Author Archives: Nathan Reeves
Alpha organisation of VPNs in Win 10
Found this when I did a quick search online, after being frustrated by the disorganised VPN icons (which when clicked from the Network system tray icon only opens the list AGAIN in a new window!)… This arranges the VPNs alphanumerically, but also permits a connection with a single click from the sys tray icon! Win!
- Open regedit
- Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Control Panel\Settings\Network
- Take ownership of the “Network” key/folder (right click, Permissions)
- Select “Advanced” in the Permissions window
- In the Advanced window, select “Change” where the owner field is (at the top of the window)
- Type in your username and save your changes.
- Close the advanced window
- Now select “Administrators” in the security tab
- Make sure “Full control” is selected, then apply changes
- Now that’s done, double click “ReplaceVan”
- Change it’s value to 2
Testing remote LPR queue
LPQ -S <ipaddress> -P <queue_name>
Another list of handy utilites…
I came across this one while searching for an easy way to recursively remove empty directories in Windows – but there are plenty of other little gadgets here:
Free security and forensics utlities
A handy collection of free forensics and security utilities is available here:
Outlook 2016 Autodiscover
Found this recently while setting up a Hosted Exchange account, where autodiscover was configured with an SRV record but no XML or other newer methods. Outlook was taking forever to finish “searching for account settings”, and google helped me with the following reg key to prevent Outlook from retrying the first methods over and over – and just go on to the next!
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AutoDiscover]
“ExcludeHttpsRootDomain”=dword:00000001
All good – account setup took a couple of seconds after that!
Patch Cleaner
This is another handy utility – this one will collect data on all the leftover install files from WinSXS and other temp folders, and remove the unnecessary ones. It is possible to save quite a lot of disk space on servers that have been provisioned with small disks…
Proactively dealing with ransomware
This handy article describes a handful of tactics to slow down the progress (and potentially stifle) a ransomware infection…
http://www.freeforensics.org/2016/03/proactively-reacting-to-ransomware.html?m=1
CCNA Exploration
Exploration 2, Chapter 11
Chapter 11 deals with OSPF.
OSPF was originally developed as a replacement for RIP. It uses Areas for scaleability and management, with Cisco’s implementation using Bandwidth as its metric or cost. OSPF has a fast convergence time, and is an IGP or interior gateway protocol.
The IP header type field for an OSPF packet is 89. OSPF uses the multicast IP address 224.0.0.5 and 224.0.0.6. OSPF ethernet frames are multicast to 01005e000005.
The OSPF LSP types are: Hello – for establishing adjacencies; DBD (database description) – an abbreviated list of the senders link state database for checking by the recipient; LSR (link state request) – Recipient requests more information about an entry in the DBD; LSU (link state update) – A reply to an LSR or an announcement of new information, and contains 11 types of LSA (link state advertisement); LSAck (link state Ack) – an Ack to confirm receipt of an LSU.
Hellos establish adjacencies, the parameters of neighbourhsip and elect the Designated Router (DR) and Backup Designated Router (BDR). Certain parameters must be established before an adjacency is established – the Hello interval (10 second default or 30 seconds on NBMA and other low bandwidth links); The Dead Time (4x the hello interval). On multiaccess networks the DR is responsible for updating other routers. The BDR monitors & takes over if the DR fails. On point-to-point links, no DR election occurs.
An LSU can contain 11 types of LSA, with the terms sometimes used interchangeably. The LSA types are: Type 1 – Router LSA; 2 – Network LSA; 3&4 – Summary LSA; 5 – AS External LSA; 6 – OSPF Multicast LSA; 7 – Not so stubby area; 8 – External attributes for BGP; 9 & 10 & 11 – opaque LSA.
After OSPF has received LSAs and built its local LSD, the SPF algorithm is used to create the SPF table and then populate the routing table. The administrative distance for OSPF is 110. OSPF supports authenticated updates. The OSPF process ID is locally significant & does not have to match neighbours IDs to establish adjacencies. The command “router ospf 1″ will start the OSPF process for AS 1. The network command “network 192.168.0.0 0.0.0.255 area 0″ will start advertising the c class 192.168.0.0 in OSPF area 0.
OSPF requires the wildcard mask to be used when issuing network statements. To obtain the wildcard mask, you subtract the netmask from 255. An OSPF Area is a group of routers that share the same link-state information. The use of areas results in smaller LSDs and give administrators the ability to isolate network problems (among other benefits such as bandwidth and processor use). It is best to use the area 0 for a single area network, as it can become the backbone for later expansion into a heirarchical multi-area network.
The OSPF router ID is just an IP address. It can be defined with the command “ospf router-id X” where X is the IP address. If that command is not issued, the router will use the highest IP address from any of its loopbacks. If there are no loopbacks configured, the router will use the highest IP address of its active physical interfaces. An active interface does not have to be OSPF enabled for its IP address to be used as the OSPF router ID.
“Show ip protocols” will display the routers OPPF ID. When configuring a loopback interface, they are automatically up. As loopback interfaces are more reliable than physical interfaces and less likely to be changed, they are common in OSPF routers for specifying the OSPF Router ID. The OSPF Router ID command was introduced in IOS 12.0 (T). When using the “ospf router id” command, the exiting OSPF id can be cleared with the “clear ip ospf process” command. The OSPF ID is determined when OSPF is configured with its first network statement, and a reload of the router may be required to affect any changes when the IP is determined by an interface.
Have duplicate router IDs in an area will cause OSPF and routing not to function properly and adjacencies to not be formed. The “sh ip ospf neighbour” command is useful for troubleshooting network issues. In the output of said command the “address” refers to the neighbours address. If the state of an adjacency is not “full” it means the adjacency has not been formed. (2way is another result to be discussed later).
Adjacencies may not form due to subnet mask mismatches, hello or dead time value mismatches, OSPF network type missmatch and missing or incorrect network statements. Some other debugging tools for OSPF include “sh ip prot”, “sh ip ospf” and “sh ip ospf int”.
SPF Schedule delay is how long it waits from receiving and LSA before running the SPF algorithm. Hold time is how long to wait between SPF calculations, used to minimise CPU use during the case of flapping links etc. “sh ip ospf in” will show hello and dead times. “sh ip ospf” shows the time since the last calculation.
It is possible to specify the interface with the sh ip ospf int command, and different interfaces can have different hello and dead times. In the routing table, the source O indicates OSPF. OSPF does not auto summarise. The OSPF metric is called Cost. Cisco IOS uses the cumulative costs of the outgoing interfaces on the route to determine the OSPF metric. The cost is calculated as 10 to the power of 8 divided by bandwidth in bps. ie – 56kb would be (10 to the 8 / 56000 = 1785). Dividing ten to the eightth ensures the higher bandwidths get lower costs. 10.8 is referred to as “reference bandwidth”, but results in bandwidths 100Mbps and greater having a metric of 1. The OSPF command “auto-cost reference bandwidth” will cause OSPF to accomodate networks with more bandwidth and should be issued on all routers to ensure metric consistency. 10 to the eightth = 100 000 000.
