fi eld in bytes. Next, the Content-Type field indica tes that the data fie ld consis ts of HTML text. (HTML documents consist entirely of keyboard characters.)
Next comes a line \,•ith a single CRLF. This is a blank line. It separates the header fron1 the data field. This is a crud e separator, but it works.
Fin ally con1es the da ta field. Th is is the HTML file the response m essage is delivering.
O f course, HTTP does not o nly d eliver HTML files. What if this response n1es- sage was delivering a jpeg graphic fi le? In that case, the Content-Type field wou ld say in1age/jpeg, and the Content-Length field \'l'ou ld give the size of the jpeg image in bytes.
5 HTfP is designed to be humanly readable.
370 Chapter 11 • Nehvorked Applications
Test Your Understanding
12. a) Which tends to have a data field , HTTP request or response messages? b) What is the firs t line called in an HTTP request n1essage? c) What is the first line called in an HTTP response message? d) What is the format for header lines after the first line? e) What wou ld the Content-Type fie ld be for an HTTP response message delivering a GIF graphics file?
ELECTRONIC MAIL (E-MAIL)
We no\,, tum to electronic ma il (e-n1ail), w hich \Vas one of the earliest applications o n wide area networks, and it is still growing rapidly today.
Delivery Standards
As in the case of the World Wide Web, e-mail uses two sets of standar~ne for n1essage delivery and one for file formats. We begin with delivery standards.
The Delivery Process Figure 11-15 illustrates ho\,, e-mail n1essages are delivered to receivers.
• Most fundamentally, the sender does not send the message d irectly to the receiver. Instead, each party has a mail host. When the sender transmits a n1essage, it sends it to its own n1ail host (1).
• The sender's mail host notes the d estination e-mail ad dress and looks up the IP address of the receiver's mail host.
• The sender's mail host then sends the message to the receiver's mail host (2).
• The receiver's ma il host holds the e-ma il until the receiver downloads it (3).
Sending (Immediately)
1
SMTP or HTTP to Send
Qmmediately)
Sending E-Mail Client
Sender's Mail Host
2
SMTP to Send Ommediately)
- -llEJ " Receiver's
Mail Host
Mail Format Standards: RFC 822/2822 (Text Only)
HTML UNICODE
FIGURE 11- 15 E-Mail Del ivery Standards
Receiving (Later when Download)
• POP, IMAP or HTTP to Download from
, Mail Host '' 181 (Later)
,, ,....._ •
Receiving E-Mail Client
Chapter 11 • Nehvor ked Applications 371
Having intermed ia te m ail hosts might seen1 cun1bersome, but people do not read the mail irnn1ediately. Mail hosts have mail boxes for each user to store n1ail until the user checks for then1. This arrangement allows e-mail users to pick u p their n1ail \,•hen - ever th ey fee l like it.6
Tran sm ission to the Sender's M ail Host Using t h e Simple M ail Tran sfer Protocol (SM TP) When the sender transn1its the n1ail to his or her ma il host, the tra- d itional transmission standard was the Simple Mail T ransfer Protocol (SMTP). When you set up an e-mail account o n your sn1artpho ne or other d evice, you n1ay be asked for the host name of your SMTP host- the host to which you \-Viii send n1ail.
Web M ail and HTTP People increasingly use Web m ail, \,vhlch allows you to send mail th rough your browser. In th is case, m ost con1munication uses HTTP. This includes sending n1ail.
SMTP between M ail Hosts Ho\,•ever, the sender con1municates with hls or her n1ail host, and mail hosts communicate via SMTP.
Immediate D elivery When you hit send, your mail is uploaded to you r mail host in1m ediately. Your mail host d oes an IP address lookup a nd then irnn1ed iately sends the mail to the user's m ail host. The d elay from the time you hit send to the tin1e the receiver's n1ail host gets the n1essage is rarely more than a second or two.
Test Your Understanding
13. a) In traditional e-mail, w hen a client sends a n1essage to its n1ail host, \,•ha t standard does it use? b) Which stand ard is used for this in Web-based e-n1ail? c) When the sender's mail host sends the n1essage to the receiver's n1ail host, \'\'ha t stand ard does it use? d) What d o you think are the advantages of a Web- e na bled e-n1ail system? (The answer is not exp licitly in the text.)
Re ce iving Standard s Sometin1e a fter mail is delivered to the receiver's mail host, the receiver \,•ill retrieve it fron1 his or her m ail box on the receiver's m ail host. Receiving is a more com plex pro- cess than send ing because users want a grea t d eal of fl exibility in ho\,, they read their n1ail. Therefore, receiving stand ards a re d ifferent fron1 send ing standard s. Fig u re 11-15 notes that th e two n1ost common traditiona l receiving standards are the Post Offi ce Protocol (POP) and the more sophisticated Internet Message Access Protocol (IMAP). When you set u p your e-mail on a device, you n1ay be asked for the host nan1e of you r
6 Also, locating the receiver's mail host is easier than locating an individual receiver. A mail user's IP address is Ukcly to change every time he or she boots up. In contrast, mail scnrcrs have static JP addresses. Suppose that you arc sending to ray®panko.com. \+\Then your mail scnrcr secs [email protected], it realizes that panko .com is the domain name. So it does a DNS lookup on panko.com. Instead of asking for the A or AAAA record, whkh would return the IP address of the panko.com wcbserver, it asks for the MX record for panko. com. This returns the JP address of panko.com. The sender's mail server then sends the mail to the receiver's mail server.
372 Chapter 11 • Nehvorked Applications
POP or IMAP host. In some cases, your POP or IMAP server can be different fron1 the name of your SMTP host. Of course, in Web-based e-n1ail, HTTP is used for download- ing as well as sending.
Test Your Understanding
14. a) In traditional e-n1ail, when the receiver's e-mail client do\vnloads new n1ail fron1 its m ail host, what standard is it likely to use? b) What standard is used for downloading e-mail in Web-based e-n1ail? c) Why is there usually a time differ- ence in transmission fron1 the sending client to the receiver's mail host and the time when the message is downloaded?
E-M a il File Format Standards
The World Wide Web, like many applica tions, has two sets of standards. HTTP gov- erns message delivery. We have seen that e-mail, in contrast, has several standards for transmitting messages, including SMTP, POP, IMAP, and HTTP. HTML governs the file fom1at of the Web's main fi le type, \,•hich is al\,•ays the first file downloaded in webser- vice. E-mail also has several standards for file fom1ats.
ASCII and Searchabl e Head er Fields The earliest e-n1ail messages were lim- ited to the characters you can type o n a standard American keyboard. They were called text standa rds, a lthough they also include d ig its, punctuation n1arks, and various other ch aracters. This was unexciting visually, but it placed little burden on displays and transmission lines.
These early text standards d id bring one major facility, searchable fie lds. The header consisted of several fi elds of the keyword--<:olon--<:ontext fom1at. These include To:, Fron1:, Date:, and oth er fields. This gives structure to e-mail messages. It allows us to display e-mails \Vith the n1ost recent ones first (\vhicl1 is the nom1), by sender, and by other fie lds. We also can do searches by character strings in specific fields. Without this, e-n1ail \Vould be far less useful.
Graphics in E-M ail M essages T\,'O developments created today's e-mail file fom1ats.
• One is attach ments, whic11 allow even text messages to deliver files in the forma ts of specific applications such as Microsoft Excel.
• The o ther is the gradual and growing addition of graphics into the docun1ent body. Many e-n1ail programs already sho\,, graphics files (png, jpg, and gif) in the body of messages, and some go much further. The ability to have HTML bodies has brough t extremely ricl1 content to e-mail, even \,•hen Web mail is not being used. With Web n1ail, of course, headers and even the body can be as rich as desired.
UNICODE Another trend in e-n1ail headers and bodies is the gro\,•ing support for non-English maracters. Originally, the searchable header and body text was lim- ited to c haracters from the American Standard Code for Information Interchange (ASCII) . ASCII cannot represent diacritical n1arks such as German un1lauts (except w ith
Chapter 11 • Nehvorked Applications 3 73
awkward extensions). Nor can it represent Japanese, Sanskrit, Cyrillic, or the \,•orld's o ther languages w ith entirely different syn1bol systen1s. To address these limitations, n1ost n1ail systen1s now support bodies in UNICODE, which can represent nearly all language syn1bol systems.
The use of UNICODE is good, but it creates problems for message filtering to iden- tify span, and phishing attacks, cross-site scripting attacks, and several other con1mon e-ma il attacks. Searching for string patterns that are the signatures of attacks becomes extren1ely challenging because different languages have very different codes for son1e gran1matical marks such as slashes.
Test Your Understanding
15. a) Text messages are limiting, but they introduced an important innova tion. What was i t? b) How can e-n1ail deliver content suitable for specific applica- tions, such as word processing progran1s? c) Wha t is the state of graphics in e-mail today? d) Why is UNICODE good? e) Wha t security issue does it create?
Cryptographic E-Mail Protections
Given e-n1ail's importance and potential for security failures, one n1ight assume that encryption and other cryptographic protections are used aln1ost all the time. In fact, they are not. In addition, even when cryptographic protections are used, they n1ay be very limited.
L.in k E.ncrypt.ion Figure 11-16 shows how encryption is done in e-n,ail. The top part of the figure shows link encryption, which protects a n1essage over a single hop between devices. All links must be encrypted to give comprehensive encryp tion for e-ma il messages.
• When you transn'lit m essages to your e-mail host, you use either SMTP or HTML. Both can protect your transmission with SSL/TLS. Ho\,•ever, Figure 11-16 shows that this only protects transmission to your mail host.
1 SMTP or HTTP
Protected Over Unk by SSLITLS
2
3
SMTP Protected?
---1~ >
4
Receiver's Mail Host
(Vulnerable?)
5
-.,.._POP, IMAP 0< HTTP Protected?
~ 6 ~ · ------(8]------------------------------~
S/MIME, etc. Sending E-Mail Client
Protected End-to-End Receiving (But may not be filterable by firewalls and anbvirus programs) E-Mail
Client (Vulnerable?)
FIG URE 11-16 Cryptographic Protections for E-Mail
374 Chapter 11 • Nehvorked Applications
• Are the trans missions between the t\,•o mail hosts protected ? The a nswer is, " Maybe." To use SSL/TLS for con1m unica tion between n1ail hosts, both hosts n1ust agree to d o so. Tod ay, data from Google indica tes that this is d one nea rly all the tim e, but there a re still a few percent of n1ail hosts tha t fail to accept SSL/TLS connections. If there is no encryption between ma il hosts, this is a vulnerability.
• Finally, w hen the receiver do\,•nloads the message, do they use SSL/TLS protec- tion? Again, the answer is, "Maybe." Also again, althoug h the use o f SSL/TLS is very common, i t is not universa l. This fina l link is ano ther potential failure point fo r encryption protection as a n1essage travels over the Internet.
End-to-End Encryption The bottom pa rt of Figure 11-16 shows end-to-end encryption, in which the sender encrypts a message an d the receiver d ecrypts it. This ensures tha t the message is encrypted throug ho ut its journey. Unfortuna tely, there a re n1ultiple standards for end-to-end e-m ail encr yp tion, a nd n1ost of these standa rds, includ ing the popular S/MIME protocol, require bo th pa rties to have d igital certifi- ca tes. (In contrast, SSL/TLS only requires the mail host to have a d igital certifica te.) Companies need to e n1ploy corpo rate-wide dig ital certificates to use encryp ted end-to- end e-mail. Trans n1issions beh,•een organizations require both con1parues to d o so, and their certifica tes must be acceptable to each other.
link Encryption
Between the sending client and its mail host
Between the two mail hosts
Between the receiver's mail host and the receiver
All links must be protected for fully encrypted communication
End-to-End Encryption
Between the two clients
Requires choosing the same encryption method
Usually requires digital certificates for both parties
Firewalls and antivirus programs cannot filer content unless the same extended encryption method is used
Encryption on Mail Hosts and Clients
E-mail stored on the client's and mail hosts must be encrypted
The hosts must be hardened with good security to prevent decryption of encrypted files
Social engineering can bypass these protections
Internal Corporate Communication
E-mail security is possible for all transmissions internally in a corporation
A strong standardized set of protections can be enforced and enabled
This is not possible for general communication over the Internet
FIGURE 11- 17 Issues in Corporate E-Mail Protection (Stu dy Figure)
Chapter 11 • Nehvorked Applications 375
In addition, a lthough end-to-end encryption enhances confidentiality, integrity, and authentication, i t lo\,•ers security by making it impossible for firewa lls along the way to read packets or antivirus servers along the way to scan for n1ah,•a re. Sometimes it is possible to provide keys to such devices to decrypt, process, and then reencrypt n1essages. Ho½•ever, this raises security issues. In addition, until all parties use e-n1ail progran1s modified to provide keys for temporary decryption and use the same algo- rithms to do so, this process will not work beyond single firn1s.
File Encryption on M ail Ho st s and Clients Of course, end-to-end transmis- sion security means nothing unless the four hosts are a lso secure. If an attacker can compron1ise a client or an e-n1ail host, the attacker will be ab le to read all messages on the host.7 Mail clients and the n1ail host should encrypt all mail in their protection and provide broader host security protections to prevent takeover, which might lead to being able to decrypt encrypted n1essages. A social engineering attack, furthern1ore, can defeat the strongest technical protections.
Internal versus External Transmission Creating strong and effective e-n1ail encryption is not fea sible for general e-mail. However, inside individual corporations, strong security policies and implementation can make this possible. Corporations can even standardize on e-mail clients with the built-in security functionality that corporations need for handling e-mail with protection and that can be governed by corporate e-mail policy server requirements. Corporate conm1unication that uses the Internet is another matter.
Test Your Understanding
16. a) If a n1essage sender uses SSL/TLS when it sends a message, how is pro- tection likely to be limited? b) Distinguish between link e ncryption and end- to-end encryption for confid entiality. c) Why is link-by-lin k encryptio n for confidentiality not fu lly secure even if there is encryption for confidentiality in all links along the way? d ) What is the remedy for the limitations of link-by-link e ncryption? e) Why is end-to-end encryption uncon1mon?
VOICE OVER IP (VoIP)
Voice over IP (VoIP) has traditionally meant sending d igitized voice data in IP packets. The use of IP is in1portant because it means that telephony can share a company's IP data neh,•ork. This can s lash the cost of long-dis tance telephone service among a com- pany's sites by taking advantage of economies of scale in networking. In add ition, VoIP con1presses the voice signal, allowing it to consume relatively little IP capacity. Today, anyone who uses Skype knows that VoIP can also stand for Video over IP.
VoIP (Voice over IP and Video over IP) is the transmission of voice and video information over IP networks. It permits a company to slash voice and video transmission costs.
7 There is also a very short period between when an c,.mail host decrypts an incoming message and rccncrypts it for outgoing transmission. Owning the maiJ host may allow this to be exploited.
376 Chapter 11 • Nehvor ked Applications
Voice over IP is the Transmission of Voice Through IP pack ets
~
Compared to ordinary telephone transmission, VoIP can have better sound quality, and VoIP compresses the signal to reduce cost.
100101 11000 1 Digitized Voice Signal
~
FIGURE 11-18 VoIP Transmission Using CODECs t o Digit ize Voice Signals
Test Your Understanding
1 7. For \,•ha t two things is VoIP an acronym ?
CODEC
VoIP Packets
The human voice rises and falls in amplitude thousands of times per second. These rises and falls appear to be sudden, b ut at the detailed level, these changes are con tinuous rises and falls in intensity. These voice signals must be sampled and encoded into ls and Os to be transmitted over a network. At the other end, they m ust be decoded back into voice signals. The circuit that provides these h-vo functions is called a CODEC (Figure 11-18).
Con1pared to ord inary telephony, digital transn1ission can provide higher voice quality than traditional voice telephony. However, to achieve voice quality equal to that of the telephone systen1, encoding must generate 64 kbps of d igital traffic. As Figure 11-19 shows, ho½•ever, m ost CODEC standards do n1ore con1pression, trading off voice quality against transmission costs by sending fewer bits.
Codec Standard Bits Transmitted per Second
G.711 64 kbps
G.722 48, 56, or 64 kbps
G.72 1 32 kbps
G.722. 1 24, 32 kbps
G.726 16, 24, 32, 40 kbps
G.728 16 kbps
G.729AB 8 kbps
G.723 5.33 6.4 kbps
G.7231A 5.3 6.3 kbps
FIG URE 11- 19 CODEC Encodi ng St andards
Chapter 11 • Nehvor ked Applications 377
Test Your Understanding
18. a) What n,•o things do CODECs d o? b) What is reduced w hen CODEC trans- mission is compressed ?
External Components
Figure 11-20 sho\,'S th e th ree externa l components in VoIP. First, th ere are the VoIP client devices.
• Businesses typically use ded icated VoIP telephones, \Vhich contain CODECs a nd TCP /IP networking functiona lity.
• Resid ential users and an increasing n u mber of busin ess en1ployees now use PCs with a software CODEC and TCP /IP functio n ality. Using a PC is especially desirable for v ideoconferencing.
To connect the VoIP system to th e p ublic S\Vitched telep hone network (PSTN), a device called a media g ate\vay handles the tran sla tion between digita l and voice con1munication.
Test Your Understanding 19. a) What are th e two op tions for VoIP clients? b) What a re the func tions of n1edia
ga te\,vays?
VoIP Signaling
In telecon1munications, there is a fundan1ental d istinction beh,•een signaling and transport.
1
3
Voic e over IP (VoIP) digitizes the human voice and d elivers the data in IP pac kets
PC with VoIP software,
voice hardware, and TCP/IP VoIP
Packet
The Interne t 4
Media Gateway
VoIP phone with CODEC and
TCP/IP functionality
AGURE 1 1- 20 Voice over IP (VoI P) Components
PSTN transport and signaling
PSTN
t~~~t
378 Chapter 11 • Nehvorked Applications
Signaling ,
2 SIP
- INVITE- 3
SIP SIP Calling Party's Called Party's INVITE
Caller / ITE s:,~~~Y s~e~Y ~ ~:
________ , -------------------------------------------· • ~ Transport
Group of Voice CODEC Bytes
Voice Transport Packet
RTP Header
UDP Header
FIGURE 11-21 VoIP Signaling (SIP) and Transport Packet
IP Header
• Signaling cons ists of the comn1unication needed to set u p circuits, tear do\,•n circuits, handle billing information, and d o other supervisory chores.
• Transport is the actual carriage of voice.
Figure 11-21 illustrates the Session Initiation Protocol (SIP), w hich is the m ain signaling protocol for VoIP. Each subscriber has a SIP p roxy server. The ca lling VoIP telepho ne sends a SIP INVITE message to its SIP proxy server. This message gives the IP address of the receiver. The caller's SIP proxy server then sends the SIP INVITE m es- sage to the called party's SIP proxy server. The called party's p roxy server sends the SIP INVITE message to the called party's VoIP telepho ne or multimedia PC.
After SIP crea tes a connection, the two VoIP cl ien ts begin communicating d irectly. This is the beginning of transport, whicl1 is the transmission o f voice between callers. VoIP, as its nam e suggests, operates over routed IP neh,•orks. Therefore, d igitized voice n1ust be carried from the sender to the receiver in packets.
Tes t Your Unders tanding
20. a) Is SIP a signaling protocol or a transp ort p rotocol? b) Describe ho\,• SIP initi- ates a con1munication session.
The VoIP Transport Packet
Signa ling includes session setup, breakdown, and other supervisory con1munication, whereas transport, again, is the transmission of packets containing fragments of voice or video between the two users.
VoIP Transport Packets As noted in Chapter 1, long a pplication n1essages are fragn1ented into sn1aller pieces that can be carried in in dividual packets. Each packet carries a sn1all part of th e applica tion message. Figure 11-21 shows a VoIP transpor t packet. Here, the app lica tio n "message" is a stream of voice CODEC bytes. Each packet carries a fe\,v by tes of the conversation.
Chapter 11 • Nehvor ked Applications 379
UDP with RTP at t h e Tra nsport Layer TCP allows reliable application mes- sage delivery. Ho\,•ever, the retransmission of lost o r dam aged TCP segments can take a second o r h,•o-far too long for voice conversa tions. Voice needs to be transmitted in real tin1e. Consequently, VoIP trans port uses UDP at the transport layer. UDP reduces the processing load o n the VoIP telephones, and it also lin1its the high neh,•ork traf- fic that VoIP generates. If packets are lost, the receiver creates fake noise for the lost CODEC bytes. It does this by extrapola ting between the content o f the preced ing and follo\,ving packets.
A lthough UDP n1us t be used instead of TCP, UDP has two serious lim ita tions for VoIP. Consequently, VoIP adds an additional header, a Real Time Pro tocol (RTP) head er, to ma ke up for these two deficiencies.
• First, UDP does not guarantee that packets ½•ill be d elivered in order. RTP adds a sequence n u mber so that the app lication layer can put packets in the proper sequence.
• Second, VoIP is highly sensitive to jitter, which is variable la tency in packet deliv- ery. Jitter litera lly n1akes the voice sound jittery. RTP contains a tin1e s tan1p for \,•hen its package of octets should be played relative to the octets in the previous packet. This allo\VS the receiver to provid e sn1ooth p layback.
The final VoIP packet, then, consists of an IP header, a UDP header, an RTP head er, a nd a snippet of the voice conversation.
Test Your Unders tanding
21. a) In a VoIP traffic transport packet, what does the da ta field contain? b) What standard is used at the transport layer? c) What two lin1ita tions of UDP does the RTP address?
PEER-TO-PEER (P2P) APPLICATIONS
A major driving force for applications, as we noted in the introduction, is increasing cli- ent processing power, includ ing processor speed, men1ory, storage, networking speed, and o ther ma tters. The firs t PCs, which arrived in the 1970s, were expensive toys, and they continued to have minin1al processing po\,•er for n1any years. However, chip den- sity has been doubling every 18 to 24 months, allowing processing chips to add much n1ore func tional ity and allo\,ving n1emory chips to hold more data. This doubl ing of chip density in about two years is kno\,'11 as Moore's la\,•. In addition, chip speeds have also been increasing at abou t the san1e rate, gro\,•ing from megahertz cycle speeds in the 1980s to gigahertz processing speeds today. Combined, the exponential gro\,•th in chip density and speed means that processing power has doubled roughly every year. In the last few years, speed increases have been more modest as energy consun1ption has become more critical, but increasing chip density has pern1itted more parallel pro- cessing in software, n1aking up for much of the impact of reduced cycle speeds.
This power growth dynamic has pern1itted us to have ever"smaller devices with impressive processing po\,•er. Sn1artphones are a lot sn1arter than they were just five years ago, and n1any IoT devices will be tiny but fairly capable. Much of this increasing power has been absorbed by every-n1ore-capable user interface capabilities, but even
380 Chapter 11 • Nehvorked Applicatio ns
Client Processing Power Increases
Moore's Law: capacity of chips doubling about every two years
Speed also increases rapidly
Today, clients have more processing power than servers did just a few years ago
Yet this processing power and storage goes largely unused during work hours
Peer-to-Peer (P2P) Applications
In peer-to-peer (P2P) applications, one client provides services to another client
Peers are client computers that provide services to other client computers
This can save a great deal of money by not buying servers
Problems with Clients
Not on all the time so not always available
Do not get the same IP address each time
Users fear that P2P applications will use too many of their computer's resources IT departments are concerned about the lack of central control
FIGURE 11-22 Peer-to- Peer Evolution (Stu dy Figure)
sm art wa tches a re beginning to do impressive work. Over the next d ecade o r more, the n1a turity of small devices sho uld accelera te.
Altho ug h s n1all d evices have ta ken the s potlight a \,•ay fro n1 traditional d esktop and laptop PCs, both ha ve turned into seriously powerful con1puters t11a t m a tch servers of a fe"' years ago. Their transmission p ipe to the Internet has also grown en orm o usly in speed.
Yet nearly all t11e tim e, our desktops a nd laptops are idle. Even w hen \,•e actively work, \,•e only use a fractio n of the device's power. These realities have caused man y to wond e r why we still use servers as much as we d o. Why not ha ve client PCs provide service to other clien t PCs? This insig h t has led to a gro\ving number of pee r-to-peer (P2Pl applications that do exactly t11a t. When o ne clien t compu ter provid es P2P ser- vices to o thers, it seen1s odd to call it a clien t. We will fo lio\,• the common practice of referring to con1puters that provid e P2P services as pee rs.
Peers are client computers that provide seNices to other client computers.
A major attraction fo r users is the appeal o f genero usly making t11eir unused resou rces available to otl1ers. This creates a grassroots coopera tive sp irit am ong t11ose who allow t11eir con1puters to be peers for P2P a pplica tions.
P2P a pp lica tio ns need to address some nonprocessing lin1its of deskto ps and lap- tops, however. O ne is simply tl1a t when they a re not o n, they a re not available. Another is tl1a t clients get a d iffe ren t dynan1ic IP address each tim e they boot u p . H ow can one peer find another to use?
In addition, P2P a p p lications run in tl1e backgro und all tl1e tin1e on the clients tl1a t provide services to oth er clien ts. Of course, ways must be fo und to p revent P2P
Chapter 11 • Nehvorked Applications 381
applications from being too "greedy" in using resources. If they reduce the perforn1ance of user machines enough to be noticeable to users, they are likely to be deleted.
A concern that n1any companies have is that \,•hen clien ts provide services to other clients, the central IT departtnent loses son1e of its control. IT d epartments are increas- ingly wary of the security issues ra ised by "shado\,, IT" of all types. At the san1e time, IT departtnents are intrigued by the possibility of buying or using less expensive server time by taking advantage of P2P processing to use idle IT resources. Users, in contrast to IT d epartments, tend to vie\v reduced IT control as a benefit rather than a problen1. It leads to less red tape and more freed on1 to act.
Test Your Understanding
22. a) What is the pronuse of P2P applications? b) What issues d o P2P applications create for users?
Skype We o nly look at t\,•o P2P applications in this chapter. The first is Skype. Th is is a peer-to-peer Voice over IP (and Video over IP) application. We already saw tradi- tional VoIP, so \,•e chose Skype to illustrate d ifferences between traditional and P2P applica tions in the san1e category. We also chose it becau se it illus trates ho\,v P2P applications usually deal with transient IP addresses by requir ing each client to log into the system.
Skype is a P2P VoIP service that currently offers free calling an1ong Skype custom- ers over the Internet and reduced-cost calling to and from Public S\,•itched Telepho ne Network customers. Skype offers a range of features, from phone ca lls to instant mes- saging and video calling. At the tin1e of this wri ting, Skype is the most popular P2P VoIP service. Skype's free ca lls from computer to con1puter have greatly contribu ted to this popularity. Figure 11-23 illustra tes ho\,, Skype operates.
1
Login and
Receive Super Node
Address
Skype Login Server
Steps 1-4 are Signaling
2 Request for
Called Host's IP Address
3 Distributed
Di rectory Search Among the
Super Nodes
Super Node
... IP Address ~
~ ~ -----------------. ---------------->-~
Calling Client PC (Ordinary Host)
Peer-to -peer communication (transport) during call
FIGURE 1 1-23 Skype P2P VoIP Operation
Called Client PC (Ordinary Host)
382 Chapter 11 • Networked Applications
There are thn.,e main elements in the Skype nel\vork: the Skype login server, ordi- nary host nodes, and super nodes.
• The login server is a central server managed din.'Ct!y by Skype. It is the only cen- tralized component in the Skype nel\vork.
• A host node is a Skype application that runs on a user's computer.
• A super node is a host node that takes on the work of signaling. Any regular host node may be made a super node if it has enough memory, network bandwidth, and CPU.
These elements are involved in the three steps that must occur for a user to place a call with Skype.
• Step 1 Login. First, a user must log in to the Skype login server. In this step, the username and password are authenticated. The Skype server also notes the user's IP address, \Vhich will be needed later in the directory search process. Login is the only step that involves a central server; the rest of the call process is done p eer-to-peer using host nodes and s uper nodes. This step is like the login process in t raditional voice over IP, \vhere each client must log in to its own proxy server.
• Step 2 Signaling/Directory Search. After login, the user can place calls. His or her host \Viii begin the signaling process. One of the main aspects of Skype signal- ing is the directory search, the process in which a Skype application looks up the usemame and IP address of the party it wants to contact. A Skype directory search is a completely P2P process that is done using the super nodes. Th is is a major difference from traditional voice over IP, where signaling uses servers (proxy servers).
• Step 3 Transport. Figure 11-24 compares Skype w ith traditional VoIP. Skype's super nodes handle signaling, but transport is done entirely by the two host nodes involved in the call. In transport, the voice packets are routed completely P2P, from caller to called party and vice versa. This is like traditional voice over IP transport, where the two clients also communicate din.'Ctly.
Because the signaling and transport are done by peers rather than going through a central server, Skype only carries the burden of managing a login server. This greatly reduces Skype's operational costs, resulting in its low-cost calls.
Traditional VoIP Skype Comparison
login Server: user logs into his or Server: User logs into the Similar her proxy server Skype login server
Signaling Server: proxy server Peer-to-Peer: Super Major difference manages signaling nodes manage signaling,
using P2P searching
Transport P2P between the two P2P between the two Similar hosts hosts
FIGURE 1 1-24 Traditional VoIP versus Skype
Chapter 11 • Nehvor ked Applications 383
Test Your Understanding 23. a) Wha t service or services does Skype provide? b) List and define Skype's three
m ain elen1ents. c) Why is Skype login necessary? (This is a con1m on p roblem in P2P processing.) d ) Wha t is a directory search in Skype? e) Which element of the Skype network is in charge of signaling? f) Which elen1ent of the Skype network is in charge of transport? g) Which of Skype's three s teps is done P2P? h) Con1pare Skype and traditional voice over IP in terms of w hether login, sig- naling, and transport are P2P or w hether they use servers.
