lorez landline

Thursday, November 13, 2014

Back to Active Directory

Eating lunch, I once again have a brain running in circles. In the end, I got a little done during that lunch break, but not much. Now I’m back in the morning, and things are considerably calmer. Earlier this week, I thought I was behind. Now, I’m not as convinced. I ended up finishing the Java book and now I’m moving on to the Active Directory book. I have decided to start over and reread the Active Directory book because I essentially skimmed through to find the parts I was looking for the first time. Now, I’m going for a decent level of competency. So I have to read the entire book to make sure I get what I want out of it. I’m pretty sure I will. My Active Directory knowledge has moved in leaps and bounds, and a lot of things are making a lot more sense.

My problem with the startup script had nothing to do with permissions. I had the default software policy to basic, and the user didn’t have rights to access or run network resources. They basically couldn’t run any software I didn’t specifically allow. So that had to be dialed back to allow the company to operate. Now, my proxy file works great and updates like I want it to. This solution seems to work a lot better than using Content Adviser. It also allows the use of Google Chrome without a separate blocking file. That was nice of Google to allow all those things to interoperate well together. Good design policy for Google, there.

Changing subjects: after restarting the Active Directory book, I’ve completed 11.96% of my goal. Granted, I don’t have a date on any of these. I just have an overarching goal to get it done. I really only have a goal on getting my app built because there is a definite potential there. Though I may be wrong, the financial outlay is low enough to where I’m not concerned with a flop. I could make nothing on the thing, and still be happy I got it out there. The hard skills in creating the app will still be there, so if I come up with another idea the lead time won’t be near what it was before. Definite bonus to me. Plus, the web based skills could easily be usable. My brain is still running the thought of having MySQL and Tomcat running on my wife’s desktop, and doing… I don’t know with it. Something internal, probably. I don’t want the hassle of hosting. That’s just a pain. It’s easier to pay someone else.

Wednesday, November 12, 2014

Introduction to Network chapter 5: Ethernet

from Introduction to Networks by Cisco Press

Ethernet operates at datalink and physical layer

Ethernet most widely used LAN technology

defined by IEEE 802.2 and 802.3

speeds between 10 and 100,000 Mb/s

802.2 - LLC

802.3 - MAC and Physical layers

LLC sublayer

handles communication between upper and lower layers

between networking software and device hardware

implemented in software

considered driver software

MAC sublayer

lower sublayer of data link layer

2 responsiblities

data encapsulation

media access control

data encapsulation

frame assembly before trasnmission

frame dissassembly upon reception

adds header and trailer to network layer pdu

data encapsultion has 3 primary functions

frame delimiting

used to identify groups of bits that make up a frame

provides syncronization between transmitting and receiving

addressing

contains physical address

Error detection

contains a CRC value used to determine if the contents have changed

media access control

responsible for placement of frames on the media (wire)

removal of frames from the media

underlying logical topology is a multiaccess bus

all nodes in a network segment share the medium

uses CSMA

understanding CSMA

1) detect if there is a signal on the media

a) if busy, wait

2) if no signal, transmit

if there is a collision, all data is bad and must be resent

contention-based methods have less overhead than controlled access systems

do not scale well with heavy media use

CSMA/CD

widespread use of switched networks makes CSMA/CD largely unneeded

CSMA/CA in wireless still needed

Every device receives every frame

To prevent mass processing of frames not intended for that device, MAC was created.

MAC used to identify which device should process a frame

MAC address structure

1st 24 bits/ 6 hex digits - Organizationally Unique Identifer

Last 24 bits/ 6 hex digits - Vendor assigned

1) Source computer sends

2) each NIC in the network views the information

a) if the destination MAC matches, then the frame is processed further

b) if not, the frame is dropped

Ethernet Frame Attributes

created in 1973

2 primary versions

-802.3 Ethernet Standard

-DIX Ethernet, or Ethernet II Used in TCP/IP networks

framing style differences are minimal

both define minimum frame size as 64 bytes

max 1518

preamble/Start Frame Delimiter not included when describing frame size

any frame less that 64 bytes discarded as a "runt"

VLAN technology increased maximum frame size to 1522

frame too big or too small, frame is dropped

Ethernet Frame

-preamble and SFD - synchronization between sender and receiver

-Destination MAC -

-Source MAC

-Length Field - exact length of the frame's data field; can indicate which higher-layer protocol is used;

if size greater than 1536, frame is ethertype protocol indicated.