When configuring OSPF you should always check the interfaces configured bandwidth using the “sh int” command. The configured bandwidth should reflect the speed of the link for accuracy. “sh ip ospf int” will display the OSPF calculated costs of interfaces.
The “bandwidth” command can be issued on an interface to specify the configured bandwidth, in kbps. The command “ip ospf cost” on an interface will define the OSPF cost of the interface directly with no calculations performed.
The “ip ospf cost” command is especially useful in multi-vendor environments where the non-cisco equipment uses a metric other than bandwidth to calculate cost. The definition of a “multiaccess network” is one where more than two devices are present on a shared media. An ethernet LAN is an example of a broadcast multiaccess network. OSPF defines 5 types of network – point to point, broadcast multiaccess, non-broadcast multiaccess, point to multipoint and virtual links. NBMA and point to multipoint incluide technologies such as frame relay, ATM and X.25.
In a multiaccess network, the number of adjacencies will grow exponentially. 5 routers = 10 adjacencies. 10 routers = 45 adjacencies. The formula to calculate the number of adjacencies is (with N = number of routers): [N (n-1)/2]. IE: 5 (5-1) /2 = 10. OR 10 (10-1) /2 = 45.
A large number of adjacencies causes an increased amount of LSA traffic. On a multiaccess network the DR handles LSAs, and other routers only form full adjacencies with the DR and BDR. Other routers send updates to the DR and BDR using the multicast address 224.0.0.6 (alldrrouters). The DR sends updates to 224.0.0.5 (allspfrouters). There is only one router flooding with this configuration.
DR and BDR elections do not occur on point to point networks. The DR is elected based on the router with the highest OSPF interface priority. The BDR is the router with the second highest priority. If OSPF interfaces have equal priorites, the highest router is used to break the tie.
DROthers only form full adjacencies with the DR and BDR, but still form neighbour adjacencies with other DROthers, sending and receiving hello packets and knowing about eachother. The neighbour state is displayed as “2way” in the adjacencies list.
“Sh ip ospf iont” will show the DR, BDR or DROther state of the router. The DR and BDR election takes places as soon as an OSPF enabled router is active o the network. A low end router that boots faster can end up as DR because of this. The DR will remain DR until the OSPF interface fails on that router. If the DR fails, the BDR becomes the DR and a new BDR is elected on the network. If a new router is added after the election has occurred, it will not be elected until the current DR or BDR fails.
An old DR will not regain its DR status if it is re-joined. To control elections beyond setting router priority, bring up the intended DR before the BDR, before others. the DR should be a router with sufficient memory and CPU to handle all the LSA traffic and processing. The interface command “ip ospf priority” is used to define an interfaces priority. The priority can range between 1 and 255. A priority of 0 makes a router ineligible to become BR or BRD. The interface properties allow a router to be a DR in one network and a DROther in another network.
“sh ip ospf int” will show a routers OSPF priority. The default priority is 1. The edge, or gateway, router in an OSPF network is called the Autonomous System Boundary Router (ASBR). OSPF uses the “default information originate” command to redistribute the default route. A default route learned by OSPF will be shown as 0*E2 in the routing table, to indicate an OSPF external type 2 route.
OSPF external routes – Type 1 accrues cost over the OSPF area, while Type 2 is always the external cost.
The “auto cost refernce bandwidth” command should be issued from “router ospf”, while the “ip ospf hello interval” and “ip ospf dead interval” from Interface configuration mode. When changing the hello interval, IOS automatically sets the dead interval to 4 times that number but it is good practice to specify it manually.
“show ip ospf neighbor” will show all adjacencies. “sh ip ospf int X” to see the configured hello and dead timer values for an interface. OSPF requires hello interval and dead timers to match for adjacencies to be formed. The OSPF administrative distance is 110. The default hello interval is 10 seconds, or 30 seconds for NBMA links.
Chapter 10 introduces Link State routing protocols.
Where a distance vector protocol makes its routing decisions based only on local information and trust the metrics advertised by their neighbours, a link-state protocol maintains a full topological map of the network, to which the router refers. Link state protocols, also known as “shortest path first”, are based on the SPF algorithm (otherwise known as the Dijkstra algorithm). OSPF and IS-IS use the SPF algorithm.
The SPF algorithm accumulates costs along each path, affecting the metric. After exchanging hellos, the routers flood their neighbours with LSPs, or Link State Packets. The LSPs contain information about the neighbours, the neighbour ID, Link state and bandwidth. Neighbours store the LSP in their local database and flood the LSP to their neighbours in turn, until all routers hold all records.
When configuring a link-state protocol, network interfaces must still be included in network statements. Link state information includes IP Address and Netmask, Network Type, Cost of the link and Neighbours. Cisco’s implementation of OSPF uses the bandwidth of the outgoing interface as a metric.
After establishing an adjacency and exchanging hello packets, hello packets are used as a keepalive (similarly to EIGRP). If no reply is received on an interface, no further protocol functions are performed on that interface. After adjacencies are established, routers can construct LSPs and start flooding them to their neighbours. Whenever a router receives an LSP from a neighbour it sends the LSP out all interfaces except the one it was received on.
LSPs are forwarded almost instantly, with no further calculation. Each router runs the SPF algorithm once flooding is complete. This leads to faster convergence times. LSPs are not sent periodically – only during the startup of the routing process or when there is a topology change. In addition to the link state information, LSPs contain information like sequence numbers and aging information. Such information is used to determine whether that LSP has been received by a router or if it is newer than one that is already held.
After the LSPs have propagated, each router can construct its own SPF tree with the shortes paths to each network, from the link state database comprised of the received LSPs. The link state database contains the link state information for each router in the area. It also contains the local link state information. With a complete link state database the router can then use the SPF algorithm the calculate the shortest path to each network. Each router calculates the shortest path from its own perspective of the network.
SPF will ignore link state database entries it has already calculated – ie. if two routers advertise their link to eachother, only one DB entry needs to be processed. The real SPF algorithm calculates the shortest path as it is building the SPF tree. Routers construct SPF trees independently, but all trees must be identical for proper convergence and routing.
Advantages of link state routing protocols include: builds a topological network, faster convergence due mainly to LSP flooding, event driven updates, heirarchical design and the ability to use “areas” which assists in route aggregation etc.
Areas also limit the amount of LSP flooding and the amount of resource usage when re-running the SPF algorithm. Routers out of the area will learn of a down route without having to rerun SPF.
Link state protocols require more memory for the database, more CPU for the SPF algorithm and bandwidth for LSP flooding.
OSPF was created by the IETF, with V2 supporting IPv4 and V3 supporting IPv6. IS-IS was initially created for the OSI stack and later modified for TCP/IP. It was designed by ISO and DEC (as DECNET). A “link” is an interface, in link state terminology. EIGRP still has comparably fast convergence, despite being a distance vector protocol.