Tor
An other popular P2P app lication is Tor. Tor has a unique purpose-to permit ano ny- n1ous IP transmissio n in which the IP address of the origina l sender is unknowable to the receiver. This goal is controversial because it is used by cybercriminals such as d is- tributed denial-of-service (DDoS) attackers and crime\,•are purchasers. However, it is also used by those \,•ishing to send tips to law enforcemen t agencies anonymously and to provide assurance of an onyn1ity to o rd inary p rivate citizens concerned with in dis- crin1inate governn1ent data collection.
To r Rou ting Figure 11-25 illustrates how Tor works in simp lifi ed (but hope- fully usefu l) fas hion. The Tor network is a large collection of peer con1puters acting voluntarily as Tor routers.8 Host X is the host wishing to transmit anonymously. Host X encrypts the n1essage three tin1es, then sends it to a selected Tor router, Tor Router 10.
• Tor Router 10 looks at the n1essage. The n1essage contains a key for decrypting its encrypted content. The router uses the key to d ecrypt the encrypted conten t. Note
Tor Network (Many Routers)
Enc rypts Message 3Times
3 Still Doubly
Encrypted
4 Tor Router 472 Decrypts Once
Original Message is in the Clear but HostX
source IP add ress HostX
Seeking Anonymity
Tor Router 10 Decrypts Once Still ! is unknowable
Singly 6
2
Each message includes the key for its decryption; Each receiver f orgets the
message's last source address
Encrypted Server B
~ -- ~~~~C_'.'~~:~ + ~ Tor Router 47 ~
5 (Exit Node) Decrypts Once
FIGURE 1 1a25 Tor Anonymous Transmission Network: A Sim plified View
8Thcsc arc not Layer 3 routers. They operate at the application layer. However, they do send messages ac-.ross a group of peer nodes, so the name "router" is certainly evocative of what the peers do.
384 Chapter 11 • Networked Applications
that Tor Router 10 knO\VS the source IP addn.,ss of the packet and the decryption key. However, it deliberately forgets them, wiping kno\vledge of them from its memory and storage. Note also that Tor Router 10 cannot read the original mes- sage. That message is still doubly decrypted.
• Tor Router 10 thenfonvards then.>Sult to Tor Router 472. This Tor router repeats the process, decrypting the now-doubly-encrypted message w ith the key it receives, forgetting the key and source IP address, and passing the no\v singly encrypted m essage on to Tor Router 47.
• Tor Router 47 d oes another d ecryption . This time, however, \vhen the message is decrypted, it is in the clear, readable to anyone. Tor Router 47 then sends this mes- sage on to Server B.
Anonymity, not Confidentiality Server B can read the message. In addition, it knows that the packet's source IP address \Vas Tor Router 47. Ho\vever, this knowledge does it little good. If it can find out what Tor Router 47 kno\VS, all it will learn is that Tor Router 47 is a Tor router. It cannot even learn the source IP address of the Tor router that sen t the messa~e to Tor Router 47- much less the IP addn.,ss of Host X. Anonymity has been achieved.
What Does t he Ex it Node Know? The original message is fully d ecrypted by Tor Router 47. This Tor Router is called a Tor exit node because it is the point at which the message leaves the Tor nehvork. Tor Router 47 is slightly dangerous because it can read the unencrypted message before sending it on. It can then deliver this m essage to som eone trying to break the Tor network's cryptographic protec- tion. However, this is merely a violation of con fidentiality, and the Tor network does not aim to offer confid en tiality. Its only promise is anonymity, w hich it fu lfills very \Vell.10
Test Your Understanding
24. a) Does Tor try to achieve confidentiality for the original message? b) Does Tor try to achieve anonymity for the original message? c) What does each Tor router do when a message arrives? d) How is the risk created by the exit node different from the risk created by intermediate Tor routers?
9 It might help you to understand Tor if you knew that the abbreviation originally stood for TI,e Onion Router. Each Tor Router along the way peels away one layer of encryption from the "onion" message. How- ever, fingerprints are gone from the original outer layer. This analogy is limited because fingerprints are still on the previous outer layers, which may still be lying around. Each stage in the Tor process erases all digital fingerprints that could identify the original sender. 10 However, its anonymity protection., although s trong, is not qu ite absolute, When the FBI took down the c rime s ite Pirate Bay, it succeeded in breaking anonymity. A short time later, Pirate Bay came back up on a Tor network, but many criminal hackers avoided it, believing that it was an FBI front to identify IP addresses.
END-OF-CHAPTER QUESTIONS
Thought Questions
1-1. The sender uses HTTP to transmit mail. What standard or standards will the receiver use to download the message?
1-2. In VoIP, which of the following is trans- port or signaling: a) SIP b) The delivery of voice between users c) RTP d) Call setup e) CODEC data?
Chapter 11 • Networked Applications 385
1-3. Skype uses super nodes, which do more work than ordinary P2P nodes. How do you think nodes become super nodes? There is nothing in the text that will help you with this question. Think broadly in terms of what costs P2P com- puting imposes on network peers.
This page intentionally left blank
Append ix
Managing the Security Process
Security is a process, not a product. 1
LEARNING OBJECTIVES
By the end of this appendix, you should be able to: • Discuss failtll'(_,s to stop the attack in the Target breach.
• Explain why security is about management far more than it is about technology.
• Explain the Plan-Protect-Respond-Cycle that governs defensive thinking in security.
• Describe and apply major security p lanning principles, including risk analysis thinking, comprehensive security, defense in depth, \veakest links, single points of takeover, least permissions, comprehensive identity management, segment ing networks into different security domains, and organizational system security.
• Describe and apply policy-based security management.
• Describe how to respond to successful break-ins, including the use of Computer Security Incident Response Teams (CSIRTs), real-time fail-over, and intrusion detection systems.
1 Ben Schneier, "Compu ter Security: Will We Ever learn?" Cryplo-Gram Newsletter, May 15, 2000, https:/ / www.schncicr.com/ crypto-gram-0005.html.
387
388 Appendix
THIS APPENDIX
Most teachers use this textbook for the core networking course. The 11 chapters provide that coverage. There is a lot of security in those chapters, especially in Chapter 4. This reflects today's networking job, which for better or worse deals heavily w ith security.
Some teachers use t his book for a combined core course in networking and security. That requires some higher-level security concepts. This appendix provides them. For a networking and security course, I like to teach this appendix after Chapter 4, the main security chapter. That way, st udents can use and reinforce these security concepts in the rest of t he course. However, it is also a n ice way to end a semester because there are a lot o f cool concepts in it.
Many teachers use this appendix in t heir network courses despite having a separate core security course. This reinforces the knowledge and skills they learn in the core security course. Today's students can never get too much security.
FAILURES IN THE TARGET BREACH
After every breach, compank-'S should pause to learn from the experience, If this type of reflection leads to appropriate changes, it m ay prevent similar breaches in the fu lure. It may even warn the company that its overall security is in trouble.
The Security of Business Partners One lesson from the Target breach is that you cannot trust external business partners to have good security. In the case of Fazio Mechanical Services, an employee fell for a spear phishing attack This could happen in any company. Ho,vever, Fazio made it more likely, It used the free consumer version of an antivirus program, Malwarebytes Anti-Mahvare,2 This free version did not assess arriving e-mail messages and attachments, It only looked for rnalware already on the computer and then only occasionally, If Fazio had used a commercial anti virus program for their e-mail, the employee probably would have seen a warning that opening an attachment was a bad idea or even that a specific threat existed in the attachment.
Inadequate Network Segregation The breach taught several lessons about Tar- get's security, After the attackers gained a foothold on the vendor's server, they moved into more sensitive parts of the net\vork to do,vnload malware onto the point-of-sale (POS) terminals, compromise a server to create a holding server, and compromise another server to act as an extrusion server. The low-security and highly sensitive parts of the network should have been segregated, (Banks do not let customers walk around in the vault.)
Not Following Up on Specific Warnings An even worse issue is that Target received explicit alerts ,vhen the attackers ,vere setting up the extrusion server, The thieves had to download malware onto the extrusion server before using it. Target used the FireEye intrusion detection program, FireEye's intrusio n detection team notified Target 's Minneapolis security staff that this downloading had occurred in
2 Brian Krebs, "Email Attack on Vendor Set Up Breach at Target," February 14, 2014. http:/ / krebsonsecurity .com/ 2014/ 02/cmail-attack-on-vendor-set-up-breach-at-target/ .
Appendix 389
a h igh-priori ty alert o n Novembe r 30, 2013 .3 In addition, the thieves had trouble ,v ith the initial mah,•are. They had to make additional updates o n December 1 and December 3. These res ulted in additional FireEye ,varnings being sent to Target's Minneapolis security group. Had Target followed up o n these "'arnings, they could have stopped or a t least reduced the da ta extntsion, ,vh ich began on December 2.4
Keeping Up with the Threat Environment for POS Systems Ta rget n1ay have been lax in reacting to the danger of POS a ttacks. In Apri l and August of 2013, VISA sen t Ta rget and other compan ies warn ings about ne,v dangers regardi ng POS data theft.5 It appears that Target's own security s taff expressed concern for the compa- ny's exposure to charge card data theft.6 Target d id not respond to this risk aggressively, another serious lapse.
Kill Chain Analysis for the Target Attack Overall, Figure A-1 sho\\'S tha t the thieves had to s ucceed at every s tep in a complex series of actions. Lockheed
Obtain Malware ) Compromise Vendor ) Compromise POS Update server
1 2 3
Compromise POS !];'promise & Use ) Compromise & Use Machines ding Server Extrusion Server
4 5 6
Maintain Command t ee Data '\ & Control 7 8 A Kill Chain Fails If ANY Component Fails
FIGURE A- 1 Kill Chain Analysis: Breaking Any Link Stops the Attack
3Michacl Ri lC)', Ben El!?in, Dunc Lawrc.ncc, and Carol Matlack_, ''ML,;scd Alarrns and 40 Millio1, Stolen Credit Card Numbers: How 1argct Blew It," Bloomberg Busincsswcck, March 13, 2014, http://www.bus incsswcck .com/ a rticlcs / 2014-0J.13 / ta rgct-m isscd •a la rms-in-cpic-hac k -of--crcd i t--card 0da ta. 4 Aviv Raff, "PoS Malwarc Targeted Target," Seculc rt, January 16, 201 4; h ttp://www.seculert.com/ blog/2014 /01 / pos-malwaro-ta rgetcd-ta rget.html. 5 Jim Finkle and Mark Hose1,ball, "6xdusivc: More Well-Known U.S. Re ta ilers Victims of Cybcr Attacks Soura,s," Re uters, January 12, 2014, hlip://www.rculers.com / article/2014/0t/12/ us-targct· databrcachrc- tailers•id US8R£A0801720140 t 12. 6 Danny Yadron; Pa ul Ziobro; and Devlin Barrett, "Target Warned of Vulnerabilities Before Data Breach," Wall Stre,t Journnl, February 14, 2()14, http://online.wsj.com/ncws/arliclcs/SBHJOOt 424052702304703804S 79381520736715690.
390 Appendix
Martin's Computer Incident Response Team7 staff calls this a kill chain, which is a term borrowed from the military. The kill chain concept was designed to visualize all the manufacturing, handling, and tactical steps needed for a weapon to destroy its target. Failure in any step in a kill chain w ill create overall failure.
Lockheed Martin has urged companies to implement security kill chain analy- sis and look for evidence that one of the steps is occurring. Success in ident ifying an operating kill chain may allo,v the company to terminate it or at least disrupt or degrade it. The ,varnings when malware ,vas put on the extrusion server should have done exactly that.
Until one understands likely kill chains in depth, however, it is difficult to realize that particular events are related, how they are related, and what type of attack they are part of. Conversely, understanding a kill chain can allow the company to act before an attack fitting that pattern even begins. For example, even cursory thinking about charge card data theft would lead the company to realize that thieves ,vould probably use FTP transfers from unusual servers, that command communication would prob- ably use certain ports in fue,valls, and so for th.
Security Is a Process, not a Product Even ,veil-defended companies suffer security compromises. However, when strategic planning is not done well, if protections are not put into place, or if the security staff is not aggn.,ssive in doing the work required for the protections to succeed, the risk of compromises becomes a near certainty. Security expert Ben Schneier has often said that "Security is a process, not a product." Box~,s and software are not magic talismans. They must be backed by highly effec tive management and implementation processes. Schneier has also said, "If you think technology can solve your security problems, then you don't understand the problems and you d on't under- stand the technology."8 Target failed to understand its security problems, and it failed to develop process~,s that ,vere effective against the threats it faced. However, Target is merely an object lesson. Many firms have inadequate security processes, and few have uniform excellence in how they manage and implement security.
Test Your Understanding 1 . a) What security mistake did Fazio Mechanical Services make? b) Why do
you think it d id this? (This requires you to speculate.) c) How m ight segre- gation of the network have stopped the breach? d) Why do you think the Minneapolis security staff d id not heed the FireEye warning? (This also requires you to speculate.) e) What warnings did Target not responded to adequately? f) What happens in a kill chain if a single action fails anywhere in the chain? g) Ho,v can kill chain analysis allow compan ies to identify security actions it should take? h) Explain why security is a process, not a product.
7 Eric M. Hu tchins, Michael J. Cloppert, and Rohan M. Amin, ''Intelligence-Driven Computer N etwork Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains," Lockheed Martin, 2011, http://www.lockheedmartin.com/ content/ dam/lockheed/ data/ corporate/ documents/LM-White-Paper- Intcl-Driven-Defense .pdf.
• Bruce Schneier, Secrets and Lies, 15th Anniversary ed. (Indianapolis, Ind.: Wiley, 2000).
Appendix 391
THE PLAN-PROTECT-RESPOND CY CLE
Figure A-2 sho"'S the overall process that companies s hould follow to deal "'ith threats. On the left is the threat env ironmen t, \Vhich consists of the a ttackers a nd a ttacks the company faces. We looked at the threat environment in Chapter 4.
The rig h t s ide of the fig u re illustra tes how companies mount defenses against the threats they fa ce. The figure sho"'S tha t con1pan ies constantly cycle through three phases of security manage,nen t. This is the plan-protect-respond cycle.
Planning The con1pany mus t plan ho,v it will protect its assets. New assets appear, and existing assets change in va lue. P lans mus t change accordingly. Adversar- ies constantly change the ir attacks, and companies must change their plans to n1eet the changing threat e n viron,nent.
Protecting Next comes protection, in which companies provide actual protec- tions on a day-to-day basis. We looked at protections such as firewalls in Chapter 4. In Figure A-2, the protect phase bubble is larger than the o ther two. This emphasizes the fact that the protect phase is ,n uch larger than the other two phases in tem1s o f tin1e a nd resource expendi tures. Ho\vever, \Vitho ut extensive and insightful planning, it is possi- ble to spend a great deal of time and effort mounting protections witho ut being effective.
Respond ing Finally, a company must respond when it su ffers a s uccess fu l security attack. Security b reakdo"'ns are inevitable, and it is professional ma lpractice not to have effective plans fo r "'hat to do when they occu r. Ta rget d id not.
Not Exactly in Sequ ence Logically, planning comes before protection, and response con1es aften,•a rd. Reality mocks this logic. Security fa ilu res consta ntly requ ire
1
Threat Environment
2
Plan
5
Planning Principles:
/c Risk analysis, Comprehensive security, Defense in depth, Weakest links,
\ Attacks and attackers Policy-Based Management
Single points of takeover, least permissions,
Identity management, Network segregation,
Organizational system security.
4
Respond
Response to incidents, also called
compromises and breaches
I ~
3 Protect
Ongoing protection by access control, firewalls, cryptography, etc.
FIGURE A -2 The Threat Environment and t he Plan-Protect-Respond Cycle in Securit y M anagement
392 Appendix
changes in p lanning and protection . Planning, protection, and response are simul tane- ous processes in the real \VOrld. Companies make comprehensive plans once a year or more, but defenders quickly learn the military axiom, "No plan survives first contact \vith the enemy." In war, the other side tries to learn you r plan and use it against you . Security adversaries do the same. At the same time, trying to react \vithout a core p lan to improvise around is absurd.
Test Your Understanding
2. a) What happens in each stage of the Plan- Protect- Respond cycle? b) Which stage consumes the most time?
SECURITY PLANNING PRINCIPLES
Perhaps more than any other aspect of IT, effective security d epends on effective plan- ning. Security planning is a complex process that we discuss only briefl y. We focus on some key planning principles that must be observed in all security thinking. These principles are sho\vn in Figure A-2.
Risk Analysis Many believe that the goal of security is to stop all threats to the corporation. Surpris- ingly, that is not true. Fundamentally, stopping all attacks is impossible. Despite strong security efforts, there \Viii always be some risk of a compromise. There has always been crime in society, and there always will be. The same is true of security incidents. No matter ho\v much money a company spends on security, it never stops all threats. Rather, the goal of security is to reduce the risk of attacks to the extent that is economi- cally feasible, that is, to the extent that the benefits outweigh the costs.
The goal of security is to reduce the risk of attacks to the extent that is economically feasible, that is, to the extent that the benefits outweigh the costs.
Risk analysis is the process of balancing risks and protection costs. Corporate security planners must ask whether every countermeasure is economically justified. For example, if the probable annual loss from a threat is $10,000 but the security mea- sur~,s needed to th\vart the threat \Viii cost $200,000 per year, the firm obviously should not spend the m oney. Instead, it should accep t the probable loss if there is no other available countermeasu re.
Risk analysis is the process of balancing risks and protection costs.
A Ri sk Analysis Example Figure A-3 gives an example of a risk analysis. With- out a countermeasure, the damage per successful attack is expected to be $1,000,000, and the annual p robability of a successful attack is 20%. Therefore, the annual p robable annual dam age is $200,000 \Vithout a countermeasure ($1,000,000 times 20%). This is the base case for the analysis-doing nothing.
Appendix 393
Countermeasure None (Base Case) A B
Total Cost of Incident (TCI), per $1,000,000 $500,000 $1 ,000,000 occurrence
Annual p robability of a 20% 20°/o 15% successful attack
Annual p rob able damage $200,000 $100,000 $150,000
Annual cost of countermeasure $0 $20,000 $60,000
Net an nual p robable outlay $200,000 $120,000 $210,000
Annual saving compared to no NA $80,000 {$10,000) countermeasure
FIGURE A -3 Risk Analysis Calculat ion
Count ermeasure A The first countermeasure will cut the damage of a success- ful attack in half. So the damage per successful attack is expected to be $500,000 instead of a million dollars. The countermeasure will not n.>duce the probability of a successful attack, so that continues to be 20%. With Countermeasure A, then, the annual probable dam age will be $100,000 ($500,000 times 20%) . This seems attractive compared \vith having no countermeasure. Ho\vever, a countermeasure is never free. This one \Vil! cost $20,000 per year. Therefore, the net annual probable cost is $120,000 \vith Countermea- sure A- $100,000 in probable dam age and $20,000 for the countermeasure.
Countermeasure A, then, will reduce the net annual probable outlay from $200,000 to $120,000. The countermeasure therefore gives an annual saving of $80,000 per year compared to the base case. Countermeasure A is cost effective.
Countermeasure B The second countermeasure does nothing to reduce the total cost of an incident. However, it reduces the p robability of attack from 20% to 15%. Therefore, it reduc~,s the annual p robable damage from $200,000 to $150,000. Unfortu- nately, the countermeasure's annual cost is $60,000 per year. The net annual probable outlay from incidents plus the countermeasure is therefore $210,000. This is $10,000 m ore than the base case's $200,000. It does not make sense economically to implement this countermeasure at all.
The Decision For this situation, the final choice is simple. The company should implement Countermeasure A. If it does, it can expect to reduce its annual outlay for this resource by $80,000. Countermeasure Bis obviously a bad choice. It would actually increase the firm's p robable annual cost outlay. Of course, every situation is different. Sometimes, multiple countermeasures will be able to save money, and in some cases, none \Vil!. If none \Vil! reduce costs, the choice should be to d o nothing.
Countermeasure Cost s Security professionals may be tempted to think of countermeasure costs in terms of hard\vare and software. Ho\vever, most counter- measun.'S require extensive security labor. In fact, labor is often the biggest cost. More broadly, security often increases labor costs for the users they are defending. If users spend even a fe\V extra minutes each time they use a n.'Source, this can lead to substantial
394 Appendix
Possible Avenue
of Attack
Possible Avenue
of Attack
Comprehensive Security:
Possible Avenue
of Attack
FIGURE A-4 Comprehensive Security
Closing All Avenues of Attack
Possible Avenue
of Attack
user labor cost. It could tip the scales against installing the countermeasure. The total cost of a countermeasure must include all factors.
Test Your Understanding
3. a) Comment on the staten1en t, "The goal of security is to elin1inate risk." b) What is risk analysis? c) Repeat the risk analysis in Figure A-3, this tin1e with Coun- tem1easu re C reducing d amage severity by a quarter and the likelihood of an attack by 75%. The annual cost of Countermeasure C is $175,000. Show your ca lculations like the table d oes. d) What do you conclude? Justify your answer.
Comprehe nsive Security To be safe from a ttack, a con1pan y must close off all avenues of attack. Figure A-4 illus- trates this simple but fundan1ental principle. There are four avenues o f a ttack, and the defender must protect all four. In contrast, an attacker o nly needs to find one unprotected avenue to succeed. Although it is d ifficul t to achieve comprehensive security, it is essen- tial to con1e as close as possible.
Comprehensive security is closing off all avenues of attack.
Test Your Understanding
4. a) What is con1prehensive security? b) Why is it in1portant?
Defe nse in Depth and Weakest Links
D efen.se in D epth Another critical p lanning principle is defense in depth. Every protection w ill break down occasionally. If attackers must break through only one line of defense, they will succeed during these vu lnerable periods. Ho\,•ever, if an
Appendix 395
Host Firewall Successfully Stops
the Attack
Addttional Lines o f Defense
Border Firewall Fails to Stop
Jl the Attack
~ [)O Attack to
Steal Data
)
Host Application with Vulnerabilities
Well Patched
Several Countermeasures Arranged on a Series Attack is stopped if ANY contermeasure succeeds
FIGURE A ·S Provide Defense in Depth for Resources
Host Data Is
Encrypted
Attac k Tar get
attacker n1ust break through two or more lines of defense, the breakdown of any single defense technology w ill not allo\,, the a ttacker to succeed. Having successive lines of defense tha t n1ust nil be breached for an a ttacker to succeed is called defense in depth.
Having several lines of defense that must all be breached for an attacker to succeed is called defense in depth.
Figure A-5 illustrates defense in depth. In the figure, there are four protections in succession. The first is a border firewall. The second is a host firewall on a server tar- geted by the attacker. The third is the use of good practice in patching application vul- nerabilities on the server. The fourth is encrypting all server data so the attacker cannot learn sensitive infom1ation even if all other defenses fail.
The figure shows \¥hat happens if the border firewall fails to stop an attack. The host firewall will stop it. The con1pany should fix the border firewall quickly, so that it becomes part of the effective defense, but attack packets will not get through to the target data while the border firewall is being fixed.
Id en t i f y and M an ag e W eakest Links Defense in depth increases security with a series of protections. In contrast, many individual protections consist of a series of interna l parts that must nil \,•ork if protection is to succeed. If one fails, the counter- n1easure fails. For exan1p le, an antivirus program may protect a user by identifying a n1alicious attachn1ent. However, if the user fails to use good judgment and opens the attachment anyway, there is no protection. A weakest link exists when the failure of a single part of a countermeasure can cause the entire countermeasure to fail to stop an attack. It is like the weakest link in a physical chain.
A weakest link exists when the failure of a single part of a countermeasure will cause the entire countermeasure to fail to stop an attack.
Figure A-6 shows ho\,, weakest links can compron1ise a countermeasure. Here the countermeasure is a fire\,•all. The fire\,•all has five components, all of which n1ust be effective for the fire\,•all to be effective. These are the firewall hardware, fire\,•all
396 Appendix
Firewall Hardware
Firewall Software
Defective Firewall
ACL
Firewall Components
Firewall Log File
A Single Countermeasure (FirewalQ with Multiple Components ALL Components Must Work or an Attack Will Succeed.
FIGURE A-6 Ident ify and M anage Weak est Links
Reading Log File
Freq uently
I~ -L
sofhvare, a firewall access con trol list (ACL), the firewall log file, and the practice o f reading the log file frequen tly. Even if all the other elemen ts are fully effective, if the ACL is defective, the firewall will fail to stop an a ttack. Similarly, if the company fails to read the firewall log file regularly, it \viii fail to keep the ACL up to date, and this will also cause the fire\vall to fail.
Def ense in Depth versus Identifying and Managing Weakest Links It is easy to confuse defense in d epth and wea kest link a n alysis because b oth have a series of elements. Figure A-7 compa res the m in te rms of their na t ure, th e n umbe r of countermeasu res involved, whe t her the co u ntermeasure has m ultip le co mpo - nen ts, and cri teria fo r success or failu re. The ke y po int is that w ea kest link analysis involves a sing le cou n termeasure while d efense in depth involves m u ltip le counter- measures.
Test Your Understanding
5. a) What is defense in dep th? b) Why is defense in d e pth necessary? b) When d oes a \veakest link exist? c) Distinguish behveen defense in depth and w eakest links.
Defense in Depth WeakestUnk
Nature Protection Weakness Number of Multiple One Countermeasures
Components per NA Multiple Countermeasure
Outcome Protection if any Failure if any component fa ils countermeasure succeeds
FIGURE A-7 Defense in Dept h v ersus Weakest Links
Attacker,. ___ M_a_lic-io_u_s----c,.. 'W Commands
Border Firewall
~
Turn Off lnterfac,e 1
Router 1
Compromised SNMP server (Single Point of Takeover)
Set: Change the Following Rows ...
Router 2
Acc,ess Point
Set: Disassociate
All Users
FIGURE A-8 Identifying and Protecting a Single Poi nt of Takeover (An SN MP Server)
Identify and Manage Single Points of Takeover
Appendix 397
Another principle is focusing on potent ial single points of takeover. We saw the Sim- ple Nehvork Management Protocol (SNMP) in Chapters 3 and 9 (see Figure A-8). If an attacker takes over the SNMP server, there is no end to the damage that he or she can do. The SNMP server is a potential single point of takeover, which means that if an attacker can take it over, the attacker gains control over a significant portion of your nel\vork. As noted in Chapter 9, companies \Vith weak security should not use the SNMP Set command. However, if security is strong, companies should use SNMP Set commands to manage remote devices.
Companies usually cannot and do not want to eliminate single points of takeover. Having a firewall policy server greatly improves a company's control over its firewalls, eliminating inconsistencies and reducing management costs. It is critical for companies to identify all single points of takeover and harden them very well against attacks.
Test Your Understanding
6. a) Why must compani~,s identify single points of takeover? b) What must companies do about potential single points of takeover?
Least Permissions Security planners constantly \vorry about protecting access to resources. People \vith access to resources can damage them. Those without access cannot. Not surprisingly, companies work very hard to control resource access. Access control is limiting who may have access to each resource and limiting what he or she can do to the K>Source.
Access control is limiting who may have access to each resource and limiting what he or she can do to the resource.
Authorizations One aspect of access control is authentication, which is requir- ing users requesting acc~,ss to prove their identities. However, just because you kno\v
398 Appendix
Authentication
Test the credentials of a supplicant
Accept or deny decision
Authorizations (Permissions)
After a supplicant is accepted as the True Party .. .
Decide what authorizations or permissions the True Party has
That is, what can the True Party do with the resource
Acceptance should rarely result in getting all permissions
FIG URE A -9 Authentication versus Aut horizations (St udy Figure)
\Vho someone is does not mean that h e or she shou ld have unfettered access to you r resources. (There undoubtedly are people you kno"' who you "'ould not let d rive you r car.)
Authorizations (Permissions) Authorizations or permissions a re the actions that an auth en ticated user is allowed to take o n the resource. For example, although you are perm itted to view the U.S. Decla ration of Indepe ndence, you n1ay not add your signature at the bottom.
Authorizations or permissions are the actions that an authenticated user is allowed to take on the resource.
Authorizations and Authentication Servers We sa"' in the ma in c ha p - ters that w hen people wish to use a server or other resou rce, they n1ust authenticate themse lves. Th e serve r passes their credentia ls to an authen tication server that vets creden tials a nd sends an accept or deny messa ge back to the server. As (Figure A-10) s ho"'S, it a lso returns a list of pern1issions. T h is employee can list files, that is, see \Vhat files are in a p roject directory. He or she may a lso read the fi les. Ho\vever, he is not a uthorized to do anything e lse, s uch as edi t fi les or d elete them.
Supplicant
1
Credentials
Server 2 Credentials
3
Authentication -----Accept Supplicant; Permissions: I
List Files, Authorizations Read
FIGURE A- 10 Authentication and Authorizations when an Authent icat ion Server is Used
Appendix 399
Team Team Team Not Team Permission Mean ing Member Editors Leader Member
List files See list of files in folder X X X
Read Read a fi le X X X Write Edit a file X X
Create/Delete Create new files, delete X File files from directory
Change Change permissions X Permissions for others
FIGURE A -1 1 lea st Permissions for a Project Team's File Fold e r
Least Perm issions An important principle in assigning permissions is to give each person the least p ermissions that he or she needs to accomplish his or her job. For exan1ple, if you give an employee permission to enter his or her build ing in a mu lti- building complex, you migh t not give that person permission to enter other buildings in the complex. Even if the person can enter a building, he or she may not have permis- sion to enter special areas such as a bank vau lt or the corporate p lanning department. You n1ay even restrict the floors the person can reach using the build ing's elevators.
Least permissions are the minimum permissions that the user needs to accomplish his or her job.
Exampl e of Least Pe rmission.s Suppose, for exan1ple, the target asset is a fi le fo lder on a server. Figure A-11 sho\,•s son1e permissions tha t can be applied in a fo lder. They are shown in increasing order of authorization, n1eaning increasing order of risk. The figure a lso sho\'l'S permissions to be given to various tean1 n1embers.
• All tean1 members can see all fi les in the fo lder-but only their names, types, sizes, and other basic inforn1ation. All tean1 men1bers also have the Read permis- sion so they can read every file in the folder. This pern1ission is sometin1es called Read-Only because the person reading the file cannot edit it. These are the least permissions that make sense for everybody in the team.
