Domain Name System (DNS) – Application Layer Protocol

Introduction:

Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution

The Domain Name System (DNS) is an application-layer protocol that plays a crucial role in the functioning of the World Wide Web (WWW) and other internet services. It enables the translation of human-readable domain names, such as www.zymitry.com, into machine-readable IP addresses. In addition to the World Wide Web, DNS is essential for enabling services such as email, file transfers, and other internet applications. By using DNS, users can navigate the internet using alphanumeric names instead of relying on IP addresses. DNS is an integral part of the application layer protocols, defining how applications on different systems communicate with each other.

Domain Name System and Application Layer Protocols:

An application-layer protocol defines how applications on different systems communicate with each other. In the case of DNS, it specifies the types of messages exchanged, their syntax, the information conveyed, and the rules for sending and responding to these messages. DNS is critical for efficient name resolution and is essential for web browsing, email services, file transfers, and various other applications.

DNS Hierarchical Structure and Name Resolution:

The Domain Name System follows a hierarchical structure that starts with thirteen root servers distributed worldwide. These root servers maintain a database of Top Level Domain (TLD) servers, such as .com, .edu, .net, and .org. The TLD servers, in turn, store information about Authoritative DNS servers, which manage databases of actual host names and their corresponding IP addresses. This hierarchical structure enables efficient and accurate name resolution.

Domain Name System Resource Records (RR):

DNS uses resource records (RR) to store mappings between host names and IP addresses. Each record consists of four fields: Name, Value, Type, and Time To Live (TTL). The Name and Value fields vary based on the record type. For example, an “A” record directly translates a host name to an IP address. Other record types include Name Server (NS) records for resolving DNS server names, Mail Server (MX) records for mail server resolution, and Canonical Name (CNAME) records for mapping IP addresses to host alias names.

DNS Messaging and Protocols:

DNS messages are sent and received over User Datagram Protocol (UDP) port 53. UDP is a lightweight, connectionless protocol used for fast transmission of DNS messages. While UDP does not guarantee message delivery, it is widely used due to its efficiency. TCP port 53 can also be used if UDP is not available, especially in IPv6 environments.

DNS Caching:

DNS caching is a mechanism used to improve DNS lookup efficiency and reduce network traffic. When a DNS resolver receives a DNS response, it stores the mapping between a domain name and its corresponding IP address in its cache. Subsequent requests for the same domain name can be resolved from the cache, eliminating the need for repeated queries to authoritative DNS servers. Caching occurs at different levels, including local DNS resolvers, ISP DNS servers, and web browser caches, helping to speed up the overall DNS resolution process. For example, a local DNS resolver can store frequently accessed domain name-to-IP mappings in its cache, reducing the latency and network traffic associated with querying external DNS servers.

DNS Security:

DNS security is of utmost importance due to the risks associated with DNS spoofing and cache poisoning. DNS spoofing involves falsifying DNS data to redirect users to malicious websites, while cache poisoning involves injecting false information into DNS caches. These attacks can lead to DNS spoofing, where users are directed to deceptive or harmful destinations. To address these risks, DNSSEC (DNS Security Extensions) was introduced. DNSSEC uses digital signatures to verify the authenticity and integrity of DNS responses, providing an additional layer of security and ensuring that users are directed to legitimate and trusted resources.

DNS Load Balancing and Redundancy:

DNS can be used for load balancing by distributing traffic across multiple servers. This helps optimize performance, improve response times, and ensure high availability of services. Various strategies, such as round-robin DNS, geoDNS, and Anycast routing, can be employed to achieve load balancing. Round-robin DNS rotates the order of IP addresses in DNS responses, distributing the load evenly. GeoDNS considers the geographic location of clients and directs them to the nearest server, reducing latency. Anycast routing involves using the same IP address for multiple servers located in different geographic locations, improving scalability and ensuring efficient load distribution. Load balancing provides benefits such as improved scalability, fault tolerance, and optimized resource utilization.

DNS Privacy and Anonymity:

Emerging concerns regarding DNS privacy highlight the need to protect user data and prevent unauthorized access. DNS queries traditionally transmitted in clear text can be intercepted and monitored, compromising privacy. The motivation behind DNS privacy concerns includes protecting user browsing habits, preventing surveillance, and combating censorship. To address these concerns, DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) have been introduced. DoH encrypts DNS queries using the HTTPS protocol, while DoT uses the Transport Layer Security (TLS) protocol. Both mechanisms ensure that DNS queries remain confidential and protected from interception, enhancing privacy and anonymity for users.