Chapter 9 deals with EIGRP.
EIGRP is a distance vector, classless routing protocol. It is an enhancement of Cisco IGRP. Features found in EIGRP that are not found in other distance vector protocols include Reliable Transport Protocol (RTP), Bounded Updates, Diffusing Update Algorithm, The esablishment of Adjacencies and Neihbour & Topology Tables.
The term Hybrid is sometimes used to describe EIGRP, due to it acting in a similar manner to a link state protocol, while it is in fact a distance vector protocol.
Neighbour adjacencies and RTP allow EIGRP to use DUAL to calculate costs & best loop free paths, as well as maintaining backup routes.
Where RIP uses hop count as its metric, IGRP and EIGRP use costs based on Bandwidth, Delay, Reliability and Load. By default, only Bandwidth and Delay are used.
IGRP however is classful, uses the bellman-ford algorithm and periodic updates, limiting its usefulness in modern networks.
IGRP was discontinued in IOS 12.2(13)T and 12.2(R1s4)S.
EIGRP has no route ageing and does not use periodic updates. Where RIP and IGRP only track the best route to a destination, EIGRP maintains a topology table seperate to the routing table which contains the best and other paths determined to be loop free. Loop free means having no path back through this router to reach that network. When a route becomes unavailable DUAL searches for a backup route that did not meet the feasibility requirement.
EIGRP does not use holddown timers, and is much faster to converge than previous protocols due to the way DUAL works among the routers to compute the best paths.
The data portion of an EIGRP update is called the Type Length Value. EIGRP updates are multicast to the address 224.0.0.10, with the IP header Protocol field set to 88. The multicast MAC address for EIGRP is 01005E00000A. The TLV fields in the packet body include Paramaters, Internal Routes, and External Routes. Some TLV Paramaters are K1 for bandwidth and K3 for delay.
The EIGRP Header field “Opcode” specifies the packet type – Update, Query, Reply or Hello. The AS number in EIGRP is for Autonomous System and is the number for the EIGRP routing process. The AS tracks multiple instances of EIGRP.
In EIGRP the Hold Time is how long the router should wait before considering the sending router to be down.
TLV: IP Internal Paramaters (for this course): Metric Fields, Subnet mask and Destination.
The delay is calculated as the sum of delays from source to destination in units of 10 microseconds. The Bandwidth metric is the lowest configured bandwidth of any interface along the route. The subnet mask is specified as the prefix length. The destination field stores the address of the destination network. The minimum length is 24bit, which is the stored network address padded with 0’s. Any network greater than 24 bits, the field is extended by 32 bits and the remainder is padded by 0’s.
TLV: Ip External is used when importing an external route into EIGRP. The bottom half of Ip External contains the fields of IP Internal. In EIGRP, the MTU is included in routing updates but is not used to calculate any metrics.
The EIGRP Header contains an Opcode and ASN field. EIGRP has PDMs or Protocol Dependent Modules which can be used to route IP, IPX and Appletalk. A seperate topology table is maintained for each protocol.
EIGRP operates at the network layer, so cannot utilise TCPs reliable delivery mechanisms. It uses RTP instead. Reliable RTP packets require an ACK from the receiver, where unreliable RTP packets do not. RTP can send packets as unicast or multicast.
EIGRP uses 5 packet types. HELLO – discovers neighbours and forms adjacencies. Multicast and unreliable. UPDATE – Contains only the routing information reuired and is sent only to routers that need it. Can be unicast or multicast, and reliable. ACK – contains a non-zero ack number and are always unicast. QUERY & REPLY – Used by DUAL when searching for other networks and other tasks. Always reliable. Queries are multicast, Replies are unicast.
EIGRP Hello packets are sent every 5 seconds by default, or every 60 seconds on slow links such as low speed NBMA links. (Non broadcast multi access). The Hold Time is how long a hello packet can be absent from a router before it is considered to be down. This value defaults to 3 times the hello interval, or 15 / 180 seconds depending on the link type. If the hold time expires, EIGRP declares the route down and sends queries to search for a new path.
EIGRP sends partial and bounded updates. Bounded updates are sent when route information changes (such as metric, etc); Partial updates only include information about the change. Bounded updates are only sent to routers that are affected by the change. DUAL prevents routing loops using mechanisms similar to split horizon and holddown timers, but it is done differently. DUAL stands for Diffusing Update Algorithm. DUAL allows all routers in the network to synchronise at the same time, resulting in faster convergence.
The decision process is performed by the DUAL FSM or Finite State Machine. The FDM tracks routes, uses metric to select the best loop-free path and selects the least cost paths to insert in the routing table. Recomputation of DUAL can be processor intensive, so DUAL keeps a list of backup routes which are already determined to be loop free to avoid recomputing.
EIGRPs administrative distance is 90, or 170 for externally imported routes, and 5 for summary routes. EIGRP is capable of authenticating updates, and by default will automatically summarise at the network boundary.
RFC 1920 defines AS’s. Prior to 2007 AS’s were 16bit numbers, they are now 32bit. BGP is the only routing protocol to use actual ASN in its configuration. EIGRP calls its process number ASN but it is not related to the public ASNs and it is 16bit. All routers must use the same ASN in EIGRP.
The EIGRP “network” command is the same as in RIP and other routing protocols. The network statement is issued with the classful address of a network, and will include its (subnets if there are more than one) in its updates. To only advertise specific subnets of the classful range use a wildcard mask with the network statement. IE. “network 192.168.1.10 0.0.0.3″.
The command “show eigrp neighbors” will show routers with established adjacencies and the interface used to reach them. The H column shows the order neighbours were learned in. SRTT is for Smooth Round Trip Time. RTO is Retransmit Interval.
When troubleshooting, verify the network and passive interface statements. Also use the “show ip protocols” command.
“router eigrp 1″ will enter configuration mode for eigrp proccess/as number 1.
EIGRP routes are displayed in the routing table with a D for DUAL as the source. When automatic summarisation is enabled, EIGRP automatically creates a summary route for the classful network as a level 2 child and directs it to Null0 when at least one of the subnets was learned by EIGRP. Equal cost routes to a destination will both be included in the routing table.
EIGRP uses bandwidth and delay to calculate metric by default, and reliability and load can be added. K1 – Bandwidth. K2 – Load. K3 – Delay. K4 – Reliability. K5 – Reliability.
Use the “metric weights” command to change the value of the K. Default is 1 or 0. K1 and K3 are set to 1 and all others set to 0 by default.
The default formula is (k1 * bandwidth + k3 * delay).
The complete formula is (k1 * bandwidth + [k2 * bandwidth / 256 – load] + k3 * delay) * (k5 / [reliabiliy +k4]) = Metric.
The K values can be verified with the “show ip protocols” command. “show interface” will display the values of bandwidth etc being used in the composite calculation. Some interfaces, such as serial interfaces, may use unexpected values – always verify them using “show interface”.