-if 1500 or less, then use of 802.3 frame format

-data field - contains encapsulated layer 3 pdu

-frame check sequence - used to detect errors

In Ethernet, different MAC addresses used for layer 2 unicast, broadcast, and multicast communications

Unicast -destination MAC of receiver

broacast - destination MAC of FFFF.FFFF.FFFF

Multicast - destination MAC is 01-00-5E

MAC and IP

2 primary addresses assigned to a host

Physical Address - MAC

Logical Address - IP

Source device sends based on IP address

DNS used to identify remote network

ARP protocol has 2 basic functions

-resolving IPv4 addresses to MAC addresses

-maintaining a table of mappings

Frame must have destination address to be placed on the media (wire)

refers to ARP table or ARP cache. Stored in RAM on all devices

Each entry binds a MAC with an IP

table maintained dynamically

-adds information by

-monitoring network

-ARP request - L2 broadcast to all devices on the LAN

-entries are time stamped; if the system doesn't get a message by the time stamp expires, the entry is removed

-also capable of static entries

ARP to remote network

-when host creates a packet for a destination, it compares destination IP address to its own IP address to determine if they are both on the same network.

-if not the same network, then ARP to router interface serving as the gateway

ARP issues

overhead on the media

-could initially flood the network

security - ARP spoofing or ARP poisoning

-broadcast adn security issues can be mitigated with modern switches

-switches segment LAN into independent collision domains

-switches send to only sender and receiver, reducing traffic flows

Switching

devices usually connected by a layer 2 switch

switch builds MAC table to make forwarding decisions

if destination MAC is not known, switch sends the frame out all port except receiving port

when destination responds, switch adds MAC to its MAC table

-capable of multiple MACs per port (switch connected to a switch)

switch MAC table sometimes referred to as CAM (content addressable memory)

-transparent to network protocols and user applications

-can operate in different modes that affect the end user

-duplex settings

-half duplex - one talks ata time

-full duplex - send and receive at the same time; CSMA/CD shut off in this case

-Cisco Catalyst supports 3 duplex settings

-half

-full

-auto

-proper cabling also required (or used to be)

-MDIX auto function

autmatic medium dependent interface crossover (auto-mdix)

switches use following forwarding methods

-store and forward

get the entire frame before forwarding

use CRC to determine if it needs to dump frame

analyzes destination for where to forward

required for QoS analysis

-cut-through

holds frame until it gets destination address, then forwards

no error checking

faster than store and forward, but can send broken frames

2 variations to cut-through

-fast-forwards

offers lowest level of latency

typical of cut-through switching

-fragment free

reads first 64 bytes before forwarding (most errors occur in first 64 bytes)

switches use buffering techniques

port-based memory buffering

frames are stored in queues that are linked to specific incoming and outgoing ports

delay occurs if there is nothing transmitting on other ports and buffer is full

shared memory buffer

frame stores in common buffer used for all ports

useful for asymmetric switching

Fixed or Modular switches

PoE allows power to be sent to devices

forwarding rate defines how many frames the switch can process in a second

stackable vs non-stackable

modular configurations - add more cards

Small form-factor pluggable (ports that can be purchased and easily changed out on each switch)

Layer 3 switch

capable of performing layer 3 routing as opposed to the standard switch that just handles layer 2

support Cisco Express Forwarding (CEF)

complex, but based on

Forwarding Information Base

conceptionally similiar to routing table

Adjacency table

maintains layer 2 next-hop addresses for all FIB entries

separation provides benefits

-adjacency table can be built separately from the FIB table

-MAC header rewrite used to forward a packet is not stored in cache entries

layer 3 switch variants

Switch virtual interface (SVI)

logical interface on a switch associated with a VLAN

Routed port

physical port on an L3 switch configured to act as a router port

allow L3 switch to act as a router

not associated with a particular vlan

L3 interface only and does not support L2 protocol

no switchport interface configuration command

Layer 3 EtherChannel

logical itnerface on a Cisco device associated with a bundle of routed ports

Tuesday, November 11, 2014

Chasing Down a Dog with a K-Bar

Saturday before Halloween

Go to a neighbors birthday party.
Come home.
Sit down to carve pumpkins on the back porch
Wife brings the dog out.
The baby sits on a blanket on the back porch.
Other two kids are hanging out, picking designs for the pumpkin.
Go inside to pee.
Wife yells for me. Trouble kind of yell.
Neighbor's dog is fighting my dog. Baby is down and crying.
I scream at the dogs and chase down the neighbors dog.
Neighbor dog runs away.
This is the second of my kids to be attacked by that dog.
I go inside and grab my K-Bar
Stuff the K-Bar in sheath into the back of my pants.
Time for Thunderdome.
Injury check.
Dog saved by being a giant fluff ball
Baby just got knocked over.
Fool me once, shame on you.
Fool me twice, shame on me.
You won't fool me again.
Time for the dog to die.
Hunting party.
Stalk the dog down the alley.
Runs around and tries to get back inside it's fence.
I yell at the dog again.
Dog runs off.
I yell at the owners through the front door to come get their dog.
Back to stalking the dog.
Owners catch the dog, bring in through back entrance.
Guess the dog gets to live.
Go home.
Carve pumpkins.
Break the plastic tools.
Get a power drill and finish the pumpkin.
Owners get rid of the dog that night.