Conclusion:

The Domain Name System (DNS) is a critical application-layer protocol that enables the translation of domain names to IP addresses, facilitating seamless internet navigation. Understanding DNS, its hierarchical structure, resource records, and messaging protocols is crucial for managing and optimizing network resources. Moreover, considering enhancements such as caching, security measures, load balancing, and privacy mechanisms further enhances the reliability, performance, and security of DNS in modern network environments.

References

G. Palmer Security Notes (2015-2023)

Gonyea, C. (2010, August 25). DNS: Why It’s Important and How It Works. Retrieved July 5, 2017, from http://dyn.com/blog/dns-why-its-important-how-it-works/.

Hogg, S. (2010, August 22). Allow Both TCP and UDP Port 53 to Your DNS Servers. Retrieved July 5, 2017, from http://www.networkworld.com/article/2231682/cisco-subnet/cisco-subnet-allow-both-tcp-and-udp-port-53-to-your-dns-servers.html.

Kurose, J. F., & Ross, K. W. (2017). Computer networking: a top-down approach (7th ed.). Hoboken, NJ: Pearson.

TechNet DNS. (n.d.). Network Ports Used by DNS. Retrieved July 5, 2017, from Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution. https://technet.microsoft.com/en-us/library/dd197515(v=ws.10).aspx.

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

Fortinet: What Is DNS (Domain Name System)?

What is DNS? | How DNS works

Definition,  domain name system (DNS)

Amazon: What is DNS?

Application Layer Protocol

What is the DNS Layer and How Do I Secure It?

Javapoint: DNS

Note: This article has been revised and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Domain Name System (DNS) – Application Layer Protocol appeared first on .

Network Devices for Security+ Certification

Learn about Network Devices and Technologies for Security+ Certification: Essential Components for Network Security,

Introduction:

Enhance Your Network Security Knowledge: Exploring Essential Network Devices and Technologies

Are you interested in bolstering your understanding of network security? In this article, we delve into the world of network devices and their critical role in maintaining a secure network environment. Discover the significance of these devices and how they contribute to network security.

Objective:

Our objective is to provide insights into the security configurations of network devices and other technologies, specifically for the Security+ Certification exam. By comprehending these concepts, you can fortify your knowledge of network security and prepare effectively for the certification.

Network Devices and Technologies

Firewall:

A firewall is a network device that monitors and controls incoming and outgoing network traffic. It establishes a network traffic barrier between a trusted internal network and an outside network. For example, a firewall can control traffic between a trusted internal Local Area Network (LAN) and the Internet. By implementing rules, firewalls filter traffic to allow or deny specific network packets. Access rules can be specified for both inbound and outbound traffic.

Routers:

Routers are layer-3 devices in the Open Systems Interconnection (OSI) model. They perform routing, sending data from one network to another. Typically, routers connect multiple LANs or WANs, or a LAN and an Internet Service Provider (ISP) network. They use headers and forwarding tables to determine the best path for packet forwarding. Routers also create network boundaries known as broadcast domains, limiting broadcast messages to devices within each domain.

Load Balancers:

Load balancers distribute network traffic across multiple servers or resources to optimize performance, enhance scalability, and ensure high availability. By balancing the workload, load balancers prevent individual servers from overloading and provide fault tolerance in case of failures.

Proxy Servers:

Proxy servers act as intermediaries between client devices and servers, forwarding requests and responses. They enhance security by providing anonymity, caching content, and filtering network traffic. Proxy servers can also help optimize network performance by caching frequently accessed resources.

Intrusion Detection and Prevention Systems (IDPS):

IDPS are specialized devices that monitor network traffic to identify and prevent potential intrusions and security threats. They analyze network packets, detect malicious activities, and take proactive measures to protect the network. IDPS play a crucial role in detecting and mitigating various types of attacks, such as intrusion attempts and malware infections.

Content Filtering Appliances:

Content filtering appliances are devices that filter and control network traffic based on predefined policies. They block access to certain websites, limit bandwidth for specific applications, and enforce acceptable use policies within the network. Content filtering helps organizations maintain security, comply with regulations, and ensure productive use of network resources.