The configured bandwidth value of an interface does not necessarily reflect the actual bandwidth of the link. The delay value, like bandwidth, as a defualt value which can be changed by a network admin. Delay is not measured dynamically.
Reliability is measured dynamically, calculated on a 5 minute weighted average. Load is also calculated dynamically, on a 5 minute weighted average (txload & rload).
To modify the configured bandwidth of an interface, in interface configuration issue the command “bandwidth X” in kilobits. “no bandwidth” will restore the default value. The Bandwidth statement does not affect the bandwidth of the link, only the metric value. It is only used in routing protocols like EIGRP and OSPF.
The EIGRP Metric: (slowest bandwidth/bandwidth) * 256 = (sum of route delay / 10) *256. It is the sum of all delay on the route and the configured bandwidth of the slowest link on the route. EIGRP uses the “reference bandwidth” value of 10000000 & divides it by the bandwidth of the slowest interface. If the result of the calculation is a whole number, it is rounded down.
Each delay value is divided by 10, then summed, then multiplied by 256. ie. (20000 / 10) + (100 / 10) = 2010 * 256 = 514560.
The values are then added to obtain the EIGRP metric.
In DUAL, a Successor is a neighbouring router used to forward packets that is the least cost route to the destination network.
FD or Feasible Distance is the lowest cost metric to a destination, in the routing table next to the AD. DUAL keeps backup routes to Feasible Successors in the topology table. To be a feasible successor, a router must satisfy the Feasibility Condition. The FC is met when a neighbours reported distance is less than the local routers feasible distance. Reported or advertised distance is just the routers Feasible Distance.
A feasible successor will have a better FD itself, but the total route cost will be greater.
The command “show eigrp topology” will display the topology table. In the topology table output, P indicates Passive or a stable state. A is for Active, when DUAL is performing calculations. In a stable routing domain, all routes should be passive.
The first child entry shows the successor with Feasible Distance / Reported Distance values and its exit interface. The second child entry shows the FS, with FD / RD should the route enter use & the exit interface.
The command “show eigrp topology %network%” will display detailed information about the metrics of an entry in the topology table. it will show all metric values, whether used or not, as well as other details. “show eigrp topology all-links” will show all possible paths, including those that do not meet the feasibility requirement.
A possible path with a higher RD than the local router could be a loop through itself. As a distance vector protocol, EIGRP does not have a total topological map of the network. By having an RD less than the local FD, DUAL can assume that the noughbours route is not part of its own advertised route.
The command “debug eigrp fsm” will display debug output for the Finite State Machine calculations. Finite state machines are almost like flow charts, defining events, causes and results.
If a route goes down abd there are no feasible successors, DUAL puts the network into the Active state and starts to EIGRP query its neighbours for a new successor. If no EIGRP replies contain a path to the network, the sender of the queries will not have a route to that network. If a reply contains a route to the network, it is added as a successor and to the routing table.
EIGRPs automatic classful route to Null0 will prevent the use of supernet routes when automatic summarisation is in effect and at least 1 route is learned by EIGRP to a subnet of the classful network.
The command “eigrp log-neghbor-changes” will display changes to adjacencies etc.
When the “no auto-summary” command is issued, DUAL takes down all adjacencies and gets a new round of updates.
Some low bandwidth point to point connections will have equal cost paths over other, different speed paths.
EIGRP Manual summarisation must be configured on each sending interface. IE. “(config-interface)# ip summary-address eigrp 1 192.168.0.0 255.255.252.0″
As with other routing protocols, summary routes result in more efficient use of bandwidth and smaller routing tables.
EIGRP also uses the “redistribute static” command for default route distribution. The static route on other routers would have the source D*EX to signify DUAL, Default and External.
EIGRP with it’s various communications will by default use a maximum of 50% of a routers bandwidth. The command “ip bandwidth-percent eigrp 1 5″ will set AS1 to use a maximum of 5% of a links bandwidth.
“ip hello-interval eigrp 1 5″ will set AS to use a hello interval of 5 seconds.
“ip hold-time eigrp 1 15″ will set the hold time to 15 seconds, which must be greater than the hello interval.
The maximum hello and hold time values is 65535, approx. 18 hours.
Chapter 8 takes a closer look at the routing table.
For networking professionals it is important to understand the routing table and the functions associated with it.
The original routing table heirarchy in Cisco IOS was built around a classful routing scheme. Although the table now incorporates both classful and classless addressing, the overall structure is still built around the classful scheme.
“debug ip routing” is used to show routing table additions and deletions in real time.
The Cisco routing table is not a flat database. It is heirarchical structure that is used to speed up the lookup process, consisting of level and and level 2 routes.
A level 1 route is a route with a subnet mask equal to or less than the classful mask of the network address. 192.168.1.0/24 is a level 1 route, because the dubnet mask is equal to the networks classful mask.
A level 1 route can function as a Default Route (0.0.0.0/0), a Supernet Route or a Network Route (equal to the classful netmask).
A network route can also be a parent route.
An Ultimate Route is a level 1 route that includes a next-hop IP address and/or an exit interface.
A level 1 Parent Route is a classful route without any exit interface or next hop IP address, that contains Child routes to subnets of the classful network of the parent. It acts as a heading, indicating the presence of level 2 child routes.
The level 1 parent route is automatically created any time a subnet is added to the routing table. The subnet is the level 2 child route. A level 2 route is a route that is a subnet of a classful network address.
The level 1 route contains the classful network address for the subnet, the CIDR netmask for all the child routes (if VLSM is in effect, the mask is excluded and instead shown on each child entry) and the statement Is Subnetted along with the number of subnets / routes.
The level 2 route contains the code for how the route was learned, the specific route entry and the exit interface or next hop address. Level 2 child routes are also considered ultimate routes because they include an exit interface or next-hop ip address.
A level 1 parent route will be deleted when there are no longer and child routes beneath it.
When two or more child routes have different subnet masks, the parent route will have the classful subnet mask, and display that the network is Variably Subnetted. It also displays the number of different masks under the classful network. The subnet mask for each child route will then be listed individually. The routing table itself always uses the classful scheme however.
When routing a packet, the router examines the level 1 parent routes for a match, forwarding the packet if an ultimate route is found. If a matching parent route is found, the child routes are examined. If no matching child route is found, a classful behavior will drop the packet and classless behavior will search the level 1 supernet routes for a match (including the default route). If there is still no match, the packet is dropped.
A route specifying a next hop ip address but no exit interface will prompt a recursive lookup in order to find the exit interface required to reach the next hop ip address.
The preferred route is always the Longest Match – or the route with the most number of matching left-most bits.
The minimum number of matching bits is defined by the subnet mask, but the router will compare host bits (of destination) as well when finding a matching routes and use a more specific route if one is available.
Before any child routes are searched, there must be a match with the classful address of the parent route.
The router then checks each child route until it finds the longest match, with the subnet masks of the child routes used to determine the minimum number of matching bits required.