True story.

Monday, November 10, 2014

Catching up

I'm still slightly behind schedule, but it will be okay. I'm about 94% complete with Java All-In-One. Technically, I'm supposed to be done with the book today so I can start programming Tuesday. I've got class on Monday, so my day is pretty much taken up.

I probably don't have to finish the entire book to learn what I need to learn. I could probably start coding now and fudge around until I figure out what I need. I think my knowledge is there, it's just a matter of slugging out the work. But I wanted to make sure and read the entire book just so I'm certain there's nothing left in there that I need.

I'm not sure it's going to take me until January 1st to finish my prototype, but it could. I do have the troublesome problem of having to move between Java 6 and Java 8 any day I want to try and code. And I'm not a big fan of Eclipse, but it's pretty much the only Android development kit out there I've heard of that doesn't require more time to setup than writing the code.

I think I'm going to write most of the code in NetBeans and then port it all to Eclipse later. The general idea shouldn't be complicated. Most of this is going to be user interface design, anyways. Which I really find strange. But that's fine.

The only question I have is a pretty straightforward one, as presented by Seth Godin. He's got a podcast called Start School. It was a class he taught for several days. Anyways, Godin said if you are going to create any sort of phone app, you have to add a social component to it. Adding a social component gives others the opportunity to find and recognize your creation as they advertise their successes.

I'm still not 100% certain what that all means, but I'm going to throw in a social component just because of the potential expanded reach. Yeah.

Thursday, November 6, 2014

Introduction to Networks Chapter 4 Notes

From Introduction to Networks by Cisco Press, 2014

Chapter 4

Wireless -

-range limitations

-easily mobile

-performance directly related to distance

-performance degraded by other wireless

wired

-won't degrade in performance based on distance

-hard to move

-static positioning

-as many devices with no degredation

Physical layer

types of media

-copper

-fiber optic

-wireless

Functional Areas

Physical components - electronic hardware, media, connectors, interfaces

encoding - convert a stream of data bits into predefined code

common network encoding schemes

-manchester - 0 is high to low transition

1 is low to high transition

-non-return to zero - two states meaning 0 and 1, and no neutral/rest position

signaling - method of representing bits

asynchronous - transmitted without clock signal. frames require start/stop indicator flags

synchronous - data signal sent with clock signal

ways to transmit

frequency modulation - carrier frequency varies

amplitude modulation - carrier amplitude varies

pulse code modulation - analog signal is converted to digital by sampling the signals amplitude and expressing as binary

data transfer speeds (in bits)

know your metric

throughput - measure of bits across media in a given time

-varies by...

-amount of traffic

-type of traffic

-latency - amount of time, including delays, to travel from one point to another

throughput can't be faster than the slowest link

Copper cabling

-inexpensive

-easy to install

-limited by distance

-limited by signal interference

data transmitted as electrical pulses

attenuation - the longer a signal travels, the weaker it gets

electromagnetic interference (EMI) and/or radio frequency interference (RFI)

-capable of distorting signal or corrupting signal

-produced by florescent lights and electrical motors

crosstalk - electrical or magnetic signal on one wire distorts the signal on another wire

-canceled by twisting pairs together

main types of copper media

-shielded twisted pair (STP)

-unshielded twisted pair (UTP)

-coaxial

UTP - most common

- 4 pairs of color coded wires

STP - not as common

-provides better noise protection

-more expensive

-difficult to work with

-if improperly grounded shield can act as antenna and pick up signals

-4 pairs of color coded wires

coax - 2 conductors sharing the same axis

-traditionally used in cable tv, early Ethernet

-still used for

-wireless

-cable internet

all copper susceptible to fire/electrical hazards

-toxic gas released when burned

-lightning strikes

-over voltage fries ports

prevent problems by....

