Computers and Networking

Networking Tips

2012-02-19T18:54:00.001+03:00

Computer networks are used to share the data and resources and for the communications. To get the optimized performance, data protection, maintenance, improved reliability and the security, every system administrator and network administrator should know the basic maintenance, troubleshooting and security techniques. Downtime is very dangerous for the critical network business applications and servers. In this article, you will learn some of the best networking tips and by using them you can get the optimized performance from your network.

Security

A compute network is susceptible to the internet and external security related threats, which includes viruses, spyware, adware, Trojan horses, rootkits, web worms, intruders and hackers. To keep your network secure

Firewall: Install and configure a software/hardware firewall on your gateway and all other computers in your network. Firewall is used monitor the inbound and outbound traffic and block the unauthorized access and hackers’ attacks.
Antivirus: Install antivirus software such as Norton Antivirus, Trend Micro Office Scan, Panda Antivirus or McAfee and regularly scan your computer with an antivirus program.
Anti spyware: Install and configure an up-to-dated anti spyware software in your network.
Updated Operating System: Update your Windows based operating systems with the latest service packs, hot fixes and security patches.
Browser Security: Raise the level of security of your web browsers.

Connectivity

Computer networking sometimes considered to be complex and seems to hard to troubleshoot. The connectivity problems occur in the computer network due to the devices conflicts, outdated LAN card’s driver, faulty hardware, faulty cable or connectors and misconfigurations. To troubleshoot the connectivity related issues, you need to perform the following tasks.

Check the LEDs of your LAN card.
Update the driver of your LAN card.
Scan your computer for the viruses and spyware.
Check the UTP/STP cable, the both end of the cable should be properly inserted i.e. one end in the LAN card and one end in the hub/switch or router.
Check the configurations of the LAN card.
PING the destination computer and check the status.
If your problem is still not resolved, replace the LAN card and reconfigure it.

Maintenance

Computer network availability and security is very critical for the businesses. Maintenance include the domain setup, dealing with the internal and external security threats, assigning IP addresses to the computes, enabling/disabling network services like DHCP, FTP SMTP, SNMP, taking data backup, adding/removing users, troubleshooting the software/hardware, configuring the firewall and implementing the security in the overall IT infrastructure. To perform the maintenance related tasks in your compute network, you need the perfect tools.

Troubleshooting

You can troubleshoot the computer network related problems by using the right tools and techniques. Be default, Windows based operating systems offer the TCP/IP stack, which contains the troubleshooting and diagnostic utilities such as PING, IPCONFIG, Hostname, ARP, Telnet, NSLOOKUP, Tracert and many others. Pinging a network computer is the first troubleshooting step as it checks the connectivity with the destination computer. Additionally, you can use the other troubleshooting tools such as Ethereal, IP Sniffer, LanGuard, Packeteer and many others. These tools help to diagnose the cause of the problem and troubleshoot them.

Performance

To get the optimized performance from your computer network, you need to perform the following actions on every computer of your network.

Use System Tools
Delete Unnecessary Files
Update Device Drivers
Update BIOS
Uninstall Unused Programs
Update Operating System

Wireless Networking Security Tips

The following tips are very helpful in securing your wireless computer network.

Change the Default SSID
Change the Default Administrator’s password
Disable SSID broadcast.
Enable Mac Address Filtering
Assign Static IP address to the Network devices and computers.
Turn on and configure the firewall on every computer in your network.
Enable IPSec, SSL, Encryption, WPA and WPE according to your security requirements.

IT companies seek out network assessment services for the evaluation of their physical, operational, and technological controls.

How to Set up a Private Network

2012-01-11T17:42:00.000+03:00

A private network is one which either does not connect to the internet, or is connected indirectly using NAT (Network Address Translation) so its addresses do not appear on the public network. However, a private network allows you to connect to other computers that are on the same physical network. This is desirable when you wish to communicate with a group of other computers or share data and internet connectivity is not necessary.

Steps

Plan your network. This is probably the hardest part of setting up a network.

Draw any routers you may be using to separate major portions of your network first. Smaller private networks do not require routers, but may still use them for administrative reasons. Routers are only required if a.)Dividing your network into multiple smaller networks, b.) Allowing indirect internet access using NAT. Next, add any switches and hubs. For small networks, only one switch or hub may be necessary.
Draw boxes to represent the computers and lines connecting the devices together. This drawing will serve as your network diagram.

Although diagrams intended only for your own use may use any symbols you desire, use of industry standard symbols make this task simpler and eliminates confusion for others. Typical industry standard symbols are:

Routers: Circle with four arrows arranged in a cross. Or just a cross if drawing a quick draft.
Switches: Square or rectangle, with four staggered arrows, two in each direction. Represents the concept of signals being "switched" - relayed only out the port which leads to the intended user based on address.
Hubs: Same as switch, with a single double-headed arrow. Represents the concept of all signals being blindly repeated out all ports without concern for which port leads to the intended recipient.
Lines and squares can be used to represent connections leading to computers.

2
Create an address plan.

IPv4 (IP ver. 4) addresses are written like this: xxx.xxx.xxx.xxx (four numbers separated by three dots), in all RFC-1166 compliant countries. Each number ranges from 0 to 255. This is known as "Dotted Decimal Notation" or "Dot Notation" for short. The address is divided into two portions: the network portion and the host portion.

For "Classful" networks, the network and host portions are as follows:
("n" represents the network portion, "x" represents the host portion)

When the first number is 0 to 126 - nnn.xxx.xxx.xxx (ex. 10.xxx.xxx.xxx)
These are known as "Class A" networks.

When the first number is 128 to 191 - nnn.nnn.xxx.xxx (ex. 172.16.xxx.xxx)
These are known as "Class B" networks.

When the first number is 192 to 223 - nnn.nnn.nnn.xxx (ex. 192.168.1.xxx)
These are known as "Class C" networks.