Virtual Private Network (VPN) Concentrators:

VPN concentrators enable secure remote access to a private network over public networks such as the internet. They manage VPN connections and encryption, ensuring secure communication between remote users and the corporate network. VPN concentrators provide a secure tunnel for data transmission, protecting sensitive information from unauthorized access.

Other Network Technologies:

In addition to network devices, various other network technologies play a crucial role in ensuring network security. These technologies work in conjunction with network devices to provide comprehensive protection and efficient network operations. Let’s explore some notable network technologies:

• Intrusion Prevention Systems (IPS): IPS devices actively monitor network traffic, detect potential threats, and take immediate action to prevent unauthorized access and attacks.
• Network Access Control (NAC): NAC solutions enforce security policies and control network access based on user identity, device compliance, and other defined parameters.
• Virtual Local Area Networks (VLANs): VLANs segment a physical network into multiple logical networks, providing enhanced security and isolation between different departments or user groups.
• Network Monitoring and Analysis Tools: These tools provide real-time monitoring, analysis, and reporting of network traffic, allowing administrators to identify potential security breaches or performance issues.

Network Devices for Security+ Certification

Conclusion:

In conclusion, network devices such as firewalls, routers, load balancers, proxy servers, IDPS, content filtering appliances, VPN concentrators, and other network technologies are essential components for network security. By understanding their functionalities, deployment scenarios, and configuration best practices, you can establish a secure and efficient network environment. Take the opportunity to further explore these topics and continue enhancing your network security knowledge.

References:

• G. Palmer Security Notes (2017-2023)
• Webopedia ISP
• Webopedia OSI
• Webopedia Router
• Firewalls
• LAN/WAN
• IDS/IDPS
• Content Filtering
• VPN Concentrator
• Load Balancers
• Pearson IT Certification | Network Implementation

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

Network Devices Explained

https://www.spiceworks.com/tech/networking/articles/what-is-network-hardware/

https://en.wikipedia.org/wiki/Networking_hardware

https://www.techtarget.com/searchnetworking/tip/An-introduction-to-8-types-of-network-devices

https://www.elprocus.com/what-is-a-network-technology-types-advantages-disadvantages/

https://www.networkworld.com/article/3685112/8-hot-networking-technologies-for-2023.html

Network Technology

Network Devices for Security+ Certification

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Network Devices for Security+ Certification appeared first on .

IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis

Updated June 19, 2023

Introduction:

References:

G. Palmer Security Notes (2017-2023)

Cepheli, O., Buyukcorak, S., & Kurt, G. K. (2016). Hybrid Intrusion Detection System for DDoS Attacks. International Conference on Intelligent Computing, Communication & Convergence (ICCC-2014). Retrieved from https://www.hindawi.com/journals/jece/2016/1075648/

Ja, J., & Muthukumar, B. (2015). Intrusion Detection System (IDS): Anomaly Detection using Outlier Detection Approach. International Conference on Intelligent Computing, Communication & Convergence (ICCC-2014). Retrieved June 16, 2023 from https://www.sciencedirect.com/science/article/pii/S1877050915007000

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

IDPS_Info498. (n.d.). Stateful protocol analysis detection. Retrieved March 28, 2017, from https://sites.google.com/site/idpsinfo498/home/common-detection-methodologies/stateful-protocol.

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

https://www.barracuda.com/support/glossary/intrusion-prevention-system

Intrusion Detection Systems

https://www.spiceworks.com/it-security/vulnerability-management/articles/what-is-idps/

Stay Secure Intrusion Detection

IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

This article is for informational purposes only. Terms and conditions of use apply.

Disclaimer

Terms and Conditions of Use

The post IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis appeared first on .

The improvement of wireless protocols is a major factor driving the development of newer Internet of Things (IoT) devices and systems. The Zigbee suite of communication protocols is used to create personal area networks with small, low-power digital radios, such as home automation, medical device data collection, and other low-power low-bandwidth needs. The Zigbee physical layer performs modulation on outgoing signals and demodulation on incoming signals. It transmits information and receives information from a source, and uses different frequency bands based on region as shown below.