Where classless and classful routing protocols affect how the routing table is populated, classless and classful behaviors affect how the table is searched after it is populated.
The routing behavior is specified using the “ip classless” and “no ip classless” commands.
The routing protocols and routing behaviors are completely independent of each other.
Prior to IOS 11.3, “no ip classless” was the default configuration.
When using “no ip classless” behavior, no supernet route will be used. This includes the default Quad Zero route.
Classful routing behavior was used when all child routes could be reached from the parent route, when organisations had classfull ip addresses assigned to them and controlled all their own subnets.
Supernet routes will have less matching bits than a child route.
The default route will be the lowest matching bit route.
When there are routes for subnets of a classful network as well as a route for the classful network itself, the classful network is considered a level 2 child route along with the subnets.
Explorer 2, Chapter 7
Chapter 7 deals with RIPv2, and its differences to RIPv1.
RIPv2 has lost its popularity against other more scaleable protocols such as EIGRP, OSPF and IS-IS. While RIP lacks some of the capabilities of the later protocols, it’s use is still appropriate in some situations.
RIPv2 is an enhancement of the functions and features of RIPv1, rather than a new protocol. It is a classless routing protocol, supporting CIDR and VLSM, along with discontiguous networks.
Some other enhancements over RIPv1 are the use of multicast addresses to send updates, the inclusion of next-hop addresses in updates and the option for authentication.
To redistribute routes (in this case static routes), the command “redistribute static” must be entered from the “config-router” mode. In the example, we were redistrubiting a supernet route to a null interface.
When using RIPv1, networks must be summarised at major boundaries, due to subnet masks not being included in the updates.
When using discontiguous networks, this can result in missing route information or the addition of equal cost routes to seperate networks. Both result in failure to accurately route traffic.
Even when the routes might seem as though they Should be redistributed through other exit interfaces, if routes to the same classful network are present from that interface split horizon will stop the updates from being distributed.
When routers using RIPv1 have VLSM networks configured on their interfaces, RIPv1 will use the subnet mask of the outgoing interface when broadcasting updates. Any networks that do not have the same subnet mask as that interface will not be distributed.
The receiving router can also only apply the mask of its incoming interface to received updates, so any sent with a different mask would result in improper route entries.
RIPv2 is defined in RFC1723. It is encapsulated in a UDP segment using port 520 which can carry up to 25 routes. RIPv2 carries the subnet mask and next-hop address of the route – significant improvements over RIPv1. If the next-hop field is all 0 (0.0.0.0), then the address of the sending router is used as the next-hop.
By default, when a RIP process is configured on a cisco router it is version1. The router will interpret version2 messages, but ignore the version2 fields within them.
The command “version 2″ from “config router” will enable RIPv2. “Version 1″ can be used to revert.
RIPv2 by default still summarises at major network boundaries. This can be seen in the output of “show ip protocols”. To disable this, issue the “no auto-summary” command from “config router”. This command can be issued in a RIPv1 environment, but will have no effect.
RIP routes have their metric incremented prior to being sent out another interface. RIPv2 sends updates using the multicast address 224.0.0.9. Using a multicast instead of broadcast means any device not configured for RIP will discard the frame at the data-link layer.
Troubleshooting RIPv2: Check all interfaces are up and operational, check the cabling, check the IP addressing and subnet masks, remove unnecessary configuration commands. “show ip route”, “show ip interface brief”, “show ip protocols”, “debug ip rip”, “ping” and “show running-config”.
Other troubleshooting is to check that the same version is running across the entire network, that all the “network” statements are present and correct and that automatic summarisation is on/off as required.
Invalid routing updates are bad. To avoid them, it is best to configure authentication on your routing protocols. RIPv2 supports authentication.
Chapter 6 deals with Classless Inter Domain Routing and Variable Length Subnet Masking
With the introduction of VLSM and CIDR, routing protocols were also updated to support the new standard. Where classful routing protocols always summarised on the classful network boundary, and did not include subnet masks in their updates; classless routing protocols do include the subnet mask in their updates and are not required to summarise routes.
Without the introduction of VLSM and CIDR, along with NAT in 1994 and Private Addressing in 1996, IPv4 address space would now be exhausted.
In RFC 791 (released 1981) IP Addresses were arranged in Classes to provide for Large, Medium and Small organisations. A class A address always begins with a 0 bit (0.0.0.0 – 127.255.255.255). Class B addresses begin with the bits 10 (128.0.0.0 – 191.255.255.255). Class C addresses begin with the bits 110 (192.0.0.0 – 223.255.255.255).
The remaining addresses were reserved for multicasting and future uses. Multicast addresses begin with the bits 1110. Addresses beginning with four 1 bits (1111) were reserved for future use and designated “experimental”.
The designations of Network and Host bits were released in RFC 790. A class A address used the first octed for the network address, which is a 255.0.0.0 subnet mask. Because the first bit is always 0, that allowed for 7 bits for networks – leaving 2 to the 7th power (or 128) networks.
With 24 bits in the host portion, each class A network had the potential for over 16 million individual host addresses. Before the introduction of VLSM and CIDR, companies and organisations were assigned entire A class addresses – a tremendous waste of resources.
Class B addresses, with the first two octets used for the network address and the first two bits as 1 and 0, had 14 bits left in the network portion, for a total of 16,384 class B networks.
Each network supported 65,534 hosts – still far too many for most organisations. Class B address space was also wasted.
Class C addresses were often too small. With three octets for network addressing and three bits set to 110, 21 bits remained for the network address – over 2million class C networks, with only 254 hosts in each.
Using classful IP addresses meant that routing protocols could determine the subnet mask of the network address by examining the first three bits of the network address. The router could also determine the subnet mask by applying its ingress interface mask for subnetted routes. The subnet mask was directly related to the network address.
CIDR was introduced in 1993, and network addresses are now determined using the network subnet mask.
CIDR uses VLSM to size subnets based on need rather than class. This allows the network boundary to occur at any bit in the address.
CIDR allows for Prefix Aggregation, or route summarisation, to use supernet routes (a route wuth a mask less than the classful mask).
Propagating VLSM and supernet routes requires a classless routing protocol, because the subnet can no longer be determined by the first octet. The subnet mask now needs to be included with the network address.
Classless routing protocols include RIPv2, EIGRP, OSPF, IS-IS and BGP. These protocols include the subnet mask in their routing updates. Classful routing protocols cannot send supernet routes because the receiving router would apply the default classful netmask to the route.
When a supernet route is in a routing table, such as a static route, a classful routing protocol will not include the route in any sent updates.
VLSM can be considered as subnetting a subnet, and those subnets can be further subnetted, allowing for better route summarisation and having different masks to fit different needs within the network.
Route aggregation is the process of advertising a contiguous set of addresses as a single address with a less specific and shorter mask. CIDR is a form of route summarisation and is synonymous with the term Supernetting.
