802.3, commonly known as Ethernet for Local Arena Network (LAN) operation, is a specification for speeds ranging from 1Mb/s to 100 Gb’s / sec using common Media Access Control specifications.

IEEE 802.3u Fast Ethernet in the form of 100Base-T is one of the most widely used forms of Ethernet. It is often considered universal for LAN applications because of its ease of use, and because systems can sense whether 10Base-T or 100Base-T speeds are being used. Additionally, 100Base-T systems can be mixed with existing 10Base-T equipment. 100BaseT Ethernet is defined under the 802.3 family of standards under 802.3u. In a 100BaseT network, all nodes within share the 100Mbps bandwidth. The designation for 100Base-T is derived from standard format for Ethernet connections with the first figure being the designation for the speed in Mbps. The base indicates the baseband the system operates at, and the letters indicate the cable or transfer medium. Cabling versions include the following:

• 100Base-TX: Two pairs of Category (CAT) 5 UTP
• 100Base-T4: Four pairs of CAT 3 (now obsolete)
• 100Base-T2: Two pairs of CAT 3 (now obsolete)
• 100Base-FX: Uses two strands of multi-mode optical fibre for receive and transmit. Primarily intended for backbone use.
• 100Base-SX: Uses two strands of multi-mode optical fibre for receive and transmit. It is a lower cost alternative to using 100Base-FX.
• 100Base-BX: A version of Fast Ethernet over a single strand of optical fibre. Single-mode fibre is used, along with a special multiplexer which splits the signal into transmit and receive wavelengths.

The theoretical maximum data bit rate of the system is 100 Mbps though the actual transfer rate is less than the theoretical maximum in real networks. This is attributed to the additional data in the form of the header and trailer addressing, error-detection bits on packets, and occasional corrupted packets which needs to be re-sent. Additionally, time is lost time waiting after each sent packet for other devices on the network to finish transmitting.

Fast Ethernet can be transmitted over many types of medium, but the most common medium is CAT 5 cable. CAT 5 has four sets of twisted wires. With 10Base-T and 100Base-T, one pair of wires is used for transmission and another for received data. Data is carried differentially over wires where the “+” and “-” wires carry opposite signals as a method to cancel out radiation.

References

IEEE Standards Association. (2015). 802.3 – 2015 – IEEE Standard for Ethernet. Retrieved July 27, 2017, from https://standards.ieee.org/findstds/standard/802.3-2015.html.

Radio Electronics. (n.d.). 100 Mbps Ethernet / IEEE 802.3u including 100 Base-T. Retrieved July 27, 2017, from http://www.radio-electronics.com/info/telecommunications_networks/ethernet/100-mbps-ieee-802-3u-base-t.php.

Disclaimer

The post Fast Ethernet Specification – IEEE 802.3u appeared first on .

Today’s networks will always have data limitations. Data sets continue to grow on pace with increasing bandwidth availability making network-compression an important service in improving network performance. The network-compression used is actually a combination of compression and caching. It has been found that TCP rate control combined with network-compression provides the best value in terms of optimizing networks.

Compression reduces the size of data frames transmitted over networks. Reducing frame size results in frames taking up less bandwidth allowing greater volumes of network traffic. Data compression is normally classified as Hardware or Software compression’s. Software compression can be further broken down into two types, CPU-intensive or Memory-intensive.

Stacker compression is based on the Lempel-Ziv algorithm and uses an encoded dictionary that replaces a continuous stream of characters with codes. This scheme is known for its flexibility, particularly in regards to Local Area Network (LAN) data since many different applications might be transmitting over the network at any given time. The dictionary approach can change to accommodate and adapt to traffic variables.

Predictor compression attempts to predict the next sequence of characters in a data stream using an index to lookup the compression sequence. By examining the next sequence, it can see if it matches the index. If so, the sequence replaces the looked-up sequence in the dictionary. If there is no match, the algorithm locates the next character sequence in the index and the process begins again. The Predictor compression ratio is not as good as other algorithms, but it remains one of the fastest algorithms available. Predictor is more memory-intensive and less CPU-intensive.

Additionally, there are also proprietary compression’s such as Cisco IOS software and Cisco hardware compression’s. Cisco IOS software supports several third-party algorithms, including Hi/fn Stac Limpel Zif Stac (LZS), Predictor, and Microsoft Point-to-Point Compression (MPPC). Compression can be used on the entire-packet, header-only, or on a payload-only basis. Cisco hardware compression is specifically designed for receiving multiple compression streams coming from remote Cisco routers using Cisco IOS software-based compression. The combination of IOS and hardware compression is designed to improve overall network performance.