When the first number is 224 to 239 - The address is used for multi-casting.

When the first number is 240 to 255 - The address is "experimental".

Multicast & Experimental addresses are beyond the scope of this article. However, do note that because IPv4 does not treat them the same way as other addresses they should not be used.
For simplicity "non-classful networks", sub-netting, and CIDR will not be discussed in this article.

The network portion specifies a network; the host portion specifies an individual device on a network.

For any given network:
- The range of all possible host portion numbers gives the Address Range.
  (ex. 172.16.xxx.xxx the range is 172.16.0.0 to 172.16.255.255)
- The lowest possible address is the Network Address.
  (ex. 172.16.xxx.xxx the network address is 172.16.0.0)
  This address is used by devices to specify the network itself, and cannot be assigned to any device.
- The highest possible address is the Broadcast Address.
  (ex. 172.16.xxx.xxx the broadcast address is 172.16.255.255)
  This address is used when a packet is meant for all devices on a specific network, and cannot be assigned to any device.
- The remaining numbers in the range are the Host Range.
  (ex. 172.16.xxx.xxx the host range is 172.16.0.1 to 172.16.255.254)
  These are the numbers you can assign to computers, printers, and other devices.
  Host Addresses are individual addresses within this range.
Assign network(s). A network, for this purpose, is any group of connections separated by a router.

Your network may not have routers or, if accessing the Internet with NAT, have only one router between your private network and the public internet. If this is your only router, or if you have no routers, your entire private network is considered one network.

Choose a network with a host range large enough to provide an address to each device. Class C networks (ex. 192.168.0.x) allow for 254 host addresses (192.168.0.1 to 192.168.0.254), which is fine if you have no more than 254 devices. But if you have 255 or more devices, you will either need to use a Class B network (ex. 172.16.x.x) or divide your private network into smaller networks with routers.

If additional routers are used, they become "internal routers", the private network becomes a "private intranet", and each group of connections is a separate network requiring its own network address and range. This includes connections between routers, and connections directly from a router to a single device.

For simplicity, the remainder of these steps will assume you have only one network, of 254 or less devices, and uses 192.168.2.x as an example. We will also assume you are not using DHCP (Dynamic Host Control Protocol) to assign host addresses automatically.

3
    Write "192.168.2.x" in the corner somewhere. If you have more than one network it's best to write each address near the network it belongs to.

4
     Assign host addresses within the range of 1 to 254 to each computer.
Write the host addresses next to the devices they belong to on the diagram. At first you may wish to write the entire address (ex. 192.168.2.5) next to each device. However, as you become more proficient simply writing the host portion (ex. .5) may help save time.

Switches will not require addresses for the purpose discussed here. Routers will require addresses as described in the "Important Notes" section.

5
     Write down the subnet mask near the network address.
         For 192.168.2.x, which is a Class C, the mask is: 255.255.255.0 The computer needs it to tell which part of the IP address is the network and which is the host.

IPv4 originally used the first number (ex. 192) to determine this based on the address class, as described above. However, the advent of subnetting and nonclassful networking made it necessary to provide a mask because other ways of dividing the address into network and host portions are now possible. For Class A addresses the mask is 255.0.0.0, for Class B it's 255.255.0.0 (More information in the Important Notes section.)

6
      Connect your network.
   Gather all needed materials including cables, computers, ethernet switches, and (if used) routers. Locate the Ethernet ports on the computers and other devices. Look for the 8-pin modular connector. (RJ-45 style) It looks like a standard telephone jack except it's a bit larger because it has more conductors.

Connect the cables between each device, just as in your map. If an unforeseen circumstance causes you to vary from the diagram, make notes to show any changes.

7
      Boot all the computers connected to the network.
Power on all other connected devices. (Some devices have no "power switch" and will power up simply by plugging them in.)

8
Configure the computers for networking.
Go to internet options (this varies depending on the Operating System), and go to the dialog box that lets you change the TCP/IP protocol. Change the radio buttons from "Obtain from DHCP server automatically" to "Use the following IP address:". Type in your IP address for that computer, and the appropriate subnet mask (255.255.255.0).

If you have no routers, leave the "Default Gateway" and "DNS server" fields blank.

If connecting to the internet using NAT, use the Host Address assigned to the router between your private network and the internet as both the DNS server and the Default Gateway. Do not use the Network Address (192.168.2.0)

If using more than one router see the Important Notes section.

If configuring a home network with a relatively new router, This section can be ignored as long as the network is connected correctly, The router will assign network addresses to everything on the network going into your network, until it hits another router.

9
       Verify connectivity.
The simplest way to do this is with Ping. Bring up MS-DOS or the equivalent on other OS's, (In Windows open the command prompt which is located in the Start Menu - Accessories - Command Prompt) and type in: ping 192.168.2.[insert host number here]. Do this on one host and ping to all other hosts. Remember, your router is considered a host. If you cannot reach one, read over the steps again or contact a professional.

NAT allows private networks to connect to public networks, by converting IP addresses on the private network to ones allowed on the public network. All devices will appear from the Internet's perspective to be connected to one of its public networks according to the public addressing plan (as defined by IANA - Internet Assignment Numbering Authority). "Dynamic NAT" allows multiple private IPs to "take turns" using a public IP.

A related technology, PNAT (Port Network Address Translation) - also known as PAT (Port Address Translation) or NAT "Overloading", allows multiple private IPs to "share" one public IP at the same time. It manipulates both OSI Layer 3 and OSI Layer 4 information so connections from multiple private IPs appear to come from one computer with one public IP.

Many computer, electronics, and even department store sell small routers designed to allow multiple users to share a single internet connection. Almost all of these use PAT, to eliminate the need for more than one public IP (extra public IPs may be expensive, or not allowed, depending on your provider).

If you use one, you will need to assign one of your private network's Host Addresses to the router.

