Network Management and Initialization Based on Computer Networks

Network Management and Initialization Based on Computer Networks and Internets, Comer CSIT 220 (Blum) 1

Network management: What is it? l A network manager is responsible for monitoring and controlling the hardware and software that make up a network. l l l The network manager works to repair the network when it goes down. The network manager also attempts to tune and tweak the network so that it operates more efficiently. There is a variety of software and hardware to help network managers in their work. CSIT 220 (Blum) 2

Network management l Network management can include: l l Security: Making sure that the network is protected from hackers, viruses, denial of service (Do. S) attacks, etc. Performance: Making sure the bandwidth is used to the fullest, eliminating bottlenecks, etc. Reliability: Making sure the network is up and running as much as possible. “Anticipate to Avoid” CSIT 220 (Blum) 3

Difficulty of Network Management l l Some failures, like a cut cable, while catastrophic are easy to detect. Intermittent or partial failures can be more difficult to find because TCP (with its retransmission procedure) is designed to “hide” (work in spite of) these problems. However, retransmission uses bandwidth that could be used for other traffic if the error did not occur. A good network manager will root out such problems before they become more severe. CSIT 220 (Blum) 4

SNMP l Simple Network Management Protocol is a set of rules for exchanging messages that allow a network manager to monitor and control network hosts/nodes. l l l The messages are called Protocol Data Units (PDUs) and are sent using User Datagram Protocol (UDP). SNMP is part of TCP/IP and as with many other application layers services it is a separate install. The term “manager” refers not only to the person overseeing the network but also to special software used. CSIT 220 (Blum) 5

Uses UDP CSIT 220 (Blum) 6

Vocabulary change l l SNMP follows the standard client-server paradigm — a client requests and a server responds/replies. But the situation is somewhat unusual in that there are more servers than clients in this case and the client’s machine is probably the better machine. The SNMP client runs on the manager’s computer and is called the manager. The SNMP server runs on various hosts and is called the agent. CSIT 220 (Blum) 7

Vocabulary change II l Client Server Manager Agent Client is to server as manager is to agent, i. e. the manager requests information from the agent, the manager initiates. CSIT 220 (Blum) 8

A community l l The manager (a person) organizes the computers into groups for management purposes, these are called communities. A computer can belong to more than one community. The manager (software) requests information (network statistics, such as how many packets required retransmission) from the agents in its community. The manager can set parameters on the agents and thus change delivery routes, configure network interfaces, etc. CSIT 220 (Blum) 9

Fetch and Store l l The S in SNMP is “simple” because it has a small set of commands. The manager can request a value from an agent — a fetch. l l the agent receives the request, retrieves information from an MIB (management information base) and sends it to the manager. The manager can request an agent to set a parameter to a particular value — a store. l Certain parameter values are interpreted by the agents as a command cause them to initiate a sequence of events, such as a reboot. CSIT 220 (Blum) 10

MIB l l l The information (and procedures) accessed by SNMP are stored in the Management Information Base (MIB). The SNMP specifies a few simple messages. The complexity and flexibility (how to handle new software or hardware) is in MIB. A separate standard defines MIB variables and the meaning of the operations on each variable. CSIT 220 (Blum) 11

SNMP Messages l Get: The simplest SNMP request message. A manager sends a get message requesting a single MIB entry (e. g. , the amount of free drive space); the agent responds with the entry — provided the manager belongs to the same community as the agent. CSIT 220 (Blum) 12

SNMP Messages l l Get-next: A type of request message that can be used to browse the entire collection of management objects. When a manager sends a get-next request for a particular object, the agent replies with the identity and value of the object which follows the object in the request message. Get-next is useful for accessing tables, such as internal IP route tables. CSIT 220 (Blum) 13

SNMP Messages l Getbulk: Requests that the data packets sent by the agent be as large as possible. This minimizes the number of protocol exchanges required. l l The maximum message size should not be larger than the path MTU. Set: If the manager has write privileges, this message is used to update an agent’s MIB value. CSIT 220 (Blum) 14

SNMP Messages l Trap: Typically the manager (client) requests and the agent (server) responds. However, some situations require the agent to initiate an interaction. A trap is an unsolicited message sent by an agent to a manager when certain predefined conditions occur in the agent. l l l The manager that receives a trap message is known as a trap destination. There may be more than one manager. E. g. , a trap might be sent if a host is about to go down. E. g. a trap might be sent if a manager without permission contacts an agent. CSIT 220 (Blum) 15

SNMP Help CSIT 220 (Blum) 16

SNMP Help CSIT 220 (Blum) 17

SNMP Help CSIT 220 (Blum) 18

SNMP Help CSIT 220 (Blum) 19

Scenario from Help The management system (Host A), sends an SNMP datagram to the agent (Host B), using the agent's host name, IP address or IPX address. The SNMP agent receives the datagram and verifies the community name to which the management system belongs. 1. 2. A. B. If it is a valid community name, the agent retrieves the data requested from the appropriate SNMP subagent. The SNMP agent returns the datagram to the management system with the requested information. If the community name is incorrect, the agent sends an "authentication failure" trap to its trap destinations (Hosts C and D). CSIT 220 (Blum) 20