In summary, compression overall improves network transmission efficiency, but much of the overall efficiency relies on other parts of the network. Slow, or problem hardware or devices anywhere in the network can still cause bottlenecks that will decrease performance of a network. Additionally, network device and software performance is dependent on computing resources available, namely sufficient memory and CPU resources. If a device or software performing compression/decompression does not have sufficient computing power it results in bottlenecks that degrade the overall performance of the network.

References

Cisco Understanding Data Compression. (2008, January 15). Understanding Data Compression. Retrieved July 20, 2017, from http://www.cisco.com/c/en/us/support/docs/wan/data-compression/14156-compress-overview.html.

Withers, S. (2005, February 10). 10 ways to improve network performance. Retrieved July 20, 2017, from http://www.zdnet.com/article/10-ways-to-improve-network-performance/.

Disclaimer

The post Compression of Network Data and Performance Issues appeared first on .

The following is a list of recommended Virtual Private Network monitoring and security controls:

• Use firewalls and Intrusion Detection/Prevention Systems (IDS/IDPS) in order to monitor VPN connections.
• Use anti-malware and personal firewalls on remote clients and servers.
• All VPN connections require authentication.
• Logging enabled and auditing performed on a regular basis in order to detect possible attacks.
• Establish user and administrator security training requirements.
• VPN’s placed within a Demilitarized Zone (DMZ) to isolate them from internal protected networks.
• Split tunneling to allow local internet access on remote hosts should be prohibited.
• Use strong authentication mechanisms to include certificates, smart cards, or tokens.
• Access privileges granted on as-needed basis.
• Use strong alternative authentication mechanisms such as Terminal Access Controller Access Control System (TACACS), and Remote Authentication Dial-In User Service (RADIUS).
• Remote access computers physically secure.
• Use strong industry proven encryption with sufficient key strength to protect confidentiality.

It is important to note that even though Virtual Private Networks provide secure communications over insecure networks, client-side security must also be addressed in order to ensure end-to-end security.

References

HKSAR-The Government of the Hong Kong Special Administrative Region. (2008, February). VPN Security. Retrieved September 20, 2017, from https://www.infosec.gov.hk/english/technical/files/vpn.pdf.

Oracle Docs. Defining a VPN. https://docs.oracle.com/cd/E19047-01/sunscreen32/806-6347/6jfa0g87q/index.html.

Tech Target. Virtual Private Network. http://searchnetworking.techtarget.com/definition/virtual-private-network.

The post Virtual Private Network (VPN) Security and Monitoring Controls appeared first on .

• Administrative cost of management.
• Administrative cost of management.
• Bandwidth usage for both baseline and during networks events.
• Frequency of network failures.
• Network recover time.
• Convergence time.
• Network topology.

The protocol used usually involves a trade-off between these factors, gaining one of these factors often means accepting deficiencies in others. Topology of a network is important because it affects convergence times of different protocols. Network topology is a primary consideration when selecting a routing protocol (Weaver et al., 2012).

There  are  two  versions  of  RIP.  RIPv1  uses  classful  routing  and  does  not  include subnet  information  while sending  out routing table  updates.  RIPv2  is  classless and  includes subnet  information  supporting Classless Inter Domain Routing (CIDR). RIPv2 multicasts routing updates to other adjacent routers using the address 224.0.0.9. Network convergence happens much faster in RIPv2. RIP has the following advantages in small networks, It is easy to understand, it is easy to configure, and it is widely used and is supported  by almost all routers. The primary disadvantage of RIP is that it is limited to 15 hops. Any router beyond that distance is unreachable making it unsuitable for large networks. RIP can create a traffic bottleneck by  multicasting  all  the  routing tables every 30 seconds which is bandwidth intensive.  RIP  has  very slow network convergence in large networks. Additionally,  RIP doesn’t support multiple paths on the same route resulting in a higher chance of routing loops causing a higher loss of transferred data (Solarwinds Routing Protocols, 2014, pg. 4-5).