If using a more complex commercial router, you will need to assign a private Host Addresses to the interface connecting to your private network, your public IP to the interface connecting to the Internet, and configure NAT/PAT manually.

If using only one router, the interface used to connect the router to your private network will become both the "DNS Server Interface" and the "Default Gateway". You will need to add its address to these fields when configuring your other devices.
If your network is divided using one or more internal routers, each router will require an address for each network connected to it. (IP Unnumbered is beyond the scope of this article) This address will need to be a host address (just like a computer's) from the host range of the network. Typically, the first available host address (that's the second address in the address range ex. 192.168.1.1) will be used; however any address in the host range is fine as long as you know what it is. Do not use the network address (ex. 192.168.1.0), or the broadcast address (ex 192.168.1.255).

For networks containing one or more user devices (ex. printers, computers, storage devices) the address the router uses for that network will become "Default Gateway" for the other devices. The DNS server, if present, should remain the address used by the router between your networks and the internet. For networks interconnecting routers, no default gateway is needed. For networks containing both user devices and routers, any router on that network will do.

A network is a network, no matter how big or small. When two routers are connected by one cable, even though a Class C (the smallest network) contains 256 addresses, all will belong to the cable. The network address will be .0, the broadcast will be .255, two of the hosts will be used (one for each interface the cable connects), and the other 252 will simply go to waste because they cannot be used anywhere else.

Generally, the small home routers described above are not used for this purpose. When they are, understand the ethernet interfaces on the "private network" side usually belong to a "switch" which is built into the router. The router itself connects to this internally using only one interface. When this is the case, only one host IP will be used by all of them, and they will all be on the same network.

When a router has multiple interfaces with multiple IP's, each interface and IP will create a different network.

The concept of a subnet mask. The general concept will help in understanding why this number matters.

Dotted decimal notation is a human way of writing IP Addresses to make them easier to work with. What the computer "sees" is 32 ones and zeros in a row like this: 11000000101010000000001000000000. IPv4 originally broke this into 4 groups of 8, hence the "dots" - 11000000.10101000.00000010.00000000, each group is an "octet" of 8 bits. Dotted decimal writes the value of the octet in decimal to make it easier for people to read - 192.168.2.0

A complex set of rules concerning the order of the ones and zeros in the first octet was used to create the "Classful Addressing Scheme"; however, no subnet mask was needed. For all Class A's the first octet was network, for Class B's the first and second were network, for Class C's the first three.

In 1987, intra-nets started becoming larger and the Internet was on its way. Wasting whole Class C ranges of 254 host addresses on small networks became a problem. Class A and B networks often wasted addresses because physical limitations forced networks to be divided by routers before they could get large enough to use so many addresses. (Class B's host range (256 X 256) - 2 = 65534 addresses; Class A's (256^3) - 2 = 16777214.)

Subnetting divides a large Classful network into many smaller "sub-nets" by increasing the number of ones and zeros used to address networks(leaving fewer for the hosts in each network). A small subnet can then be assigned to a small network without using a large number of extra addresses. To say which bits are the network address we use a 1. The "mask" (ex. 255.255.255.192) when converted to binary (ex. 11111111.11111111.11111111.11000000) defines exactly how many more bits are added to the network portion (ex. two host bit). In this example, one Class C with 254 hosts becomes four sub-nets with 62 hosts each. Of these sub-nets only two may be assigned to networks; the first and last cannot be used according to RFC-950.

Further discussion of the rules of subnetting is beyond the scope of this article. What matters here is that even though we are using Classful addresses, Windows (and other software) doesn't know this. And hence, will still need a mask to tell it how many bits we want to use for the network portion. By saying 255.255.255.0, we're saying that.

Tips

Many devices can determine if you are using a crossover or straight-through cable. If you are not so lucky to have auto-sensing on at least one of the devices connected by a cable, you must use the correct type between them. Computer/router-to-switch will require a straight-through; computer/router-to-computer/router a crossover. (Note: The ports on the back of some home routers actually belong to a switch built into the router, and must be treated as a switch)

Straight-through is a CAT-5, CAT-5e, or CAT-6 Ethernet Cable with the wires connected as follows:

On both ends: Orange Stripe; Orange; Green Stripe; Br CAT-6 Ethernet Cable with the wires connected:

On one end: Orange Stripe; Orange; Green Stripe; Blue; Blue Stripe; Green; Brown Stripe; Brown
On the other end: Green Stripe; Green; Orange Stripe; Blue; Blue Stripe; Orange; Brown Stripe; Brown

The above conforms to TIA/EIA-568 standard, however, all that is important for a crossover to work is for pins 1 & 2 (transmit) to switch places with pins 3 & 6 (receive) on the opposite end. For a straight-through pins should be the same on both ends. Color sets (ex. Orange Strip & Orange) mark twisted pairs. Keeping pin sets on the same twisted pair (i.e. pins 1 & 2 on one color set, and pins 3 & 6 on another) allows best signal quality.
- Note: TIA/EIA standard has not been established for CAT-7 or greater cabling.
Hubs are cheaper when connecting only a few devices, but they don't know which interface leads where. They simply repeat everything out all ports, hope it gets to the right device, and let the receiver decide if it needs the information or not. This wastes a lot of bandwidth, only allows one computer to talk at one time, and slows the network down when more computers are connected.
Switches cost more, but are smarter. They use addresses to decide where to send data, allow more than one device to talk at once, and don't waste the bandwidth of the other devices' connections.
Never connect hubs in any way which forms loops or rings, it will cause packets to be repeated around the ring forever. Additional packets will be added, until the hub is saturated and cannot pass traffic.

Best practice is to not connect switches this way either. If connecting switches this way, ensure the switch supports "Spanning Tree Protocol" and that the feature is active. Otherwise packets will repeat ad infinitum as with hubs.