• Some of the tean1 n1embers w ill be editors. The write permission allo\,•s then, to edit files in the folder. These members therefore have more permissions, but they are still not allowed to do riskier things such as delete files. That would allo\v a rogue team men1ber or an attacker \,•ho compron1ises an editor's computer to elimina te all files in the directory.
• The team leader exclusively retains further permissions. Only he or she can create new files, delete existing files, or change permissions for files.
• Finally, everyone else in the world receives no permissions in the d irectory. They cannot even see the names of files in the directory. They may not even be able to see that the directory exists.
400 Appendix
Test Your Understanding
7. a) Distinguish beh,•een authentication and authorizations. b) What is another tern1 for authorizations? c) What is the principle of least permissions? d) Why is it important?
Identity Management Identity management means having con1prehensive visibil ity and control over indi- vidual emp loyee access to and permissio ns on all resou rces. The princip le of least permissions is part of con1prehensive identi ty n1anagement, but there is a major problem ren1a injng.
Many compliance regimes require a company to have strong identity management.
Identity management means having comprehensive visibility and control over individual employee access to and permissions on all resources.
A problen1 in au thentication is that big companjes have many authenticatio n servers, not just o ne. This creates the danger that different authentication servers will have incompatible inforn1atio n. This mig h t, for example, allo\,, someone w ho had just been fired to try logging into systen1s that use different au thentication servers in hopes of finding o ne that had not been upda ted to ren1ove his or her access creden tials.
Identity Management Mandates in Compliance Regulation Trus sort of thmg has a lways been a problem, but con1pliance regulations increasingly require fi rn15 to have con1prehensive identity managen1ent to be in full con1pliance. A major goal of con1prehensive identity n1anagement is ensuring that there is unifornuty in vetting cre- dentials throughout the firm. There must be a way to synch ronize data on all of these authentication servers.
D irectory Servers Figure A-12 shows th at companies accon1plish unilornuty by storing credential inforn1ation not on the authentication servers individually but o n a rurectory server. Directory servers conta in a great deal of general information about employees and computer resources, including telephone numbers, e-mail addresses, and, yes, security information.
When the database server o n th e left receives a request from a person (Joe) to log in, the DBMS server will pass Joe's credentials to an a u th entication server. If there is no directory server, the a u thentication server w ill make the accept/ deny decision. If it accepts Joe, it will let Joe log in to have access to his resources and pernussions .
Ho\,vever, if there is a d irectory server, as there is in this case, the a u thentica- tion server will pass the request to the directory server.9 The d irectory server wi ll
9 1.n smaller fi rms, directory servers allow user identity in formation to be managed on a single device, the directory server. Larger firms, however, usually have multiple d irectory servers, a nd often from multiple vendors. Most larger finns need mctadircctory scnrcrs that synchronize identity data ac-ross the ind ividual directory servers regardless or their dHforent manufac turers. This adds another layer of complexity.
4
OK
Directory Se rve r
2 OK.Perm~
~ Credenbals
Credentials
! • Cred: nbals t
Directory Server
Database
2
~ Permissions
Credentials
JOE: E-Mail Phone DBMS
Username Password Permissions
FTP Server Username Fingerprint Permissions
FI GURE A· 12 D irectory Server w it h M u lt ip le Authent icat ion Servers
Appendix 401
3
make the d ecision a nd p ass the accep tance decision p lus p e rm issions to the a u then - tication server. Th is ensures tha t the vetting d ata is cu rren t. If an en1p loyee leaves the con1p any, the security a dm inistrator m e rely d isables h is or her reco rds on the directory server. That person is insta n tly c u t off fro m a ccess usi ng any a u then tica- tion se rver.
Role-Based Access Control The traditional w a y to manage identity da ta has been to decide wha t level of access to give to each user. This req uires crea ting m any a ccess p rofiles, increasing the likeli hood of an e rror. In addition, it is difficult to ascer- tain what permissions a particu la r a u tlle n ticated user "'ill need on a device. A con1mo n ,vay to red uce this complexi ty is to use role-based access control (RBAC), in "'h ich per- mi~sions a re assigned to roles , vithin each team. Using th e exa,nple o f docun1ents for a project team "'e sa"' in Figu re A-11, these ro les might b e lead er, editor, general tea m
Traditional Individual-Based Access Control
Many access permissions will have to be defined on different devices
It is difficult to define what permissi ons an individual will need on a device
This is error-prone
Role-Based Access Control (RBAC)
Assign individuals to roles
They receive role permissions
If add Joe as an editor, no need to think about specific permissi ons
Less likelihood of errors
FI GURE A -13 Role-Based Acce ss Cont rol (RBA C) (Study Fig ure)
402 Appendix
member, and outsider. It is much easier to understand what permissions a role will need than what an individual w ill need in the abstract. The person controlling access merely assigns each member to an assigned role. This reduces both cost and errors.
Test Your Understanding
8. a) How does a company addn.,ss the problem of changing login credentials and permissions on various servers for an employee when he or she moves to a different department? b) What does a company do when an employee is ter- minated to ensure that no authentication server will give that person access to any resource? c) What is role-based access control? d) What are its advantages compared to assigning permissions based on individuals?
Segment the Network Buildings in \vhich confidential projects are worked on are divided to control communi- cation between employees in different departments. Often, different parts of the build- ing will have acc~,ss controls to prevent unauthorized personnel from entering. A few parts of the building may have particularly strong access controls. For example, they may be on separate floors that cannot be reached by elevators without the correct access credentials. There may even be a guard on duty to check credentials for people arriving and to collect cellphones so they cannot be used internally. The guard may also check employees who are leaving to ensure that they have not taken trade secrets \vith them on paper or electronically.
In the Target breach, network segmentation \Vas either not used or was defeated. The at tackers first gained entrance to the Target network through a vendor access server. From there, they were able to move to the part of the network holding the POS download server. This should not have been possible. In network segmentation, the nel\vork is divided into different security domains, each \Vith security controls that are appropriate to it. Communication bel\veen security domains is restricted, especially between security zones w ith different levels of security risks.
In network segmentation, the network is divided into different security domains, each with security controls that are appropriate to it. Communication between secu- rity domains is restricted, especially between security zones with different levels of security risks.
A good example of segmentation is the use of a demili tarized zone (DMZ) 10 for servers public-facing servers, that is, servers that must be accessed by the outside \VOrld. These servers are likely to be under constant attack, yet they must operate
10 This name is confusing. In Korea and Vietnam., the demilitarized zone was the boundary area that lay between the two antagonists. It was called the demilitarized zone because it was sup posed to be left unoc- cu pied by either side. In practice, the DMZ was the bloodiest battle ground in the wars. Each side knew that they would face the enemy constantly. They had to be completely prepared for battle. By analogy, the security DMZ is where company servers that face the Internet and w ill certainly be attacked through the Internet must be placed so that they can be accessible to Internet users.
Security Domain 1: Subnet to Internal Corporate Network
(60.4 7 .3.x)
Bolder Router
Security Domain 2: Data Link to the Internet
(60.47.1.x)
Security Domain 3:
Demilitarized Zone (DMZ)
DMZ DNS Server
Public Webserver
DMZ Sub net (60.47.2.x)
E-Mail Server O ther Public- Facing Server
FIGURE A -14 Network Segregation Usi ng a Demi litarized Zone (DMZ) for Publ ic-Faci ng Servers
Appendix 403
publicly to serve a firm's customers. Figure A- 14 shows that many firms have an access router that connects three security domains. Like firewalls, routers often have access control lists that determine what traffic should be able to travel from one sub- net to another.
The demilitarized zone (DMZ) is for public-facing servers that must be accessible to the outside world.
• First, there is the public Internet, over which firms have no control whatsoever.
• Second, there is the internal nehvork, which should rarely be accessed directly from the Internet. Access controls should be very restrictive.
• Third, servers that must be made accessible to the public are placed in a third nehvork subnet. This is called the demilitarized zone (DMZ). Access from the Internet must be very permissive, but communication from the DMZ to the internal corporate nehvork should be minimized and rigidly controlled.
Because access to servers in the DMZ by Internet users must be easy, the serv- ers themselves must be strongly hardened to survive the inevitable attacks they will face. To give an example, the webserver has a web firewall that focuses entirely on web-based attacks. The fact that the entire firewall server only needs to protect a sin- gle webserver means that it will use all its processing power to protect that fire,vall. This permits it to do very sophisticated filtering. In addition, this server can permit only ,veb traffic to pass. Beyond that, the firewall w ill have detailed rules for threats specific to firewa lls . DMZ servers should also cause minimal damage if they are com- promised. For example, the DMZ directory server only kno,vs the IP addresses of
404 Appendix
hosts in the DMZ. Co,npromising the d irectory serve r wi ll no t co mp ro mise the IP addresses of in te rnal servers.
Test Your Understanding
9. a) Why is it important to segn,ent netivorks into m ulti ple secu ri ty do1nains? b) Ho"' is this done for public-facing servers? c) Ho,v restricted sho uld access be fro,n the Internet to the DMZ? d ) How restric ted should access be fro m the DMZ to the internal network? e) Ho, v restricted should access be fro m the Interne t to the internal ne t"•ork?
Organizational System Security We often s pea k of in form ation systems, "'hich are combina tions of people, proce- d ures, and technology that produ ce use fu l information when need ed . Howeve r, every in fo rmation systen, is e mbedded in a larger orga niza tion system . This organi- zational system may be a functional deparhn en t, a task force, a ne"' prod uct iden- tification and develop ment e ffort, o r a ny othe r workflo"' in a fi m,. It is importa n t to n,a nage secu rity in this broade r o rganizationa l systen, because fa ilu re to achieve organizational system security ,v iii n,a ke techn ical p rotections useless. Fig u re A-15 s ho\\'S that ,nanagi ng orga niza tional systen, secu rity is a complex jo b. It has m a n y componen ts, a nd a ny single fa ilu re can lead to a comp ro mise.
Goal s Every orga nizatio na l syste n, has goals. Secu r ity ,nust be built one o f these goals. It mus t a lso be rea lized that orga niza tion syste ms can never achieve all goals, so there is a danger that the securi ty goal ,viii be sacrificed for other goa ls.
Peopl e a nd Trainin g The system's people mus t be capab le of doing the req uired work a nd m ust u nderstand p e rti nent secu rity req uire me n ts. For that to hap pen, they n, us t be tra ined to "'ork securely. Imp le menting secu ri ty ,veil alwa ys requires training, not s im ply announcing security rules. If someone must add a new
C .!2 ., .Q C
g E 0 ()
Acti ve Management
Policies Priori ties Culture
Organization Roles
Procedures Processes Separation of Duties, etc.
People Training
FIGURE A-15 Or ganizatio nal System Security
Goals
Appendix 405
employee to a team, this will require specialized knowledge fo r giving them appro- p riate permissions.
Procedures, Processes, and the Separation of Dut ies The organizational sys- tem will have n.=ing work patterns. ln a few cases, th~,se patterns are procedures, which are so simple and well-defined that they can be automated. Titis has been the traditional focus of information systems. Hov,ever, most recurring work patterns in organizations are more complex and less well-defined. They are processes. A typical process is new product development, which takes place across multiple organizational units over a considerable period of time. Other common proces~,s are employee performance revie\vS and the cre- ation of annual plans. The fact that proa.~,s are not completely defined means that they are difficult both to support and to secure. Many aspects of securing procedures and p rocesses have been explored in the accounting and finance literature. One example is the separation of duties. ln the granting of exceptions to corporate rules, for example, it is common to forb id the person requesting an exception from authorizing the exception as well.
Organizational Structure and Roles An organizational system has an orga- nizational struct ure in which individ ual people have specific reporting patterns and specific roles. Their training must include security aspects of both. On the positive side, if people understand their place and role in the system, they can be given responsibility and accountability for their work. If they are effective, they will discover actions they must take to achieve good security. At least they know that it is up to them to do so.
Policies, Priorit ies, and Culture At a broad level, there are policies, priorities, and culture. These must have appropriate security content and must be taught to all membe rs of the o rganizational system . Having a strong security culture is important because if security culture is strong, people are likely to figure out ho\v to \VOrk securely even \Vhen security f!a\vS are present. When security culture is \Veak, the best techni- cal, procedural, and other protections are likely to be circumvented. It is important to realize that in most organizations, the security culture is only moderate and that some circumvention must be expected .
Communicat ion Communication must be constan t and effective. If the re is effective communication among everyone, problems are likely to be resolved and mistakes discoven.>d. ln the attack on Pearl Harbor, Admiral Kimmel believed that the Army had the capacity to p rotect his ships at anchor. The Army did not. ln fact, it \Vas focusing o n an entirely different problem, the sabotage of Army airplanes. Admiral Kimmel relied on the Army without sufficient justification because of lack of deep com- munication between the Army and N avy.
Active Management Above everything is active managem en t. Unless the management personnel at the top of the organizational system are engaged and effec- tive, the system has little chance of being secure. They must create and co mmunicate security requirements and disciplines effectively, they must ensure that problems in security elements are identified and \vo rked through, and they must actively look for lapses in security. Above all, they must demonstrate security discipline in their own behavior frequently and consistently.
406 Appendix
Test Your Understanding
10. a) What is an organizational system? b) Why is it necessary to train employe~,s in security relevant to their jobs? c) Distinguish between p rocedUK>S and processes. d ) which are harder to secure? Why? e) Explain why the separa tion o f duties may be necessary and how it is done. f) How d oes establishing a clear organiza- tional structure and roles tend to lead to better security? g) Which is hardest to create-good security policies, p riorities, or culture? h ) Why is security culture important? i) What is the value of communication in good security? j) Why is active m anagement necessary for good organization system security?
POLICY-BASED SECURITY MANAGEMENT
We have d iscussed the importance o f security planning and m ajor security p rinciples. No\v we look a t ho\v plans a re implemented in well-run organizations.
Policies versus Implementation Policies (What t o Do) The heart o f secu rity managem ent is the creation and
imp lementation o f security policies by high-level policy makers. Figure A-16 illustrates ho\v policies should be used. Security policies are b road statements that specify what s hould be accomplished in terms of security. They specify '\vhat to d o" rather than "how to do it." For example, the security policy migh t be, "All information on use r PCs must be strongly encrypted." Policy makers h ave the overvie\v knowledge that operational people do not have. For instance, policy m ake rs may know that ne\v compliance regimes create serious liabilities unless all mobile phone data is strong ly encryp ted . Operation- level people may not realize this. Or, po licy-level people, \Vho scan the horizon broad ly, may realize that a serious new threat can only be stopped \vith the encryption of mobile phone data. Again, operation-level people may not realize this. It is not tha t operational- level employees a re incompeten t. They have extensive operational expertise. However, they d o not have the b road vie\v that planners have.
Policies Implementation
Characterized by: What to do _ _:, ____ _ More formally Broad statements about what
should be done
Example
Created by
Problem s avoided
Policy that all m obile phones m ust be encrypted st rongly.
Planners w it h superior knowledge of regulatory requirements and trends in attack patterns.
Implem entat ion actions inconsist ent w it h the broad environment.
FIGURE A-16 Po licy-Based Management
How to do it
Specific decisions about how to implement the policies
Decision to use functions built into mobile phone operating systems or added encryption software w ith added feat ures.
Implementers w ith superior knowledge of security and specific technologies.
Micromanagement by policy makers.
Appendix 407
Policies are broad statements that specify what to do, not how to do it,
Implementation (How t o Do It) Note that the policy does not specify how the encryption should be done. That is for implementers to decide within the dictates of the policy. Implementers may decide to use the implementation of encryption built into mobile phone operating systems, or they might adopt an encryption product that offers superior features, such as the ability to decrypt encrypted PCs using a central database that stores encryption keys securely. This would prevent the user's loss of the encryp· tion key from rending the data useless and permit forensic analysis of the PC if phone user is suspected of misuse. These decisions should be left to implementers because they have superior knowledge of security sofhvare for mobile phones. Separating policies from implementation prevents senior security policy professionals from micromanaging implementers and forcing implementers to use suboptimum choices for m obile phone encryption.
Implementation decisions specify how to do it.
Policies, in turn, prevent the implementers from overlooking m obile phone encryption because they d o not realize that encryp tion is mandatory under a particular compliance regulation or necessary in light of a new threat
The key point is that the separat ion of policies from implementation uses the specific different strengths of both policy makers and implementers.
Policy makers have the overview knowledge that operational people do not have. Implementers know about specific technologies and the local situation that policy makers do not. Separating policies from implementation uses the specific different strengths of both policy makers and implementers.
Test Your Understanding
11. a) What is a policy? b) Distinguish between policy and implementation. c) Why d o companies separate polick,s from implementation?
Oversight Figure A-17 notes that policy makers cannot merely toss policies and implementation guidance out and ignore ho,v implementation is done. It is essential for management to exercise oversight, ,vhich is a collection of methods for ensuring that policies have been implemen ted appropriately in a particular implemen tation. Policies d o not give pro- tection by themselves. Nor do unexamined implementations. Protection is most likely to be effective ,vhen excellent implementation based on excellent policies is subject to strong oversight.
408 Appendix
( Policy Document ) Aud its:
Were policies followed? Was implementation done
according to implementation
/ Implementation
~ Choices
!
~ decisions? ~ C Oversight )
\ ------ Reading Log Files: Vulnerability Testing To test whether
r Effective Attacking your own system compliance is belng followed. to test policy compliance Security
~- · FIGURE A-17 Oversight
Oversight is a collection of methods for ensuring that policies have been implemented appropriately in a particular implementation.
Audits One form of oversight is the audit. An audit samples and analyzes actions taken during development (and use) to ensure that policies are being imple- mented properly. Note that an audit only samples actions. It does not look at every- thing, which would be impossible. Ho,vever, if the sampling is done well, the auditor can issue an opinion on whether a policy is being carried out appropriately based on ,veil-considered data.
An audit samples actions taken within the firm to ensure that policies are being imple- mented properly.
Reading Log Files Another form of oversight is reading log fi les. Whenever users take actions, their actions should be recorded in log files. Reading log files can also reveal whether policies were implemented successfully. Of course, if these log files are not read, they are useless. Log files should be read daily or even several times each day. Nobody enjoys reading log files, so reading log files is an important thing to audit.
Reading log files can reveal improper behavior.
Vulnerabi lity Testing The most important oversight mechanism is vulnerabil- ity testing. Simply put, vulnerability testing is attacking your systems before attackers do. Vulnerability testing identifies ,veaknesses so that you can fix them before they are exploited by attackers. Nearly every implementation will have security vulnerabilities, so testing should be mandatory before an implementation is used operationally. In addition, fixing one security vulnerability may create unexpected vulnerabilities in
Appendix 409
other parts of the system. System\vide vulnerability testing should be done regularly and frequently. 11
Vulnerability testing is attacking your systems before attackers do so that you can identify weaknesses and fix them before they are exploited by attackers.
Test Your Understanding
12. a) Why is oversight important? b) List the three types of oversight described in the text. c) What is vulnerability k,sting, and why is it done?
Implementation Guidance In many cases, the policy maker will only specify the broad policy, such as "encrypt all mobile data strongly." However, in some cases, policy makers also will provide implementation guidance, which consists of instructions that are more specific than policies but more general than implementation (see Figure A-18). An example of implementation guidance is to specify that strong encryption for confidentiality requires keys that are150-bits or longer. This implementation guidance ensures that when implementers use encryption, they w ill specify encryption that policy makers have deemed to be strong.
Implementation guidance consists of instructions that are more specific than policies but fess specific than implementation.
There are two forms of implementation guidance: standards and guidelines. 12
Use Strong Encryption
Keys must be at least 150 bits
AES encryption, 192-bit keys
Policy Document
i c mp lementation
Guidance
. Implementation Choices
Standard: MUST be followed
~ Guideline: SHOULD be fo llowed, M UST be considered .
FIGURE A-18 Implementat ion Guidance: Standards and Guidel ines
More General
More Specific
11 Before doing a vulnerability test, the tester must have explicit written permissions for each test based on a detailed description of what will be done and what damage might be done accidentally. Vulnerability testers who do not take these precautions have been accused of making malicious attacks. This has resulted in firings and even jail terms. 12 When do firms use guidelines instead of standards for implementation guidance? They use guidelines for situations that are not amenable to black-and-white rules. Encryption strength is relatively easy to specify. The quality of work experience requires human judgment.
410 Appendix
Standards Standards MUST be followed. If a compliance regulation govern- ing the system requires at least 128-bit keys, this should be specified as a standard for the system being developed. The implementer might not know of the regulatory requirement, so mandatory implementation guidance is justified.
Standards are mandatory directives that must be followed.
Guidel ines In contrast, guidelines13 are din.>ctives that SHOULD be followed. This gives the implementer guidance but also some lee\vay in deciding \Vhether to follo\v the guidance if there is good reason not to. For example, guidance m ight be, "Use SHA-512 hashing in authentication where feasible." The developer receiving the SHA-512 guideline may know that SHA-512 authentication is not possible because the technology in use only allO\VS 384-bit hashing. After due consideration, he or she may use SHA-384 in this situation.
But Considering Guidelines Is Mandatory The fact that guidelines are not mandatory does not mean that implementers can ignore guidelines. They must con- sider them carefully. For example, a guideline that security staff members should have three years of security work experience indicates that someone hiring a security staff member must consider that having at least three years of experience is an expectation. If the person doing the hiring selects someone \Vith only hvo years of security work experience, he or she should have a very good reason for doing so, typically in the form of offsetting relevant experience in other IT jobs.
Guidelines are implementation guidance directives that should be followed but can be dispensed with if circumstances warrant it.
Following guidelines is optional, but seriously considering guidelines is mandatory.
Test Your Understanding
13 . a) Compare the specificity of policies, implementation guidance, and imple- mentation. b) Distinguish between standards and guidelines. c) Which must be followed? d) Must guidelines be considered?
Policy-Based Centralized Management Given the critical importance of policies, it is important to have a way to dissemi- nate and enforce policies . For example, many companies have dozens or even hun- dreds of firewalls in their nehvork. It would be easy to accidentally misconfigure a few of the firewa ll access control lists inconsistently wit h policies. Figure A-19
13 In the Pirates of the Caribbean movies, there was a running joke that the Pirate Code is "more of a guideline., really."
~ Firewall
Administrator
1 New Policy: 2 Firewall No access to Internet Policy Server servers for employees .__._
in Accounting.
~ 3 Appropriate ACL Changes
Pohcy Database
Appropriate ACL Changes
A p pendix 411
Border Firewall
DMZ Firewall
M arketing Firewall
Server Room Firewall
Accounting Firewall
FIGURE A- 19 Centralized Firewall M anagement System
s hows a syste m designed to red uce s uch erro rs . All major fi rewall vendors offer these syste ms .
The fi re,vall a d,ninistra tor c rea tes high-level po licies. In Figure A-19, the fi re\\•all policy is that no IP add ress in the accounting d eparbn ent may a ccess an extern a l "'eb- server. The fi re\\•all adminis trator sends this policy to the fi re,vall policy server, ,vhich p laces the policy in its policy database.
The fire,va ll pol icy server then modifies the firewall access control lists (ACL) o f affected fi re,valls. In the figure, the only a ffected servers a re the border fire\\• a ll and the a ccou nti ng fi rewal l. T he fi rewall po licy server then pus hes these ACL changes to the affected firewalls. Note that the policy server does not si mply p ush pol icies ou t to fire,va lls. It creates detai led ACL cha nges a nd ,n oves these changes o u t to the fi rewa lls.
Sepa rating firewall p olicies fron1 ACL rules is a good exam ple of pol icy-based see11rity. The fi rewall ad ministrator sets a high-level policy. The fi re\\•all policy server converts this policy into ind iv idua l firewa ll ACL ru les. The fi re,vall po licy server w ill not make huma n mistakes s uc h as forgetting to ad d a pa rticular ru le to a particula r firewall. Furthenn ore, if there is a question about a pa rticula r firewall rule on a pa r- ticu la r fi re,va ll, the fi re,vall admi nis trator ca n as k "'ha t policy it i1nplen1en ts. Pol icies a re usually easier to understand than s pecific firewall ru les.
The p rocess o f creating s pecific firewall ru les fo r diffe rent fi re,valls based on fire\\•all policies is based on technology ra ther than magic. Consequently, erro rs are inevitable. Th is ,na kes v u lnerability testi ng ma ndatory. The tes t s u ite mus t incl ude both th ings tha t s h o uld be forbidden to ensure tha t they are forbidden a nd everyth ing else that s h o uld not be forbidd en to e ns u re tha t it gets through.
Test Your Understanding
14. a ) Distingu is h be twee n fi rewa ll po licies and fi rewa ll ACL n1 les. b) After a fi re- wa ll ad ,n in istrato r sends a policy to the policy server, w hat does the pol icy server do? c) Wh ich is easier to understand-a fire,v all pol icy o r a firewa ll ru le?
412 Appendix
RESPONSE
The final phase in the plan- protect- respond cycle is responding to security breaches, which are also called incidents and compromises. These protection failures take place in every firm all too frequently. As noted earlier, response is responding to incidents according to plan (Figure A-19). If no plan is in place, losses will be more than they need to be.
Response always takes place under conditions of stress, and people do not think well under stress. In addition, there are almost always time pressures to stop the at tack and restore systems to running order. These pressures expand in major attacks by sophisticated hackers. Time is always of the essence because t ime gives the attacker more opportunity to do damage and hide his or her efforts from the security staff. However, rushing response \viii backfire if the security team misdiag- noses the root cause of the attack. This will result in t ime-consuming backtracking once the m isdiagnosis is discovered.
There are two keys to effective fast response. The first, of course, is to have a plan for how to respond to compromises. A plan helps focus the security team on key steps and prevents steps from being overlooked. A good plan focuses the team in a way that benefits from experience. In fact, response is best defined as "responding to compromises according to plan." Specific situations will require modifying p lans during the response process, but modifications \vithin a plan are far more likely to succeed than unplanned reaction.
Response is best defined as "responding to compromises according to plan."
The second key is practice. When a football team gets a new play, they try it first in practice, usually w ith disastrous n.>Sults. They then see what went wrong, try it again,
Responding to breaches, also called incidents or compromises Response time and accuracy are both critical
Goal Is to find the root cause of the failure, stop the attack quickly, and restore operation
The attack must be stopped quickly because the attacker will use delays to Increase damage and hide
The analysis must also be correct, or much time will be spent backtracking
Keys to Success Have a good plan
Response Is "responding to compromises according to plan"
People do not think well under stress
No plan will be perfect, but it is best to Improvise within a good plan
Practice Speed and accuracy require rehearsal
Only after many repetttions can they execute the play correctly and rapidly
FIGURE A-20 Response (Study Figure)
Appendix 413
and make new mistakes. Only after many repetitions can they execute the play correctly and rapidly in a game. Response to security incidents is the same. Having a plan that has not been rehearsed extensively is useless.
Test Your Understanding 15. a) What are the three names for successful attacks? b) What are the two keys to
fast and effective response?
Normal Incidents Most security incidents are relatively minor, such as several PCs becoming infected w ith a virus. Security teams see these minor incidents frequently. Even more com- mon are fa lse alarms, \vhich are apparent compromises that turn out to be legitimate actions. Both are treated the same way initially because there is no way of knowing in the beginning \Vhich is occurring (Figure A -20).
Most importantly, these are IT and security issues. Both minor incidents and false alarms are handled by the on-duty IT and security staff as part of their normal work. There is rarely a need to call in an external consulting company.
Normal Incidents Major Incidents
Example
Corporate-wide consequences
Should be viewed as
Are handled by
Led by
I Team includes IT and security people
Team includes other line managers
Calling in an external consulting company
Normal incidents: Malware compromise of a few dozen PCs
False alarms: Nondamaging but time-consuming
None
An IT and security issue
The on-duty IT and security staff
The IT manager on duty
Yes
No
Rarely
FIGURE A-21 Normal Incidents versus Major Incidents
Breaking into the company's financial system
Terrorist attack that closes one data center
Medium to Very High
A business issue
The Computer Security Incident Response Team (CSIRT)
A senior business manager
Yes
Legal, public relations, etc. Only PR should talk to outsiders Unless the CEO steps into that role
Most of the time
414 Appendix
Minor incidents are handled by the on-duty IT and security staff.
There are no b road corporate issues involved. There is no need to call in line managers from other departments during the incident, although affected d epartments should be kept informed of the situation.
For both minor incidents and false alarms, occurrences are frequent enough to give responders the experience they need to handle them. There usually is no need for additional rehearsals.
Test Your Understanding
16. a) What are the two types of normal incidents? b) Who handles normal inci- dents? c) Why do normal incidents typically require no rehearsal?
Major Incidents Major incidents are those that cannot be handled by the on-du ty security staff. They requ ire sp ecial handling because major incidents have business implications that beyond IT, som etimes involving the entire company. Th e Target breach is an example of a major incident. Damage to the firm and its repu tatio n were h igh, and top management needed to be involved. Target also brought in security consultants \vhose specialized knowledge and experience al!O\ved the company to iden tify roo t causes and take appropriate actions (al though it sometim es failed to do so).
Major incidents are those that cannot be handled by the on-duty security staff.
They require special handling because major incidents have business implications that extends beyond IT, sometimes involving the entire company.
When major incidents occur, companies activate their computer security incident response team (CSIRT). The team consists of members of the IT and security staff, but it go~,s well beyond that. In fact, the CSIRT is headed by a high-level business manager, not by a m ember of the IT and security staff. During response to a major incident, technical decisions are also business decisions. For example, taking the company's e-commerce server offline for five hours is a decision that must be considered from all business and technical viewpoints.
During response to a major incident most technical decisions are also business decisions.
The CSIRT \Viii have several other business managers on the team . One \Viii cer- tainly be from the Legal Department. Major compromises ahvays involve complex legal questions and decisions. Input from Legal must be built into the CSIRT's work at every step.