Zigbee uses the Media Access Control (MAC) layer to access networks using Carrier-Sense Multiple Access with Collision Avoidance (CSMA/CA), to transmit beacon frames for synchronization and to support reliable transmission. It does not use all of the MAC functions used in other protocols, but uses the physical layer and MAC for CSMA/CA functions as previously mentioned, and as a method for defining the type of network topology in use This provides the ability to discover and join networks and expand on topologies defined by 802.15.4 at the MAC layer which allows mesh networking.

Devices in a Zigbee network have two addresses, a MAC address and a Network Address (NwkAddr). The MAC address comes from the underlying 802.15.4 protocol and the NwkAddr is part of the Zigbee layer itself. As in Ethernet networks, Zigbee networks use the MAC address to map to network addresses. Zigbee networks also use an Extended PAN ID (EPID) which is used in conjunction with the MAC address to filter out packets that are not part of the network.

When examining network broadcasting functions, specifically Unicast, a Network ACK is returned to the original node once a messages reaches its destination. At the MAC level, a MAC ACK is sent between each hop as the message propagates. Additionally, encryption can be applied at the MAC level as well as at the network and application support layers.

References

http://www.informit.com/articles/article.aspx?p=1409785&seqNum=7.

https://www.mwrinfosecurity.com/assets/Whitepapers/mwri-zigbee-overview-finalv2.pdf.

Silicon Labs IOT. (n.d.). The Wireless Protocols Tying Together the Internet of Things. Retrieved August 3, 2017, from https://www.silabs.com/documents/public/user-guides/ug103-02-fundamentals-zigbee.pdf.

Disclaimer

The post Zigbee IEEE 802.15.4 Internet of Things (IoT) Protocol appeared first on .

802.3, commonly known as Ethernet for Local Arena Network (LAN) operation, is a specification for speeds ranging from 1Mb/s to 100 Gb’s / sec using common Media Access Control specifications.

IEEE 802.3u Fast Ethernet in the form of 100Base-T is one of the most widely used forms of Ethernet. It is often considered universal for LAN applications because of its ease of use, and because systems can sense whether 10Base-T or 100Base-T speeds are being used. Additionally, 100Base-T systems can be mixed with existing 10Base-T equipment. 100BaseT Ethernet is defined under the 802.3 family of standards under 802.3u. In a 100BaseT network, all nodes within share the 100Mbps bandwidth. The designation for 100Base-T is derived from standard format for Ethernet connections with the first figure being the designation for the speed in Mbps. The base indicates the baseband the system operates at, and the letters indicate the cable or transfer medium. Cabling versions include the following:

• 100Base-TX: Two pairs of Category (CAT) 5 UTP
• 100Base-T4: Four pairs of CAT 3 (now obsolete)
• 100Base-T2: Two pairs of CAT 3 (now obsolete)
• 100Base-FX: Uses two strands of multi-mode optical fibre for receive and transmit. Primarily intended for backbone use.
• 100Base-SX: Uses two strands of multi-mode optical fibre for receive and transmit. It is a lower cost alternative to using 100Base-FX.
• 100Base-BX: A version of Fast Ethernet over a single strand of optical fibre. Single-mode fibre is used, along with a special multiplexer which splits the signal into transmit and receive wavelengths.

The theoretical maximum data bit rate of the system is 100 Mbps though the actual transfer rate is less than the theoretical maximum in real networks. This is attributed to the additional data in the form of the header and trailer addressing, error-detection bits on packets, and occasional corrupted packets which needs to be re-sent. Additionally, time is lost time waiting after each sent packet for other devices on the network to finish transmitting.

Fast Ethernet can be transmitted over many types of medium, but the most common medium is CAT 5 cable. CAT 5 has four sets of twisted wires. With 10Base-T and 100Base-T, one pair of wires is used for transmission and another for received data. Data is carried differentially over wires where the “+” and “-” wires carry opposite signals as a method to cancel out radiation.

References

IEEE Standards Association. (2015). 802.3 – 2015 – IEEE Standard for Ethernet. Retrieved July 27, 2017, from https://standards.ieee.org/findstds/standard/802.3-2015.html.

Radio Electronics. (n.d.). 100 Mbps Ethernet / IEEE 802.3u including 100 Base-T. Retrieved July 27, 2017, from http://www.radio-electronics.com/info/telecommunications_networks/ethernet/100-mbps-ieee-802-3u-base-t.php.