Frame Relay | Packet Tracer

2011-12-15T16:51:00.000+03:00

Cisco CCNA Videos - Getting to Know Frame Relay

2011-12-15T16:45:00.000+03:00

Inter-Vlan Routing

2011-12-06T20:04:00.001+03:00

How to configure OSPF in Packet Tracer

2011-12-06T19:01:00.000+03:00

Configuring Access Lists and Network Security - cisco routers

2011-11-28T18:44:00.000+03:00

Once the router's interfaces are configured, a momment should be taken to determine if any of these interfaces connect to "secure" networks. These networks can be those that connect corporate workstations with the rest of your network or perhaps the rest of the internet. They could also be networks which house servers that provide specific services to the internet community but which you would like to protect as much as possible. A good example of such a server is a WWW server of SMTP gateway. The general public needs to be able to view your web page and send you mail but they do not need to be able to connect interractively to those servers. Other uses for access control could be in protecting parts of your corporate intra-net from other parts of your company. For example, if you have a Research and Development department, it is unlike that you'll be giving your sales staff access details on top secret projects. Likewise, you don't want your Research and Development department making some clever modifications to your accounting servers.
The traditional way of protecting such servers is with access lists. Access lists filter Internet traffic and determine if a packet is permitted to pass into or out of the network. Ideas about how access lists should be designed, where they should be placed, and how physical networks should be structured to allow propper filtering without overloading network links and the routers they connect varry considerably. Some corporations choose to invest in commercial "fire wall" products while others will implement minimal access controls at all. Still others will invest in the hardware necessary to service access lists at two levels (one router that blocks access to itself and the interrior router and a second, the interrior router, that blocks access to itself, is only accessible from inside or even only from its console, and provides primary access list control. This router generally does nothing else besides filtering packets and sending them to its default router or a local host.)

Which method you choose depends on your needed level of security, your budget, and the particular application for which the protection is needed. The decisions that lead to the various scenarios are beyond the scope of this document, however. This section intends to focus solely on access list design and implementation for the general case.
Cisco has created two different classes of access lists within its routers. The first, the standard access list, filters only on source address. If numbered access lists are being used (IOS 11.1 and earlier did not support named access lists), than these lists would be numbered from 1 to 99. The second type of access list, the extended access list, is numberes from 100 to 199 and is capable of filtering based on source address, destination address, protocol, protocol port number, and a myriad of other features not necessarily applicable to general IP traffic.
Once an access list is created, it must be tied to an interface in order to be used. The interface configuration considers a filter list to be an "access group". The access group can be applied either inbound or outbound with respect to the interface. For example:

Interface Serial0
  ip access-group 101 in
  ip access-group 6 out

This group of commands specifies that traffic coming into Serial0 must be processed through extended access list number 101 and that outbound traffic must pass through standard access list 10 before leaving the interface.
Standard access lists are configured by specifying a list number, wether a match on this entry will result in traffic being permitted or denied, and the host or network which is being filtered and the mask associated with it (if it is a network or subnet).

access-list 10 permit 234.5.6.12
 access-list 10 deny 5.10.10.32 0.0.0.31
 access-list 10 permit 5.10.0.0 0.0.255.255
 access-list 10 permit 123.234.0.0 0.0.0.255

The above example creates access list 10 and configured 4 entries. The first line permit all traffic with a source IP address of 234.5.6.12. Note that when a host IP address is listed, no mask needs to be associated with it. The second line denies all traffic from the subnet 5.10.10.32/27. One thing to observe about access lists is that instead of netmasks, they use what Cisco calls "wildcard masks." These masks function very similarly to netmasks with one important difference. Network masks operate from left to right. Wildcard masks operate from right to left. Therefore, when looking at the above configuration line, what the wildcard mask is matching is the 32 addresses that begin at 5.10.10.32. (Since zero is a valid mask, it counts as one address. Hence 31 is used in the mask instead of 32.)
The remaining two lines permit traffic from 5.10.10.0.0/16 and 123.234.0.0/24 respectively. On first glance, a newcommer to access lists might think that the only thing getting denied to this network is the second line and that the permit lines are unnecessary. Access lists, though, are designed to be selectively permissive, not to selectively deny traffic. As a result, an implicit deny exists at the end of this access list. (More propperly, anything that does not explicitly match an entry in the access list is dropped.)
There are a couple of other important things to consider when creating access lists. First, order is extremely important. Since access lists function through "short circuit" processing (bail out when a match is found), those entries that are most likely to match traffic should be listed first. IP access list processing is very processor intensive. By listing frequent matches first, processor utilization is kept to a minimum. Note also lines 2 and 3 of the above example. They state, collectively, that all traffic from 5.10.0.0/16 is to be permitted EXCEPT for those hosts in 5.10.10.32/27. If line 2 (the deny statement) were listed AFTER line 3, than the denial would have no effect. The traffic would be permitted as a result of line 3 and those hosts you intended to block would be allowed access. When you create access lists, you should review them very carefully to be certain that no mis-ordering has occured.
The second thing to watch for when creating access lists is the fact that changes to a cisco router take effect immediately upon entry. It is a fact that most access lists are not the stagnant, unchanging creatures we would like them to be. From time to time, they will require modification. Modifying an access list means deleting the existing list and recreating it with the appropriate changes. When an interface is configured to refference an access list that does not exist, the traffic will, by default, be permitted through. However, when you create that access list, the implicit denial at the end can result in your configuration session being filtered out. As a matter of policy, it is good practice to remove the refference to the access list from the interface before modifying the access list. (via "no ip access-group 123" or whatever access list you intend to refference.)
Building extended access lists is somewhat more complicated and requires a few more steps. Since extended access lists filter based on both the source and destination IP address, two parts to each entry are needed. The following is a brief example of an extended access list for IP.