And now for something completely different CSIT 220 (Blum) 21

DHCP Dynamic Host Configuration Protocol does not require an administrator to add an entry for a computer into the database. l Instead DHCP is “plug-and-play” networking. The computer runs a client to l obtain configuration info from DHCP l obtain a permanent address if the computer is nonmobile. l CSIT 220 (Blum) 22

DHCP l l l DHCP uses permanent address that are assigned to server computers and a pool of addresses that are allocated on demand. Based on the computer’s entry in the server’s database, the DHCP decides the type of address to assign. For dynamic addresses, the computers IP may change with each boot. l This challenges internet connections. (Recall dynamic DNS. ) CSIT 220 (Blum) 23

DHCP Considerations l l When a system reboots, there is a flood of DHCP requests. This is handled by using a random wait time before transmitting an address request. Caching allows the computer to save the DHCP server’s address in a cache on a permanent storage, and use the cache information on reboot once it has been validated. CSIT 220 (Blum) 24

Lease l l l DHCP uses the concept of a "lease" or amount of time that a given IP address will be valid for a computer. The lease time can vary depending on how long a user is likely to require the Internet connection at a particular location. It's especially useful in education and other environments where users change frequently. Using very short leases, DHCP can dynamically reconfigure networks in which there are more computers than there available IP addresses CSIT 220 (Blum) 25

APIPA l l l Automatic Private IP Addressing, a feature of the Windows 98 and Windows 2000 If a DHCP client finds no DHCP server when it boots, it uses APIPA to automatically configure itself with an IP address from a range that has been reserved especially for Microsoft. The IP address range is 169. 254. 0. 1 through 169. 254. 255. 254. The client also configures itself with a default class B subnet mask of 255. 0. 0. A client uses the self-configured IP address until a DHCP server becomes available. CSIT 220 (Blum) 26

Network Security Based on Computer Networks and Internets, Comer CSIT 220 (Blum) 27

Security Policy l l Information must be seen as part of a company’s assets and thus worth securing. On the other hand, if the information is not accessible to an appropriate set of people, it is worthless. Thus security and accessibility must be balanced. There is no ideal blend that is right for all companies. An important step toward securing a network is to develop a security policy. CSIT 220 (Blum) 28

Security policy l l l A security policy is a written document stating how a company intends to protect its information. While written, it must be flexible so it can adapt to changes in technology and so forth. A security policy might include l l A description of who has access to what information and for what use. A description of security measurements and penalties for the violation thereof. An evaluation procedure. A policy for educating users. CSIT 220 (Blum) 29

Security Aspects l Some aspects of data security to address are l l Integrity: the data should be protected from corruption (accidental or intentional). Availability: the data should be readily accessible by designated users. Confidentiality: the data should not be accessible by undesignated users. Privacy: in some situations it is the user’s data that requires protecting. CSIT 220 (Blum) 30

Protecting Data from Accidental Corruption l l Checksum, CRC and parity are used to ensure integrity during transmission, similar approaches can be used on information in storage. A backup scheme can be seen as protecting data integrity. A RAID (Redundant Array of Independent/ Inexpensive Disks) scheme protects integrity while maintaining availability. Protect hardware from power surges, water damage, etc. CSIT 220 (Blum) 31

Protecting Data from Intentional Corruption l l Authenticate users before giving them access to information. Restrict access to hardware, computers, servers, hubs, etc. Protect the network against viruses and hacker attacks. Have a recovery plan. CSIT 220 (Blum) 32

Data Availability/User Privacy l l l The whole reason for a network is sharing information and resources. Data and resources must be accessible to authenticated users. Protecting system data and resources should not violate the user’s privacy rights or at least the user’s level of privacy should be acknowledged. CSIT 220 (Blum) 33

Audit trail l l One mechanism for tracking security is an “audit trail. ” The term comes from accounting where it means the set of paperwork used to validate or invalidate an accounting procedure. Any logging of activity (paper or electronic) is known as an audit trail. One can track: l l The information a user accesses or attempts to access Businesses maintain an audit trail for customer transactions. Some ISPs and chat rooms maintain logs of users. Etc. CSIT 220 (Blum) 34

Authorization and Authentication l Authorization is the setting of user’s permissions l l Can a user read a file? Edit a file? Delete a file? Etc. Space and/or time limits on access, e. g. a user has so much space on a drive Location limits, certain information can only be accessed from certain locations Authentication is the attempt to ensure that the user is who he or she claims to be l l l Username and password Biometric devices Possessed object CSIT 220 (Blum) 35