Disclaimer

The post Fast Ethernet Specification – IEEE 802.3u appeared first on .

Today’s networks will always have data limitations. Data sets continue to grow on pace with increasing bandwidth availability making network-compression an important service in improving network performance. The network-compression used is actually a combination of compression and caching. It has been found that TCP rate control combined with network-compression provides the best value in terms of optimizing networks.

Compression reduces the size of data frames transmitted over networks. Reducing frame size results in frames taking up less bandwidth allowing greater volumes of network traffic. Data compression is normally classified as Hardware or Software compression’s. Software compression can be further broken down into two types, CPU-intensive or Memory-intensive.

Stacker compression is based on the Lempel-Ziv algorithm and uses an encoded dictionary that replaces a continuous stream of characters with codes. This scheme is known for its flexibility, particularly in regards to Local Area Network (LAN) data since many different applications might be transmitting over the network at any given time. The dictionary approach can change to accommodate and adapt to traffic variables.

Predictor compression attempts to predict the next sequence of characters in a data stream using an index to lookup the compression sequence. By examining the next sequence, it can see if it matches the index. If so, the sequence replaces the looked-up sequence in the dictionary. If there is no match, the algorithm locates the next character sequence in the index and the process begins again. The Predictor compression ratio is not as good as other algorithms, but it remains one of the fastest algorithms available. Predictor is more memory-intensive and less CPU-intensive.

Additionally, there are also proprietary compression’s such as Cisco IOS software and Cisco hardware compression’s. Cisco IOS software supports several third-party algorithms, including Hi/fn Stac Limpel Zif Stac (LZS), Predictor, and Microsoft Point-to-Point Compression (MPPC). Compression can be used on the entire-packet, header-only, or on a payload-only basis. Cisco hardware compression is specifically designed for receiving multiple compression streams coming from remote Cisco routers using Cisco IOS software-based compression. The combination of IOS and hardware compression is designed to improve overall network performance.

In summary, compression overall improves network transmission efficiency, but much of the overall efficiency relies on other parts of the network. Slow, or problem hardware or devices anywhere in the network can still cause bottlenecks that will decrease performance of a network. Additionally, network device and software performance is dependent on computing resources available, namely sufficient memory and CPU resources. If a device or software performing compression/decompression does not have sufficient computing power it results in bottlenecks that degrade the overall performance of the network.

References

Cisco Understanding Data Compression. (2008, January 15). Understanding Data Compression. Retrieved July 20, 2017, from http://www.cisco.com/c/en/us/support/docs/wan/data-compression/14156-compress-overview.html.

Withers, S. (2005, February 10). 10 ways to improve network performance. Retrieved July 20, 2017, from http://www.zdnet.com/article/10-ways-to-improve-network-performance/.

Disclaimer

The post Compression of Network Data and Performance Issues appeared first on .

Transmission Control Protocol (TCP) Hybla.

A key component of TCP is a congestion-control mechanism. TCP does this by having each sender limit the rate based on perceived network congestion. If a TCP sender perceives that there is little congestion on the path between itself and the destination, it increases its send rate. If the sender perceives that there is congestion along the path, then the sender reduces its send rate.

One of the newer congestion algorithms that aims to improve network connection performance is TCP Hybla. Hybla is designed to address some of the negative effects of long network Round-Trip Times (RTT) to include reduction of the Congestion Window (cwnd) growth rate, and multiple losses in one Congestion Window. To address the issue of slow cwnd increase, TCP Hybla removes the reliance on RTT from the cwnd algorithm. This is done by adjusting the size of the cwnd to a normalized ratio of the previous window which results in a larger average cwnd as shown in the calculations below:

To alleviate packet loss in the window, TCP Hybla uses Selective Acknowledgement (SACK) which allows the sender to know exactly which packets have been sent successfully, and the ability to send more than one packet per RTT.

Another enhancement of TCP Hybla is packet spacing during transmission. As previously stated, Hybla results in a larger cwnd size which can result in erratic transmission bursts. These bursts can be smoothed out using more intermittent transmissions and spacing each transmission out over a period of  time. TCP Hybla is well suited for satellite transmissions and other connections that typically have a high RTT.