access-list 101 permit tcp any any established
 access-list 101 permit tcp any 204.34.5.25 host eq 80
 access-list 101 permit ip 203.45.34.0 0.0.0.255 204.34.5.0 0.0.0.255
 access-list 101 permit tcp 203.44.32.0 0.0.0.31 204.34.5.0 0.0.0.255 eq telnet
 access-list 101 permit tcp any 204.34.5.10 eq smtp

This access list allows all TCP connections with the established flag, allows any user to get to the host 204.34.5.25, tcp port 80 (which is the http port), all IP protocols from 203.45.34.0/24 to reach any host within the 204.34.5.0 class C, all hosts within 203.44.32.0/27 can telnet into any host on the 204.34.5.0, and allows all hosts to connect to the smtp port on host 204.34.5.10.
A few notes about this access list. The first line is important. It allows all packets which have had the TCP established flag set. This means two things. First, all outbound connections will be able to have the return traffic pass back through the access list. This is important. Since outbound tcp connections come from random ports above 1024, it is not possible to filter explicitly for outbound connections. The established field takes care of that. Second, an inbound TCP connection only needs to have the first packet pass beyond this point in the access list. Once the connection has been opened, the remaining traffic will have the established flag set and will not have to again pass through the entire access list.
The second line also demonstrates that when a source or destination is used, the wildcard mask can be replaced with the word "host" to indicate this. It also gives an example of filtering based on a destination port. The third line matches all IP protocols (TCP, UDP, ICMP, etc. Everything that gets encapsulated in an IP packet.) The source and destination network number and wildcard mask pairs function the same as in standard access lists. The fourth line shows that, on well known services, the port number can be replaced with the name of the service.
There is one last important thing to consider when creating access lists however. Many services depend on other services in order to function. For example, you can't just permit telnet connections without permitting DNS packets to get through as well. You often won't be able to telnet out unless telnet ident requests can come back into your network. If you wish to synchronize the clocks on your computer systems to other systems, you likely need to permit NTP packets (both TCP and UDP) to pass through. For this reason, carefull consideration is needed when creating access lists. It is all too easy to overlook one or two key services when creating lists. As network administrators gain experience with access controls, these omissions become more rare, but they still occur with annoying frequency. Access lists should be tested throroughly once they are in place. Both to be certain that necessary traffic is permitted through the list as well as to be certain that unwanted traffic does not.

8 steps to protect your Cisco router

2011-11-14T23:29:00.000+03:00

Network security is a completely changing area; new devices like IDS (Intrusion
Detection systems), IPS (Intrusion Prevention systems), and Honeypots are modifying the
way people think about security. Companies are spending thousand of dollars on new
security devices, but forgetting the basic, the first line of defense: the border router.

Although a lot of people may think that routers don’t need to be protect, they are
completely wrong. A lot of secure problems appear all time against this kind of device
and most of them are vulnerable.

I will give you 8 steps, easy to follow, to minimize your Cisco router
exposure by turning off some unused services, applying some access control and
applying some security options available on that.

1- Control Access to your router;
2- Restrict telnet access to it;
3- Block Spoof/Malicious packets;
4- Restrict SNMP;
5- Encrypt all passwords;
6- Disable all unused services;
7- Add some security options;
8- Log everything;

1- Control Access to your router
The first thing to do is apply some rules to restrict all external access to some ports of the
router. You can block all ports, but it is not always necessary. These commands bellow
will protect your router against some reconnaissance attacks and, obviously, will restrict
access to these ports:
access-list 110 deny tcp any host $yourRouterIP eq 7
access-list 110 deny tcp any host $yourRouterIP eq 9
access-list 110 deny tcp any host $yourRouterIP eq 13
access-list 110 deny tcp any host $yourRouterIP eq 19
access-list 110 deny tcp any host $yourRouterIP eq 23
access-list 110 deny tcp any host $yourRouterIP eq 79
int x0/0
access-group in 110
Where $yourRouterIP is your router IP and x0/0 is your external interface.

2- Restrict telnet access to it
Telnet is not a very safe protocol to use, but if you really need to use it (you should
always use ssh) you might want to restrict all access to it (remember that all your traffic
will be unencrypted). The best way to accomplish that is using a standard access-list and
the access-class command.
access-list 50 permit 192.168.1.1
access-list 50 deny any log
line vty 0 4
access-class 50 in
exec-timeout 5 0
Where 192.168.1.1 is the IP address allowed to telnet the router

3- Block Spoof/Malicious packets
You must never allow loopback/reserved IP address from the Internet reach your external
interface and you can reject broadcast and multicast addresses too.
access-list 111 deny ip 127.0.0.0 0.255.255.255 any
access-list 111 deny ip 192.168.0.0 0.0.0.255 any
access-list 111 deny ip 172.16.0.0 0.0.255.255 any
access-list 111 deny ip 10.0.0.0 0.255.255.255 any
access-list 111 deny ip host 0.0.0.0 any
access-list 111 deny ip 224.0.0.0 31.255.255.255 any
access-list 111 deny icmp any any redirect
int x0/0
access-group in 111

4- Restrict SNMP
SNMP must always be restrict, unless you want some malicious person getting a lot of
information from your network ☺
access-list 112 deny udp any any eq snmp
access-list 112 permit ip any any
interface x0/0
access-group 112 in
And if you are not going to use SNMP at all, disable it:
no snmp-server

5- Encrypt all passwords
A very important thing to do is protect all your passwords using the powerful algorithm
as possible.
The password from exec mode, that grants privileged access to the IOS system,
Can be set using a MD5 hash, which is the strongest option available on the
Cisco IOS.
enable secret $yourpassword
All other passwords, you can encrypt using the Vigenere cipher that is not
Very strong, but can help. To do that, you can use the service password-encryption
Command that encrypts all passwords present in you system.
service password-encryption

6- Disable all unused services
6.1 - Disable Echo, Chargen and discard
no service tcp-small-servers
no service udp-small-servers
6.2 - Disable finger
no service finger
6.3 - Disable the httpd interface
no ip http server
6.4 - Disable ntp (if you are not using it)
ntp disable