Where classful protocols summarise the routes to a single classful route at the classful network boundary, CIDR ignores those limitations and allows summarisation with a mask that is less than the default classful mask. This reduces the number of entries in a routing table and reduces the amount of bandwidth used in updates.
A supernet is always a route summary, but a route summary is not always a supernet. A router can have two routes for a single network, with one of them a summary, the traffic would be routed through the route with the most specific match.
To calculate a summary route, you write the network addresses in binary and count the number of left-most matching bits to get the prefix, or subnet mask for the summarised route.
Next you copy the matching bits and add 0 bits to determine the summarised network address.
Chapter 5 deals with RIP v1.
RIP is the oldest distance vector routing protocol, and evolved from GWINFO (Gateway Information Protocol) – a xerox routing protocol.
RIP uses hop count as its only metric, limited to 15 hops with 16 being considered infinity. Updates are broadcast every 30 seconds.
RIP messages are sent in UDP segments, on port 520, to broadcast addresses. The RIP header includes fields for Version and Command as well as a Must Be Zero field.
The maximum segment size before addition of IP header information is 502 bytes, which can contain 25 route entries. The Address Family Identifier body field is set to 2 for IP, unless the router has requested a full routing table in which case it is set to 0.
RIPv1 includes numerous fields that are left at 0. This is due to it having been developed before IP, and having space reserved for larger address space. Most of these extra fields have been used by RIPv2.
RIP has two message types: Request Message and Response Message. When a router starts up it sends a request message for its neighbours to send their full routing tables which it then analyses and adds any new (or better cost) networks before sending a triggered update to its neighbours with its own routing table.
RIPv1 is a classful routing protocol. Subnet mask information is not sent in updates, and routers apply the local interface subnet information or the default subnet of the address class. Because of this RIP networks cannot be disconitiguous or use VLSM.
RIP has a default Administrative Distance of 120, Making it the least preferred routing protocol.
From global configuration mode, “router rip” will enter RIP configuration. “No router rip” removes all RIP configuration. In “router-rip” command mode, the “network directly-connected-classful-network-address” command will enable RIP on the interfaces configured to that network as well as advertise that network in broadcast updates. If you enter a subnet address, the router will automatically convert it to a classful address.
Troubleshooting RIP can be performed mostly with “sh ip route”, “sh ip protocols”, and if these do not assist enough “debug ip rip” will give realtime information on the RIP processes which are occurring.
To troubleshoot RIP with the show ip protocols command you should check that RIP is configured and running, that it is sending and receiving on the correct interfaces and advertising the correct networks as well as whether or not the routers neighbours are sending updates.
Show ip protocol is useful for troubleshooting other dynamic routing protocols as well.
Most RIP configuration errors involve missing or incorrect Network statements, or the configuration of a discontiguous network environment.
Broadcasting RIP updates out a network with no routers on it degrades the network bandwidth, as well as having all hosts on the network process the packet up to the transport layer. It also opens the possibility of packet sniffing software intercepting the packet and having a false update sent back, corrupting the routing table and misdirecting traffic.
The passive-interface command stops the rotuer from broadcasting updates through a specific network but still includes that network in the broadcast updates. (ie. passive-interface fastethernet0/0)
Show ip protocols can then be used to verify the passive interface. The passive interface will not be listed in the interfaces list but its network will be listed under the routing for networks list.
All routing protocols support the passive-interface command and it should be used as a part of a normal routing configuration. The 172.16 – 172.30 B class ranges should be entered as the B class range, not any subnet ranges.
RIP performes automatic network summary. Any router with interfaces in more than one major classful network is considered a Boundary Router, and any updates it sends outside that network will include the summarised network.
When RIP recieves an update on an interface, any networks that are within the same major classful network as the interface have the interfaces own subnet applied to them. Any updates from a different classful network have the default classful netmask applied to them.
Automatic summarisation has advantages in that it reduces the size of the routing tables in routers outside the network boundary as well as consuming less bandwidth when broadcasting updates.
A major disatvantage is that it does not support discontiguous networks. If two networks in the same major classful range are seperated by another classful range, the network will not converge. The router in the middle will have two routes to the classful network, and attempt to load balance between them.
In “Router rip” you can issue the “default-information originate” command on the router whos default route you want distributed via. RIP. On a different router you can see the R* beside the default route.
Chapter 8
This chapter deals with the physical layer, or Layer 1 of the OSI model.
The physical layer carries the signals that are placed onto it by the data-link layer between local devices, or to an intermediary device. In order to identify where a frame begins in the string of individual signals, a particular sequence of signals is used.
Physical layer standards are defined by engineering organisations rather than RFCs, or the IETF. Standards for layer 1 include specifications for NICs, connectors, cables and the encoding/signalling used.
Layer 1 generates an electrical or optical signal representing a 0 or a 1. The signals can be represented on the media, showing 0 and 1 by varying the amplitude, frequency or phase of the signal with use of a clock. Some older types of signalling include NRZ and Manchester Encoding.
Where the frame for layer 2 is presented as a unit, the physical layer transmits the data as a stream of bits.
On the physical layer frames must be delimited so the receiving device can reconstruct them correctly. To achieve this a preamble and start-of-frame delimiter are used. An end of frame field is appended to the trailer.
Coding groups are used, such as 4b/5b, to provide better error detection as well as limit the amount of energy transmitted onto the media. It also assists in inserting control signals.
There are various common media types, each with different characteristics. Some carry data for longer distances, with greater bandwith. Some are more susceptible to interference, and others don’t require cable runs for the local end devices, such as 802.11a, b, g & n.
The physical layer characteristics strongly influence the data carrying capacity of the network / link, or bandwidth. Where the amount of data transmitted over a link in a given period of time is known as throughput, the usable data transmitted in a period of time is known as goodput.
Types of fibre media are Single and Multimode. Multimode uses LEDs to generate the light signal, and a larger core cable. Single mode uses a laser and smaller core cable. Smaller core cables reduce diffusion (or modal dispersion) of the light, and single mode fibre is good for a much longer distance.
Common fibre connectors include SC and LC, commonly used with single mode fibre. ST, LC and Duplex LC are often used for multimode. When troubleshooting a suspected cable fault in a fibre network, an OTDR is used (Optical Time Domain Reflectometer).
Most data networks use category 5, 5e or 6 UTP copper cables with RJ-45 connectors.
Chapter 7
Chapter 7 discusses the Data Link layer.
The data link layer allows the layers above it to access the media and place data on it. The PDU of the data link layer is the Frame, and end devices are known as Nodes.
The data link layer encapsulates layer 3 packets into Frames, and controls how the frames are placed onto and taken from the media (Media Access Control). Layer 2 (Data Link Layer) deals with the physical network, or network segment, and is not aware of any networks other than the segment.
The Data Link layer performs error detection using the FCS field of the frame trailer, which contains a CRC value for the frame. The Data Link layer contains two sublayers – LLC (Logical Link Control) exists as software – the “driver”. The Media Access Control sublayer deals with the physical requirements of the type of media.