Another critical department is Public Relations. Rumors and unauthorized pro- nouncements can be extremely d amaging, and th ey often presen t information th at
Appendix 415
is plainly \vrong. CSIRT members and other employees must not spread rumors or speak to the press. Only the public relations din.>ctor should speak for the company- unless the CEO elects to do so. Whoever speaks for the company must have excellent information about \vhat is transpiring.
Typically, a CSIRT calls on external security experts to speed the \VOrk and bring in higher-level expertise. These are typically consulting firms with experience in large breaches. These consultants should be held on retainer and should be familiar w ith the company's IT system so they can provide immediate help.
Test Your Understanding
17. a) What is the definition of a major incident? b) What group handles a major incident? c) What characteristics should its leader have? d) What major depart- ments will almost always be involved? e) Who is the only person who should talk about the incident w ith the media and other outsiders? f) Who may elect to speak instead?
Rehearsing for Major Incidents It is difficult to rehearse for major incidents because most team members vie\V their participation as time consuming and irrelevant to their main work. However, the CSIRT must rehearse a few times each year. Rehearsal improves reaction time and quality. It also integrates new members to the team. Given normal organizational changes, ne\V membership is almost ahvays present.
Rehearsal Improves Response Time and Quality Rehearsals are mandatory
Desktop Exercises
Sit around a table Presented with a situation Walk through the analysis step by step Each member tells what he or she would do and what help Is needed from others The moderator throws In surprises Postmortem on what worked, failed, and was learned
Live Exercises Go through a breach step by step Actually do each step on the system Expensive compared to desktop exercises Can find things desktop exercises never can E.g., The planned steps for moving control to another data center fail to transfer the security
credentials needed to run the system there
FIGURE A·22 Rehearsing for Major Incidents (Study Figure)
416 Appendix
Desktop Exercises The least costly way for CSIRTs to rehearse is the desktop exercise, in \vhich the team members sit in a room and run through scenarios. In these exercises, the moderator leads the team through a situation step by step. At each step, the members discuss what each must do, ho\v they w ill d o it, and what help they need from others. A good moderator adds new facts to the exercise abruptly, changes previous data, and does other things to m ake desktop exercises more realistic.
Live Exercises Desktop exercises are valuable, but they are not as good as live exercises, in \Vhich team m embers do the work at each step on the live system or a close facsimile. Live exercises reveal that confident statements made d u ring desktop exercises are far more problematic than the team members believe. They also get to a level of detail that exposes practical problems. For example, one live exercise involved a terrorist attack that filled the company's main server room w ith toxic fumes. The per- sonnel \Vere evacuated safely, and the company S\vitched the server room's processing to another data center and moved the staff to this center. Only w hen they got there did they realize that a critical list of passwords was in the old server room, which was now impossible to en ter. Although a firm will undertake m ore desktop exercises than live exercises, live exercises are still needed occasionally. No football coach would diagram a p lay on the backboard, have each player discuss \Vhat he or she \VOuld do during the play, and use the p lay in the next game \vithout practice.
Test Your Understanding
18. a) Distinguish between desktop exercises and live exercises in CSIRT rehearsals. b) Why are desktop exercises important? c) Why are live exercises necessary?
Real-Time Fail-Over If there is a disrup tion in a m ajor data center, critical corporate transaction processing \Vill grind to a halt. Years ago, it \Vas common to n.>commend that a firm maintain a "hot site" with equipment, software, and power. If the main site failed, the hot site would be turned on and personnel transferred to it. However, this took days to implement. By then, the co mpany could be near bankruptcy.
Today, the norm is to use real-time fail-over w ith synchronized data centers. Figure A-23 illustrates th is situation. Th e company has hvo d ata centers. One is in Ne\v York City. The other is in Denver. Each handles four of the company's eight major applications. They are connected by an ultra-high-speed transmission link. This allows them to copy and store one ano ther's data in real time. Application and operating sys- tem software changes to running programs also are transferred to the corresponding backup versions of the programs at the other data center in real time. Both data and sofhvare, in other words, are ful ly synchronized.
If the Denver data center fails, the New York data center can take over immedi- ately. This is called fail-over. Immediate response is a crucial ad vantage. Do\vntime is enormously expensive. Fail-over with synchronized data cen ters can limit downtime to seconds.
The downside of fail-over \vith synchronized data and p rograms is cost. Each data center needs to have extra capacity to handle the increased \VOrkload after fail-over.
Denver Data Center
Tasks 1 2 3 4
Real-Time Backup of Data and Software Changes
Both data centers have fully synchronized software to handle all eight tasks.
Each backs up the o ther's data and appli- cation software changes in real time.
Either side can take over imm ediately if the other fads.
However, some jobs will ha ve to be delayed by limited processing power.
FIGURE A -23 Real-Time Fai l-O ver w ith Synch ronized Data Centers
N ew York Data Cente r
Tasks 5 6 7 8
A p pendix 417
More d irectly, synchronizing d a ta requires a massive transnlission link between the two si tes. Althoug h falling net"'orking costs h ave n1a de immediate fail-over econo mically feasible, they have not m ade it ch ea p. Setting up and ma intaining this link is a centra l issu e in network d esign, implem enta tion, and o peration. Most obviously, the re m ust be backups in p lace fo r fail ures in this u ltrafas t d a ta pip e .
Test Your Understanding
19. a) v\Tha t is the advantage o f rea l-rune fa il-ove r ,-vith synchronized data centers? b) \Nhy is it expensive?
Intrusion Detection Systems (IDSs) Your ca r has a lock to keep peop le o u t. Son1e cars a lso have car a la rms that "'arn you ,-vhen son1eone is trying to break into your ca r. (Or w h en a ca t wa lks across the hood o f your neighb o r's car.) In the secu rity world, fi re,-valls and other counterm easures a re like car locks o r security g uards. They s to p peop le w ho a re trying to brea k in.
Intrusion Detection Systems Secu r ity p rofessio n als also need som eth ing like car alarn,s to tell them ,-vhen son,eon e is try ing to h ack the syste m. Th ese a re intrusion detection systems (lDSs). Wh en susp icious things happen on a network, IDSs n ote them a nd create a larn,s for the secu ri ty staff. Th e secu rity s taff can then block the attacker. Otherwise, the assa ila n t can attack a resou rce rep eatedly unti l h e or she s ucceed s. If son,eone is trying to brea k in to you r ca r, you certainly "'a nt to kno,-v abou t it when they sta rt to attempt the brea k-in.
The problem ,vith fi rewa lls is that they o nly look a t p rovable a ttack packets. If a packet is susp icious, the fi re"'all ignores it. IDSs, as C h a p ter 4 noted, s p ecifically target s us picious a ttack packets, raising a n alarm if they a re serious.
The p roblem "'ith IDSs is the sam e p rob lem that ca r a la nns h ave. M a ny of the ir a lerts a re fa lse a la rm s. O u t o f a hundred notifica tions, only one or t,-vo m ay signa l a real
418 Appendix
Firewall Intrusion Detection System
Aut omobile A nalogy Security guard who preven ts a A car alarm that notifies you ij break-in of your car someone is attempting to break in
Prevents a Break-In Yes No
Requires Near-Certain ty Yes No to Act
Target Provable (defin ite) attack packets Suspicious packets
Logging Logs dropped packets; may log Collects a broad spectrum of all packets event data and puts it into an
integra ted log file for analysis
Actions Passes or drops packet Generates alarms, allows secu- rity admin ist rator to query t he integrated log file to understand
patterns
Major Problem Failure to stop suspicious packets Many false alarms
Vigilance is a Major No Yes Problem
FIGURE A-24 Firewall versus Intrusi on Detection System (Study Figure)
problem . Security professionals usually find themselves unable to follo\v up on each alarm. In other cases, many check alarms cursorily, perhaps missing a real attack.
The Problem of Vigilance It is possible to "tune" IDSs to ignore many alarms that do not make sense. For example, if you have no Linux devices outside your data center, you may disable Linux-only alarms. In addition, IDSs normally report events \vith some indication of likely severity. Many security staffs only fo llow up on high- level security alerts. To go back to the car alarm case, the owner might reduce the sensitivity of the alarm. (This does not seem to be possible with my neighbor's car alarm.) Even in the best situations, however, there will be far more false alarms than dangerous incidents. Vigilance tends to flag under such conditions, and it is all too easy when vigilance flags to dismiss an important alert. Nearly all the time, ignoring an alarm will be both the right choice and a time-saving measure. This creates power- ful negative reinforcement to ignore alerts.
Log Files Each IDS constantly records information about its device's operation. For example, a router may report every packet's source and destination IP address and other packet header information. It may also report errors. Each event's data is stored as a record.
Distributed and Integrated Log Files A company may have hundreds of IDSs on individual d evices. However, at tack analysis requires combining the IDS records on different devices into a single combined log file. This integrated log file permits event correlation, \vhich is analyzing events from different d evices that
Firewall wrth IDS
1
C>O and Log File _ _,
DBMS Server
with IDS and Log File
Firewall with IDS
and Log File
2
Syslog Data
Transfer
SysLog
Sysl og
Security Administrators
6-~ 4 ~ ~
Ala~ l Qu~l Integrated Log File in
chronological order for Event Correlation
3
FIGURE A-25 Distribut ed IDSs and Integrated IDS Log Files in Chronologica l Order for Event Correlation
Appendix 419
together present a clearer p ic ture of w hat ha p pened. It shou ld en d in root cause analysis to id entify the attac k a nd attacker perfectly. Figure A-25 notes tha t this transn1ission follows the SysLog standard.
Alarms Once the da ta are on the Integrated Log File, they are in useable form. In Figure A-25, the security administrator on the left is receiving an a larn1 fron1 the sys- tem-wide IDS. The alarm gives a brief description of the situation. It is probably \,•rong but should not be ignored.
Querying the Integrated Log File After receiving an alarn1, a security admin- istra tor will conduct queries on the integrated log file to get a better understanding of patterns that touched off the alarm.
Figure A-26 shows the results of a query. The query returns the req uested event records. For sin1plicity, irrelevant en tries have been removed in the figure.
The first three log file en tries tell a combined s tory. First, a packet from Host 1.15.3.6 goes to Host 60.3.4.5. Interna l host IP ad dresses are in the range 60.x.x.x. There- fore, Host 1.15.3.6 is an externa l host. Second, Host 60.3.4.5 records a failed login for the account of Lee. Third, a packet goes from the internal host to the external host.
These packets need to be interpreted. An obvious interpreta tion is tha t someone at Host 1.15.3.6 seen1s to have attempted to log into Host 60.3.4.5 under the username lee. The login attempt failed, and a notification was sent to the externa l host. (ACKs have been ren1oved.) This might be the sign of an attack, or it may simply be Lee forge tting his or her pass\vord or typing it incorrectly. Follo\ving this logic, the next six records indicate tha t there is one n1ore failed attempt and then a success.
This may be an a ttack us ing password guessing, or it may be norma l hun1an n1emory failure or poor typing. More a nalysis is needed. However, even the first nine records contain potentially useful hints. There is some time beh,•een notification of fail- ure and the next login a ttempt, so the actor at the extern al host appears to be human. (An automated password cracker \,•ould send the next guess much faster.) This is more evidence for the "bumbling hun1an" interp retation. Are \,•e convinced that this pattern
420 Appendix
1. 8:45:05:47. Packet from 1.15.3.6 to 60.3.4.5 (FIREWALL)
2. 8:45:07:49. Host 60.3.4.5. Failed login attempt for account Lee (Host 60.3.4.5)
3. 8:45:07:50. Packet from 60.3.4.5 to 1.15.3.6 (FIREWALL)
4. 8:45:50:15. Packet from 1.15.3.6 to 60.3.4.5 (FIREWALL)
5. 8:45:50:18. Host 60.3.4.5. Failed login attempt for account Lee (Host 60.3.4.5)
6. 8:45:50:30. Packet from 60.3.4.5 to 1.15.3.6 (FIREWALL)
7. 8:49:07:44. Packet from 1.15.3.6 to 60.3.4.5 (FIREWALL)
8. 8:49:07:47. Host 60.3.4.5. Successful login attempt for account Lee (Host 60.3.4.5)
9. 8:49:07:48. Packet from 60.3.4.5 to 1.15.3.6 (FIREWALL)
10. 8:49:08:30. Packet from 60.3.4.5 to 12328.5210. TFTP request (FIREWALL)
11. 8:49:12:59. Series of packets from 123.28.5.210 and 60.3.4.5. TFTP response (FIREWALL)
12. No more Host 60.3.4.5 log entries (The log would not say this; it would merely stop sending events)
13. 9:03.17:33. Series of packets between 60.3.4.5 and 1.17.8.40. SMTP (FIREWALL)
14. 9:05.55:89. Series of packets between 60.3.4.5 and 1.17.8.40. SMTP (FIREWALL)
15. 9:1 1.22:22. Series of packets between 60.3.4.5 and 1.17.8.40. SMTP (FIREWALL)
16. 9:15.17:47. Series of packets between 60.3.4.5 and 1.17.8.40. SMTP (FIREWALL)
17. 9:20:12:05. Packet from 60.3.4.5 to 60.0.1 .1. TCP SYN: 1, Destination Port 80 (FIREWALL) 18. 9:20:12:07: Packet from 60.0.1.1 to 60.3.4.5. TCP ACK=1, Source Port 80 (AREWALL) 19. 9:20:12:08. Packet from 60.3.4.5 to 60.0.1 .2. TCP SYN: 1, Destination Port 80 (FIREWALL)
20. 9:20:12:11 Packet from 60.3.4.5 to 60.0.1.3. TCP SYN: 1, Destination Port 80 (FIREWALL)
21. 9:20:12:12. Packet from 60.0.1.3 to 60.3.4.5. TCP SYN: 1; ACK: 1, Source Port 80 (FIREWALL) 22. 9:20:12:07: Packet from 60.0.1.2 to 60.3.4.5. TCP ACK: 1, Source Port 80 (FIREWALL)
FIGURE A-26 Query Results from the Integrated IDS log File (Irrelevant Entries Omitted)
indicates an attack? However, if we follow this up by analyzing the rest of Figure A-26, we may change our mind . We have only seen 9 entries. There are 22 in total, so \,•e still have work to do.
Test Your Understanding
20. a) What do fire\,•alls do that IDSs do not? b) What do IDSs do that firewalls do not? c) Con1pare \,•ha t is logged by IDSs and fire\,•alls. d) Why are IDS false alarms a problen1? e) What standard do device IDSs normally use to send their log data to the central IDS?
21. a) Continuing the analysis of the IDS query in Figure A-26, scrutinize Events 10 and 11. You need to know that the Trivial File Transfer Protocol is a v,ay to do\,vnload a file fron1 a remote con1puter. What do these two records suggest? b) After Event 11, there are no n1ore log entries in the IDS log file for Host 60.3.4.5. What does this suggest? c) If you con1bine this \'l'ith what you learned in the first nine records, what do you conclude, at least tentatively?
Appendix 421
SOME FINAL PICTURES
FIGURE A-27 Rack Server
FIGURE A-28 Corporat e Access Po int
FIGURE A-29 Four-Pair UTP
422 Appendix
END-OF-CHAPTER QUESTIONS
Thought Questions
A-1. List the nine security principles named A -6. Castles are often surrounded by moats in the appendix. or other protections that will forestall
A-2. For each, say whether it was violated at attacks or reduce the speed of attacks. Target, according to what you read here Then come thick walls that must be and in Chapter 4. If so, describe how it breached. If these fail, the defenders is related. fa ll back to an inner keep with more
A-3. Some companies abandon their IDSs. defenses. If attackers manage to break Why do you think they do so? into the inner keep's doors, they must
A-4. Some companies are ou tsourcing the ascend spiral "murder steps" that are examination of IDS event logs to other uneven and require concentration that companies. a) Why do you think they a ttackers need to avoid being killed do so? b) Why was doing so ineffective by defenders. These steps rise counter- in the case of Target? clockwise so that the attacker's right
A-5. During the American Revolutionary arm is next to the wall, making it dif- War, the British landed troops on Long fic ult for most knights to swing their Island. Their goal was to march west swords effectively. What principle do to New York City. George Washington these protections embody? Justify your arrayed his troops near the western end answer. of Long Island to intercept the British. A -7. Edward Snowden wanted files that he There were two passes for crossing the d id not have permissions to see. He mountains between the western end of asked another employee who did have the island from the British landing point. permissions to show him a file . The Washington put half his troops at each other employee had Snowden walk pass. Ho\vever, Loyalists on Long Island away while the person logged in and knew that there was a third, smaller downloaded the file. Snowden looked pass through the mountains; they told at the file for the particular paragraph the British. The British decided to attack he "needed to do his job." Snowden through that smaller gap, although it then walked away, and the other was a more difficult route. Washington employee logged out of the system. learned of this third route just before the Only then d id Snowden come back. attack. He positioned some riders there What the other employee did not know to give warning if the British took that was that Snowden had installed a key more difficult road. Unfortunately, the logger on his compu ter. It had captured British captured Washington's scouts. the other employee's login credentials. They descended without warning on Snowden used these credentials to log Washington's flank, and the battle was a back in and steal massive numbers of rout. It almost ended the Revolutionary files. What security principles were War. That night, however, the American violated? Justify your answer. troops quietly retreated to the western A -8 . For her dorm room, a student bought end of the Island, then evacuated in a 20-pound safe for $300 to store her boats to New York City. When the Brit- laptop, table t, and phone when she ish rose the next morning, Washington is not using them. a) What principle was gone-defeated and chastised but should have been involved in the pur- with his army mostly intact and a bitter chase? b) Do you think it was jus tified? lesson learned. What security principle c) What other security principles may caused this failure? Justify your answer. be relevant?
A-9. Bob Eckert had a heavily autom ated home. One night, while he was watch- ing TV, the television set shut d own, various lights started blinking w ild ly,
Log File Analysis Questions
A-10. Interpret lines 13 through 16 in Figure A-26.
A-11. In terpret lines 17 through 22 in Figure A-26.
Perspective Quest ions
A-14. What was the most surp rising thing you leamed in this chapter?
Appendix 423
and other weird d evice behavior ensued. What security planning p rin- ciple was p robably violated?
A-12 Do you think an attack is happ ening? Justify your answer based on wha t the log file has revea led.
A-13. Do you th ink that Lee is the cu lprit? Weigh the evidence for and agains t Lee's guilt.
A-15. What was the m ost difficult thing for you in this chapter? Why was it difficult?
Th is page intentionally left blank
GLOSSARY
2.4 G Hz Unlicensed Service Band : Unlicensed frequency band around 2.4 GHz. Used for Wi-Fi, Bluetooth, and other services.
4-Pair Unsh ield ed Twisted Pair (UTP): The type of wiring typically used in Ethernet networks. 4-pair UTP contains eight copper wires organized as four pairs. Each wire is covered with dielectric insulation, and an outer jacket encloses and pro- tects the four pairs.
5 GHz Unlicensed Service Band: Un licensed radio band around 5 GHz. Used for Wi-Fi and other services. 64-bit modified extended unique identifier(EUl-64): In most IPv6 addresses, the interface ID that speci- fies a particular device on a subnet is 64 bits long. Typically the 64-bit address is derived from a 48-bit EUI-48 address (formerly called a MAC address). If so, it is a modified extended unique identifier (EUI-64).
802 LAN/MAN Stan dards Committee: The IEEE committee responsible for Ethernet standards.
802.lX Initial Authentication Mode : An initial authentication mode used in 802. lli. Req uires the use of an authentication server. Called enterprise mode by the Wi-Fi Alliance.
802.lX Au th entication Server: Authentication server used in 802.lX initial authentication mode.
802.lX Authenticator: In Wi-Fi transmission, the wireless access point.
802.lX Mod e: See 802.lX Initial Authentication Mode.
802.3 Working Group: Working group in the IEEE 802 LAN/MAN Standards Committee that creates Ethernet standards.
802.3 M AC Layer Standard: The data link layer standard for Ethernet.
802.ll ac: In W-Fi, the fastest physical transmission standard for sale today.
802.llad : 802.11 physical layer standard in the 60 Ghz unlicensed band. Has a theoretical top speed of 7 Gbps.
802.l lax: Planned successor to the 802.llac stan- dard. Will be able to accommodate a substantia l
increase in density- the number of wireless hosts that can be served by an access point.
802.l l ay: In the 60 GHz band, the Wi-Fi suc- cessor to 802.llad. Adds MU-MIMO and other improvements, should raise the basic speed to 20 to 30 Gbps and is likely to allo,v bonding for even higher speeds. Under development.
802.lli: An advanced form of 802.11 wireless LAN security.
802.l l n: Version of the802.11 WLAN standard that uses MIMO and sometimes doubled bandwidth to achieve a rated speed of 100 Mbps or more and lon- ger range than earlier speed standards.
802.lX Port-Based Network Access Con trol: In Ethernet, a standard for access control on switch ports.
Ab sorptive Attenua tion: In wireless transmis- sion, the attenuation of a signal but water along the way absorbing its signa l po,ver. In optical fiber, attenuation due to the absorption of signa l strength as a signal propagates.
Access Card : Small card with a magnetic stripe or microprocessor that gives you access to your computer or to a room.
Access Control: Limiting who may have access to each resource and limiting his or her permissions when using the resource.
Access Control List (ACL): An ordered list of pass/deny rules for a firewall or other device.
Access Lin k: 1) In networks, a transmission line that connects a station to a switch. 2) In telephony, the line used by the customer to reach the PSTN's central transport core.
ACK: See Acknowledgment.
Acknowledgment (ACK): 1) An acknowledgment message, sent by the receiver when a message is received correctly. 2) An acknowledgment frame, sent by the receiver whenever a frame is received; used in CSMA/ CA+ACK in 802.11.
Acknowledg ment Num ber Fi eld : In TCP, a header field that tells what TCP segment is being acknowledged in a segment.
425
426 Glossary
Act: See Access Control List.
ADSL: See Asymmetric Digital Subscriber Line.
ADSL Modem: Modem used in Asynchronous Digital Subscriber line service. Terminates the carrier's connection.
Advanced Persistent Threat (APT): Attack occur- ring over a long period o f time. The user employs many advanced methods to get deeper and deeper into the target system.
Advanced Research Projects Agency (ARPA): An agency within the U.S. Department of Defense tha t funded the creation of the ARPANET and the Internet.
Advertisement Message: Bluetooth LE cl ients periodically send this type of message to advertise their presence.
Ad-hoc wireless network: A self-organizing wire- less network.
Aggregate Throughput: Throughput sha red by multiple users; individual users will get a fraction of this throughput.
Ag.ility: The ability to rapidly ch ange ho,v the network operates when cond itions change.
Alphanumeric: Strictly speaking, letters and numbers. However, often used to refer to a ll key- board characters and, often, some control codes.
Alternative States: In physical transm ission, a change in a transmission med ium that can signal one d a ta pattern tha t represents a particular bit pa ttern. Different (alternative) s tates signal d if- feren t bit pa tterns.
Amazon Web Services (AWS): A cloud service provided by Amazon.
American Standard Code for Information Inter- change (AS01): Code for representing all American keyboard characters plus some control codes.
Amplitude: The maximum (or minimum) inten- sity of a wave. In sound, this corresponds to volume (loudness).
Antenna: A physical structure that transmits rad io s ignals.
Antivirus (A VJ Program: Program to remove ma lware from arriving messages and from the computer's disk d rive.
API: See Application Program Interfaces.
Application Architecture: The arrangemen t of how application layer functions are spread among computers to deliver service to users.
Application-Aware Firewall: A firewa ll that can identify and manage the application that creates a stream of packets.
Application Messages: A message sent from one networked application to another over a network.
Application Program Interfaces (API): A stan- dard ized interface between programs.
API. See Application Program Interface.
Apps: Sma ll applications crea te d for mobile devices.
APT: See Ad vanced Persis tent Threat.
ARP cache poisoning: Send ing false information to a host to place in its ARP cache. This will cause it to send messages to a particular IP add ress to the wrong data lin k a d dress and therefore the wrong destination host.
ARP update: A command to tell a host to send messages to a particular IP add ress to a particu- lar data link layer address. Useful if the data link address is the correct one. Causes the receiving host to send frames to the wrong host if the ARP update is false.
ARPANET: A packet-switched network created by the Advanced Research Projects Agency.
ASCII Code: A code for representing letters, num- bers, and punctua tion characters in 7-bit binary format.
Asymmetric: Different in two directions.
Asymmetric Digital Subscriber Line (ADSL): The type o f DSL designed to go into residential homes, offers high downstream speed s b ut lim ited upstream speeds.
Audit: Collecting da ta abou t events to examine actions after the fac t.
AUP: See Acceptable Use Policy.
Authentication: The requirement tha t someone who requests to use a resource must prove his or her identity.
Authentication Header: In IPsec, a header that pro- tects part or all of the packet ,vith authentication.
Authoritative DNS Server: DNS server that man- ages host names for a particular domain.
Authorizations: A rule tha t d etermines wha t an account owner can do to a particular resource (file or directory).
Availability: The abi lity of a nel\vork to serve its users.
A WS: See Amazon Web Services.
Backward-Compatibl e: Able to work wi th all earlier versions of a s tandard or technology.
Base Case: In a risk ana lysis, the case in which the organiza tion d oes nothing.
Basic Printer Profile (BPP): Bluetooth profile that a llows a device to print w ireless to a printer without need ing to download a particular printer driver for that printer.
Beacon: Bluetooth LE a d vertising message that transmits potentially useful information.
Beamforming: In radio transmission, d irecting energy toward a wireless d evice without using a dish antenna.
BGP: See Bo rder Gateway Protocol.
Binary Numbers: The base two counting system where l s and Os used in combination can represent whole numbers (integers).
Binary Signaling: Digital signaling that uses only l\Vo s tates.
Biometrics: The use of bod ily measurements to identify an applicant.
Bits per Second (bps): The measure of network transmission speed.
Bluetooth: A w ireless nehvorking s tandard created fo r personal area nel\vorks.
Bluetooth LE: See Blu etooth Low Energy
Bluetooth Low Energy (LE): New form of Blue- tooth d esigned fo r low-energy devices such as Internet of Things devices.
Bluetooth Profile: An application layer s tan- dard designed to allov.r d evices to ,vork together a u tomatica lly, w ith li ttle or no user interven- tion.
Bluetooth Special Interest Group: The o rganiza- tion that creates Bluetooth s tandards.
Glossary 427
Bonding: See Link Aggregation.
Border Gateway Protocol (BGP): The most com- mon exterio r rou ting protocol on the In ternet. Recall that ga teway is an old term for rou ter.
Border Router: A router that s its a t the edge of a site to connect the site to the outside world through leased lines, PSDNs, and VPNs.
Bot: A type of mahvare that can be u pgraded remotely by an a ttacker to fix errors or to give the malware ad ditional functionality.
Botmaster: Attacker who control a bo tne t.
Botnet: A la rge number of compu ters infected with bo t malware.
BPP: See Basic Printer Profile.
Breach: A s uccessful a ttack.
Broadband: 1) Transmission where signals a re sent in wide radio channels. 2) Any high-speed transmission system.
Broadband Channels: Strictly spea king, a radio channel with large bandwidth. This permits high- speed transmission. More b road ly, the term is used for any fast transmission system.
Brute-Force Attack: A password-cracking attack in which an attacker tries to break a password b y trying all possible combinations of characters.
CA: See Certificate Authority.
Cable Modem: 1) Broadband data transmission service using cable television. 2) The modem used in this service.
Cable Modem Service: Asymmetrica l cable data service offered by a cable television company.
Cable Television: Form of television delivery that d istributes signa ls to the home over coaxia l cable.
Cache: A limited amount of memory to hold data for a very short period o f time until the d evice can deal w ith it.
Caching: In general, storing very temporary information for retrieva l. In routing, storing rout- ing decisions for particu lar IP a d dresses that were very recently hand led instead of going through the whole rou ting process again.
Carriage Return: Takes the cu rsor back to the start of the cu rrent line.
428 Glossary
Carrier: A transmission service company tha t has government rights of way.
Carrier Ethernet: Ethernet service p rovided in a MAN or WAN by a carrier to user organizations.
Carrier WAN: Wid e area networking service offered by a ca rrier.
CON: See Content Delivery Network.
Cell: In cellular telephony, a small geographical region served by a cellsite.
Cellphone: A cellular te lephone, also called a mobile phone or mobile.
Cellsite: In cellular telephony, equipment at a site near the m idd le of each cell, containing a trans- ceiver and supervising each cellphone's opera tion.
Certificate Authority (CA) : Organiza tion that provides public key- private key pa irs and digital certificates.
Challenge Message: Message sent by a verifier to a supplicant. The supplicant is cha llenged to trans- form the message and return it. The transform w ill prove the supplicant's identity.
Channel: A smaU frequency range that is a subdi- vision of a service band.
Channel Bandwidth: The range o f frequencies in a channel; determined by subtracting the lowest frequency from the highest freq uency.
Channel Reuse: Th e ability to use each channel multiple times in d ifferent cells in the network.
Cipher: An encryption method.
Class 5 Switch: In telephony, th e switch at the lowest level of the switching hierarchy. Subscribers connect to these switches.
Classic Bluetooth: Early version o f Bluetooth that operated at speeds of 2 to 3 Mbps.
Clear l ine of Sight: An unobstructed radio path between the sender and the receiver.
Cll: See Command Line Interface.
Client Host: In client/ server processing, a server program on a server host provides services to a client program on a client host.
Client Program: Program th a t receives service from a server program on a server host.
Client/Server Architecture: The form of client/ server computing in which the work is done by p rograms on two machines.
Clock Cycle: A period of time during which a transmission line's state is held constant.
Cloud: An image that indicates that the user does not need to know what goes on within the problem. A general name for services provided by companies over the Internet.
Cloud Service Provider (CSP): A company that p rovides cloud computing services.
Coaxial Cable: Copper transmission med ium in which there is a central wire and a coaxial meta l tube as the second connector.
Co-channel I nterference: In w ireless transmis- sion, interference between two devices transmitting simultaneous in the same channel.
Coin Battery: Small round batter about the size of a coin. Produces little power but has a long battery life.