7- Add some security options
7.1 - Disable source routing
no ip source-route
7.2 - Disable Proxy Arp
no ip proxy-arp
7.3 - Disable ICMP redirects
interface s0/0 (your external interface)
no ip redirects
7.4 - Disable Multicast route Caching
interface s0/0 (your external interface)
no ip mroute-cache
7.5 - Disable CDP
no cdp run
7.6 - Disable direct broadcast (protect against Smurf attacks)
no ip directed-broadcast

8- Log everything
To finish, you must log everything on an outside Log Server. You must everything from
all your systems and always analyze the logs.
logging trap debugging
logging 192.168.1.10
where 192.168.1.10 is the ip of your log server (configured as a Syslog server)

Conclusion
With these simple steps you can add a lot of security to your router, protecting it against a
lot of possible attacks, increasing your network security.

Only as an example, you can see the nmap result before and after applying these options:

Before:
bash-2.05b# nmap -O 192.168.1.1
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on (192.168.1.1):
Port State Service
7/tcp open echo
9/tcp open discard
13/tcp open daytime
19/tcp open chargen
23/tcp open telnet
79/tcp open finger
80/tcp open http
Remote OS guesses: AS5200, Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1),
Cisco IOS 11.3 - 12.0(11)

After:
bash-2.05b# nmap -P0 -O 192.168.1.1
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Warning: OS detection will be MUCH less reliable because we did not find at least 1
open and 1 closed TCP port
All 1601 scanned ports on (192.168.1.1) are: filtered
Too many fingerprints match this host for me to give an accurate OS guess
Nmap run completed -- 1 IP address (1 host up) scanned in 403 seconds

Configure DHCP on a Cisco router or switch

2011-09-21T20:07:00.000+03:00

If you want to configure Dynamic Host Configuration Protocol(DHCP) on PC clients, you currently have multiple options to choose for your DHCP server. One of the morecommon ways to accomplish this is by using a Windows or Linux server. However,most home networks get DHCP from their DSL or cable router.
Many administrators forget—or don't even realize—that DHCPis also available on Cisco IOS routers and switches. Keep in mind that DHCP is onlyavailable on newer IOS-based switches. For example, Catalyst 3550 and 3750offer DHCP.

Deciding if this is right for your organization

Using a router as a DHCP server has its pros and cons. Forexample, let's say you have a multisite network, and you've decided to use yourrouters as DHCP servers for each network.
One benefit of running DHCP on a routers is that it doesn'trequire any extra hardware (like a Windows server does). In addition, runningDHCP on a router can save your organization the cost of a dedicated DHCPserver. It also provides DHCP locally at each site—regardless of whether theWAN is operational.
But there are some drawbacks. For example, someadministrators might not be too comfortable monitoring and troubleshooting DHCPfrom a router; they may prefer to use Windows DHCP Manager rather than CiscoIOS commands to check the status of client leases, manually terminate a DHCPlease, or assign a static reservation. In addition, some administrators mightprefer implementing a centralized DHCP server in order to have one place tomonitor and troubleshoot DHCP.
Of course, every IT shop is different, with varying skillsets, comfort levels, and budgets. Depending on your organization's needs, CiscoIOS DHCP could be the perfect fit for your network.

Getting started

Let's look at how to configure basic DHCP on an IOS-basedrouter. For this example, we'll start off with the default configuration on aCisco 2611 router running IOS 12.2. (The configuration should be the same—orvery similar—on all IOS-based routers).

To begin, connect the router's Ethernet port to a switch,and connect the switch to a laptop, which will serve as the DHCP client.
To configure Cisco IOS DHCP, follow these steps, whichinclude sample commands:

Configure an IP address on the router's Ethernet port, and bring up the interface. (On an existing router, you would have already done this.)

Router(config)# interface ethernet0/0
Router(config-if)#ip address 1.1.1.1 255.0.0.0
Router(config-if)# no shutdown

Create a DHCP IP address pool for the IP addresses you want to use.

Router(config)# ip dhcp pool mypool

Specify the network and subnet for the addresses you want to use from the pool.

Router(dhcp-config)# network 1.1.1.0 /8

Specify the DNS domain name for the clients.

Router(dhcp-config)#domain-name mydomain.com

Specify the primary and secondary DNS servers.

Router(dhcp-config)#dns-server 1.1.1.10 1.1.1.11

Specify the default router (i.e., default gateway).

Router(dhcp-config)#default-router 1.1.1.1

Specify the lease duration for the addresses you're using from the pool.

Router(dhcp-config)#lease 7

Exit Pool Configuration Mode.

Router(dhcp-config)#exit

This takes you back to the global configuration prompt. Next,exclude any addresses in the pool range that you don't want to hand out.
For example, let's say that you've decided that all IP addressesup to .100 will be for static IP devices such as servers and printers. All IPaddresses above .100 will be available in the pool for DHCP clients.
Here's an example of how to exclude IP addresses .100 andbelow:

Router(config)#ip dhcp excluded-address 1.1.1.0 1.1.1.100

Next, enter the ipconfig/renew command on the laptop to receive an IP address. After you have theIP address, enter the ipconfig /allcommand.

Using DHCP commands

After configuring DHCP on the router, you can use DHCP show commands to see what's going on. Forexample, you can use one of the most common DHCP commands to view which DHCP IPaddresses currently have leases: show ipdhcp bindings.

Keep in mind that DHCP configuration can be very complex onCisco routers. You can configure backup servers, settings to prevent conflicts,secure DHCP, and many other options. For more information, check out Cisco'sConfiguring DHCP documentation.