References

Kurose, J. F., & Ross, K. W. (2017). Computer networking: a top-down approach (7th ed.). Hoboken, NJ: Pearson.

Marcondes, C., Matthews, J., Chen, R., & Sanadidi, M. G. (2008, December 10). A Cross-Comparison of Advanced TCP Protocols in High Speed and Satellite Environments. Retrieved July 13, 2017, from http://wons09.cs.ucla.edu/publication/download/482/getPDF.pdf.

Ndegwa, A. What is CWND and RWND?. https://blog.stackpath.com/glossary/cwnd-and-rwnd/.

TCP Selective Acknowledgments (SACK). http://packetlife.net/blog/2010/jun/17/tcp-selective-acknowledgments-sack/.

Disclaimer

The post Transmission Control Protocol (TCP) Hybla appeared first on .

The following is a list of recommended Virtual Private Network monitoring and security controls:

• Use firewalls and Intrusion Detection/Prevention Systems (IDS/IDPS) in order to monitor VPN connections.
• Use anti-malware and personal firewalls on remote clients and servers.
• All VPN connections require authentication.
• Logging enabled and auditing performed on a regular basis in order to detect possible attacks.
• Establish user and administrator security training requirements.
• VPN’s placed within a Demilitarized Zone (DMZ) to isolate them from internal protected networks.
• Split tunneling to allow local internet access on remote hosts should be prohibited.
• Use strong authentication mechanisms to include certificates, smart cards, or tokens.
• Access privileges granted on as-needed basis.
• Use strong alternative authentication mechanisms such as Terminal Access Controller Access Control System (TACACS), and Remote Authentication Dial-In User Service (RADIUS).
• Remote access computers physically secure.
• Use strong industry proven encryption with sufficient key strength to protect confidentiality.

It is important to note that even though Virtual Private Networks provide secure communications over insecure networks, client-side security must also be addressed in order to ensure end-to-end security.

References

HKSAR-The Government of the Hong Kong Special Administrative Region. (2008, February). VPN Security. Retrieved September 20, 2017, from https://www.infosec.gov.hk/english/technical/files/vpn.pdf.

Oracle Docs. Defining a VPN. https://docs.oracle.com/cd/E19047-01/sunscreen32/806-6347/6jfa0g87q/index.html.

Tech Target. Virtual Private Network. http://searchnetworking.techtarget.com/definition/virtual-private-network.

The post Virtual Private Network (VPN) Security and Monitoring Controls appeared first on .

• Administrative cost of management.
• Administrative cost of management.
• Bandwidth usage for both baseline and during networks events.
• Frequency of network failures.
• Network recover time.
• Convergence time.
• Network topology.

The protocol used usually involves a trade-off between these factors, gaining one of these factors often means accepting deficiencies in others. Topology of a network is important because it affects convergence times of different protocols. Network topology is a primary consideration when selecting a routing protocol (Weaver et al., 2012).

There  are  two  versions  of  RIP.  RIPv1  uses  classful  routing  and  does  not  include subnet  information  while sending  out routing table  updates.  RIPv2  is  classless and  includes subnet  information  supporting Classless Inter Domain Routing (CIDR). RIPv2 multicasts routing updates to other adjacent routers using the address 224.0.0.9. Network convergence happens much faster in RIPv2. RIP has the following advantages in small networks, It is easy to understand, it is easy to configure, and it is widely used and is supported  by almost all routers. The primary disadvantage of RIP is that it is limited to 15 hops. Any router beyond that distance is unreachable making it unsuitable for large networks. RIP can create a traffic bottleneck by  multicasting  all  the  routing tables every 30 seconds which is bandwidth intensive.  RIP  has  very slow network convergence in large networks. Additionally,  RIP doesn’t support multiple paths on the same route resulting in a higher chance of routing loops causing a higher loss of transferred data (Solarwinds Routing Protocols, 2014, pg. 4-5).