Collision: When two s imultaneous signals use the same shared transmission med ium, the sig- nals will add togeth e r and b ecome scrambled (unintelligible).
Command and Control Server: In a distributed denial of service a ttack, an intermediate server to wh ich the botmas ter sends commands. The command and control server sends commands to individua l bots on compromised hosts.
Command line Interface (Cll): Soft,vare in te r- face in which the user types commands on a single line. Communication in both d irections is limi ted to keyboard character.
Comprehensive Security: Security in which a ll avenues of attack are closed off.
Compression: Reducing th e numb er of bits needed to be transmitted when the traffic has redundancy that can be removed.
Compromise: A successful attack.
Computer Security Incident Response Team (CSIRT): A team convened to handle major secu- rity incidents, made up of the firm's security staff, memb ers of the IT s taff, and memb ers of func - tional depa rtmen ts, includ ing the firm's legal department.
Com p uting Infras tructu re: In Infrastructure as a Service, servers and their operation, database management systems, and rela ted services.
Com ma n d mode: In Cisco's Internet Operating System, an interaction mod e in which the device gives the user a prompt and the user types a com- mand. This is a primitive but efficient interaction mode that consumes few resources. Hov,ever, commands usually have complex syntax.
Confid en tiality: Assurance that interceptors can- not read transmissions.
Connection: An enduring communication session with a s tart, ind ividual message exchanges, and a close.
Connectionless Protocol: A protoco l in which there is no enduring communication session bel\veen two devices. Messages are sent individu- ally with no prior agreement to communicate.
Con nection -Oriented Pro tocol: Type of conver- sation in which there is a formal opening of the interactions, a formal closing, and maintenance of the conversation in between.
Content D elivery Netw o rk (CO N): An Internet delivery system that s tores content near the user in order to reduce latency.
Conti n u ity Testers: UTP tester tha t ensures tha t wires are inserted into RJ-45 connectors in the cor- rect order and are making good contact.
Control Ag ility: The ability to change the control func tion quickly and easily.
Con trol Function: In SO N, the func tion that d etermines how the control function acts. Tradi- tiona lly, the control function was implemented on ind ividual switches, routers, and access points. In SON, the control func tion is centralized.
Core: 1) In optica l fiber, the very thin tube in to which a transmitter injects light. 2) In a switched network, the collection of all core switches.
Core Switch: A sw itch further up the hierarchy tha t carries traffic between pairs of switches. May a lso connect switches to routers.
Corporate Access Poin t: Access po in t used in an organization. Has higher q ua lity than a home access router and is centrally manageable.
Glossary 429
Coun try T op-Level Doma in (cTLO): First-level domain name that specifies the owner's country (.UI<, .AU, .CN, etc.)
Cred entials: Proof of identity that a supplicant can present during authentication.
Credit Card Nu mber Theft: Stealing a cred it card number, and usually related information, in order to commit fraud.
Crime,vare: Software used to commit crime. Often built by a third party and sold to the attacker.
Crim p: A device that presses the connector onto wires in a cord. To preven t the wires from being pulled out of the connection.
Crim p ing Tool: Tool used to compress an RJ-45 connector onto the untwisted wires of a UTP cord.
Cross-Site Scrip ting (XSS) : Attack in which the application program reflects user inpu t back in a way that permits the execu tion of a malicious script in the application program.
Cryptography: Mathematica l methods for pro- tecting communication.
CSIRT: See Computer Security Incident Response Team.
CSMA/CA+ACK: See Carrier Sense Multip le Access with Collision Avoidance and Acknowledg- ments. See definitions of the ind ividual components.
CSP: See Cloud Service Provider.
CSU/DSU: Device on a customer premises that terminates a carrier's transmission line. Carrier service unit/ data service unit.
Customer Premises: The property owned by the organization that uses the network.
Customer Pre m ises Equ ipment (CPE): Equ ip - ment owned by the customer, includ ing PBXs, interna l vertica l and horizontal wiring, and tele- phone handsets.
Cybercri minal: Crimina l who commits crimes using a computer.
Cyberterror: A computer attack made by terrorists.
Cyberwar: A computer a ttack made by a national government.
Data Li n k: The path that a frame ta kes across a single network (LAN or WAN).
430 Glossary
Data Link Layer Addresses: Device ad dress at the d a ta link layer. The source and destination data link layer add resses in in the frame's header and are used by switches or access points to forward the frame.
Data Miner: Malware that actively searches a vic- tim computer's data fi les to information that can be used in a crime.
Datagram: Generic name fo r a message in a connectionless protocol.
Dead Zone (Dead Spot): A location where a receiver cannot receive radio transmission due to an obs truction b locking the d irect path bel\veen sender and receiver.
Decibels (dB): A way of expressing the ra tio between !\Vo power levels, P1 and P2 on a logarith- mic basis.
Decision Cache: In rou ting, a lis t a router keeps of recen t routing decisions for specific IP addresses so that it does not have to go through an entire routing decision again if another packet to tha t IP add ress arrives. This is nonstandard and somewha t risky.
Decrypt: Conversion of encrypted ciphertext into the original p lain text so an authorized receiver can read an encrypted message.
Dedicated Link: Unshared transm iss ion link d edicated to the use of a s ingle device.
Default Router: The next-hop router that a router will forwa rd a packet to if the routing table does not have a row tha t governs the packet's IP address except for the default row.
Default Row: The row of a rou ting table that will be selected automatically if no other row matches; its value is 0.0.0.0.
Defense in Depth: The use of s uccessive lines of defense.
Demilitarized Zone (DMZ): A subnet that holds servers tha t must be freely accessible by the out- s ide world, such as public webservers and mail servers. Hosts in the DMZ will be under constant a ttack and m ust be hardened exceptionally ,veil. Access from the DMZ to the in ternal net,vork should be rare and very tightly controlled.
Denial-of-Service (DoS) Attack: The type of attack whose goal is to ma ke a compu ter or a net- work unavai lable to its users.
Density: In Wi-Fi, the n u mber of wireless devices that use an access point.
Destination Host: Host that receives a message from another host, the sou rce host.
Destination IP Address: The IP address o f the host that receives a packet.
Destination IP Address Field: In a packet, a field that g ives the IP address of the destination host.
Destination Port Number Field: In a TCP seg- ment or UDP datagram, a field that g ives the port number on the destination d evice.
DHCP: See Dynamic Host Configu ration Protocol.
Differentiated Services Control Point: Fie ld that specifies the quality of service that a packet should receive.
Diffserv (Differentiated Services): Th e field in an IP packet that can be used to label IP packets for priority and other service parameters.
Digital Certificate: A d ocumen t tha t gives the name o f a tru e party, that true party's public key, and other information; used in authentication.
Digital Certificate Authentication: Authenti- cation in w hich each user has a p ublic key and a pr ivate key. Au then tication d epends on the applicant knowing the true party's priva te key; req u ires a digital certifica te to give the true par- ty's p ublic key.
Digital Signaling: Signal ing that u ses a few states. Binary (hvo-state) transmission is a specia l case of d igital transmission.
Digital Subscriber Line (DSL): A technology that provides d igital data signaling over the residentia l customer's existing single- pair UTP voice-g rade copper access line.
Directory Search: In telephony, the searching for the a d dress o f a peer to which a peer w ishes to connect to. In the domain name system, searching for the IP ad dress associa ted with a host name.
Directory Server: Server tha t stores information a bout an organization's resources hierarchica lly.
Directly Propagating Worms: A type of worm that tries to jump from the infected computer to many other computers without human intervention.
Dish Antenna: An antenna that points in a par- ticula r direction, allowing it to send stronger ou tgoing signals in that direction fo r the same power and to receive wea ker incoming signa ls from that direction .
Disassociate Message: In Wi-Fi, a frame that tells a wireless device that is associated with an access po int to d isassociate itself. This has legitimate uses, but it can also be used to create a denial-of service attack against the w ireless devices associ- a ted ,vith the access point.
Distributed Computing Architecture: An appli- cation arch itectu re in which a program running on one machine calls multiple programs on other machines, which may call programs on yet other machines. After calling other p rograms, the cal ling program uses results from the called programs in its own logic flow.
Distribution System: In 802.11 W-Fi, the trans- mission system that connects different Wi-Fi access points. In LANs, this is almost always Ethernet.
DMZ: See Demilitarized Zone.
DNS: See Domain Name System.
Domain: In DNS, a group of resources (routers, single networks, and hosts) under the control o f an organiza tion.
Domain Name System (DNS): A server that pro- v ides IP addresses fo r users who know only a tar- get host's host name. DNS servers a lso provide a hierarchical system for naming domains.
Domain Name Registrar: An organization that sells or a llocates second-level domain names.
Domain registrars: Compan ies that allow indi- v iduals and organizations to p urchase the righ t to use a particular second-level domain name on the Internet.
Dotted Decimal Notation: The notation used to ease h uman comprehension and memory in read- ing IPv4 addresses.
Drive-By Hacker: A hacker who parks outside a firm's premises and eavesdrops on its data trans- missions; mounts denial-of-service attacks; inserts
Glossary 43 1
vi ruses, worms, and spam into a network; or does other mischief.
Drop Cable: A thin coaxial cable access line that runs from the cable television company line in a neighbo rhood to individua l homes.
DSL: See Digital Subscriber Line.
DSL Access Multiplexer (DSLAM): A device a t the end office of the telephone company that sends voice signa ls over the ordinary PSTN and sends data over a data network s uch as an ATM network.
DSLAM: See DSLAccess Multiplexer.
Dual Mode: In Bluetooth, a dev ice that imp lements both Classic Bluetooth and Bluetooth LE
Dynamic Host Configuration Protocol (DHCP): The protocol used by DHCP servers, which provide each user PC w ith a temporary IP address to use each time he or she connects to the Internet.
Dynamic IP Address: A temporary IP add ress that a client PC receives from a DHCP server.
Dynamic Routing Protocol: A protocol that allows routers to exchange routing tab le information.
D-Wave: An Internet o f Things protocol similar to Zigbee.
Echo Reply Message: In JCMP, a message that responds to an Echo message.
Echo Request Message: JCMP message that asks a host to send back an echo rep ly message. This lets the sender know that the other devices is reachable and also gives the round-trip latency to that device.
ECN: See Explicit Congestion Notification.
Economically Feasible: Whether the benefits of a cho ice outweigh the costs. If they do, then th e choice is economically feas ible.
Edge Router: A router at the edge of the netv.rork between an organization and its Internet service provider.
EIGRP: See Enhanced Interior Ga teway Routing Protocol. Electromagnetic In terference (EMI): Unwanted electrica 1 energy coming from external devices,
432 Glossary
such as electrical motors, fluorescent lights, and even nearby data transmission ,vires.
Electronic Signature: A bit string added to a mes- sage to provide message-by-message authentication and message integrity.
E-LAN Service: In carrier Ethernet, a service that gives Ethernet connections bel\veen multiple s ites, effectively connecting them into a s ingle Ethernet network.
E-Line Service: In carrier Ethernet, a service that g ives an Ethernet connection bel\veen two s ites, effectively connecting them into a s ingle Ethernet network.
Encoding: Converting messages into bits.
Encapsulated Security Protocol (ESP): In IPsec, the standard tha t adds encryption, authentication, and message integrity to 1Pv4 or 1Pv6 packets.
Encryption for Confidentiality: To encryp t a message so that an eavesdropper who intercepts it cannot read it; however, the intended receiver can decrypt it and read it.
End Office Switch: The nearest switch of the tele- phone company to the customer premises.
End-to-End Encryption: The encryption of traffic a ll the way between two end devices, such as the source and destination host.
End-to-End Security: Th e encryption of traffic a ll the way between two end devices, such as the source and destination host.
Enhanced Interior Gateway Routing Protocol (EIGRP): Interio r routing protocol used by Cisco routers.
Enterprise Mode: In WPA and 802.lli, operating mode that uses 802. lX.
Ephemeral Port Number: The temporary number a client selects whenever it connects to an applica- tion program on a server. Accord ing to IETF rules, ephemeral port numbers should be between 49153 and 65535.
Error! Reference Source Not Found: An HTTP response message status code that is returned to the browser if the requested webpage could not be found.
ESP: See Encapsulating Security Payload .
ESP Header: The part o f the ESP content that goes before the data to be protected.
Espionage: To s teal the trade secrets of a company.
ESP Trailer: The part o f the ESP content that goes after the data to be p; works w ith the ESP header to p rovide security to the data.
Error Rate: In biometrics, the normal rate of mis- identification when the subject is cooperating.
Ethernet: Switched network s tandard; dominates in LANs; also used in WANs. Stand ard ized by the IEEE 802.3 Working Group.
Ethernet Cord: A physical cord used fo r Ethernet transmission. The term is normal ly used for 4-pair UTPwiring.
Ethernet Connector: Connector that terminate a 4-pair UTP cord so that it can be p lugged into an Ethernet jack .
Ethernet Frame: A message a t the data link layer in an Ethernet network.
Ethernet Jacks: Port in an Ethernet switch or host used by Ethernet. The term is normally used for RJ-45 ports for 4-pair UTP cords.
Ethernet II Frame: The Ethernet frame syntax tha t ,vas in use prior to the 802.3 Working Group taking control of Ethernet s tandards. Simpler than the 802.3 Ethernet frame. However, the In te rnet Protocol standard calls for the use o f Ethernet II frames rather than 802.3 Ethernet frames, and th is is normal p ractice.
EtherType Field: In an Ethernet II frame, the field that specifies the contents of the data field- usually an 1Pv4 or 1Pv6 packet.
EUl-48: See Extended Unique ldentifier-48.
Evil Twin Access Point: Attacker access point outside a build ing that attracts clients inside the build ing to associate w ith it.
Evil twin attack: Wi-Fi a ttack in which the a ttacker intercepts encrypted frames from a host, decrypts and reads them in the clea r, and then reencrypts them and passes them on.
Exit Node: In a TOR network, the node that trans- mits the final packet to the destination host. It is the fina l node in the TO R network transmission- the node from which the packet exits the TOR network.
Explicit Congestion Notificatio? (ECN): . Field that notifies the receiver tha t there 1s congestion on the network. The receiver may respond by reduc- ing its transmission rate.
Exploit: Term used variously for the act of break- ing into a computer, the method used to break in, or the crimeware software used to break in.
Extended Unique Identifier-48 (EUI-48): A com- mon data link address format with a length of 48 b its. Formerly called a MAC address.
Extension Header: In 1Pv6, a header that follows the main header.
Exterior Dynamic Routing Protocol: Rou ting protocol used between autonomous systems.
Facial Recognition: Biometric au thentica tion method tha t uses the shape of a person's face as proof of identity.
Fail-Over: When one system will take over the work load immediately if another system fails.
False Alarm: An apparen t incid ent that proves not to be an a ttack.
False Positive: A false alarm.
Fiber Cord: Optical fiber cord. Used for longer Ethernet physical links.
Fiber to the Home (F1TH): Optical fiber brought by carriers to individual homes and businesses.
Field: (1) A subd ivision of a message head er or trailer. (2) An 1Pv6 field is a group of four lower- case hexadecimal symbols. Each field represents 16 bits. Fields are separated by colons.
File Formal Standard: Standard for the format of files delivered by a network application. Most network applications have two standards--0ne to control delivery, the other for the file forma t of the d elivered file or message.
File Storage Services: Cloud services such as D ropbox and iCloud, which store user files in the cloud for backup and to provide access anywhere.
Fin Bit One-bit fiel d in a TCP header; ind icates that the sender wishes to open a TCP connection.
Fingerprint Recognition: The use of fingerprints to identify a person.
Firewall: A security system that examines each packet passing through it. U the fire,vall identifies the packet as an attack packet, the firewa ll dis- cards it and copies information about the d iscarded packet into a log file.
Firewall Filtering Mechanisms: The methods used by a firewall to id entify provab le (definite)
Glossary 433
a ttack packet; if identified, the packet is dropped and logged.
Firewall Log File: A file that contains summary information about packets d ropped by a firewall.
Firewall Policy Server: Server that s tores firev.rall policies. It sends access control list changes to indi- vidual firewalls to implement these policies.
Flag Field: A one-bit field.
Flow Label Field: 1n 1Pv6, all packets in a stream of packets are g iven the same flow label number.
Forwarding Function: 1n SON, the switch, router, o r access point function tha t sends incoming frames or packets back out.
Frame: 1) A message at the data link layer. 2) In time division multiplexing, a brief time period, which is further subdivided into slots.
Frame Check Control Sequence Field: A fou r- octet fiel d used in error checking in Ethernet. If an error is found, the frame is d iscarded.
Frequency: Th e number of complete cycles a rad io wave goes through per second. In sound, frequency corresponds to pitch.
Frequency Spectrum: The range of all possible frequencies from zero hertz to infinity.
FITH: See Fiber to the Home.
Full-Duplex Transmission: A type o f communica- tion that supports s imultaneous two-way transmis- sion. Almost all communication systems today are full-duplex systems.
Gateway: An obsolete term fo r " rou ter"; sti ll in use by Microsoft.
Gbps: Gigabit per second.
Generic Top-Level Domain (gTLD): First-level domain name tha t specifies the type of organiza- tion that owns the domain (.com, .edu, etc.).
Get: An SNMP command sen t by the manager that tells the agent to retrieve certain information and return this informa tion to the manager.
gTLD: See Generic Top-Level Domain.
Guideline: A directive that should be fo llowed but that need not be fo llowed, depending on the context.
Hacking: The intentional u se of a compu ter resou rce without authorization or in excess of authorization.
434 Glossary
Hacktivists: Hackers who are motivated to s teal information by poli tics ra ther than monetary ga in.
Hand off: a) In w ireless LANs, a change in access points when a user moves to another location. b) In cellu lar telephony, transfer from one cel lsite to another, which occurs when a subscriber moves from one cell to another w ithin a system.
Head End: The cable television operator's central distribution point.
H eader Checksum Field: The UDP da tagram field that allows the receiver to check for errors.
H ertz (Hz): One cycle per second, a measure of frequ ency.
H ex Notation: See Hexadecimal Notation.
Hexadecimal (Hex) Notation: Th e Base 16 nota- tion tha t humans use to rep resen t 48-bit MAC source and destination add resses.
Hie rarch ical Topology: A network topology in which all switches are arranged in a hiera rch y, in which each switch has only one paren t switch above it (the root switch, however, has no parent); used in Ethernet.
Hierarchy: 1) The type of topology wherein there are multiple layers of sw itches o rganized in a hierarchy, in wh ich each node has only one par- ent node; used in Ethernet. 2) In IP addresses, three multiple parts tha t represen t successively more specific locations fo r a host.
Hop Limit Field: In IPv6, the field that limits the number of hops an IPv6 packet may make among routers.
Host: Any computer a ttached to a netv.rork.
Host Name: An unofficial designation fo r a host computer.
Host Part: The pa rt of an IP address that identi- fies a pa rticular host on a s ubnet.
Hos t-to-Host VPN: Vir tual private network tha t creates cryptographically protected connec- tions betv.reen two ind iv id u al hos ts.
Ho s t-to-Site VPN: Virtu al pr iva te network that creates cryptograph ically protected con - nections between an individual hos t and a cor- po rate site.
HTTP: See Hypertext Transfer Protocol.
HTTP Request Message: In HTTP, a message in which a client requests a fi le or another service from a server.
HTTP Response Message: In HTTP, a message in which a server responds to a client request; contains either a requested file o r an error message explain- ing why the req uested file could not be supplied.
Human Interface D evice (HID) Profile: In Blue- tooth, this profile is used for mice, keyboards, and other input devices.
Hybri d TCP/JP-OSI Architecture: The architec- ture that uses OSI s tandards at the physical and data link layers and TCP /IP standards at the inter- net, transport, and application layers; dominant in corporations today.
Hypertext Trans fer Protocol (HTTP): The proto- col that governs interactions betv.reen the browser and the webserver application program.
IaaS: See Infrastructure as a Service.
JANA: See Internet Assigned Numbers Authority.
ICMP: See Internet Control Message Protocol.
ICMP Control Message: In ternet Control Mes- sage Protocol message that d irects a host to take an action.
ICMP Error Ad visement A message sent in error a d visement to inform a source d evice that an error has occurred.
ICV: See Integrity Check Value.
Id en tity T h e ft : Stea ling enou gh in formation about a person to impersonate him or her in large financia l transactions.
JDC: See Insulation Displacement Connection.
IDS: See Intrusion Detection System.
IEEE 802.11 Working Group: IEEE Working Group that creates Wi-Fi (802.11) wireless LAN s tandards.
IKE: See Internet Key Exchange.
IMAP: See In ternet Message Access Protocol.
Imp lementation Guidan ce: Instructions tha t are more specific than policies but less specific than implementation.
Inci dent: A s uccessful a ttack.
Internet p rocess The process (hardware o r software) that implements the transport layer's functionality.
Individual Throughput: The actual speed a single user receives (usually much lower than aggrega te throughput in a system with shared transmission speed).
Infrastructure as a Service: Providing computing infrastructure, which consists of servers and their operation, database management systems, and rela ted services, as a service in which the customer pays by use instead of owning the infrastructure.
Initial Authentication: Authentication a t the beginning of a communication session, before the two sides exchange working da ta. As opposed to message-by-message authentication during data exchange.
Insiders: People within an organization; they are especially dangerous if they attack you. Includes everyone with insider perm issions, such as con tractors.
lnsta.ntiate: See Spawn.
Insulation Displacement Connection (JDC): A connection in which a meta l prong is pushed through insulation into another wire.
Integers: Whole numbers.
Integrated Log File: A log file that integrates the data from multiple log fi les on different devices. Permits a more complete picture of an a ttack or suspected attack.
Integrity Check Value (ICV): The optional mes- sage integrity part of the trailer for the Encapsulating Security Protocol.
Interface: 1) The router's equivalent of a network in terface card; a port on a router that must be designed for the network to which it connects. 2) In webservices, the outlet through which an object communicates ,vith the outside world.
Interface ID: The third part of an 1Pv6 address. Indicates the host on the subnet of the organ iza- tion on the Internet containing the host.
Interior Dynamic Routing Protocol : Routing protocol used ,vithin a firm's internet.
Internal Router: A router that connects different LANs within a site.
International Organization for Standardization (ISO): A strong standards agency for manufacturing, including computer manufacturing.
Glossary 435
International Telecommunications Union-Tele- communications Standards Sector (ITU-T) : A standards agency that is part of the United Na tions and that oversees international telecom- munications.
Internet Assigned Numbers Authority (IANA): The organization tha t alloca tes b locks of IP addresses to regional assigned number authori- ties for distribution to organizations and Internet service providers.
Internet Control Message Protocol (ICMP): The protocol created by the IETF to oversee supervi- sory messages at the internet layer.
Internet Core Routers Router used by an Internet service provider.
Internet Engineering Task Force (IETF): TCP/ IP's standards agency.
Internet Key Exchange (IKE): In IPsec, the s tan- dard for the initial negotiation stage in establish- ing a security association.
Internet Layer: The layer that governs the trans- mission of a packet across an entire internet.
Internet Message Access Protocol (IMAP): One of the two protocols used to down load received e-mail from an e-mail server; offers more features but is less popular than POP.
Internet of Things (loT): Internet use by small devices that talk to one another, with no human involvement.
Internet Layer Process: Hardware or software process that implements internet layer function - ality on a host or router.
Internet Service Provider (ISP): Carrier that pro- vides Internet access and transmission.
Interoperate: To be able to work together.
Intrusion Detection System (IDS): A system that warns of a possible attack.
Inverse square law: Radio signal strength declines with the square of transmission distance.
IOS: Operating system used on Cisco s,vitches, routers, access points, firewalls, and other devices. Designed to use a command line interface.
loT: See Internet of Things.
IP Address: An Internet Protocol address; the address that every computer needs when it con- nects to the Internet; IP addresses are 32 bits long.
436 Glossary
I nternet Protocol Security (IPsec): A se t of s tandards that operate at the internet layer and provide security to all upper layer protocols transparently.
IP Version 4 ((Pv4): The standard tha t governs most routers on the Internet and private intemets.
IP Version 6 ((Pv6): A new version of the Internet Protocol.
IPsec Gateway: Border device a t a site that con- verts internal data traffic into protected da ta traffic tha t travels over an untrusted system such as the Internet.
IPv4: See IP Version 4.
IPv4 Addresses: Addresses in the fourth version of the Internet protocol. 32 bits long. In contrast, IPv6 addresses are 128 bits long.
IPv4 Mask: A 32-bit series ,vith a number of ls followed by the number of Os. The number of ls corresponds either to the IKPv4 packet's network part or network plus subnet part. Used by routers to assign routes to all packets going to a particular network or subnet on a network.
IPv6: See IP Version 6.
IPv6 Canonical Text Representation: A s tan- dardized ,vay of represen ting an IP address for condensed human reading.
IPv6 main header: The first header in an IPv6 packet. Other headers may follow. These are extension headers. The data field follows the last extension header.
Iris Recognition: Authentication that uses the pattern in the iris (the colored part of the sup- plicant' eye)
ISO: See In ternational Organization for Stan- dard ization.
Jitter: Variability in latency.
kbps: Kilobits per second.
Keystroke Logger: Type of spyware that cap- tures victim keystrokes and sends them to the attacker.
Kill Chain: The series of s teps that must all suc- ceed for an attack to succeed. If defenses can stop a single link in the chain, the attack will fail. A method for v isualizing attacks and how to stop them.
Label Header: In MPLS, the header added to packets before the IP header; contains information that a ids and speeds routers in choosing which interface to send the packet back out.
Label Number: In MPLS, number in the label header tha t aids label-switching routers in packet sending.
Label Switched Path: A path that all packets to a particular address will ta ke across and MPLS label-switched network.
Label Switching Router: Router that implements MPLS label switching.
LAN: See Loca l Area Network.
Latency: Delay, usually measured in mi lliseconds.
Layers: Standards agencies divide the job of get- ting two applications on two different hosts into four to seven layers of functionality, each provid - ing service to the layer above it. One layer can be changed without requiring a change in upper layers.
Leased Line : A high-speed, point- to - point, always-on connection.
Least Permissions: The m inimum permissions an employee needs to do his or her job. If broader permissions are given, that creates a security vulnerability.
Licensed Service Band: Regulated radio signa l band that requires rad io devices to be licensed to prevent interference bel\veen radios.
Line Feed: Moves the cursor or print head one line down.
Link Aggregation: The use of two or more trunk links between a pair of switches; also known as trunking or bonding.
Link encryption: Providing encryption over a single physica l link or data link, instead of over the entire route between the source and destina- tion hosts.
Link Security: Security over part of the path between hvo devices. As opposed to end-to-end security bel\veen the devices. For Instance, In 802.lli, security over the link bel\veen an access point and a wireless device.
Load Balancing: Dividing traffic across routers in order not to overload any single route.
local Are a Network (LAN): A network within a customer's premises.
local Loop: In telephony, the line used by the cus- tomer to reach the PSTN's central transport core.
longes t Match: The matching row that matches a packet's destination IP address to the greatest number of bits; chosen by a router when there are multiple matches.
MAC: See Media Access Control.
MAC address: Former name for EUI-48 address.
Main IPv6 Header: The primary header in IPv6. Followed by zero or more extension header, then the higher-level content of the packet.
Ma jor Incid ent: A large security incident with wide repercussions. Must be managed by the computer security incident response team.
Malw are: Software that seeks to cause damage.
MAN: See Metropolitan Area Network.
Manageable Switch: A switch that can be man- aged remotely v ia the Simple Network Manage- ment Protocol.
Managed Device: A device that can be managed remotely via the Simple Network Management Protocol. Examples: printers, switches, routers, and user PCs.
Management In formation Base (MIB): A specifi- cation that defines wha t objects can exist on each type of managed device and also the specific char- acteristics of each object; the actual database stored on a manager in SNMP. There are separate MIBs for different types of managed devices; both a schema and a database.
Manager: The central PC or more powerful com- puter tha t uses SNMP to collect information from many managed devices.
Man-in-th e-Mid dle Attack: An attack in which an eavesdropper intercepts message transmissions between two devices in order to read exchanged messages.
Master-S lave Co ntrol: Form of transmission in which one host controls the transmission of another host.
Mbps: Megabits per second.
Glossary 437
Media Access Control (MAC): The process of controlling when stations transmit; a lso, the low- est part of the data link layer, defining functionality specific to a particular lAN technology.
Media Gateway: A device that connects IP tele- phone networks to the ordinary public switched telephone network. Med ia gateways also convert bel\veen the signaling formats of the IP telephone system and the PSTN.
M essage In teg rity: The assurance that a message has not been changed en route; or if a message has been changed, the receiver can tell that it has been changed.
M essage Order: Controlling when one device in a pair may transmit.
M etric: A number describing the desirability of a route represented by a certain row in a routing table.
M etropolitan Area Ne twork (MAN): A WAN that spans a single urban area.
MIB: See management information base. M ill isecon d (ms): The uni t of t ime in which la tency is measured.
M illiwatt (mW): One thousandth of a watt.
MIMO: See Multiple Input/Multiple Output.
M in o r Inci de n t: Security incident that can be managed by the on-duty staff.
Mob ile Phone: See Cellphone.
Mobile Telephone Switch ing Off ice (MTSO): A control center that connects ceUular customers to one another and to wired telephone users, as ,vell as overseeing all cellular ca lls (determining what to do when people move from one cell to another, including which cellsite should handle a caller when the caUer ,vishes to place a call).
M odal Dispersion: The main propaga tion prob- lem for optical fiber; dispersion in which the dif- ference in the arrival times of various modes (permitted light rays) is too large, causing the light rays of adjacent pulses to overlap in their arrival times and rendering the signal unreadable.
Mode: An angle at which light rays are permitted to enter an optical fiber core.
438 Glossary
Mome ntary Traffic Peak: A surplus of traffic that briefly exceeds the network's capacity, happening only occasional ly.
MPLS: See Multiprotocol label Switching.
Ms: See MiUisecond.
MTSO: See Mobile Telephone Switching Office.