Methods of media access control used depend on the type of media sharing and the topology of the network. Deterministic methods such as token ring use controlled access, while non-deterministic methods such as ethernet are contention based. Deterministic methods provide less (but predictable) throughput to nodes but encounter no collisions. CSMA/CA and CSMA/CD provide a means to minimise collisions and resultant errors in contention based protocols.
Data Link layer protocols are typically not defined by RFCs, but by various engineering organisations such as the IEEE. In this chapter we also had Half and Full duplex explained to us. Physical and Logical topologies like Star, Multi-Access and Ring.
Layer 2 addresses (For ethernet, at least) are typically known as MAC addresses or Burned In addresses. They consist of 48 bytes, or 12 hexadecimal characters. The first 6 characters or 3 bytes are the Organisationally Unique Identifier. The last 3 are the devices number, assigned by the manufacturer.
Some layer 2 protocols include Ethernet (IEEE 802.2 and 802.3), PPP, HDLC and ATM.
The basic ethernet frame format remains the same over the different varieties of ethernet, ethernet being a connectionless, unreliable method of data transfer. PPP is defined by RFCs, unlike other layer 2 protocols. PPP establishes virtual connections between the two nodes which hide the underlying infrastructure. Each protocol transmitted over the link establishes its own PPP session. PPP allows things like authentication and compression to be negotiated by the nodes for the link.
802.11 is wireless LAN. The layer 2 headers in wireless lans have far more options and flags for a variety of functions both required and optional used in the wireless environment.
Chapter 6 deals with IPv4 addressing.
We were introduced to the network / host portions of the IP address. It was explained how the dotted decimal representation we are used to seeing is a representation of the binary, calculated using postional notation. There was discussion on converting between binary and decimal, and vice verca.
We were introduced to some of the types of IPv4 addresses, such as Host, Network and Broadcast addresses. The network address has all host bits as 0, and the broadcast address has all host bits set to 1.
The CIDR notation of network prefix was explained, and we were shown how it directly indicates the number host bits used as network and host bits. There were a number of helpful exercises in converting netmasks and ip addresses back and forth using binary.
We were then introduced to some types of IPv4 transmission – Unicast, Broadcast and Multicast. Some ranges of IP addresses were shown to us, 0.0.0.0 – 223.255.255.255 for hosts, 224.0.0.0 239.255.255.255 for multicast and 240.0.0.0 255.255.255.255 for experimental use.
We were shown the private address ranges – 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
Some other ranges of addresses were mentioned, such as 127.0.0.0/8 for loopback and 169.254.0.0/16 for link-local.
The authorities who assign IP addresses were mentioned, such as APnic for the asia pacific region.
Legacy classes of IP addresses were explained, and the modern classless use of IP addresses.
The importance of planning an addressing scheme for a network was explained and the subnets usefulness in that. The appropriate use of static and dynamic IP addresses is also necessary.
The use of a public IP for a publicly accessible host was mentioned, and the use of NAT for the private hosts.
The teirs of ISPs and upstream providers was shown, followed by a mention of the 128-bit IP7 address and its header.
The use of subnets, binary anding and VLSM was then explained. We were shown how to calculate the number of hosts on a network, and how to calculate network and broadcast addresses of a given IP/subnet.
Some testing procedures were explained, such as testing the local stack, testing connectivity to the local network and testing the ability to route outside of the local network. ICMP and its role in these processes was explained, and some ICMP utilities such as tracert and ping were promoted.
Chapter 5 deals with the Network Layer.
The network layer uses connectionless, unreliable, media-independent protocols such as IP to deliver data across a network or internetwork. IP packets are routed through intermediary devices when they are destined for a host outside of the local network. The local network is defined using a netmask, which represents the subnet. Routers use a process known as binary anding to determine the destination network of a packet.
Networks are often divided according to Function, Owner or Geographically. Security, performance and address management are other factors in dividing a network.
IP Packets have a Time To Live field which is decremented by 1 by each router handling the packet. This ensures the packet will be dropped after a certain amount of time, ensuring it isn’t stuck in an endless loop. TTLs are also used by the Tracert utility when determining the hops through a network.
A router will either discard a packet for which it does not know the route to the destination network, or forward it through the “gateway of last resort” or “default gateway”. Routes can be shared between routers using a routing protocol – dynamic routes. Static routes can be defined on a router or host by an administrator. Static routes are more efficient on bandwidth as information is not exchanged between routers, but they are more time consuming for administration.
Chapter 4 deals with the transport layer. We were intruduced to the transport layer protocols TCP and UDP.
The transport layer is responsible for the end-to-end delivery of data. Its functions include tracking individual conversations, determining the destination application (using port numbers), segmentation and reassembly of data and in some cases connection-oriented dialogues (with provision for same-order data reassembly and retransmission of lost data).
The segmentation of data at the transport layer allows dialogues to be multiplexed, and the concept of reliable and unreliable protocols were outlined to us.
We were shown the Well Known, Registered and Dynamic / Private port ranges and their uses were explained.
The TCP Three Way Handshake was explained, and the process for terminating the TCP connection was also explained. We were shown the purpose and function of Window Sizing and how it works as a flow control mechanism, dynamically changing during a dialogue depending on network and host/server load. Acknowlegements were discussed.
UDP was discussed, some of its attributes being Unreliable delivery of data, the un-ordered reassembly of segments (or Datagram – the UDP PDU), connectionless data transfers and lower network overhead due to that. UDP sdatagrams also have a smaller header. UDP uses port numbers the same way as tcp, randomly selecting a ‘source port’ when sending a transmission. Socket pairs are still used to describe the combination of source and destination layer 3 address and layer 4 application number (port).
Chapter 3
Chapter 3 dealt primarily with the tcp/ip model application layer, or OSI model Application, Presentation and Session layers (Layers 7 – 5).
We were introduced to the layered abstract models representing networks and how they provide a guideline for designing independent – yet compatible – protocols, and how these protocols allow cross-compatibility between unlike end devices.
The OSI Application layer interacts with the user, accepting the input and converting it to a digital format before passing it to the next layer.
The Presentation layer then encodes the data in a standardised format the destination device can decode – this includes compression and encryption if required or if it is part of the standard. Presentation layer implementations are normally independent of the protocol stack. Many formats of media files are defined at the presentation layer.
The Session layer then establishes a dialogue with the destination device, and handles the exchange of information. The session layer also maintains dialogues and restarts broken or idle sessions.
Most network aware applications use functions from layer 5, 6 and 7.
TCP/IP Model Application Layer protocols include Telnet, DNS, HTTP, SMTP and FTP. Protocols are generally defined by RFCs, which are maintained by the IETF.
Software operating at the Application Layer lever are considered either Applications or Services. Applications interact with the user, while services are user-transparent and provide an interface to the lower layers of the stack. The applications and services implement the Application Layer Protocols, which provide the rules and formats for data handling – including the types of messages exchanged between hosts and the syntax of those messages, control commands, data formats and error notification / recovery.
