lorez landline

Thursday, November 6, 2014

Introduction to Networks Chapter 4 Notes

From Introduction to Networks by Cisco Press, 2014

Chapter 4

Wireless -

-range limitations

-easily mobile

-performance directly related to distance

-performance degraded by other wireless

wired

-won't degrade in performance based on distance

-hard to move

-static positioning

-as many devices with no degredation

Physical layer

types of media

-copper

-fiber optic

-wireless

Functional Areas

Physical components - electronic hardware, media, connectors, interfaces

encoding - convert a stream of data bits into predefined code

common network encoding schemes

-manchester - 0 is high to low transition

1 is low to high transition

-non-return to zero - two states meaning 0 and 1, and no neutral/rest position

signaling - method of representing bits

asynchronous - transmitted without clock signal. frames require start/stop indicator flags

synchronous - data signal sent with clock signal

ways to transmit

frequency modulation - carrier frequency varies

amplitude modulation - carrier amplitude varies

pulse code modulation - analog signal is converted to digital by sampling the signals amplitude and expressing as binary

data transfer speeds (in bits)

know your metric

throughput - measure of bits across media in a given time

-varies by...

-amount of traffic

-type of traffic

-latency - amount of time, including delays, to travel from one point to another

throughput can't be faster than the slowest link

Copper cabling

-inexpensive

-easy to install

-limited by distance

-limited by signal interference

data transmitted as electrical pulses

attenuation - the longer a signal travels, the weaker it gets

electromagnetic interference (EMI) and/or radio frequency interference (RFI)

-capable of distorting signal or corrupting signal

-produced by florescent lights and electrical motors

crosstalk - electrical or magnetic signal on one wire distorts the signal on another wire

-canceled by twisting pairs together

main types of copper media

-shielded twisted pair (STP)

-unshielded twisted pair (UTP)

-coaxial

UTP - most common

- 4 pairs of color coded wires

STP - not as common

-provides better noise protection

-more expensive

-difficult to work with

-if improperly grounded shield can act as antenna and pick up signals

-4 pairs of color coded wires

coax - 2 conductors sharing the same axis

-traditionally used in cable tv, early Ethernet

-still used for

-wireless

-cable internet

all copper susceptible to fire/electrical hazards

-toxic gas released when burned

-lightning strikes

-over voltage fries ports

prevent problems by....

-separate data and electrical

-connect cables correctly

-inspect for damage

-most be grounded correctly

UTP cabling

-cancelation - pair wires in a circuit, then magnetic fields are cancelled

-vary twists per wire enhances cancellation effect

standards defined by EIA/TIA

-cable types

-cable lengths

-connectors

-cable termination

-methods of testing

categorized by IEEE by transmission speed

- terminated with ISO 8877 RJ45 jack

termination options

-Ethernet straight through

-crossover

-rollover

Fiber Optic Cable

-higher data rate

-longer distance

Fiber is used

-Enterprise networks as the backbone

-fiber to the home (FTTH), access networks

-long haul networks

-submarine networks

fiber design/layout

-core - pure glass - transmission medium

-cladding - surrounds core, acts as a mirror

-jacket -surrounds and protects core and cladding

-susceptible to sharp bends

transmitted using...

-lasers

-LED

-laser light through the fiber could damage the human eye

single mode fiber - small core and lasers

-long distance

multimode fiber

-large core and LED

-cheaper

-up to 550 meters

terminated with optical fiber connector

-70 different connector types

Tuesday, November 4, 2014

Physical Security with Kiwi Syslog Server and Cisco Router/Switch syslogging

This is something I've been working on the last few weeks. We've run Kiwi Syslog Server forever, but have never done anything with it other than collect logs. I decided to try and implement some physical security measures using the reporting functionality of Kiwi Syslog Server.

Statements in bold are specific Cisco commands. I'm not going to give away the farm, but I can direct you towards what I use.

I'm not going to say this is the best way to do this. I just saying this is what I've done.