Multimode Fiber: The most common type of fiber in lANs, wherein light rays in a pulse can en ter a fairly thick core at multiple angles. Inexpensive but can transmit signa ls over sufficient distance for LAN usage.
Multipath Interference: Interference caused when a receiver receives two or more signals- a direct s ignal and one or more reflected signals. The multiple signa ls may interfere ,vith one another.
Multiuser MIMO (MU-MIMO): Using MIMO to send Wi-Fi frames to multiple hosts s imultane- ously and a lso to receive frames simultaneously.
Multiple Input/Multiple Output (MIMO): A radio transmiss ion method that sends severa l signals simultaneously in a single radio channel.
M ultiplex: 1) Having the packets of many conver- sations share trunk lines; reduces trunk line cost. 2) The ability of a protocol to carry messages from multiple next-higher-layer protocols in a single communication session.
Multiprotocol label Switching (MPLS): A traffic management tool used by many lSPs.
mW: See Mi lliwatt.
Nanometer (nm): The measure used for wave- lengths; one bi llionth of a meter (10"9 meter).
NAT: See Network Address Translation.
Nation al Insti tu te of S tandards and Technol- ogy. United States agency that creates security recommendations for Federa l agencies. Given the lnstitute's recommendation, the lnstitute's recom- mendations are ,videly adopted in industry.
Near Field: In radio transmission, the signal very near the antenna. Has unique properties. Can be used to query radio frequency ID circuits that have no po,ver.
Near Field Communication (NFC): Form of radio transmission in which devices within about 4 cm (roughly 2 in.) can communicate peer-to-peer.
Network Address Translation (NAT): Converting an IP address into another IP address, usuaUy at a border firewall; disguises a host's true IP address from sniffers. Al lows more internal addresses to be used than an ISP supplies a firm with external addresses.
Network Applications: Those applica tions that require a network to communicate with one another in order to function.
Network Core: The central part of the network.
Network Management Program (Manager): A program run by the nehvork administrator on a central computer.
Network Operation Center (NOC): Central man- agement point for a network.
Network Part: The part of an IP address that identi- fies the host's network on the Internet.
Network Segmentation: When the network is divided into different security domains, each with security controls that are appropriate to it. Strict rules for communication between security zones.
Network Stacie Programs on a host that govern communication to and from the Internet.
Network Standard: A rule of operation that gov- erns the exchange of messages between two hard- ware or software processes.
Network Vis ib ility: A type of tool tha t helps managers comprehend what is going on in their networks.
Network Working Group: The origina l ad hoc standards setting group for the ARPANET. When the ARPANET gre,v into the Internet, the group matured into the Internet Engineering Task force, which now sets standards on the Internet.
Next-Generation Firewall (NGFW): Fire,vall that can detect applications, not simply port numbers. Permits much finer control over network traffic.
Next Header Field: In an 1Pv6 main or extension header, the fie ld tha t specifies the next header's type or specifies that the payload follows the header.
Next-Hop Router: A router to which another router forwards a packet in order to get the packet a step closer to reaching its destination host.
NGFW: See Next-Generation FirewaU.
Nm (nm): See Nanometer.
NOC: See Nel\vork Operation Center.
Nonmalicious Insiders: Insiders (employees, etc.) who do not mean to do serious harm yet may do so through ignorance or while underestimating the riskiness of their actions.
Northbound APls: In SON, an application pro- gram interface between an SON application and the SON controller.
Object: In SNMP, an aspect of a managed device about which data is kept.
Octet: A collection of 8 bits; same as a byte.
OFDM: See Orthogonal Frequency Division Multiplexing.
OM: See Optical Multimode.
Omnidirectional Antenna: An antenna that trans- mits signals in all directions and receives incoming signals equally well from a ll directions.
One-to-One Connection: Transmission from one host to another. Unicasting.
One-Pair Voice-Grade (lPVG) UTP: The tradi- tional telephone access lines to individual residences.
Open Connect Appliances: Video delivery serv- ers in Netflix's content delivery network Ope11 Co1111ect.
Open Connect Nehvork: Netflix's content delivery nel\Vork
Open Shortest Path First (OSPF): Comp lex but highly sca lable interior routing protocol.
Optical Fiber: Cabling that sends signals as light pulses.
Optical Multimode (OM): Quality standard for multimode fiber.
Orga.nizational system security: A name for all of the non-technologica l aspects needed for the pro- tection of a business systems such as a department or project team.
Orthogonal Frequency Division Multiplexing (OFDM): A form of spread spectrum transmission that divides each broadband channel into subcarri- ers and then transmits parts of each frame in each subcarrier.
Glossary 439
OSI: The Reference Model of Open Systems Inter- connection; the 7-layer network standards archi- tecture created by ISO and ITU-T; dominant at the physical and data link layers, which govern trans- mission within single nel\Vorks (LANs or WANs).
OSPF: See Open Shortest Path First.
Oversight: A collection of methods to ensure that policies have been implemented properly.
Packet: A message at the internet layer.
Pairwise Session Key: A session key for encrypted transmission bel\Veen !\Vo devices. This key is not known by other devices.
PAN: See Personal Area Nel\Vork.
Parallel Transmission: A form of transmission that uses multiple wire pairs or other transmission media simultaneously to send a signal; increases transmission speed.
Passphrase: A series of words used to generate a key.
Password Dictionaries: Dictionary of common names and pass,vords and common variants of these. If a password is in the dictionary, it will be cracked immediately no matter how long it is.
Patch: An addition to a program that will close a security vulnerability in that program.
Payload: 1) In security, a piece of code that can be executed by a virus or worm after it has spread to multiple machines. 2) In 1Pv6, a ll of the packet after the main packet header.
Payload Length Field: In 1Pv6 packets, a field that gives the length of everything fo llowing the main header, including subsidiary headers.
Peers: In peer-to- peer applications, devices that traditionally were called clients.
Peer-to-Peer (P2P) Applications: App lica - tions that operate bel\Veen devices traditionally considered to be clients, with little or no server involvement.
Peer-to-Peer (P2P) Computing: Most or a ll of the work is done by cooperating user computers, such as desktop PCs. If servers are present at all, they serve only facilitating roles and do not control the processing.
Peer-to-Peer Traffic: Traffic bel\Veen peers in peer to peer applications.
440 Glossary
Perm ission: A rule tha t determines what an account owner can do to a particular resource (file or d irectory).
Person al Area Network (PAN): A small wireless network used by a single person.
Personal Identification Nu mber (PIN): A four- or s ix-digit number a cardholder types to authenti- cate himself or herself.
Personal Mode: Pre-shared Key Mode in WPA or 802.lli.
Physical s ta n dard : The process (hardware or soft- ware) that implements the transport layer's func- tiona lity.
Phishing: Social engineering a ttack tha t uses an official-looking e-mail message or ,vebsite.
Physical Standard: Standard a t the physical layer, the lowest layer in nehvorking.
Piconet: In Bluetooth, a persona l area nehvork with up to eight d evices.
PIN: See Personal Identification Number.
P ing: Send ing a message to ano ther host and listening for a response to see if it is active.
P lan n ing: The firs t step in the plan-protect- respond cycle for cyberdefense. Creating plans for protections and responses.
Plan-Protect- Respond Cycle: The basic manage- ment cycle in wh ich the three named stages are executed repeatedly.
Point-to-Poin t Network: A network that directly connects two devices. Often used to connect two routers on the Internet that are many miles apart.
Point-to-Point Pro tocol (PPP): The most widely used da ta link layer protoco l in point-to -poin t net,vorking.
Policy-Based Configu ration: In SON, creating policies that are automatically transla ted into con- figura tion changes on individual devices.
Policy Database: In SON, creating policies that are automatically translated into configuration changes on individual devices.
POP: See Post Office Protocol.
Port Nu mber: The field in TCP and UDP that tells the transport process what applica tion process
sent the data in the data field or should receive the data in the data field.
Port Spoofing: Using a ,vell-kno,vn port number for a different purpose, w ith malicious intent
Post Off ice Pro tocol (POP): The most popular protocol used to download e-mail from an e-ma il server to an e-mail client.
PPP: See Point-to-Point Protocol.
Prefi x Notation: A way of representing masks. Gives the number of initial ls in the mask.
Pre -Shared Key (PSK): A mode of operation in WPA and 802.l li in which all sta tions and an access point share the same initia l key.
Pre-Shared Key (PS K) Initial Authentication: An ini tial authentication mode used in 802.l li. All devices use the same pre-shared key for in itial authentica tion. Used in residences and organiza- tions that only have a s ingle access point. Called persona l mode by the Wi-Fi Alliance.
Priori ty Level: The 3-bit field used to give a frame one of eight priority levels from 000 (zero) to 111 (eight).
Private IP Ad dress Ra.nge: An IP address that may be used only with in a firm. Private IP addresses have three designated ranges: 10.x.x.x, 192.168.x.x, and 172.16.x.x through 172.31.x.x.
Private Key: A key that only the true party should know. Part of a public key-private key pair.
Profile Wave: The Wi-Fi alliance creates profiles, which are subsets of a particu lar standard. The alliance bases interoperability testing on specific profiles.
Pro mp t: In a command line interface, characters at the s tart of a line to ind ica te that the system is a,vai ting your input. May give Information on wha t type of input you may type.
Propagate: In signa ls, to travel.
Protecti o n: Implementing a security p lan; the most time-consuming stage in the p lan-protect- respond management cycle.
Pro tocol: 1) A standard tha t governs interactions between hardware and software processes a t the same layer but on different hosts. 2) In IP, the header fie ld that describes the content of the data field.
Protocol Fiel d: In IP, a fie ld that designa tes the protocol of the message in the IP packet's data field.
Provable Attack Packet: A packet that is provably an a ttack packet.
PSI<: See Pre-Shared Key.
PSTN: See Public Switched Telephone Network.
PSTN Core: The public switched telephone net- works central transmission lines and switches. Does not include end office switches that serve users or transmission lines to users.
Pu blic-facin g servers: Servers tha t provide ser- v ices to clients on the In ternet. Clients must be able to access it. This can lead to attacks, so public- facing servers must be especia lly well protected.
Pu blic Key: A key tha t is not kept secret. Part of a public key- priva te key pair.
Public Sw i tc h ed Te l ephone Network (PSTN): The worldwide telephone network.
QoS Guarantee: A guarantee that certain traffic will get through regard less of network congestion. Requires reserving capacity on each device.
Quality of Service (QoS) Metrics: Numerical ser- v ice targets that must be met by networking s taff.
Rack Server: Server tha t fits in a s tandard equip- ment rack. Each rack can hold several rack servers positioned one on top of another.
Radio Frequency ID (RFID): A tag tha t can be read at a distance by a radio transmitter/receiver.
Rapid Spanning Tree P rotocol (RSTP): A ver- sion of the Spanning Tree Protocol that has faster convergence.
Rate Limited: Traffic that is limited to a certa in small percentage of a net,vork's total traffic in order to reduce congestion.
Rated Speed : The official standard speed of a technology.
RBAC: See Ro le-Based Access Control.
Real Time Fail-Over. Two data centers that are synchronized so tha t if one data cen ter fails, the other can ta ke over in rea l time (immediately).
Real Time Protocol (RTP): The protocol that adds headers that contain sequence numbers to ensure tha t the UDP datagrams are p laced in proper
Glossary 441
sequence and that they contain time stamps so that jitter can be eliminated.
Recognized Organization: An organization recog- nized by the Internet Assigned Number Authority; it receives a network part.
Recommendation System: A system that recom- mends a prod uct that a user might like based upon the user's past pattern of selections.
Record: In a file or database, information about a single entity.
Redundancy: Duplication of a hard,vare device in order to enhance rel iability.
Reading log files: Many devices create log files tha t list each operational or security-relevant event. The organization must read these log fi les constantly to detect attacks. Early identification of an a ttack may mitigate its damage.
Reference Model of Open Systems Interconnec- tion: Standards architecture created by the JTU-T and ISO. Acronym is OSI. Rarely spelled out.
Refl ection: In cross-site scripting, when an appli- cation executes a script sent in a user's input. This can be a ma licious script.
Regen erate: In a switch or router, to clean up a signal before sending it back out.
Remote Access V PN: Vir tual priva te network that allo,vs a remote host to communicate securely with a site.
Request fo r Comment (RFC): A document pro- d uced by the IETF tha t may become designated as an Official Internet Protocol Standard.
Request Message: In req uest-response cycles, a message a client programs sends to request service from a server application program.
Reserved Capacity: On routers, switches, and transmission lines, reserving a certain amount of capaci ty for a particular application so that mes- sages in the applica tion w ill always get through even if congestion is severe.
Reset: In TCP, a flag in a TCP segment to inform the other side that the sender will accept no further input.
Residential Access Ro uters: In a home network, a multifunction devices tha t is a trivial router but includes an Ethernet switch, a consumer-grade
442 Glossary
wireless access point, a DHCP server, and often other functionality.
Respond: ln security, the act of stopping and repairing an attack.
Response Header field: In HTTP, a header field that follow the status line in an HTIP response message.
Resp on se M essage: ln Cha llenge- Response Au thentica tion Protocols, the message that the applicant returns to the verifier.
Re usabl e Pass,vord : Password that is used repeated ly to get access.
RFC: See Request for Comment.
RFID: See Radio Frequency ID.
Right o f Way: Permission to lay wires in public areas; given by government regulators to trans- mission carriers.
Risk Analysis: The process of balancing threats and protection costs.
RJ-45 Connector: The connector at the end of a UTP cord, which plugs into an RJ-45 jack.
RJ-45 Jack: The type of jack into which UTP cords RJ-45 connectors may plug.
Roaming: 1) In cellular telephony, the situation when a subscriber leaves a metropolitan cellu- lar system and goes to another city or country. 2) In 802.11, when a wireless host travels from one access point to another.
Rogue Access Point: An unau thorized access point. If it has no security or poor security, it allows a malicious outsider access even if all regular access points are highly secure.
Role- Based Access Control (RBAC): Assigning access to resources based on roles in the organi- zation ra ther than assigning them to individual people. Individuals are then assigned to roles.
Root Cause Analysis: The ana lysis of da ta in log fi les to determine the fundamental cause of and observed pattern in the data.
Root DNS Server: One of 13 top-level servers in the Domain Name System (DNS).
Root Privileges: In UNIX systems, complete privi- leges (authorizations) on the machine, allowing the user to do anything. Also used to refer to similar privileges on non-UNIX machines, such as Win- do,vs, Apple, and mobile phone systems.
Ro u te: The pa th tha t a packet takes across an internet.
Ro und-Trip Laten cy: The time delay between when a message is sent and the response is received.
Ro uter: A d evice that forwards packets within an internet. Routers connect two or more single net- works (subnets).
Routing: 1) The forwarding of IP packets. 2) The exchange of routing protocol informa tion through routing protocols.
Ro uting Decision: When a router receives a packet, it must make a decision about what port to send the packet back out to get to e ither the next-hop router or the destination host.
Ro uting Prefix: The firs t part of an 1Pv6 address. Indicates the organization on the Internet contain- ing the host.
RST Bit: ln a TCP segment, if the RST (reset) bit is set, this tells the other side to end the connection immedia tely.
RSTP: See Rapid Spanning Tree Protocol.
RST: A TCP flag field. lf set, the TCP segment tells the other party that the sender is breaking the con- nection.
RTP: See Real Time Protocol.
RTS/CTS: See Request to Send/Clear to Send.
SaaS: See Software as a Service.
S ON: See Software-Defined Networking.
SO N Application Programs: In SON, a program that implements a control function, such as impos- ing quality of service rules on one or more devices.
SO N Controller: In SON, the device that manages the control function for multiple switches, routers, and other forwarding devices.
Searchable Fields: In e-mail and applica tions, the abil ity to search for messages or files on the basis of the contents of specific fields such as sender, receiver, date, time, and subject.
Second-Level Domain: The third level of a DNS hierarchy, which usua lly specifies an organization (e.g., microsoft.com, hawaii.edu).
Security Association: An agreement between two parties on the security methods and parameters they ,vill use in their subsequent interactions.
Security Policies: A security policy is sta tement of wha t should be done to achieve a desired level of security. Imp lemen tation is actually doing it according to the policy. Ta kes advan tage of the different knowledge of policy makers and implementers.
Self-organizing: A network is self-organizing if it reorganizes itself automatical ly when devices are added or dropped.
Separation of Duties: Creating procedures or pro- cesses that require two (or more) people to com- plete an action. This prevents a single person from acting alone to take an unsecure or malicious action.
Sequence Number Field: In TCP, a header field that tells a TCP segment's order among the multiple TCP segments sent by one side.
Server Host: In client/server processing, a server program on a server host provides services to a client program on a clien t host.
Server Program: Program on a server host that provides service to a client program on a client host.
Service Band : A subdivision of the frequency spectrum, dedicated to a specific service such as FM radio or cellular telephone service.
Service Level Agreement (SLA): A quality-of- service guarantee for throughpu t, availability, latency, error rate, and other matters.
Service set ID (SSID): The name of a Wi-Fi access point or group of access points. A Wi-Fi user must know the SSID to connect to an access point.
Session Initiation Protocol (SIP): Relatively simple signaling protocol for voice over IP.
Session Key: Symmetric key that is used on ly during a single communication session between two parties.
Set: 1) When a flag's fie ld is given the value 1. 2) An SNMP command sent by the manager that tells the agent to change a parameter on the managed device.
Shadow Zone: See Dead Zone.
Signal Analysis Software: Software that analyzes the characteristics of a radio signal, such as signal strength.
Glossary 443
Signal Bandwidth: The range of freq uencies in a s ignal, determined by subtracting the lowest frequency from the highest frequency.
Simple Mail Transfer Protocol (SMTP): The proto- col used to send a message to a user's outgoing mail host and from one mail host to another; requires a complex series of interactions between the sender and the receiver before and after mail delivery.
Simple Network Management Protocol (SNMP): The protocol that allows a genera l ,vay to collect rich data from various managed devices in a network.
Single-Mode Fiber: Optical fiber whose core is so thin (usually 8.3 microns in diameter) that only a single mode can propagate, also the one traveling straight along the axis.
Single Network: A network that uses a single set of standards for al l devices. E.g., Ethernet.
Single Point of Takeover: If an attacker can take over a single system, the a ttacker gains control over a significant portion of your network.
SIP: See Session Initiation Protocol.
Site-to-Site VPN: Virtual private net,vork that secures all communication between two sites.
Site Survey: In wireless LANs, a rad io survey to help determine where to p lace access points.
Skype: A P2P VoIP service that currently offers free calling among Skype customers over the Inter- net and reduced-costs calling to and from Public Switched Telephone Network customers.
SLA: See Service Level Agreement.
S/MIME Protocol: A security protocol for end-to- end communication between the programs of two e-mail users.
SMTP: See Simple Mai l Transfer Protocol.
Sniffer Program: In security, a program that inter- cepts traffic to read it in order to find information useful to an attacker.
SNMP: See Simple Network Management Protocol.
SNMP Agent: In the Simple Network Manage- ment Protocol, the hardware or software function - al ity on a managed device that communicates w ith the SNMP manager.
444 Glossary
SNMP Get: In the Simple Network Management Protocol, a command sent by the manager that asks an agent for information about its managed device.
SNMP Manager: In the Simple Netv.rork Manage- ment Protocol, the program that coUects data from managed devices and can send commands to man- aged devices to change their configuration.
SNMP Schema: In the Simple Network Manage- ment Protocol, the schematic structu re of the man- agement information base.
SNMP Set: In the Simple Nel\vork Management Protocol, a command from the manager to the agent to change the configuration of a managed device.
SNMP Trap: In th e Simple Network Management Protocol, an alarm sent by an agent to the manager if the agent detects a problem.
Social Engineering: Tricking people in to doing something to get around security protections.
Socket: The combina tion of an IP address and a port number, designating a specific connection to a specific application on a specific host. It is ,vritten as an IP add ress, a colon, and a port nu mber, for instance, 128.171.17.13:80. Sofl\Vare as a Service (SaaS): Service in which an application service provider s upplies an application to customers on demand .
Sofl\Vare-Oefined Networking (SON): A rad i- cal change in networking that removes the control function from ind iv idual switches, routers, access points, and other devices.
Solid-Wire UTP: Type of UTP in which each of the eight wires really is a single solid wire rather than a collection of s trands.
Source Host: Host tha t transmits a message to another host, the destination host.
Source IP Address: The IP add ress of the host that transmits.
Source IP Address Field: Field in an IP packet containing the IP address of the host that transmits the packet.
Source Port Number Field: Field in a TCP seg- ment o r a UDP datagram containing the IP address of the host tha t transmits.
Southbound APis: In SON, an application pro- gram interface between an SON controller and a switch, router, or other device.
Spawn: To launch a copy of a virtual machine or a new v irtual machine. Also called instantiation (creating an instance of).
Spear Phishing: A phishing attack that is high ly focused on an in d ividual. Like ly to be extremely convincing because it contains content highly familiar to the intend ed victim.
Splitter: A device tha t a DSL user plugs into each telephone jack; the splitter separates the voice sig- nal from the data signal so that they cannot interfere with each other.
Spread Spectrum Transmission: A type o f rad io transm ission that ta kes the origina l signa l and spreads the signal energy over a much broader channel than ,vould be used in no rmal ra dio transmission; used in order to reduce propagation problems, not for security.
Spyware: Software that sits on a victim's machine and gathers information about the v ictim.
SSUTLS: See Secure Sockets Layer and Transport Layer Security.
Stand-Alone Processing: An application arch i- tecture in which all processing is done on a single machine.
Standards Agency: An o rganization that creates and maintains standards.
Standards Architecture: A fam ily of related standards tha t collectively a llows an application program on one machine on an internet to com- mun icate wi th another applica tion program on another machine on the internet.
State: In digital physical layer signaling, one of the few line conditions that represent information.
Stateful Packet Inspection: Firewall filtering mech anism that uses different fil tering methods in different states of a conversation.
Static IP Address: An IP address tha t never changes.
Strain Relief: In a UTP connectoriza tion, press- ing the RJ-45 connector in to the jacke t o f a UTP cord. This means tha t even if the cord is pulled, causing stra in, the cord will not pull ou t of the connector.
Strand: In optical fiber, a core surrounded by a cladd ing. For two-way transm ission, two optica l fiber strands are needed.
Stranded-Wire UTP: Type of UTP in which each of the eight "wires" really is a collection of wire s trands.
Stripping Tool : Tool for stripping the sheath off the end of a UTP cord.
Subnet: A smaU network that is a subd ivision of a large organization's network.
Su b n et ID: The second part of an IPv6 address. Indicates the host's s ubnet in the organization on the Internet containing the host.
Sub net Part The part of an IP address that specifies a particular subnet within a network.
Su pervisory Protocols: A protocol that governs how network devices operate, as opposed to a protocol that is used to send, receive, and forward information.
Su p p lican t: The party trying to prove his or her identity.
Surreptitiously: Done without someone's knowl- edge, such as surreptitious face recognition scanning.
Switch: A device that forwards frames within a single network.
Switching Decision: In switched networks, the decis ion a s,vitch makes when it receives a frame in one port and must decide which other port to send the frame back out to the next device along the data link.
SYN Bit: In TCP, the flags field that is set to indicate if the message is a synchronization message.
Syn chro n ization P rofile (SYNCH): Bluetooth profile for synchronizing data on two devices.
Synchro n ized Data Cente r: Two (or more) data centers with synchronized software and data. This permits real-time fail -over.
Synch ronou s DSL: Digital subscriber line with the same speed in both directions. Normally used In bus inesses.
Syntax: In message exchange, how messages are organized.
SYSLOG Standa rd: Standard for transmitting data from log files on ind ividua l devices to an inte- grated log file.
Tag: An indicator on an HTML file to show where the browser should render graphics files, when it should play audio files, and so forth.
Glossary 445
Tag Field: One of the two fields added to an Eth- ernet MAC layer frame by the 802. IQ s tandard.
Tops: Terabits per second- a thousand billions of bits per second.
TCP: See Transmission Control Protocol.
TCP Reset Seg me nt: TCP segment in which the RST flag bit is set.
TCP Segment: A TCP message.
TCP/IP: The Internet Engineering Tas ks Force's s tandards architecture; dominant above the data link layer.
TOR: See Time Domain Reflectometry.
Test Signals: Signa l sen t by a high-quality UTP tester through a UTP cord to check signal quality parameters.
Text Stan d ard s: Standards for representing key- board characters p lus some control codes. Therefore, not actually limited to text.
Threat Environment: The threats that face the company.
Through p u t: The transmission speed that users ac/unlly get. Usually lov.rer than a transmission system's rated speed. Ti me Domain Reflectometry (TO R): A test- ing system for UTP that can detect breaks in the wire.
Time to Live (TTL) Fiel d : The field added to a packet and given a value by a source host, us ually between 64 and 128. Each router along the way decrements the TTL field by one. A router decre- menting the TTL to zero will dis card the packet; this prevents misaddressed packets from circulat- ing end lessly among packet switches in search of their nonexistent destinations.
Top-Level Domain: The second level of a DNS hierarchy, which categorizes the domain by orga- nization type (e.g., .com, .net, .edu, .biz, .info) or by country (e.g., .uk, .ca, .ie, .au, .jp, .ch).
Tor: A peer-to- peer application designed to keep the sender's IP address anonymous. This increases privacy but also conceals the identity of attackers.
Total Cost of a Countermeasure: All of the costs a firm ,vill encounter if it installs a countermeasure, including technology costs, IT security labor costs, and increases in labor costs in non-IT business units.
446 Glossary
Traceroute: Program that gives the rou nd-trip latency to every router along the route to a particu- lar destina tion host. Id entifies links w ith unusu- a lly hig h latency.
Traffic Analysis: Ana lysis that asks how much traffic must flow over each of the network's many ind ividua l transmission links.
Traffic Class Fiel d: An 1Pv6 fiel d for specifying specia l handling for a packe t.
Traffic Engineering: Designing and managing traffic on a network. Traffic Shaping: Lim iting access to a network based on type of traffic.
Transceiver: A transmi tter/receiver.
Transcoding: Changing a video file into one of many formats that d ifferent viewers need to view the video. Transmission Control Protocol (TCP): The most common TCP /IP protocol a t the transport layer. Connection-o riented and reliable. Transparent: An in termediate process whose workings are invisib le to end devices.
Transport Mode: One of IPsec's hvo modes of opera tion, in which the two computers tha t are communicating implement IPsec. Transport mode gives strong end-to-end security bel\Veen the com- puters, but it req u ires IPsec configuration and a d igital certificate on all machines.
Transport Lay er Process: Internet transmission standard implemented on the source and destina- tion host. Above the internet layer and below the applica tion layer.
Transport Process: The process (hardware or sofhvare) tha t implements the transport layer's func tionality.
Traps: The type of message that an agent sends if it detects a cond ition that it thinks the manager should know about.
Trojan Horse: A program that looks like an ord i- nary system file but continues to exploit the user indefinitely.
True Party: In au then tication, the person the supplicant says that he or she is.
Trunk Link: A type of transmission line that links switch es to each o ther, routers to each o ther, o r a router to a switch.
TTL: See Time to Live Field .
Tunnel Mode: One of IPsec's two mod es of operation, in which the IPsec connection extends only bel\veen IPsec gateways a t the two s ites. Tunnel mode p rovides no protection within sites, but it offers transparent security.
Two-Factor Authentication: A type o f a u thentica- tion that requires l\Vo fo rms of credentials.
Two-Way Amplifier: In cable television, an amplifier tha t amplifies signals traveling in both d irections.
UDP: See User Datagram Protocol.
UDP Checksum Field: Field in the UDP head er that the receiver uses to check for e rrors. If the receiving transport process fin ds an error, it d rops the UDP datagram.
UDP Length Field: Field in the UDP header that gives the length of the UDP data fiel d in octets.
UDP Datagram: Message in th e User Da tagram Protocol.
UNICODE: The standard that a llows characters of al l languages to be represented.
Unlicensed Service Band : Unregula ted ra d io band that d oes not requ ire rad io devices to be licensed.
Unreliable Protocol: Protocol that d oes not do error correction.
User Datagram Protocol (UDP) : Unreliable trans- port-layer protocol in TCP /IP.
Username: An alias that signifies the account that the account holder w ill be using.
Verifier: The party requiring the supplicant to prove his or her identity.
Version Number Field: In IP packets, the first field; it tells whether the packet in an 1Pv4 packet or an 1Pv6 packet. Video over IP (VoIP): The transmission o f vid eo codec data in IP packets.
Virtual LAN (VLAN): A closed collection of serv- ers and the clients they serve. Broadcast signals go only to computers in the same VLAN.
Virtual Machine (VM): One of mu ltiple logica l machines in a real machine; to its users, it appears to be a real machine.
Virtual Private Network (VPN): A net,vork that uses the Internet or a wireless network w ith added security for data transmission.
Virus: A piece of executable code tha t a ttaches itself to p rograms or d ata files. When the pro- gram is executed or the data file opened, the v irus spreads to other programs o r data files. VLAN: See Virtual LAN.
VM: See Virtual Machine.
VM Instances: Specific v irtual machines.
Voice over IP (VoIP): The transmission of voice s ignals over an IP network.
VoIP: See Voice over Wan d Video over W.
VPN: See Virtual Private Nel\vork.
Vul nerability: A secu rity weakness fo u n d in software.
Vulnerability Testing: Testing a fter protections have been con figu red, in which a company or a consultant attacks protections in the way a deter- m ined attacker would and notes which attacks tha t should have been stopped actually s ucceeded.
WAN: See Wide Area Network.
WAN Optimization Device: Network device that optimizes w ide area network traffic through com- pression and other methods. Desirable beca use WAN traffic is more expensive than LAN traffic per bit transmitted.
Wavelength: The physical d istance between com- parable points (e.g., from peak to peak) in successive cycles of a wave.
Weakest Link: In a series of protections that must all succeed for a counte rmeasure to s ucceed, the protection most li ke ly to fail. If it fa ils, the en tire series of protections is meaningless.
Well-Known Port Number: Standard port num- ber of a major a pplication that is usua lly (but not a lways) used. For example, the well-known TCP port numb er for HTTP is 80. Well-known po rt numbers range from O through 1023.