The protocols on the source and destination devices must match to ensure proper data transfer and interpretation. Applications and Services may use numerous protocols in a single dialogue.
Client and Server processes are considered to be in the Application Layer, and may include additional controls such as authentication. Server processes, also known as Daemons, typically run in the background (as a service does) awaiting client requests – or listening. A layer 7 server may employ various underlying processes resulting in a number of connections between two devices, as well as serving data to many clients simultaneously. Each dialogue must be kept seperate.
A port is an address used for a service. Each service uses its own port on a device. Some ports include 53 for DNS, 80 for HTTP and 443 for HTTPS. Some services use mutliple ports, such as DHCP using ports 67 and 68, and FTP using ports 20 and 21.
In a Peer to Peer infrastructure each device acts as both a client and a server, assuming the required role on a per-request basis. Peer to Peer networks have no centralised resources or dedicated server, causing difficulty in administering security requirements, policies and user accounts. A Peer to Peer application is software which acts as a server and a client in a single communication, such as many popular file sharing applications.
During the outline of the DNS service, we were introduced to the nslookup tool as well as having some of the DNS record types explained. A records are for end devices. NS is an authoritative name server. CNAME is a canonical name or FQDN. MX is mail exchanger.
Most DNS servers and resolvers cache DNS records, to reduce bandwidth use by continually querying the top, second etc. level servers for records. A server with name records corresponding to its position in the DNS system heirarchy is considered an authoritative server for that domain.
The HTTP system uses URLs and URIs to access data stored on remote servers. There is also the HTTPS system which includes encryption for more secure data transfer. Browsers may require plugins to correctly interpret and display various data types such as Flash.
HTTP requests include GET – gets data. POST sends data such as form content. PUT uploads resources such as files.
In SMTP, the MTA is the Mail Transport Agent and transfers mail to other MTAs and the MDA. It also accepts outgoing mail from the MUA. The MDA is the Mail Delivery Agent. It is responsible for delivering mail to the users inbox and accepting connections from the MUA to collect mail awaiting delivery. The MUA is the Mail User Agent, or the “Email Software”. It is possible to setup web-based software so users with no MUA can view their mail via a web browser.
It is possible to use the Telnet Application to connect on port 25 to an MTA and manually create a mail or just test connectivity. Some example commands were provided in the chapter. You can also connect to the MDA on port 110 to test connectivity, user credentials and see waiting mail.
A DHCP transaction occurs when a host configured to obtain its IP address, layer 3 address, from a server broadcasts a DHCP Discover packet.
Available DHCP servers will respond with a unicast DHCP Offer packet.
The client then responds with a DHCP Request packet, specifying the server which is having its offer accepted and which lease offer is being accepted.
The server then responds with a DHCP Ack packet, allowing the client to assume that layer 3 address, knowing it has been temporarily removed from the available IP pool and no conflicts will occur. The transaction is then considered finalised until the lease is close to expiring, where the client sends another DHCP Request packet to the server in order to renew the lease.
A possible response from the server is a DHCP Nak packet, which is a negative acknowledgement. The DHCP process then begins from the start. The NAK packet may be transmitted when multiple clients are offered the same IP Address, with the slower client missing out.
SMB is used for resource sharing, and is the backbone of Microsoft file and print sharing. It is a request – response protocol which establishes long term, authenticated sessions between devices. In pre-windows 2000 environments a non-tcp/ip smb protocol was used but more recent operating systems use tcp/ip and dns naming.
SMB messages can start, authenticate and end sessions, control file and printer access, allow applications to send and receive files to and from other devices.
Sharing resources from Linux based computers is possible using the Samba application. Apple also supports SMB resource sharing.
The Gnutella protocol supports 5 types of packets – Ping, Pong, Query, Query Hit and Push.
Telnet is one of the oldest application layer protocols / services. Its primary use is to establish VTYs or virtual terminals with remote devices, however it can connect to many services and display the output on screen to verify a service is running our troubleshoot connectivity.
A telnet command can be sent to the remote device when a VTY is established. The commands first byte is an IAC or Interpret As Command. Other commands include Are You There (AYT), Erase Line (EL), Interrupt Process (IP).
Telnet supports user authentication but not data encryption, and SSH should be used for sessions with virtual terminals where possible.
That concludes chapter 3.
Chapter 1
Chapter 1 introduced data networks and the internet, along with the role these networks play in the “human network”, creating a global community. It also outlined some of the uses of the internet such as information exchange; improved quality, speed and decreased cost of communication and collaboration; facilitation of education – providing more current material to a wider audience at a lower cost; and entertainment uses.
It then went on to outline the elements of the network and discuss the importance of the standardisation of those elements such a rules for communication, format of messages and standards for media.
A brief outline of converged networks was provided, presenting the convergence of various types of communication networks as the first step to an “intelligent information network”.
We were given a history of packet switched networks, and the differences between circuit switching and packet switching. Network infrastructure was discussed, introducing concepts such as network QoS, scalability, fault tolerance as well as the increasing need for end device mobility and wireless network capabilities – and the need for security. The data network has become an integral part of day to day life.
We were also introduced to the Packet Tracer software, and referred to the book “A mathematical theory of communications” which I have not yet read.
This chapter provided a good introduction to the course, not rushing into technical details but giving a scope for the chapters to come.
Chapter 2
Chapter 2 introduced itself as describing some of the devices, media and messages which make up a network, as well as some of the rules and and process which govern the network. It also would introduce some of the tools and commands which are used to construct and maintain networks.
Network components were identified, including the end devices, intermediary devices and media. Types of networks were also described, from LANs to WANs and the Internet. Some graphical representations of network devices were provided, to assist in understanding how devices are shown in network diagrams.
The “protocol stack” was explained, and related to the layered models used to consider networks. Some of the industry standards associations were mentioned, and their purpose explained. The use of packets (encapsulated data) was shown, and the PDU and encapsulation process described.
We were shown how the use of models helps to conceptualise the network processes as well as keep processes seperate to aid in development and innovation, as well as keeping protocols media independent. The OSI and TCP/IP models were outlined.
Network addressing, ports and topology were touched upon. The networks function as a user-transparent connection medium was mentioned.
This chapter started to define some of the main aspects of the technical learning to come, while easing into some of the concepts behind the network without being confrontational with technical details, but preparing the student for the content of the next chapters.
Process Explorer
Handy little unit, this.
If you have some rogue thread under the svchost process and want to isolate it.
Find out what is using up all the disk I/O and making that workstation run like a dog.
Search for a filename that is reportedly locked and identify the process that has it locked.
Replace your Task Manager with something that has a truckload of extra features.
Take a look on the MS Virtual Academy http://www.microsoftvirtualacademy.com/training-courses/utilizing-sysinternals-tools-for-it-pros