-separate data and electrical

-connect cables correctly

-inspect for damage

-most be grounded correctly

UTP cabling

-cancelation - pair wires in a circuit, then magnetic fields are cancelled

-vary twists per wire enhances cancellation effect

standards defined by EIA/TIA

-cable types

-cable lengths

-connectors

-cable termination

-methods of testing

categorized by IEEE by transmission speed

- terminated with ISO 8877 RJ45 jack

termination options

-Ethernet straight through

-crossover

-rollover

Fiber Optic Cable

-higher data rate

-longer distance

Fiber is used

-Enterprise networks as the backbone

-fiber to the home (FTTH), access networks

-long haul networks

-submarine networks

fiber design/layout

-core - pure glass - transmission medium

-cladding - surrounds core, acts as a mirror

-jacket -surrounds and protects core and cladding

-susceptible to sharp bends

transmitted using...

-lasers

-LED

-laser light through the fiber could damage the human eye

single mode fiber - small core and lasers

-long distance

multimode fiber

-large core and LED

-cheaper

-up to 550 meters

terminated with optical fiber connector

-70 different connector types

Tuesday, November 4, 2014

Physical Security with Kiwi Syslog Server and Cisco Router/Switch syslogging

This is something I've been working on the last few weeks. We've run Kiwi Syslog Server forever, but have never done anything with it other than collect logs. I decided to try and implement some physical security measures using the reporting functionality of Kiwi Syslog Server.

Statements in bold are specific Cisco commands. I'm not going to give away the farm, but I can direct you towards what I use.

I'm not going to say this is the best way to do this. I just saying this is what I've done.

First assumption: you already have syslogging turned on and working.

Good. Got that done? It can be troublesome, but skipping past that.

Second, you ought to have some sort of scheme as to how you have everything plugged into your routers and switches. Let's hope you already have that.

That 65 hour project done? Good. Moving on.

The purpose of having the first two things done is so you can limit the length of the exclusion list on your Syslog Server. There are always some oddballs, but those can be accounted for without too many exclusions in the list.

I hope you also have hostnames that identify the device decently. That makes writing the catch statements easier. I call them catch statements, but really that is inaccurate. They are text based filters.

What I've learned about writing these filters is you need to be simplistic in filter design. You can have up to 100 different filters per action, so don't try and filter a complex statement in one filter. Use multiples. For example, I have one filter built that limits to switch traffic. Should I need to write anything else that is based solely on switches, I can then copy that one filter and know I'm now working only on switches.

For physical security on switches, any unused port is in a shutdown state. All other ports use MAC address sticky. Because they use MAC address sticky, I alert on any time there is a port-security violation. So within two minutes of plugging in a cable to the switch, I'm aware.

For routers, I'm aware of what ports should be used. I then monitor all router ports for up/down states. So, should you plug into a router, the syslog will see the port status change and alert. That can then be correlated with DVRs in the store to identify who plugged in, and with the port status down message, you get an indication of how long the person was plugged in.

The other option is to have the router ports shutdown as well. Depending on the day, I can lean either direction.

If you are going to leave the ports on, you need to be physically blocking them off with a tamper sticker. I'd almost say use a tamper sticker anyways.

As for all the other port up/down messages, I would run those though whatever network analytic software you use.

I'm sure there are better ways to do physical security. Locked rooms, locked doors, and cages come to mind. But operationally, that's not always possible. So you have to work with what you've got. And despite being critical to operation, people who build buildings generally don't want to dedicate an entire lockable room to things that aren't sold out the front door.

Monday, November 3, 2014

Active Directory and Content Adviser part 2

Found a solution to the problem I talked about the last post. The answer was use a proxy server. The proxy server is actually a file pointing to the local host with a bit of scripting involved that either returns the outside interface "proxy server unavailable". Which works out pretty well, because you get the effect of blocking the Internet. The proxy file is located on a read-only network share, and is copied to the computer whenever the user logs in. So even if the Internet goes down, you still have the old proxy file. And when the Internet comes up, you get the latest, greatest version.

That seems to work a lot better in theory than content adviser. And for some reason I want to spell adviser as "advisor". Anyways.

The hard part was need to rebuild the IE auto-install to get the proxy settings into the Internet Options control panel, and turning off Content Adviser. That required removing the computer from the domain, use "Turn Windows Features On and Off" to remove and re-add IE 11 with none of the IEAK options set. The rejoin the domain, and then the IEAK version to have the proxy file working and in place.

The great benefit of this approach is the proxy file works with Chrome as well.

But there are certain programs we use that are hard coded to use Internet Explorer, so there's no option of permanently going away from that.

Yay. Now all I have to do is get the logon script working properly, and everything will be great. Did I mention I'm deploying the computer Monday afternoon?

My Active Directory learning was from this book: Windows Server 2008 Active Directory Configuration.