First assumption: you already have syslogging turned on and working.

Good. Got that done? It can be troublesome, but skipping past that.

Second, you ought to have some sort of scheme as to how you have everything plugged into your routers and switches. Let's hope you already have that.

That 65 hour project done? Good. Moving on.

The purpose of having the first two things done is so you can limit the length of the exclusion list on your Syslog Server. There are always some oddballs, but those can be accounted for without too many exclusions in the list.

I hope you also have hostnames that identify the device decently. That makes writing the catch statements easier. I call them catch statements, but really that is inaccurate. They are text based filters.

What I've learned about writing these filters is you need to be simplistic in filter design. You can have up to 100 different filters per action, so don't try and filter a complex statement in one filter. Use multiples. For example, I have one filter built that limits to switch traffic. Should I need to write anything else that is based solely on switches, I can then copy that one filter and know I'm now working only on switches.

For physical security on switches, any unused port is in a shutdown state. All other ports use MAC address sticky. Because they use MAC address sticky, I alert on any time there is a port-security violation. So within two minutes of plugging in a cable to the switch, I'm aware.

For routers, I'm aware of what ports should be used. I then monitor all router ports for up/down states. So, should you plug into a router, the syslog will see the port status change and alert. That can then be correlated with DVRs in the store to identify who plugged in, and with the port status down message, you get an indication of how long the person was plugged in.

The other option is to have the router ports shutdown as well. Depending on the day, I can lean either direction.

If you are going to leave the ports on, you need to be physically blocking them off with a tamper sticker. I'd almost say use a tamper sticker anyways.

As for all the other port up/down messages, I would run those though whatever network analytic software you use.

I'm sure there are better ways to do physical security. Locked rooms, locked doors, and cages come to mind. But operationally, that's not always possible. So you have to work with what you've got. And despite being critical to operation, people who build buildings generally don't want to dedicate an entire lockable room to things that aren't sold out the front door.

Monday, November 3, 2014

Active Directory and Content Adviser part 2

Found a solution to the problem I talked about the last post. The answer was use a proxy server. The proxy server is actually a file pointing to the local host with a bit of scripting involved that either returns the outside interface "proxy server unavailable". Which works out pretty well, because you get the effect of blocking the Internet. The proxy file is located on a read-only network share, and is copied to the computer whenever the user logs in. So even if the Internet goes down, you still have the old proxy file. And when the Internet comes up, you get the latest, greatest version.

That seems to work a lot better in theory than content adviser. And for some reason I want to spell adviser as "advisor". Anyways.

The hard part was need to rebuild the IE auto-install to get the proxy settings into the Internet Options control panel, and turning off Content Adviser. That required removing the computer from the domain, use "Turn Windows Features On and Off" to remove and re-add IE 11 with none of the IEAK options set. The rejoin the domain, and then the IEAK version to have the proxy file working and in place.

The great benefit of this approach is the proxy file works with Chrome as well.

But there are certain programs we use that are hard coded to use Internet Explorer, so there's no option of permanently going away from that.

Yay. Now all I have to do is get the logon script working properly, and everything will be great. Did I mention I'm deploying the computer Monday afternoon?

My Active Directory learning was from this book: Windows Server 2008 Active Directory Configuration.

Friday, October 31, 2014

Active Directory makes me something something....

Been working on Windows Server 2008 Active Directory automatic installation. All I want to do is use automatic installation of IE 11 with a specific Content Adviser set. But no. When I update Content Adviser using the IE Automated Installation Kit, it doesn't update Content Adviser. It doesn't even install.

Great.

Back to beating on the same problem.