How to Export Email Addresses of all your Facebook Friends

2011-08-17T15:45:00.000+03:00

"It doesn’t work if you Facebook account is already linked with Yahoo account. First, remove Yahoo as a “Linked Account” from FB"

Search the Facebook Apps directory for something like “export contacts” and you’ll come across quite a few applications that sound as if they can transfer your friends contact information out of Facebook.
There’s an app called “Export Friends” that will save you friends names, city, birthday and their current location in a CSV (text) file that you then import into Excel, Gmail or any other web email program.
Then there are social plug-ins that can sync photos and status updates of your Facebook friends with matching contacts in Outlook.

The problem is that none of these apps can download what you are looking – the phone numbers and email addresses of your Facebook friends. There are Greasemonkey scripts and other hacks that can pull this information from Facebook through “web scraping” but don’t ever take that route as Zuckerberg’s army might ban your account forever.

Export Email Addresses of your Facebook Contacts

Facebook APIs don’t expose email addresses of users and hence none of the Facebook apps can provide you with the actual contact data of your friends. There’s however a simple (and perfectly legal) workaround that can help you easily download all your friends email addresses from Facebook’s walled garden.

Go to address.yahoo.com and click the Facebook icon. A login dialog should pop-up, just sign-in with your Facebook credentials and within seconds, you entire Facebook address book will be available inside your Yahoo Mail Account. Once the import is done, click this link to download a CSV file with the email addresses of all your Facebook contacts to your desktop.
You can then import the CSV file into Gmail Contacts, LinkedIn, your phone address book or any of the social sites where you want to connect with your existing Facebook circle.

The Common Types of Computer Viruses

2011-07-22T14:22:00.000+03:00

Computer viruses are similar to biological viruses in the way they multiply in number and in the way they need a host to survive. However, in both scenarios there must be a cause, such a weak immune system or an expired anti-virus program, in order for the virus to penetrate and spread. Having a reliable anti-virus program is the best solution.
Just as a biological virus spreads by injecting its DNA into a host cell, whereas a computer virus needs to attach itself to a document or program to infect other computers and programs.
The way a computer virus infiltrates your PC depends on the type of virus it is. Because all computers viruses have their own features and factors that make them unique and dangerous to the health of your computer. Making it important than ever to learn about the different types of computer viruses lurking in the corners of cyberspace and on the fringes of your hard drive. The advantage of learning more about these computer viruses is two fold. First, you'll gain valuable knowledge, and second you'll be able to better prevent and deal with a computer virus when and if it preys your computer.

Due to the many different types of computer viruses, it can be confusing at times to diagnose what kind of virus your computer is suffering from. To make the identifying process easier, we've listed the three basic types of viruses that you will likely encounter.
These computer viruses include:

Trojan Horses
Worms
Email Viruses

The Trojan virus gets its name from an incident that occurs in Homer's Iliad. Similar to how the Greeks in Homer's poem sent an army of men, hidden in a wooden horse, to the Trojans to get into the wall of the city. A Trojan horse appears to be nothing more than an interesting computer program or file, such as "saxophone.wav file" on the computer of user who's interested in collecting sound samples. The Trojan virus once on your computer, doesn't reproduce, but instead makes your computer susceptible to malicious intruders by allowing them to access and read your files. Making this type of virus extremely dangerous to your computer's security and your personal privacy. Therefore, you should avoid downloading programs or files from sites if you're not 100 percent positive of what the file or program does.
A Worm is a virus program that copies and multiplies itself by using computer networks and security flaws. Worms are more complex than Trojan viruses, and usually attack multi-user systems such as Unix environments and can spread over corporate networks via the circulation of emails. Once multiplied, the copied worms scan the network for further loopholes and flaws in the network. A classic example of a worm is the ILOVEYOU virus.
The best way you can protect yourself from worms is by updating your security patches. Operating systems and application vendors normally provide these patches. In addition, you should avoid opening email attachments from unknown senders.
Email viruses use email messages to spread. An email virus can automatically forward itself to thousands of people, depending on whose email address it attacks. To avoid receiving virus-laden emails, always check that your antivirus software is up-to-date and also stay clear of opening attachments, even from friends that you weren't expecting or don't know anything about. Also, block unwanted email viruses by installing a spam filter and spam blocker.

What is Network Security?

2011-07-15T16:47:00.000+03:00

Network security comprises the measures a company takes to protect its computer system, and it is a prime concern for every company that uses computers. Compromised network security means a hacker or competitor may gain access to critical or sensitive data, possibly resulting in data loss, or even complete destruction of the system.
Appropriate network security is achieved when a user has to go through several layers of security before being able to access the desired network. The more layers the system has, the more secure it is.

The systems administrator is often in charge of network security since he has administrator privileges on the system. In fact, only the systems administrator and his assistants should have administrative access to the mainframe server and related computer terminals. This will help keep unauthorized people in the company from changing any data on the servers.
A systems administrator will also build a secure firewall for the network, which may include an encryption layer and sentinel software that automatically repels an unauthorized program from gaining access. The administrator may also place restrictions on employees' computers to prevent them from accessing websites that may have malicious coding or malware that will install itself on a user's computer. Anti-adware and malware programs are available for individual computers, as well as for networks.
One problem that generally arises when network security is implemented is that of flexibility. Management must balance security issues against employees' ability to access websites for their work. Communication among management, the systems administrator and employees is critical for network security to operate and for the employees to be able to work with it.
As evidenced in dealing with past e-mail and network viruses, security breaches are costly and detrimental to production and efficiency. U.S. companies spend millions of dollars each year in network security measures. A company's best defense against network security breaches is a multi-pronged attack. Firewalls with no single point of access, sharp systems administrators, frequent security updates, and early installation of anti-adware will all help keep a network safe.

10 steps you'll need to take to build and bring a website 'live' on the World Wide Web.

2011-04-04T19:20:00.001+03:00

1. Define the purpose of the web site

When starting a web site project, you must first clarify what the goals of the website are. Knowing your goals will impact the choices you make when putting the web site together and ultimately contribute to its success or failure.