EIGRP is a distance vector routing protocol that exchanges routing table information with  neighboring routers in an autonomous system.  Unlike RIP,  EIGRP shares routing table  information that  is not available in neighboring routers which reduces  traffic transmitted through routers. EIGRP uses a Diffusing  Update  Algorithm (DUAL) which reduces the time  taken for network convergence thereby improving operational efficiency. EIGRP was a proprietary protocol from Cisco that was made an open standard in 2013. The primary advantages of EIGRP is fast network convergence, low CPU utilization, and easy configuration. EIGRP  has more adaptability and versatility in large complex networks. EIGRP combines many features of both link state and distance vector. Since EIGRP is mostly deployed in large  networks, routers have a tendency to delay sending routing information at scheduled times  which can cause neighboring routers to query the information repeatedly increasing network traffic (Solarwinds Routing Protocols, 2014, pg. 5-7).

OSPF is a link state routing protocol used in large Autonomous System (AS) networks. OSPF gathers link state information from available routers and determines the routing table information to forward packets to based on the destination IP address. This is done by the router when it creates a topology map of the network. Any change in the link is immediately detected and the information is forwarded to all other routers ensuring that all the network routers have same routing table information. Unlike RIP, OSPF only multicasts routing information when there is a change in the network. OSPF has a complete knowledge of the network topology which allows routers to calculate routes based on incoming requests. Additionally, OSPF has no limitations in hop count, has faster convergence than RIP, and  does a better job of load balancing. The primary disadvantage of OSPF is that it does not scale well if more routers are added to a  network. This is due to the router maintaining multiple copies of  routing information. An OSPF network with intermittent links can increase traffic every time a router sends information. This lack of scalability in OSPF makes it unsuitable for routing across the Internet (Solarwinds Routing Protocols, 2014, pg. 3-4 ).

IS-IS was originally devised as a routing protocol for CLNP, but has been extended to include IP routing.  IS-IS is an Interior Gateway Protocol (IGP) used on the Internet to distribute IP routing information throughout a single AS in an IP network. IS-IS is a link-state routing protocol meaning routers exchange topology information with their nearest neighbors. The topology information is distributed throughout the AS so that every router within the AS has a complete picture of the topology of the AS. This is then used to calculate end-to-end paths through the AS usually using a variant of the Dijkstra algorithm. The main advantage of a link state routing protocol is that the complete knowledge of topology  which allows routers to calculate the best route in an AS. The primary disadvantage of IT-IT like other link state protocols is that it does not scale well as more routers are added to the routing domain. Increasing the number of routers increases the size and frequency of the topology updates (Metaswitch IS-IS, n.d.).

References

Metaswitch IS-IS. (n.d.). What is Intermediate System – Intermediate System (IS-IS)? Retrieved March 16, 2017, from http://www.metaswitch.com/resources/what-is-intermediate-system-to-intermediate-system-isis.

Solarwinds Routing Protocols. (2014). Network Routing Protocols – Back to Basics. Retrieved March 16, 2017, from http://web.swcdn.net/creative/pdf/Whitepapers/Network_Routing_Protocols_Back_to_Basics_SS.pdf.

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

The post Routing Protocols. RIP, EIGRP, OSPF, IS-IS appeared first on .

Weaver et al.’s (2012) provides the following list of BH characteristics:

• A machine with adequate memory and processor speed.
• All patches up to date.
• BH fits the network configuration and is in a secured controlled physical environment.
• Only necessary services installed. All other services disabled or uninstalled.
• Service accounts such as the administrator account are removed or disabled. Administrative privileges should be given to another created account.
• Machine is backed up to include configuration and log files.
• Regular security audits.
• Connected to the network.

BH’s  are usually located outside the internal network and used with packet filtering devices such as routers and firewalls. on either side. This helps protect the BH from attack because packets are filtered before they reach the BH (Weaver et al., 2012).

Dillard (n.d.) states that BH’s typically host web, mail, DNS, and FTP services, and are configured differently from other computers and servers. Each BH fulfills a specific role, all unnecessary services, protocols, programs, and network ports are disabled or removed. A BH does not share authentication services with trusted hosts within the network so that if a BH is compromised the intruder will not have unrestricted access. In addition to other hardening already mentioned, Access Control Lists (ACLs) will be modified on the file system and other system objects. Logging of all security related events need to be enabled and steps need to be taken to ensure the integrity of the logs so that a successful intruder is unable to erase evidence of a breach.

References

Dillard, K. (n.d.). IDFAQ: What is a bastion host? Retrieved April 3, 2017, from https://www.sans.org/security-resources/idfaq/what-is-a-bastion-host/2/11.

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

The post Bastion Host Overview appeared first on .