Wednesday, October 29, 2014

Introduction to Networking Chapter 3 notes

Chapter 3 notes from Introduction to Networking

Network protocols and communication

Rather than adopt new standards and rebuilding the wheel, the network industry has developed a framework

-use of accepted models

All communication has 3 elements

-sender or source

-receiver or destination

-channel, the medium over which the message travels

transmission governed by protocols

-specific to type of communication

protocols necessary for effective communication

-specific to characteristics of communication method

-must be followed to be successfully delivered and understood

-identify sender and receiver

-common language and grammar

-speed and timing of delivery

-confirmation of acknowledgement requirements

Network protocols define

-message encoding

-msg formatting and encapsulation

-msg size

-msg timing

-msg delivery options

message encoding

-process of converting into another form for transmission

decoding - reverse of encoding; used to interpret

message formats

-depend on msg

-channel

if destination address and formatting wrong, then msg is not delivered

-computer format called a frame

frame acts like an envelope

message size

-large messages broken into smaller

message timing

access method- where you can send

flow control - how much and how fast

response timeout - reaction according to no answer

rules of communication

message delivery options

1 to 1 - unicast

1 to many - multicast

1 to all - broadcast

protocol suite - a group of interrelated protocols necessary to communicate

visualized as a stack

lower layers - transmit data

upper layers - focused on content

application protocol

transport protocol

internet protocol

network access protocol

standards organizations

-open standards encourage competition and innovation

-prevent monopoly

-standards organizations write rules in order to maintain an open internet

-vendor neutral

-non-profit includes ISCO, IAB, IETF, IEEE, ISO

ISOC - promotes open development

-evolution

-world wide use

IAB - responsible for overall management

-development of standards

-oversight of architecture and protocols

IETF - develop, update maintain internet and TCP/IP technologies

-produce RFC

IESO - technical management of the IETF

IRTF - focused on long term research

IEEE - wide range of standards

-wireless

-MAC for wired ethernet

ISO - created OSI model

EIA - electrical wiring, rack size

TIA - electrical wiring, cell tower, VOIP

ITU-T - video compression, IPTV, broad band communications, DSL

ICANN - coordinate IP Address allocation

-domain names used by DNS

-TCP/UDP protocol/port number

IANA - handles ICANNs job of

-IP address allocation

-domain name management

-protocol identifiers

TCP/IP and OSI model

-layered model used to help visualize interaction between layers

benefits of layered model

-assists in protocol design

-fosters competition

-prevents different layer changes from affecting other layers

-provides common language for network functions/capabilites

Two types of model

protocol model - closely matches structure of a particular protocol suite

-represents all functionality required to interface human network with data network

reference model - provides consistency within all types of networking protocols and services

-describes the what, not the how

OSI model TCP/IP Model

-----------------------------------------------------

Application

Presentation Application

Session

-----------------------------------------------------

Transport Transport

-----------------------------------------------------

Network Internet

-----------------------------------------------------

Data link

Physical Network access

OSI model designed by ISO

TCP/IP model deployed faster, so that it is what has been used

OSI model has specific functions at all layers

7. Application Layer - means for end to end connectivity between individuals in the human network using data networks

6. Presentation layer - provides a common representation of the data transferred between application layer services

5. Session Layer - Provides services to the presentation layer to organize its dialogs and to manage data exchange

4. Transport Layer - defines services to segment, transfer, and reassemble the data for individual communications between the end devices

3. Network Layer - provides services to exchange individual pieces of data over network between end devices

2. Data Link Layer - method for exchanging data frames between devices over common media

1. Physical Layer - Decribes mechanical, electrical, functional, and procedural means to activate, maintain, and deactivate physical connections for bit transmission to and from a network device

TCP/IP model (AKA Internet model)

defined by RFC

-contains technical and organizational documents

Application - represents data to the user, plus encoding and decoding control

Transport - supports communication between diverse devices across diverse networks

Internet - determines best path through the network

Network Access - controls hardware devices and media that make up the network

TCP/IP model is described in terms by the OSI model

-network access layer doesn't specify which protocols to use when transmitting

-only describes hand off

Data Encapsulation

segmentation - divide data into smaller, manageable, chunks

benefits - many conversations interleaved on the network

-increase reliability of the transmission

-more complex

multiplexing - interleaving the pieces as they traverse the media

data at any layer a PDU (protocol data unit)

data - application layer PDU

segment - transport layer PDU

packet - network layer PDU

frame - data link layer PDU

bits - physical layer PDU

data encapsulation - process of adding headers and trailers before transmission

deencapsulation - occurs at end devices

OSI model describes processes of encoding, formatting, segmenting, and encapsulating data for transmission over the network

network address -

-contains layer 3 information required to deliver IP packet from source to destination