EIGRP is a distance vector routing protocol that exchanges routing table information with  neighboring routers in an autonomous system.  Unlike RIP,  EIGRP shares routing table  information that  is not available in neighboring routers which reduces  traffic transmitted through routers. EIGRP uses a Diffusing  Update  Algorithm (DUAL) which reduces the time  taken for network convergence thereby improving operational efficiency. EIGRP was a proprietary protocol from Cisco that was made an open standard in 2013. The primary advantages of EIGRP is fast network convergence, low CPU utilization, and easy configuration. EIGRP  has more adaptability and versatility in large complex networks. EIGRP combines many features of both link state and distance vector. Since EIGRP is mostly deployed in large  networks, routers have a tendency to delay sending routing information at scheduled times  which can cause neighboring routers to query the information repeatedly increasing network traffic (Solarwinds Routing Protocols, 2014, pg. 5-7).

OSPF is a link state routing protocol used in large Autonomous System (AS) networks. OSPF gathers link state information from available routers and determines the routing table information to forward packets to based on the destination IP address. This is done by the router when it creates a topology map of the network. Any change in the link is immediately detected and the information is forwarded to all other routers ensuring that all the network routers have same routing table information. Unlike RIP, OSPF only multicasts routing information when there is a change in the network. OSPF has a complete knowledge of the network topology which allows routers to calculate routes based on incoming requests. Additionally, OSPF has no limitations in hop count, has faster convergence than RIP, and  does a better job of load balancing. The primary disadvantage of OSPF is that it does not scale well if more routers are added to a  network. This is due to the router maintaining multiple copies of  routing information. An OSPF network with intermittent links can increase traffic every time a router sends information. This lack of scalability in OSPF makes it unsuitable for routing across the Internet (Solarwinds Routing Protocols, 2014, pg. 3-4 ).

IS-IS was originally devised as a routing protocol for CLNP, but has been extended to include IP routing.  IS-IS is an Interior Gateway Protocol (IGP) used on the Internet to distribute IP routing information throughout a single AS in an IP network. IS-IS is a link-state routing protocol meaning routers exchange topology information with their nearest neighbors. The topology information is distributed throughout the AS so that every router within the AS has a complete picture of the topology of the AS. This is then used to calculate end-to-end paths through the AS usually using a variant of the Dijkstra algorithm. The main advantage of a link state routing protocol is that the complete knowledge of topology  which allows routers to calculate the best route in an AS. The primary disadvantage of IT-IT like other link state protocols is that it does not scale well as more routers are added to the routing domain. Increasing the number of routers increases the size and frequency of the topology updates (Metaswitch IS-IS, n.d.).

References

Metaswitch IS-IS. (n.d.). What is Intermediate System – Intermediate System (IS-IS)? Retrieved March 16, 2017, from http://www.metaswitch.com/resources/what-is-intermediate-system-to-intermediate-system-isis.

Solarwinds Routing Protocols. (2014). Network Routing Protocols – Back to Basics. Retrieved March 16, 2017, from http://web.swcdn.net/creative/pdf/Whitepapers/Network_Routing_Protocols_Back_to_Basics_SS.pdf.

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

The post Routing Protocols. RIP, EIGRP, OSPF, IS-IS appeared first on .

Weaver et al.’s (2012) provides the following list of BH characteristics:

• A machine with adequate memory and processor speed.
• All patches up to date.
• BH fits the network configuration and is in a secured controlled physical environment.
• Only necessary services installed. All other services disabled or uninstalled.
• Service accounts such as the administrator account are removed or disabled. Administrative privileges should be given to another created account.
• Machine is backed up to include configuration and log files.
• Regular security audits.
• Connected to the network.

BH’s  are usually located outside the internal network and used with packet filtering devices such as routers and firewalls. on either side. This helps protect the BH from attack because packets are filtered before they reach the BH (Weaver et al., 2012).

Dillard (n.d.) states that BH’s typically host web, mail, DNS, and FTP services, and are configured differently from other computers and servers. Each BH fulfills a specific role, all unnecessary services, protocols, programs, and network ports are disabled or removed. A BH does not share authentication services with trusted hosts within the network so that if a BH is compromised the intruder will not have unrestricted access. In addition to other hardening already mentioned, Access Control Lists (ACLs) will be modified on the file system and other system objects. Logging of all security related events need to be enabled and steps need to be taken to ensure the integrity of the logs so that a successful intruder is unable to erase evidence of a breach.

References

Dillard, K. (n.d.). IDFAQ: What is a bastion host? Retrieved April 3, 2017, from https://www.sans.org/security-resources/idfaq/what-is-a-bastion-host/2/11.

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

The post Bastion Host Overview appeared first on .