WEP: See Wired Equ ivalent Privacy.
Wide Area Network (WAN): A network that links d ifferent sites together.
Glossary 447
Wi-Fi: A name created by the Wi-Fi All iance to refer to 802.11 standards.
Wi-Fi Alliance: Trade grou p that crea ted interop- erab ility tests of 802.11 LANs; actually produ ced the WPA standard.
Wi-Fi Direct: A form o f Wi-Fi in which wireless hosts sends frames to one another directly instead o f though and access point.
Wired Equivalent Privacy (WEP): A weak secu rity mechanism for 802.11.
Wireless LAN (WLAN): A local area network that uses rad io transmission instead of cabling to con- nect devices.
Wireless Protected Access (WPA): Th e 802.11 secu ri ty method created as a s topgap between WEP and 802.lli.
Wireless Protected Access 2 (WP A2): Another name for 802.11 security.
Workgroup Switch: A sw itch to which s ta tions connect directly.
Working Group: A specific subgroup o f the 802 Comm ittee, in ch arge of developing a specific group of standards. For instance, the 802.3 Working Group creates Ethernet standa rds.
Worm: An attack program that propaga tes on its own by seeking out o ther computers, jum ping to them, and installing itself.
Worst Case: In service -level agreements, the worst service a cus tomer will receive w ithout the service provider paying a penalty. The worst case for speed would be a certain minimum speed.
XSS: See Cross-Site Scripting.
Zero-Day Attack: Attack th a t takes advantage o f a vulnerabi lity for which no patch or other ,vork- around has been released.
Zigbee: Popular Internet of Th ings transmission protocol.
Zigbee controller: In Z igbee, a device tha t con - trols end devices tha t server users, such as light, secu rity cameras, and thermostats.
Zigbee end devices: A Zigbee device that serves users, such as light, security cameras, and thermo- s tats.
Th is page intentionally left blank
INDEX
Page numbers in bold type indicate where terms are defined o r characterized; page numbers in italics indicate tables o r figures; page numbers w ith an "n" indicate a footnote.
l PVG. See one-pair voice-grade UTP 802. 11 i WLAN security 2.4 GHz sen•ice band, 189-190 cryptographic security in, 227 2.4 GHz unlicensed service band, 194, 194-195 initial authentication in, 228,229 2.5G6ASE-SX, 159 protections of, 225-226, 225 2.5GBASE-T, 155 PSK mode in, 22&-230, 230 2-bit field, 68 stages of, 227-228 2-pair data-grade, 343 802. lln s tandards, 204, 206,208 4G. See fourth-generation s tandards 802. 11 standards 4-pair unshielded tw isted pair UTP, 152, 152-153, bandwidths in, 203-204
154 EUl-48 used in, 200n8 5G. See fifth -generation standards MAC and, 201 5G6ASE-T, 155 802. 11 Wi-Fi standards, 204 5 GHz unlicensed sen•ice band, 194, 195, 203 802. 11 wireless LAN (WLAN) 8 -bit boundar ies, 272, 272 2.4 GHz service band used by, 194, 194-195 l OGBASE-SR, 159 5 GHz service band used by, 194, 195, 203 l OGBASE-T, 155 management, 236-238 32 bits per row, 56 packet and frame transmission of, 197-198, 197 n5, 198 32 bit strings, 261-262 Wi-Fi standards and, 182, 182-183 40G6ASE-SR4, ISSnlO, 159 802. 11 Working Group, 209, 227, 228 SO-micron fiber, 161 802 committee, 297 60 GHz unlicensed band, 210 802 LAN/MAN Standards Committee, 147 64-bit inter face, 296-297 64-bit modified extended unique identifier (EUl-64),
297,297-298 100G6ASE-SR4, 158n l 0, 159 l OOGBASE-SR IO, 158n10 128 -bit address, 272, 275-277 10006ASE-SX, 159-160, 162 10006ASE-T, 162 802.l AE, switch -to-switch protection, 172 802.l X authentication server, 231 802.l X authenticator, 231 802. l X initial authentication mode, 227
authentication process of, 231, 23 1-232 elements of, 231
802.l X mode, 231 802. l X Port-Based Network Access Control,
171 802.2 Ethernet frame, 63-64 802.3 MAC Layer Standard, 162, 164 802.3 Working Group, 63-64, 154n6, 155, 159 802. llac standar ds, 204 802. llad, 210 802. llax, 209-211 802. llay, 211
A absorptive a ttenuation, 161, 187-188 access card, 132 access control, 397-398 Access Control List (ACL), 89,138,411
firewall log file and, 136, 395-396 router reconfigura tion of, 98 statehtl inspection firewall and, 138
access links, 149,331, 341 access points, 183, 183-184, 203
802. 11 WLAN management of, 236-238 corporate, 33, 33 cryptographic security between, 227 evil t win, 233-236, 235 locating, 217 MAC control of, I 99-200 MU-MlMO and, 207 placement, 237 PSK mode for s ingle, 228, 228n6 rogue, 232- 233, 233 SNMP managing, 238, 23&-239 SSID and, 226n5 throughput, 205
449
450 Index
access points (co11 ti1111ed) Wi-Fi, 224-225 wireless, 155, 225n4 wireless networks multiple, 19$--199, 199 Xirrus Wi-Fi Inspector and, 214, 217
acknowledgment (ACK), 58, 282 number, 59, 59n13 number field, 283
ACL See Access Control List active management, 405 addresses. See also n> Versio n 4 (1Pv4) address
128-bit, 272, 275-277 data link, 31 destination, 165 destination IP, I 9 dynamic IP, 24 glo ba l unicast, 296n2 hierarchical, 25$--260 JP, 17-18, 56, 62n16, 147, 300-302, 305, 371n6 !Pv6, 260, 272, 276-277, 296n2 MAC, 31, 200n8 private IP, 301 single network, 31, 31 source IP, 19, 56 static IP, 24
ad-hoc w ireless nehvork, 250 ADSL See asymmetric digital subscriber line ADSL modems, 334 Ad,•anced Encr yption Standard (AES), 226 advanced persistent threats (APTs), 121, 121 advertisement message, 247 AES. See Ad ,•anced Encr yption Standard aggregate thro ughput, 76, 77 agility, 361 AH. See Authentication Header ala rms, 91, 4 17-419 ALOHANET, 146 alphanumeric information, 65 alternative s ta tes, 151 Amazon Web Services (AWS), 359, 360 American Standar d Code for Information
Interchange (ASCil), 372-373 code, 65 encoding text as, 65, 65
amplitude, 156 anonymous transmission nehvork, 383 antennas
dish, 186, 186 omnidirectional, 185, 186 paddle, 338
Antheil, George, 196n4
anti-replay, 127n27 anti,•irus (AV) programs, 142, 142 AP!s. See application program interfaces appliance sen•ers, 11 application architectures, 354
programming in, 355 security, 356, 356-358 server locations, 355
application aware firewalls, 139 application data, 52-53 application layer (Layer 5), 48
3-bit field, 68 connections, 50 ne hvorked,354-358 standards, 4 7
application messages, 10, 14 encoding of, 64 longer, 16-17 sho rt, 14
application program interfaces (AP!s), 99, JOO application security, 356, 356-358 application-specific integrated circuits (ASJCs),
140n33 apps, 357 APTs. See advanced persistent threats ARPANET, 38, 38, 145 ARP cache poisoning, 172, 173 ARP update, 172 ASCH. See American Standard Code for Information
Interchange ASICs. See application-specific integrated circuits asymmetric, 318 asymmetric digital subscriber line (ADSL), 333, 333,
336 attackers
business competitors as, 124 cybercriminals as, 122-123 cyberterrorists as, 124-125 employee and inside, 123 national governments as, 124-125
attacks APTs, 121 Dos, 120 d rive-by hackers, 224-225, 224, 233 evil h vin, 224, 233, 235-236 malware, 113 man-in-the-middle, 172 provable packet, 136 stolen data from, 110 types of, 113 zero-day, 114
attenuation absorptive, 161, 187-188 high absorptive, 210-211 in,•erse square law, 186-187 oxygen absorption, 2lln12 radiative, 154, 154
audits, 408 authentication, 126-127, 127
802.l X, 231 in 802.lX initial authentication mode, 227,231,
231-232 802. lli WLAN security, 227, 228 access cards, 132-133 access control through, 397-398 biometrics, 133 concepts of, 128-129, 129 d igital certificate, 133, 134 hashing methods in, 316nl 7 initial, 227 pairwise session key, 228-229, 229 w ith passwords, 130-131 processing required for, 316n l7 resources use through, 398, 398 reusable passwords in, 130 serve~398, 398,401 two-factor, 135, 135n32 types of, 132, 132-134 user, 171
Authentication Header (AH), 3U, 312 authoritative DNS server, 302 authoriza tion, 118-119, 397-398 automation, 96 AV. See anti virus programs availability, 78 AWS. See Amazon Web Sen•ices
B backup links, 169 backward com patibility, 208, 208 bandwidth, 189
in 802.11 standards, 203-204 channel, 192, 203, 203-204 radio transmission and, 191 service bands, 203-204 signal and channel, 190-191, 192
base case, 392 basic printing profile (BPP), 246 beacons, 247 beamforming, 207, 207 Bell, Alexander Graham, 153n4 best-ma tch row, 269-270
Index 451
Bezos, Jeff, 5 BGP. See Border Gateway Protocol binary
to decimal conversion, 18-19, 67 encoding, 64, 69 integers converted to, ~7, 66-67 signaling, 150, 150-151
biome trics, 133 bits per second (bps), 75 bluetooth, 243
classic, 243 master-slave operation of, 244-246 modes of operation, 244 one-to-one connections of, 244-246 PANs and, 243 profiles, 246
Bluetooth Low Energy (Bluetooth LE), 244, 246, 247 advertisement message in, 247 beacons in, 247
Bluetooth Special Interest Group (SIG), 243 bonding, 160 Border Gateway Protocol (BGP), 310 border router, 260, 260 botrnaster, 120 botnet, 120 botne t m alware, 2 bots, 120 BPP. See basic printing profile bps. See bits per second breaches, 412 bring your own device (BYOD), 252 broadband channels, 191 broadband modems, 33 browsers, 13 business competitors, 124 BYOD. See bring your own de,•ice
C cable modem, 34, 81,336 cable modem service, 334-336, 335 cable television, 334 cache memory, 88 caching, 349, 350 Canonical Text Representation, 277, 277, 298 carriage return, 368 carrier Ethernet, 345-346, 346 carriers, 329, 329nl car rier WANS, 331, 331, 345-346 Category Se, 154, 154n7, 162 Category 6, 154, 154n7, 162 Category 6A, 154, 154n7
452 Index
CON. See content delivery nehvork cells, 337 cellsite, 337-338, 337n3 cellular data service, 337,339 cellular phones, 7 cellular service, 337, 337-338 genera tions of, 339-340, 340 centrali2ed firewall management system, 411 centrali2ed management, 41(HI JJ Cerf, Vint, 30n23 certification authority, 133 challenge message, 134 channels, 190
bandwidth, 192, 203, 203-204 broadband, 191 reuse, 338 signals and, 190-191, 192 use, 193-194, 194, 195n3
CIA. See confidentiality, in tegrity, and authentication cipher, 125 Cisco !OS interaction, 324, 324-325 Class 5 switches, 332 classic bluetooth, 243 clear line of sight, 211 clear-to-send (CTS), 203 CLI. See command line interface client port numbers, 61, 62 client program, 13 clients hosts, 10-11, 11-12 clock cycles, 151 cloud, 9-10
computing, 365-366 security, 365, 365
cloud sen•ice pro,•ider (CSP), 362, 362, 364 coaxial cable, 335, 335 co-channel interference, 193-194, 194 CODEC transmission, 376, 376 coin batteries, 241-242, 242,244 collision, 200 command and cont rol server, 120 command line inter face (CLI), 322, 322-323 command mode, 323 commercial networks, 81 communications, 405 comp liance regulations, 400 comprehensive security, 394 compression, 349, 349 compromises, 4 12 computers, hacking of, 118-119 computer security incident response team (CSIRT),
414-415
computing infrastructure, 363 confidentiality, 125 confidentiality, integrity, and authentication (CIA),
226 Config command, 325 configuration information, in DHCP, 305, 305-306 connectionless protocol, 49, 57 connection tests, 218,219 connection window, 215-216 consumer services, 81 content delivery neh vork (CON), 359, 360 content-length field, 369 content-type field, 369 continuity testers, 180 control function, 97, 98 control segments, 52 cord distances, 154, 154-155 core fields, 166-167 core switches, 148-149 corporate access points, 33, 33 countermeasures, total cost of, 393-394 country top-le,•el domains (cnDs), 303 CPE. See customer premises equipment credentials, 129, 232 credit cards
cyberattacks from, 109-110 damages from theft of, 111 number theft of, 118
crimeware programs, 123 crimping tool, 179, 179 Crocker, Steve, 39 cross-site scrip ting (XSS), 357, 357-358 cryptanalysts, 126 cryptographic protections, 373, 373-375 cryptographic security, 227 cryptography, 125 CSIRT. See computer security incident response team CSMA/CA+ACK, 203
media access control and, 201 reliability of, 202
CSP. See cloud service provider CSU/DSU, 342 cTLDs. See country top-le,•e l domains CTS. See clear-to-send customer premises, 146 customer premises equipment (CPE), 331, 331 cyberattacks, 1--4, 107-108, 124n26
anti-replay and, 127n27 from credit cards, 109-110 drive-by hackers, 224-225, 224, 233 perspective on, 112
cybercriminals, 122, 122 cyberterror, 124-125 cyberwar, U 4
D DARPA. See Defense Ad,•anced Research Projects
Agency data, stolen, 110 Database Management System (DBMS), 13 Data Fields, 54-55, 55, 168
UDP limits on, 284-285, 285 data link, 21, 48, 49, 147
addresses, 31 frames path in, 27-28 layer s tandards, 46nll length restrictions in, 162, 163 switched nehvorks and, 35
data link layer (Layer 2), 48, 63, 162 data miners, 118 data s peeds, 339 data t ransmission, 184-185 Davies, Betsy, 223-224 dB. See decibels DBMS. See Database Management System DON. See dotted decimal notation DDoS. See distributed denial-of-service dead zone, 188 decibels (dB), 239-240, 239-241 decimal, 167
binary conversion to, 18-19, 67 decision cache, 271, 271 decrypt, 125 dedicated links, 77 default router, 270 default row, 268 Defense Ad,•anced Research P rojects Agency
(DARPA),38 defense in depth, 394-396, 395-396 demilitarized zone (DMZ), 402-404, 402nl0, 403 density, 209 desktop exercises, 416 destination address, 165 destination host, 13, 14, 16-17, 17 destination JP address, 19, 56 Destination IP Address Field, 56 Destination Port Number Field, 61 devices
bring your own, 252 dual-mode, 244 Green Power, 251n9 human interface, 246
Index 4 53
IoT, 2-3, 7 managed, 94, 97, 307 manual configura tion of, 97, 98 single-mode, 244 WAN optimization, 349 Wi-Fi, 208-209, 225 Zigbee end, 250
DHCP. See Dynamic Host Configura tion P rotocol dial-up telephone modems, 355 differentiated services (Diffserv), 280 Differentiated Services Control Point, 273 Diffserv. See differen tiated services digital certificate authentication, 133, 134 digital signaling, 150, 151, 15ln2 digital subscriber line (DSL), 333 directly propagating worms, 115 directory search, 382 directory servers, 400-401, 400n9, 401 disassociate messages, 238 dish antennas, 186, 186 distributed denial-of-service (DDoS), 2, 2, 120, 120 distribution system, 199 DMZ. See demilitarized zone Domain Name System (DNS), 3, 25-26, 301
authoritative server and, 302 hierarchy in, 303 IP address lookup, 302, 305 root servers and, 303 in TCP /JP, 302-305 Xirrus Wi-Fi Inspector connecting to, 218
domain records, 305 domain registrars, 304 dotted decimal notation (DON), 18-19, 19 download times, 76 drawings, by Microsoft Visio, 103-105 drive-by hackers, 224-225, 224,233 drop cable, 336 DSL. See digital subscriber line DSL access multiplexer (DSLAM), 334 dua l-mode de,•ices, 244 dua l-purpose segments, 59 Dynamic Host Configuration Protocol (DHCP), 24,
24, 24n21 configuration information in, 305, 305-306 servers, 305-306
dynamic IP address, 24 dynamic routing protocols, 309, 309
E echo (ping), 311 ECN. See Explicit Congestion Notification
454 Index
economically feasible, 392 edge ro uter, 89 EIGRP. See enhanced interior gateway routing
protocol electrical contact, 179-180 electromagnetic interference (EMI), 189 electromagnetic wave, 185 electronic signatures, 12fr 127, 127 e-mail
corpora te protection of, 374 cryptographic pro tections for, 373, 373-375 delivery process of, 370, 370-371 file format standards fo r, 372-373 gr aphics in, 372 link encryption, 373-374 mail servers and, 371n6 receiving, 371-372 vulnerabilities of, 114-115 on WANS, 370-373
EMJ. See electromagnetic interference em ployee attackers, 123 Encapsulating Security Payload (ESP), 312, 312-313,
312n14 header and trailer, 314 TCP /fP and protections of, 3 14-316 in transport mode, 315 in tunnel mode, 315-316, 315-316
encoding alternatives to, 68-69 of application messages, 64 binary, 64, 69 text as ASCil, 65, 65
encryption, 228n6 encryption fo r confidentiality, 125, 125, 127, 127n27 end office switches, 332 end-to-end encryption, 374 energy restrictions, 242 enhanced interio r gateway routing protocol
(EIGRP), 310 enterprise mode, 227 error advisement, JCMP, 310 error rates, 7~79, 79n3 ESP. See Encapsulating Security Payload espionage, 125 ESS. See extended service set Ethernet, 27
4-pair UTP used in, 152, 152-153, 154 cables, 152-153, 152n3 carrier, 345-346 connectors, 153 cord d is tances w ith, 154
EUl-48 used by, 147, 166 hierarchical topology in, 165-166 jacks, 153 LANs, 183-184 origins, 148 parallel transmission in, 152, 153 physical links in, 160 security, 170-171 signaling s tandards, 147, 154 SNMP used with, 169, 30Cr307 standards for, 148, 162, 182
Ethernet frame, 28, 16fr167 Ethernet Il fra me, 63, 63-64, 168 Ethernet switches
802.3 MAC Layer Standard, 164 decisions fo r, 164 destination address and, 165 fa ilures and backup links, 169 hierarchical topology of, 165, 165-166 multi-switch, 164 nehvor k, 28, 147 reliability, 169-170 routers com pared to, 263-265, 264 RSTP and, 170 single net wor k, 28 workgroups and, 149
EtherType Field, 64 EUJ-48. See Extended Unique ldentifier-4S EUl-64. See 64-bit modified extended unique
identifier evil t win access points, 233-236, 235 evil t win attack, 224, 233, 235-236 Excel, 67 EXEC mode, 323 Explicit Congestion Notifica tion (ECN), 273 extended service set (ESS), 199 Extended Unique Identifier-48 (EUJ-48), 32, 172,
226n5, 297 802.11 standards using, 200n8 Ethernet use of, 147, 166 EUl-64 and, 297-298 field size o f, 63 MAC changed to, 31
extension headers, 279-281, 281 exterior dynamic routing protocol, 310
F facial recognition, 133 fail -o,•er, 416 false alarms, 141, 413 false positives, 141
fiber cord, 155 fiber to the home (FTl'H), 334 fields, 277 field size, 63 fifth-generation (5G) standards, 339-340 file format standards, 366, 372-373 fi le storage services, 364 financial settlement agreements, 8 fingerprint recognition, 133 finish, 58 FireEye int n ,sion detection, 388-389 firewall, 136, 224
ACL used by, 138, 138 centrali2ed management system with, 411 filtering mechanisms, 137 IDSs compared to, 418 IDSs supplementing, 141 log file, 136, 395-396 NAT and, 300 next-generation, 139-140, 140 packets and, 138, 142 routers w ith, 402--403 SP!, 137, 137-139
firewall application aware, 139 firewall policy server, 411 flag fields, 58, 58, 283 flow label field, 280 forwa rding function, 97 fou r-site analysis, 84-85 fou r-step closing, of HTTP, 54 fou rth-generation (4G) s tandards, 339-340 fra me check sequence field, 64 fra me fo rwarding, 162, 164-165 frames, 27, 32
802.11 WLAN transmission of, 197-198, 197n5, 198 802.2 Ethernet, 63-64 data link path and, 27-28 Ethernet, 28, 166-167 Ethernetll,63,63-64, 168 packets in, 48 in single net work, 29-30 syntax for, 64
frequencies, 184-185, 189 frequency spectn,m, 189, 190 FTTH. See fiber to the home full -duplex transmission, 155
G gateway, 310
IPsec,314 m edia,377
Gbps. See Gigabits per second generic top-level dom ains (gTLDs), 303 GET commands, 95-96, 169 GHz. See gigahertz Gigabits per second (Gb ps), 75 gigahertz (GHz), 185 g lobal unicast addresses, 296n2 GPOs. See G roup Policy O bjects Green Power devices, 251n9 Group Policy Objects (GPOs), 319 gTLDs. See generic top-level domains guidelines, 410
H hacking, 118-119, 118n25, 119
application security and, 356, 356--358 cybercr iminals and, 122 d rive-by, 224-225, 224,233
hacktivists, 125 handoff, 337 handshaking, 318 hard drive, encrypting, 117 hashing methods, 316n17, 317 head end, 335 Header Checksum Field, 57 header lengt h fie ld, 273n5 headers, 54-55, 55, 62n16 hertz (fu), 185
Index 4 55
hexadecimal (hex) notation, 166, 167, 277-278 HID. See hu man in ter face device hierarchal topology, 165-166 hierarchica l addressing, 258-259 hierarchical 1Pv6 address, 260 hierarchy, 165 high absorptive attenuat ion, 210-211 hop limit field, 280, 280n8 host names, 25 host parts, 259, 294, 294-295 hosts
clients, 10-11, 11, 12 descr iption of, 4 destination, 13, 14, 16--17, 17 internal, 139 on Internet, 5 rack server, 12 server, 10-11, 11-12 server and client, 10-11, 11 source, 13, 14, 16
host-to-host VPNs, 128,313 HTML. See Hypertext Markup Language HTTP. See Hypertext Transfer Protocol
456 Index
human b reak-ins, 11&-119 human interface device (HID), 246 Hyb rid TCP /IP-OSI Architectu re, 47, 48 Hypertext Markup Langu age (HTML), 366 Hypertext Trans fer P rotocol (HTTP), 13, 41-42, 367
fou r-step closing of, 54 HTML st andards and, 366, 366 message ordering in, 49-50 message requ ests in, 368, 368 message response in, 368-369, 369 requ est-response cycle in, 50, 52-53
Hz. See hertz
I JaaS. See Infrastruc ture as a Sen•ice JANA. See Internet Assigned Num bers Au thority ICMP. See Internet Control Message Protocol ICMP e rro r advisem ent, 310 !CV. See integrity check value JDC. See insula t ion d is placement connection identity m anagement, 400-402 identity the ft, 118 JDSs. See intrus ion detection systems !EC. See International Electrotechnical Commission IEEE 802. 11 Working G roup, 182 IETF. See Internet Engineering Task Force IKE. See Int ernet Key Exchange IMAP. See Internet Message Access Protocol !MG tag, 367n4 IMP. See interface m essage p rocessor implementation decisions, 407 implementation guidance, 409, 409 incidents, 412
major, 413, 414-416, 415 minor, 413 of security, 413-414
individual throughput, 76, 77, 205 Infrastruct u re as a Service (IaaS), 362, 363 initial authentication, 227 insula tion displacement connection (JDC), 180 integers, 6H7, 6H7 integra t ed log file, 418-420, 419-420 integrity check value (!CV), 314 interface
64-bit, 29&--297 application program , 99, 100 command line, 322, 322-323 de,•ices for human, 246 as router ports, 270 for routers, 257
interface ID, 296
interface message p rocessor (IMP), 38 internal host, 139 internal router, 261 International Elect ro technica l Commission (IEC),
154n6 International Organization for Standardization
(ISO), 42-43, 147, 154n6 International Telecommunication Union (ITU), 339 International Telecommunication Union-
Telecommun ications Standards Sector (ITU-T), 42-43
Internet changes in, 6, 6-7 clou d on, 9-10 core routers for, 32, 32 cyberattacks on, 1-4 host, 5 managem ent of, 7-9 mobile phones usage of, 7 nehvor ks on, 257-258, 258 outs ide of, 10 packets in, 29-30, 30n23 residential access to, 333 security, 9 single neh vork compared to, 330, 330 standar ds de,•eloped for, 37-40 WANs for b usiness and, 341
Internet Assigned Num bers Authority (TANA), 8, 275,30 1
Internet Control Message Protocol (ICl\l!P), 274, 3 10-311, 311
Internet Engineering Task Force (!El F), 8, 42-43, 256, 275-276
data link layer s tandards from , 46n11 Internet Key Exchange (IKE), 318 Internet layer (Layer 3), 48-49, 310-311, 311 Internet Message Access P rotocol (IMAP), 371-372 Internet o f Things (IoT), 7
devices connect ed to, 2-3, 7 energy restrict ions for, 242 P2P protocols for, 241-242, 242 security in, 3, 251-252
Internet process, 15, 22 Internet Prot ocol (IP), 22n20. See also voice over IP
as connect ionless protocol, 57 final packet, 15 nehvorks, 262 packets, 15-16, 19 packetsyntax,56,5&-57 private address ranges, 301 Video over, 375
Interne t Pro tocol (JP) address, 17-18, 62n16, 147, 37l n6
destination, 19, 56 DNS and lookup of, 302, 305 dynamic, 24 expanding, 300-301 fie lds, 56 sou rce, 19, 56 static, 24 transparency and, 301
Internet Pro tocol security (!Psec), 312 communication s tages in, 319 encr yption and options in, 317 SAs in, 318 SSL/TLS com pared to, 320 TCP /IP and, 311-313 transparency o f, 319nl8 VPNs with, 314
Internet Sen•ice Providers (ISPs), 4, 5, 258 financial settlement agreements behveen, 8 leased lines reaching, 342
Internet standards, development of, 37-40 intrusio n detection systems (JDSs), 141, 141, 417-420,
418-419 in,•erse square law, 186-187 IoT. See Internet of Things IP. See Internet Protocol !Psec. See Internet Protocol security !Psec gateway, 314 !Pv4. See IP Version 4 !Pv6. See JP Version 6 IP Version 4 (IP,•4)
mask, 261, 261 packet syntax,56,273 router addresses and, 268
IP Version 4 (IP,•4) address, 18,257 DON and, 19 decis ion cache and, 271 fie lds, 273-275 Header Checksum Field in, 57 header options of, 275 hierarchical addressing in, 258-259 host part in, 259 masking of, 263 networks, 259 packet syntax, 56, 273 routers and, 268 subnet par t in, 259 subnet planning, 294-295, 295-296 var iable part lengths in, 260
IP Version 6 (!Pv6), 19, 275-276
Index 457
Canonical Text Representation, 277, 277 ESP in tunnel mode, 315-316, 315-316 extension headers, 281 growth of, 276 header values, 281 hexadecimal notation in, 277-278 main header, 279-280 packet syntax, 279 s ubnet ting, 296-298
IP Versio n 6 (1Pv6) address 128-bit addresses, 276-277 glo ba l unicast addresses, 296n2 hierarchica 1, 260 routing table for, 272
iris recognition, 133, 133n29 ISO. See International O rganizatio n for
Standardization ISPs. See Internet Service P ro,•iders ITU. See International Telecommunication Union ITU-T. See International Telecommunication Union-
Telecommunications Standards Sector
J jacket, 152, 179-180, 335 Java, 220 jitter, 79, 79, 79n4, 220
K Kahn, Bob, 30n23 kbps. See kilo bits per second Key ET-AP, 234 keys, 126 keystroke logger, 118 kill chain analysis, 389, 389-390 kilobits per second (kbps), 75
L label number, 347 label switched path, 347 label switching router, 347 Lamar, Hedy, 196n4 latency, 79-80, 220,35 1
round-trip, 92 SLA specifying, 81 traceroutes and, 93--94
Layer 2. See data link layer Layer 3. See Internet layer Layer 4. See transport layer Layer 5. See application layer layered standards architectures, 45, 256
458 Index
layer ing, 43--45 Layer standar ds, 147 leading zeros, 278 leased lines, 86-87, 87,34 1,341
ISPs and, 342 speeds,344 WANS w ith private, 342-343, 343
least permissions, 399, 399 licenses service bands, 192-193, 793 line feed, 368 link aggregation, 759, 159-160 link encryption, 373-374 live exercises, 416 load balancing, 348 loca l area networks (LANs), 146, 328, 328-330. See
also 802.11 wireless LAN Ethernet, 183-184 layer I and 2 standards fo r, 147 virtual, 170- 171, 170nl3, 171
loca l loop, 332 Lockheed Martin, 389-390 log files
firewa ll, 136, 395-396 integrated, 418--420, 419-420 q uery of, 420 reading, 408
long dis tance lines, 35 1 longest match rule, 269
M MAC. See Media Access Control main headers, 281 major incidents, 413,414,415
exercises for, 416 rehearsals fo r, 415
mal ware, ll3, 113, 139 AV progr ams a nd, 142 botnet, 2 payloads against, 117- 118 spyware as, 118 Target breach and, 107-110 types of, 115-116, 116