L3 address has 2 parts

-network prefix

-host part

network prefix used by routers to forward packet to the proper network

host part used by routers to forward packets to the proper network

host part used by last router to deliver to final destination

a L3 IP packet contains 2 addresses: source, destination

Data link address

L2 physical address - used to deliver from one network interface to another network interface on the same network

on Ethernet, L2 physical address know as MAC or BIA (burned in address)

-48 bits

How does a host find MAC address?

uses ARP (address resolution protocol)

1) sending host send ARP request; broadcast to entire LAN

2) all devices examine the broadcast to see if it contains its own IP address

3) destination IP address device responds with ARP reply. ARP reply contains associated MAC address

Access remote network

1) sender determines destination is not in network

2) sends to default gateway

3) repeats 1 & 2 until reach destination

Monday, October 27, 2014

Information Density

I spent most of the last couple of days studying Cisco Introduction to Networks material. The chapter on IP addressing was incredibly dense. I ended up taking 25 pages of written notes during the entire thing.

I think what I learned from all of it is the future of the Internet is in the hands of two distinctly different people with distinctly different goals. One wants unlimited access to everything and no security. The other wants security.

There was a time when the Internet was time when the Internet was this wild, woolly place of hope and adventure. It was the great playground of intellectuals and only those in the know could manipulate the world. Which was great in theory, but not in practice. Eventually you ran into a human problem, not a technology problem.

I guess it narrows down to the simple fact that people want to get paid for their work. And the other group believes the Internet should be a free trading ground of ideas. I think both ideas are capable, but designing the Internet towards one or the other is short-sighted.

From a security standpoint, the argument is that with IPv6, you should use normal router and device hardening techniques and that should be fine. That idea was designed by someone who never had to protect a network, or anything for that matter. Security wise, you should always design for security in depth. There should be multiple, complimentary levels of security. Combining router hardening with NAT and PAT, VLANs, VPNs, network obfuscation and no DHCP pool and you've got the beginnings of security. I said beginnings, because each technology has its failings.

It's a big blue marble out there, and a lot of cooks with different plans make for an interesting mix.

Friday, October 24, 2014

No Blog is a Bad Blog

A Day late and a dollar short, here. I'm behind on pretty munch everything, which is why typing all this on a phone is kind of nicer. I can drag a blog out of myself where ever I happen to be.

I've taken a few pictures for something I'm thinking of about running cable. A Modest Mouse song about a long walk off a short pier keeps running through my head.

Then my wife was telling me something about a $100 bottle of wine, and I could think about was an Entreleadership podcast with Seth Godin. In that episode, he was discussing story telling and selling by pointing out that there isn't a wine out there where the cost of production alone justifies the high cost. If it only costs $5 to produce, then $100 wine doesn't make sense unless there is something else involved.

The other thing running through my head right now is one of Murphy's rules for combat. I found the document some time before the invasion in 2003, and it was pretty accurate. One of the statements was:

If you are low on eveyrthing except the enemy, you are in combat.

Yeah, seems pretty accurate.

lorez landline

Thursday, November 6, 2014

Introduction to Networks Chapter 4 Notes

Tuesday, November 4, 2014

Physical Security with Kiwi Syslog Server and Cisco Router/Switch syslogging

Monday, November 3, 2014

Active Directory and Content Adviser part 2

Friday, October 31, 2014

Active Directory makes me something something....

Wednesday, October 29, 2014

Introduction to Networking Chapter 3 notes

Monday, October 27, 2014

Information Density

Friday, October 24, 2014

No Blog is a Bad Blog

About Me

Blog Archive