Sniffing Passwords l l The problem with the username/password approach to authentication in networks is that the password information must be sent over the network where it can be read by a sniffer (computer with MAC card in promiscuous mode). The best defense here is to encrypt the communication. The password packet can still be sniffed but it is unintelligible to the hacker. CSIT 220 (Blum) 36

Cryptography l l l One way to secure data, be it in storage or in transit, is encryption. Encryption coverts information in its usual readable form (called plaintext) to information in an encoded, unreadable form (called cyphertext). PGP (Pretty Good Privacy) program: a good encrypter that works with most email systems. CSIT 220 (Blum) 37

Encryption l l The data is stored or transmitted in binary (numerical) form. To encrypt data one applies some mathematical operation to it. The mathematical operation should have an inverse so that one can recover the original data (decrypt the message). The mathematical operation often has a parameter (known as a key in encryption) which specifies the precise operation within a family of operations. CSIT 220 (Blum) 38

Caesar Shift Example l l l The Caesar shift is an early form of encryption. The mathematical operation is addition. The key (parameter) is the amount added, e. g. 3 CAT FDW (ASCII for C + 3 is ASCII for F) The inverse operation is subtraction which uses the same key. FDW CAT (ASCII for F - 3 is ASCII for C) CSIT 220 (Blum) 39

Public Key Encryption l l l In some cases, the parameters for the mathematical operation and its inverse are not the same. Then one is said to have two keys. For purposes of encryption, it is ideal if knowledge of one of the parameters does not (easily) lead to knowledge of the other. Such a mathematical operation is the basis for public key encryption. CSIT 220 (Blum) 40

Public Key/Private Key l A user is assigned two keys (a private key and a public key). l l l The private key should be known only to the user. The public key is published along with the user’s name. Someone can send the user a private message by using the user’s public key to encrypt, then the user is the only person (presumably) who can decrypt the message. CSIT 220 (Blum) 41

Digital signature l l Use this process in reverse. The user encrypts the message with his or her private key. Anyone with the users’ public key can decrypt it. BUT since the user’s public key decoded the message, the message must have come from the user l This does not give privacy but authentication. CSIT 220 (Blum) 42

Double Key Encryption l l l To have a private and authenticated transaction use two keys. Mary encrypts a message with John’s public key and then does a second encryption using her private key. The message must be decrypted using Mary’s public key (authenticated: we know it’s from Mary) and further decrypted using John’s private key (private: only John can do this). CSIT 220 (Blum) 43

Firewalls l l A firewall guards the perimeter of a network, all traffic flows through and is examined by the firewall. The earliest firewalls performed a packet filtering service. l l If sending packets is analogous to sending mail then a having a firewall is analogous to having the mail censored. Certain packets are not allowed in based on their content or source; certain packets are not allowed in based on their content or destination. CSIT 220 (Blum) 44

Firewall l l A firewall can help centralize part of a network’s security effort. A firewall can prevent l l l outsiders from probing all computers in an organization flooding the network with unwanted traffic attacking a computer by causing it to crash. CSIT 220 (Blum) 45

Firewall: Fig. 40. 1 CSIT 220 (Blum) 46

Packet filter CSIT 220 (Blum) 47

Firewall l l The firewall working closely with the router, it examines each packet to determine whether or not to forward it. The filtering may be based on any number of criteria: l l Source or destination IP address l Allow only certain addresses or rule out certain addresses Direction Service type (FTP, SMTP, telnet, etc. , identified by port number) Time CSIT 220 (Blum) 48

Firewall l l A firewall can also maintain an audit trail (log file). A firewall can be trained to look for virus signatures. The firewall can scan for tokens or tickets which authenticate users. A pair of firewalls can agree on an encryption scheme, for instance if two private networks are connected by a public line (a virtual private network). CSIT 220 (Blum) 49

Tunneling l l If one encrypted an entire packet it could not be delivered. But if one encrypts only the data then there all those fields supplying information about the source, destination, etc. One can encrypt an entire packet and then place it in another packet (encapsulate it). The destination of this outer packet must then decrypt the original packet and forward it, but by then it has presumably reached a private, secure network. CSIT 220 (Blum) 50

Tunneling CSIT 220 (Blum) 51

Proxy server l l A proxy is somebody who is authorized to stand in for somebody else. A proxy server stands in for the client on a private network in that when the client makes a request of a server outside the network, the request is made of the proxy server, the proxy server then makes the request of the destination — that is it stands in for the client. The reply is then passed from the proxy to original client. This way the destination does not learn the address of the true client, only that of the proxy. CSIT 220 (Blum) 52

Caching too l l The proxy server hides the private network’s addresses. Another benefit of a proxy is that it can cache results for the entire network. Like any host client, it checks its cache before requesting something. But the proxy had made the requests for all of the computers on the network. CSIT 220 (Blum) 53

Proxy server CSIT 220 (Blum) 54

Other References l l http: //www. webopedia. com http: //www. whatis. com Computer Dictionary, Shnier Microsoft 2000 help CSIT 220 (Blum) 55