manageable switch, 169 managed devices, 94, 97,307 management
active, 405 centrali2ed, 238-239 information, 169 network, 90, 91
management informa tion base (MTB), 95, 306--308, 308
man-in-the-middle attack, 172 MANs. See metropalita n area net works manual device configuration, 97, 98 masks
8-bit boundar ies and, 272, 272 !Pv4, 261, 261 !Pv4 add r ess, 263 ne hvork, 263 prefix no tation for, 262-263 subnet, 261-263, 26ln1, 262
master-slave control, 244-246, 245 Mbps. See Megabits per second Media Access Control (MAC)
802.11 standar ds and, 201 802.3 Layer Standard for, 162, 164 access points and, I 99-200 addresses, 31, 200n8 CSMA/CA+ ACK, 201 EUl-48 a nd, 31 send/ clear request to, 202-203
media gateway, 377 Megabits per second (Mbps), 75 mesh access routers, 250n8 message decr yption, 384 message in tegrity, 127 message order, 49-54 message requests, 368, 368 message response, 368-369,369 message syntax, 54-55 Metcalfe, Bob, 145-146 metropolitan area nehvor ks (MANs), 328, 328-330,
330 MJB. See management information base Microsoft Visio
canvas d rawing in, 703 connections added in, 104 d rawing started in, 703 sam p le drawing by, 105 using, 102-104
milliseconds (ms), 79 milliwatts (m W), 239 MJMO. See multiple input/ multiple output mino r incidents, 413 Mir ai bots, 2 mobile p ho nes, 337. See also cellular phones mobile telephone switching office (MTSO), 337 moda l dispersion, 157 modems
ADSL, 334 broadband, 33 cable, 34, 8 1, 336
cable sen•ice w ith, 334-336, 335 d ia l-up telephone, 355
modes, 157 momentary traffic peaks, 87-90, 88 Moore's Law, 379 MOS score, 220 MPl.S. See multiprotocol label switching ms. See milliseconds MTSO. See m obile telephone switching office Mueller, Robert, 112 multimode fiber, 157
propagation limitations of, 156-157 single-m ode and, 161 speed standards of, 159
multipath interference, 188, 188 multiple access points, 198-199, 199 multiple input / multiple ou tput (MIMO), 205-207,
206 multiplex, 77, 77-78 multi p rotocol label switching (MPLS), 347, 347-34$ multiuser MIMO (MU-MIMO), 207,207 mW. See milliwatts
N N = 2b-2 Rule, 294 nanometers (nm), 156 NAT. See Net work Address Translat ion national governments, 124-125 National Institute of Standards and Technology, 131 National Security Agency (NSA), 125 near field communication (NFC), 248, 248-249 Netflix, 359-361, 360, 361n2, 364 Nehvork Address Translation (NAT), 275, 299,
299-300 firewall and, 300 security and, 300
network core, 331 networked applications, 12-13, 354, 354-355 network managem ent
at NOCs, 91 programs, 90
network operation centers (NOCs), 90, 91 network part, 259 network protocol acceleration (tuning), 351 networks. See also loca l area networks; sing le
network; virtual private network; wide area networks
anonymous t rans mission, 383 application layer on, 354-358 border routers in, 260 cloud computing and, 365-366
commercial, 81 content delivery, 359,360 Ethernet switches and, 28,147 on Internet, 257-258, 258 IP, 262 1Pv4 address, 259 masks, 263 metropolitan area, 328 open connect, 361 organizational, 5 personal area, 243, 243 paint-to-point, 26, 27 segregation, 388, 403 self-organizing, 250 speed measures of, 75 subnets in, 263n2, 294 switched, 35 w indow, 216, 216-217
Index 459
wireless, 198-199, 799, 250-251, 251-252 Xirrus Wi-Fi Inspector on, 216, 216-217
networks segm entation, 402-404 networks s tack, 14 network s tandards (protocol), 41, 41
agencies in, 42-43 ar chitect ure, 43-44, 44 impar tance of, 42
networks visibility, 90-93 nehvorks window, 216, 216-217 nehvork visualization p rogram, 95 next-generation firewall (NGFW), 139-140, 140 next header field, 281 next-hop router, 270 NFC. See near field communication NGFW. See next-generation firewall nm. See nanometers NOCs. See nehvork opera tion centers nonmalicious insiders, 123 Northbound AP!s, 100 NSA. See National Secur ity Agency
0 object, 307 OC. See optica l carriers octets, 63 ODBC. See Open Database Connect i,•ity Protocol OFDM. See orthogonal frequency d ivision
multiplexing OM. See optical multim ode omnidirectional ant ennas, 185, 186 one-pair ,•oice-grade (1PVG) UTP, 333 one-to-one connection, 244-246, 245
460 Index
open connect appliances, 360, 361n2 open connect network, 361 Op en Database Connectivity Protocol (ODBC), 13, 13 open shortest path firs t (OSPF), 309 Op en System Interconnection (OSI), 45-46,
147 Ethernet s tandards and, 148, 162, 182 hybrid, 47, 48
operating systems, 61n15 optical carriers (OC), 342 optical fibe r, 155
cable, 155 FTTH and, 334 mu ltimode, 157, 161 parallel transmission, 158nl0 quality standar ds for, 158 switches and, 162-163 tr ansmission dis tances of, 157-158 wavelengths in, 156, 185
optical mu ltimode (OM), 157 optimi2ation, of WANs, 349, 349-351 organizational network, 5 organizational system security, 404, 404-405 orthogonal frequency di,•ision multiplexing
(OFDM), 197, 197 OSI. See Open System Interconnection OSPF. See open shortest path first oversight, 407-408, 408 oxygen absorption attenuation, 211n12
p P2P. See peer-to-peer packets
8-02.11 WLAN transmission of, 197-198, 197n5, 198 firewa lls and, 138, 142 in frames, 48 JDSs and, 14 1 Internet with, 29-30, 30n23 JP, 15-16, 19 IP final, 15 IP syntax, 56 Jp,,4 syntax, 56, 273 !Pv6 syntax, 279 provable attack, 136 routers processing, 22-23, 26'.>-265 routing decision sending out, 370-371 selection details, 2S9-290 single network addresses, 29, 31, 31 statehtl inspection of, 137-138, 137-139 transport, 37S, 378 VPN and secu re flow of, 31'.>-314
Wireshark program capture of, 287, 287 Wireshark program selection of, 2S9-290
paddle antennas, 338 PAD fie lds, 168 pairwise session key, 228-229, 229 PANs. See personal area networks parallel transmission, 153, 153n5
in Ethernet, 152, 153 optical fiber, 158nl0
PARC, 145 parity bit, 65nl9 passphrase, 230 passwords
authentication with, 130-131 reusable, 129-131
patch, 114 payload length field, 280 payloads, 117, 117-11S PCs. See personal computers peers, 380 peer-to-peer (P2P)
IoT protocols for, 241-242, 242 Wi-Fi Direct and, 249
peer-to-peer (P2P) applications, 379-381, 380 evolution, 380 Skype as, 381-382 Tor as, 38'.>-384
percentage-of-time elements, S1 per missions, 398 per sonal ar ea networks (PANs), 243, 243 per sonal computers (PCs), 7 per sonal identification numbers (PINs), 109, 135 personal mode, 228 phishing, 108,113, 114-115 physical links, 149
in Ethernet, 160 length restrictions in, 162, 163 purchasing, 160 switches and distances with, 163
physical standard, 26 piconet, 245 ping, 92, 311 PINs. See personal identification numbers Pirate Bay, 3S4nl0 plan-protect-respond cycle, 391, 391-392, 412-413 POE. See power over Ethernet point-of-sale (POS) systems, 108, 108-110, 388-389 points, corporate access, 33 point-to-point links, S6-87, 183 point-to-point nehvor k, 26, 27 Point-to-Point Protocol (PPP), 27, 27
policies, 405 centralized management based on,
410--411 security, 406 of security management, 406, 406 server, 411
policy-based configura tion, 97-98 policy database, 411 POP. See Post Office Protocol port numbers, 62n16
client, 61, 62 destination, 61 operating systems using, 6 ln15 serve~60-61, 138--140 sockets and, 62
ports, for switches, 257 port spoofing, 139 POS. See point-of-sale systems Postel, Jon, 311 Post Office P rotocol (POP), 371-372 power over Ethernet (POE), 15Sn8 power ratios, 239, 239-241 PPP. See Point-to-Point Protocol prefix notation, 262-263 Pre-Shared Key (PSK) mode, 228-229, 228n6, 229
230 priority Je,•els, 89 private IP address ranges, 301 private key, 133-134, 133n31 privileged EXEC mode, 323 procedures, 405 processes, 405 profiles, 247 profile waves, 208-209 prompt, 323 propagation, 115
d istance, 156-157 frequency-dependent, 189 of multimode fiber, 156-157 in w ired transmission, 184-189, 187
Protocol Field, 274 protocols, types and reliability of, 70 provable attack packet, 136 PSK. See P re-Shared Key mode PSTN. See Public Switched Telephone Networ k PSTN Core, 332 public-facing sen •ers, 402, 403 public key, 133-134, 133n31 Public Switched Telephone Nehvor k (PSTN), 332,
332,377 purchasing, physical links, 160
Q QoS. See quality-of-service QoS guarantees, 89 quality
optical fibe r standards for, 158 tests, 220, 220
quality-of-service (QoS), 344 guarantees, 89 metrics for, 74-75, 74-79
query, of integrated Jog file, 420
R rack servers, 11, 12 radar window, 214-215, 215 radiative attenuation, 154, 154 radio frequency ID (RFID), 248, 248 radios, 184-185 radio signals, 184 radio transmission
bandwidth and, 191 e lectromagnetic waves in, 185 frequency and, 185 p0int-to-point single nehvor ks, 26-27 regu lation of, 192
radio waves, 2lln12 ransomware, 117
Index 4 61
Rapid Spanning Tree Protocol (RSTP), 170 rated speed, 76, 76, 205 rate-limited, 90 RBAC. See role-based access control reading log files, 408 real-time fail-o,•er, 416-417, 417 Real nme Protocol (RTP), 379 recommendation system, 359 record, 418 redundancy, 85-86, 86 reflection, 357 regenerated signal, 162 regu lation, 329nl regu lation, of radio transmission, 192 Reif, Harry, 175n 1 reliability
of CSMA/CA+ACK, 202 Ethernet switches, 169-170 protocol types and, 70 through redundancy, 85-86 of TCP, 51, 53 of w ireless propagation, 184
Request for Comments (RFC), 3 12 request-resp0nse cycle, 50, 52-53
462 Index
request-to-send (RTS), 203 reserved capacity, 89 reset (RST) flag bit set, 283-284 residential access, 333 residential access routers, 32-33, 33 residential Internet access, 333 resources
access control of, 397-398 authentication for use of, 398, 398
response, 412, 412-413 response headers, 369 response message, 134 reusable password, 129-131, 130 RFC. See Request for Comments RFTD. See radio frequency ID rights of way, 329 RIP. See routing information protocol risk analysis, 392-393, 393 RJ-45 connectors, 152-153, 152-153, 176
crimping tool used on, 179, 179 electrical contact in, 179-180 hold ing connector of, 178 pin 1 location of, 178 strain relief for, 180 T56SA and T56SB, 178 testing, 180 wires inserted into, 179
roaming, 199, 33Sn4 rogue access points, 232- 233, 233 role-based access control (RBAC), 401, 401-402 root cause analysis, 419 root DNS servers, 303 root privileges, 356 round-trip latency, 92 routers, 20, 35, 198n6
ACL reconfigu red of, 98 border, 260, 260 data links behveen, 21 decision caching of, 271 default, 270 edge,89 Ethernet switches compared to, 263-265,
264 with firewall, 402-403 interface as port of, 270 interfaces for, 257 internal, 261 Internet core, 32, 32 IP,•4 addresses and, 268 label switching, 347 mesh access, 250n8
next-hop, 270 packets processed by, 22-23, 263-265 residential access, 32-33, 33 routing decis ions of, 267 routing table used by, 266-269 traceroutes of, 93-94 Zigbee,250
routing, 20, 20, 32-33 processes, 265 in TCP /IP, 309n11 of Tor, 383-384
routing decisions, 20, 20 best-match row in, 269-270 of routers, 267 row matches in, 266-269 sending packet back out in, 370-371
routing information protocol (RIP), 309nl3 routing prefix, 296-297 routing table, 265-269, 266
fo r IPv6 addresses, 272 row matches, 266-269 RST. See reset flag bit set RSTP. See Rapid Spanning Tree Protocol RTP. See Real Time P rotocol RTS. See request-to-send RTS/CTS, 201n9, 202-203
s SaaS. See Sofhvare as a Service SAs. See security associations Schneier, Ben, 390 SDH. See Synchronous Digital Hierarchy SON. See Sofhvare-Defined Nehvorking SON application programs, 99 SON cont roller, 99 searchable fields, 372 secondary fields, 168 second-level domains, 304 Secu re Sockets Layer (SSL), 128 security. See also 802.1 Ii WLAN secur ity; Internet
Protocol secur ity 802.lli PSK mode and, 228-230, 230 application architectures, 356, 356-358 of business partners, 388 cloud, 365, 365 com prehensi,•e, 394 cryptographic, 227 Ethernet, 170-171 hacking and application, 356, 356-358 fDSs for, 417~0 inci dents of, 412-414
Internet, 9 of loT, 3, 251-252 IPsec for, 311-313 kill chain analysis in, 389-390 NATand,300 p lan-protect-respond cycle in, 391-392 policies, 406 process of, 390 SNMP,307 in w ireless nehvorks, 252
security associations (SAs), 3 17 as asymmetric, 318 creating, 318-319 in IPsec, 318 options in, 316, 319
Security Connection 2, 234 security management
implementation in, 407 policies of, 406, 406
security policies, 406 segment leading zeros, 278 self-organizing network, 250 send/clear request, 202-203 separation of duties, 405 sequence number field, 282 sequence numbers, 52, 52n12, 59 server hosts, 10-11, 11-12 server program, 13 servers, 371n6
802. l X authentication, 231 appliance, 11 authentication, 398, 398, 401 authoritative DNS, 302 client hosts and, 10-11, 11 command and control, 120 DHCP, 305-306 d irectory, 400-401, 400n9, 401 firewall policy, 411 hosts, 10-11, 11-12 locations, 355 outsourcing, 359 port numbers, 60-61, 138-140 public-facing, 402, 403 rack, II, 12 root DNS, 303 Skype login, 382 VMs and,361 Xirrus Wi-Fi Inspector and, 218
service band, 189, 190 2.4 GHz, 190 2.4 GHz unlicensed, 194, 194-195
Index 463
5 GHz unlicensed, 194,195, 203 bandwidth, 203-204 licenses and unlicensed, 192-193, 193
service level agreements (SLAs), 80, 80-81, 348 service set ID (SSID), 198--199, 226n5 Session Initiation Protocol (SIP), 378, 378 session key, 229 Shannon, C laude, 191, 191n2 SIG. See Bluetooth Special Inte rest Group signal analysis software, 237 signal bandwidth, 190-191, 192 signal histo ry, 217-218, 218 signaling
binary, 150, 150-151 digital, 150, 151, 151n2 Ethernet standards of, 147, 154 in VoIP, 377-378, 378
signal strength, 214-215 signal-to-noise ratio, 191n2 Simple Mail Transfer Protocol (SMTP), 371 Simple Network Management Protocol (SNMP), 94,
94, 306 access points managed by, 238, 238-239 cent ralized management and, 238-239 Ethernet and TCP /IP de,•ices using, 169, 306-307 management information and, 169 MIB and, 95, 306-308, 308 network visualization program and, 95 set security, 307 single Point of takeo,•e r in, 397, 397
single-field zeros, 278 single-mode devices, 244 single-mode fiber, 161, 161 single nehvor k, 26-27, 26n22
addresses, 31, 31 Ethernet switched, 28 fra mes in, 29-30 Internet com pared to, 330, 330 packets in, 29, 31, 31 WANS and, 330
single Points of takeover, 397, 397 SIP. See Session Initiation Protocol site survey, 237-238 site-to-site VPNs, 314 Skype, 381
login server fo r, 382 operation of, 382 P2P VoIP operation of, 381 super node fo r, 382 traditiona l VoIP compared to, 382
SLAs . See service level agreements
464 Index
smart phones. See cellular phones S/MIME p rotocol, 374 SMTP. See Simple Mail Trans fer P rotocol SNAP. See Subnet Access Protocol sniffer progr am, 300 SNMP. See Simple Network Management
P rotocol SNMP agents, 95 SNMP Get commands, 95 SNMP manager, 94 SNMP schemas, 95 SNMP Set commands, 95, 307 SNMP traps, 95 social engineering, 114-115 socket, 61-62, 62 Software as a Service (SaaS), 362, 363 Software-Defined Networking (SON), 96
applications, 100, 100 configuration through, 99 operations of, 99-100
software vulnerability, 114 solid-wire UTP, 175- 176, 176 SONET. See Synchronous Optical Network source host, 13, 14, 16 source rP address, 19 Sour ce JP Address Field, 56 Southbound AP.ls, 100 spam, 117-118 spawn, 362 spear phishing, 108, 115, 121 speed s tandards, 159 speed test, 219, 219 SP!. See stateful packet inspection splitters, 334 spread spectrum transmission, 195-196, 196, 197 spyware, 118 SSID. See service set JO SSL See Secu re Sockets Layer SSL/TLS, 128,128n28,3 19
IP.sec compared to, 320 standards (protocols). See also nehvor k standards
(protocol) 802.11, 201, 203-204 802.llac, 204 802.lln, 204, 206, 208 802.11 Wi-Fi, 204 agencies, 45 application layer (layer 5), 47 data link layer, 46nll de,,eloping Internet, 37-40 e-mail file format, 372-373
fo r Ethernet, 148,162, 182 Ethernet signaling, 147, 154 fifth -generation (SG), 339-340 fi le format, 366, 372-373 fourth -generation ( 4G), 339-340 HTTP and HTML, 366, 366 implementation guidance, 409, 410 Layer I and Layer 2, 147 multimode fiber speed, 159 physical, 26 quality optical fiber, 158 speed, 159 SysLog,419 TCP /rP, 46, 256 text, 372 TIA/EIA-568, 178 Wi-Fi, 182, 182-183 of INWW, 366, 366
stateful packet inspection (SPJ), 137-138, 137-139 static rP addr esses, 24 strain relief, 180 stranded-wire UTP, 175-176, 176 strands, 155 stripping tool, 176, 176-177 Subnet Access P rotocol (SNAP), 46 subnet ID, 296 subnet part, 259 subnets, 259,260
host parts and, 294, 294-295 internal router connecting, 261 rPv4 p lanning, 294-295, 295-296 rPv6, 296-298 masks, 261-263, 261nl ,262 in networks, 263n2, 294 planning, 295-296
supervisory protocols, 23 supplicant, 128-129 switched Ethernet nehvork, 147 switched networks, 35 switches, 28. See also Ethernet switches
802.IAE protection and, 172 Class 5, 332 core, 14~149 distances with intermediate, 163 end office, 332 label, 347 manageable, 169 nehvor ks w ith, 28, 35, 147 optical fiber and, 162-163 physical links distances w ith, 163 parts for, 257
RSTP and, I 70 single network, 28 transmission lines and, 162-163 transmission links and, 149 workgroup and core, 148--149, 149
switching decision, 164 SYNCH. See synchronization profile synchronization (syn), 58 synchronization profile (SYNCH), 246 synchronized data centers, 416, 417 Synchronous D igital H ierarchy (SDH), 342 synchronous DSL, 344 Synchronous Optical Net work (SONET), 342 SysLog standards, 419
T Tl lines, 87n5 T3 lines, 87n5 T568A RJ-45 connectors, 178 T568B RJ-45 connectors, 178 tag fie lds, 168 tags, 367 Target breach, 107-110, 388--390, 4-02 Tbps. See Terabits per second TCP. See Transmission Control Protocol TCP / fP, 46, 293
carrier Ethernet and, 345 DHCP servers and, 305-306 DNS in, 302-305 dynamic routing protocols in, 309-310 ESP protections in, 314-316 fie lds in, 5S, 282-283 ICMP and, 310-311 internetworking, 255-256 IP protocol field in, 274 IPSEC and, 311-313 IP subnetting in, 294-295 IPv6 s ubnetting in, 296-29S NAT in, 299-301 routing in, 309n 11 SNMP used with, 169, 306-307 standards architecture, 256 32 bits per row and, 56 VPNs and, 313-314
TCP / fP-051, 47, 48 TCP reset segment, 283 TCP segment, 14, 15, 50,282 TOR. See time domain reflectometry technologies, in WANs, 329 telephone system, 332 Terabits per second (Tbps), 75
Index 465
test signals, 180 text s tandards, 372 threat enviro nment, 113 three-site analysis, S2-83, 83 throughput, 76, 76, 205, 205 TIA/EIA-568 standards, 178 time domain reflectometry (TOR), 180 time to live (]TL), 274 TLDs. See top-level domains TLS. See Trans port Layer Security top-le,•el domains (TLDs), 303-304 Tor
anonymous transmission network of, 383 message decryption of, 3S4 origins of, 3S4n9 routing of, 383-384
Tor exit node, 384 total cost of countermeasu res, 393-394 traceroute, 93, 93-94 traffic analysis, 82-83, 85
four-site, 84-85 three-site, 82-83 two-site, S2
traffic capacity, 77, 88--89 traffic class fie ld, 280 traffic engineering, 348 traffic shaping, 89, 89, 350, 350 trailers, 54-55, 55 training, 404-405 transcei vers, 184-1S6 transcoded formats, 359 Transmission Control Protocol (TCP), 14, 14nl 5, 15,
22n20 connection and reliability in, 51 e rror rates in, 79n3 long distance lines and, 351 message ordering in, 50-54 openings and closing in, 283-284, 284 reliability of, 53 segment syntax in, 57-59 sequence numbers in, 282 transport layer error correction in, 70n20 UDP sockets and, 62
transmission distances, 157-158 transmission lines, 756
failed, S5 switches and, 162-163
transmission links, 149 transmission speed, 74, 74nl , 76, 154, 192 transparent, 17 transport layer (Layer 4), 48, 50-54, 70n20, 379
466 Index
Transport Layer Security (TI.$), 128 transport mode, 313, 313-314, 315 transport packets, 378, 378 transport process, 22 Trojan horse, 113, 116, 116, 121, 142 true party, U9 trunk lines, 341 trunk links, 149 TTL. See time to Ii ve tunnel modes, 312-313, 313
of ESP, 315-316, 315-316 two-factor authentication, 135, 135n32 two-site analysis, 82, 82 two-way am p lifiers, 336
u UDP. See User Datagram Protocol unicode, 6Sn18, 372-373 unlicensed service bands, 192-193, 193 unreliable protocol, 57 unshielded tw isted pair (UTP)
l PVG,333 4--pair, 152, 152-153, 154 connectors on, 176 continuity and signal testing of, 180 cords, 154-155 correct o rder of pairs in, 177, 178 crimping cord of, 179 cutting cords of, 176, 178 pair color s, 177 signal quality testing of, 180 solid- and st randed-w ire, 175-176, 176 strain relief for, 180 stripping wires of, 176 unhvisting pairs of, 177
user authentication, 171 User Datagr am Protocol (UDP), 14n15, 23, 5~, 60
data field limits in, 284-285, 285 TCP and sockets of, 62 VoIP and, 379
usemame, 129 UTP. See unshiel ded hvisted pair
V verifie r, 128-129 Version Number Field, 56, 273, 280 Video over JP, 375 virtual LANS (VLANs), 170-171, 170n13, 171 virtual machines (VMs), 361, 361-362
virtua l pri,•ate nehvor k (VPN), 127-128, 313 evil h vins defeated by, 224, 235-236 host-to-host, 128,313 JP sec w ith, 314 secure packet flow in, 314 site-to-site, 314 TCP /JP and, 314
viruses, 115 VLANs. See virtual LANS VMs. See virtual machines voice over JP (VoIP), 79,375
CODEC transmission of, 376, 376 external components of, 377, 377 signaling in, 377-378, 378 Skype and, 381 Skype com pared to, 382 transport packets in, 378, 378 UDPand,379
voice s ignals, digitized, 376 VoIP. See voice o,•er IP VPN. See virtual private network vulnerability, 114-115 vulnerability testing, 408-409, 409nll
w WAN optimization devices, 349 WANs. See wide area nehvor ks wavelengths, 156, 156, 185, 185 weakest link, 395-396, 396 web mail, 371 webpages, downloading, 367 webservice, 12 WEP. See w ired equi\•a lent privacy wide area nehvor ks (WANs), 328, 328
carrier, 331, 331, 345-346 device optimization and, 349 economics of, 329 e-mail on, 370-373 Internet and business, 341 LANs compared to, 329 leased line private, 342-343, 343 MANs and, 330 optimization of, 349, 349-351 residential Internet access, 333 single neh vorks and, 330 technologies in, 329 telephone carriers and, 332 wired business, 340, 341
Wi-Fi Alliance, 183 Wi-Fi channel use, 193-194, 194, 19Sn3
Wi-Fi devices access points for, 224-225 profile waves for, 208-209
Wi-Fi Direct, 249,250 Wi-Fi standards
802.11, 204 802.11 WLAN and, 182, 182-183
wired equivalent privacy (WEP), 226 wired transmission, 184-189, 187 wireless access points, 155, 225n4 wireless networks
ad-hoc, 250 multiple access points of, 198-199, 199 security in, 252 Zigbee ad-hoc, 251, 251
wireless propagation absorpti ve attenuation, 161, 187-188 dead zones of, 188 EMI, 189 frequency-dependent problems in, 189 in,•erse square law attenuation, 186-187 multipath interference, 188, 188 reliability of, 184
Wireless Protected Access (WPA), 226 Wireshark program, 286
data collection by, 288-289, 288-289 options window of, 290, 290 packet captu re of, 287, 287 packet selection details in, 289-290
workgroup switches, 148-149, 149 world wide web (WWW)
HTTP and HTML standards in, 366, 366 web mail on, 371 webpage download on, 367
worms, 115 worst-case specifications, 81 WPA. See Wireless Protected Access WPA2,226 WWW. See world w ide web
X Xirrus Wi-Fi Inspector
access points and, 214,217 connection test of, 219 connection window of, 215-216 DNS sen•er and, 218 four windows of, 213-217, 214 networks window of, 216, 216-217 quality test of, 220,220 radar window of, 214-215, 215 ribbon menu of, 213, 218 signal history and, 217-218, 218 signal strength and, 214-215 speed test in, 219 tests in, 218-220
XSS. See cross-site scripting
z zero-day attacks, 114 Zigbee,250,250n8
ad-hoc w ireless network, 251, 251 dua l-band use in, 251 Green Power devices in, 2Sln9
Zigbee controller, 250 Zigbee end devices, 250 Zigbee routers, 250 2 -Wave, 251
Index 467
Th is page intentionally left blank
CREDITS
The credits are for the icons/images used.
Chapter 1 1-2 D Dima Gorohow/Shutterstock; 1-8 Kjetil Kolbjomsrud/Shutterstock; 1-l l a Anjana2312198S/ Digital Vision Vectors/Getty Images; 1-l Sa JakeOlimb/DigitalVision Vectors/Getty images
Chapter 2 2-4a Thorbjom66/Digita 1Vision Vectors/Getty images
Chapter 3 3 -10 MathisworksDigita lVision Vectors/Getty Images
Chapter 5 5-l Oa A Sk/Sutterstock; 5-18a Real Vector/ Shutterstock
Chapter 6 6-18a Vladwel/Shutterstock images
Chapter 6a 6a-1 to 6a-8 Courtesy of Xirrus Inc.
Chapter 7 7-1 Golden Sikorka/Shutterstock; 7-13 Soloma/ Shutterstock; 7-17 Unggoonk/Shutterstock; 7-23 Granger Wootz/Blend Images/Getty Images; 7-24 Albert Lozano/Shutterstock; 7-25 Andrey Popov /Shuitterstock
Chapter 8 8-3 Lineicons freebird/Shutterstock; 8-16 Adapted from: Statistics of !Pv6 Adoption by Google. Retrieved from: https:/ /www.google.com/ intl/en/ ipv6/ statistics.html
Chapter Sa 8a-2 a-1- 8a-4 Reprinted with permission from Wireshark Foundation
Appendix A-27 Kjetil Kolbjomsrud/Shutterstock; A-28 Magnetic Mcc/Shutterstock; A-29 Georgios Alexandris/Shutterstock
469
Th is page intentionally left blank
OTHER MIS TITLES OF INTEREST
Introductory M IS
Experiencing MIS, 8/ e Kroenke & Boyle ©2019
Using M IS, 10/ e Kroenke & Boyle ©2018
Management Information Systems, 15/e Lauden & Lauden ©2018
Essentials of MIS, 13/ e Lauden & Lauden ©2019
Processes, Systems, and Information: An Introduction to MIS, 3/ e McKinney & Kroenke ©2019
Information Systems Today, 8/ e Valacich & Schneider ©2018
Introduction to Information Systems, 3/ e Wallace ©2018
Database
Hands-on Database, 2/ e Conger ©2014
Modern Database Management, 13/ e Hoffer, Ramesh & Topi ©2019
Database Concepts, 8/ e Kroenke, Auer, Vandenburg, Yoder ©2018
Database Processing, 15/e Kroenke & Auer ©2019
Systems Analysis and Design
Modern Systems Ana lysis and Design, 8/ e Hoffer, George & Valacich ©2017
Systems Analysis and Design , 10/ e Kendall & Kendall ©2019
Decision Support Systems
Business Intelligence, Analytics, and Data Science, 4/ e Sharda, Delen & Turban ©2018
Business Intelligence and Analytics: Systems for Decision Support, 10/ e Sharda, Delen & Turban ©2014
Data Communications & Networking
Applied Networking Labs, 2/e Boyle ©2014
Digita l Business Networks Dooley ©2014
Business Data Networks and Security, 11/ e Panko & Panko ©2019
Electronic Commerce
E- commerce 2018: Business. Technology. Society, 14/ e Lauden & Traver ©2019
Enterprise Resource Planning
Enterprise Systems for Management, 2/e Motiwalla & Thompson ©2012
Project M anagement
Project Management: Process, Technology and Practice Vaidyanathan ©2013
@ Pearson
www.pea rson.com
ISBN-13: 978-0- 13-4817 12-5 ISBN-10: 0- 13-481712-5