This may sound obvious, but many web sites seemed to have been put together without the goal kept in mind. The result is a messy web site that is disorganized and harder to build and maintain.

So if, for example, the goal is to create an e-commerce web site that sells products, then as a web site designer you have to consider things like the following:

Do you need credit card processing capabilities?

Are you going to need a shopping cart system to take orders?

How many items will be sold on the web site?

This is just one example. The point to take away is that by defining the purpose you can better prepare and get the right tools / people for the job.

2. Diagram the structure of the website.

A simple diagram helps to visualize the web site for both you and your client - this assuming someone has hired you to build a website. Nothing special is really needed, just a series of boxes representing each page in the site with lines connecting them showing the linking strategy. A pyramid scheme is usually used to show the hierarchy of a web site from the home page

3. Write out the text for the web site

Before you start writing any HTML, you should (in your favorite word processor) write out all the text that you need to include in the website. Doing so will help you with the design process.

Another thing you should do is to make sure that the text is finalized before it gets to the web site; it is much easier to correct things in a word processor than in an HTML page.

4. Choose a basic layout that will be used on all pages

Armed with your website diagram and your web site's text (complete text!) you can now choose a basic layout for your pages. You can go crazy with some funky artsy web site (and sometimes it can work), but most of the time you should use standard layouts that people are used to:

Left side navigation.

Top navigation

Right side navigation.

When in doubt, think of how books are laid out.

5. Choose the basic color scheme and fonts for the site

Your next task is to start considering the basic colors and fonts that you're going to use. You want to choose a style that fits the subject of the web site. For example: pink doesn't do well for a hardware store, maybe some steel blues instead! The point to take away is to establish the style of the web site before you start creating pages, otherwise you may find yourself doing pages over again!

6. Build out the website

With the before-mentioned completed, you're ready to actually start creating your web pages. So what you need to do is:

Take the structure you developed in steps 1 to 5 to create your web pages.

Link the web pages together.

Now is the time for you to practice a little and actually build a small web site! If you can't think of something, create one on your favorite movie with a page for each main character.

Remember that you only get good at doing something by doing it!

7. Choose a domain name

Once your website is built, you will need to get it on the web - that means you need a domain name.

All websites need a domain name, and your choice of a domain name can impact on how many people find your website, so choose carefully! Here are some points to remember when considering your choice of a domain name:

Domain names that tell you something about the web site are food for search engines and they help clue people in, too. If for example you were building a website for a hardware store, a domain name like 'discountHardware.com' is pretty good, it tells you everything about the web site immediately. If you called it 'bigSteel.com' instead, you can argue that we are not giving such a clear message of what the web site is about. Even if the hardware store was actually called 'Big Steel Hardware', I would go with 'discountHardware.com'.

Search engines such as Google will look at several elements of your web site to try and determine what your website is about. One of those key elements is the domain name; Google will look for keywords in the domain name that help the 'Google bot' (Google's automated snooper software) to categorize your web site.

One question that is asked often enough is whether the domain name has to have the same name as the business it is representing - the answer is no

8. Register your domain name

This can be trickier than you think, since many of the good domain names are taken. You can pretty much forget about single-word domain names like business.com and auctions.com; they are long gone! You will need to come up with combination words like 'how-to-build-websites.com'.

Today you have many more options for domains; in the past, businesses could only register .com's because .net and .org domains where reserved for special types of organizations. Those old restrictions are now gone, and there are a wide variety of extensions you can choose from:

.com, .net, .org, .tv, .biz, and several others including country codes like .ca (Canada), .us (USA), .co.uk (United Kingdom) et cetera.

In terms of the search engines, it makes no difference which ending (extension) you use.

Some people might argue that the first thing you need to do is to register your domain name, then build your web site. That may be true if your website design is impacted by the domain ... for some people this is the case, and for others it isn't. You can make that call for your own websites.

How do you know if a domain is already taken?

The quickest way to figure this out is to type in the domain name in your browser and see if it takes you anywhere. This is not always useful though because many domains have been bought but have no website!

That means the best way to figure this out is to go to your registrar. Every registrar will have a form where you can check to see if domains names are available just by typing it in.

The best thing about going to the registrar is that when you type in a domain name you are interested in their systems will not only tell you if the .com is available, they will also give you the scoop on all the other variations - a big time saver.

9. Find a hosting company: What to look for in a host

Today, hosting web sites cost much less than what they did just a few years ago, and that's a good thing. You can go from zero cost hosting to very pricey solutions, depending on your web site's needs.

What can affect the cost of hosting a website?

Traffic - more traffic can cost you more per month. But for this to affect you, you would have to have a pretty popular web site. Since you are just starting out, I wouldn't expect that problem for a while.

Extra features / services - you may need to use a database (for e-commerce) or need many email accounts, extra disk space to store all your websites files. Each host will have a list of plans that you can choose from depending on your needs.

In the end you have to choose the hosting company and hosting plan that is best suited to for your web site. Cheaper is not always best, but it may be good enough for you.

10. Upload your website to the hosting company's server

Once you created your web site, paid for your domain name, and picked your hosting company, it's time to upload the web site onto your host server for the world to see. Typically, you would use something called FTP to do this; you hosting company should be able to help you with the details when setting up your account.

Some quick tips to remember

Keeping web pages small - under 60k

Keeping content headers (H2 tags) clear and to the point.

Keep paragraphs small.

Keep contact information (email - phone) easily found in same place on all pages.

Keep look and structure of the web pages consistent across all pages.

Provide a 'Home' button to take the user back to the cover (a.k.a.: splash, home) page of the website.

Make sure links are always underlined. (Don't use CSS to remove the underline: big mistake if you do since people assume that underlined texts are links.)

The company logo should appear on every page in the same spot and it should always be a link back to the home page.

Creating the Magical Mirror Effect

2010-10-18T22:42:00.000+03:00

.“It’s all done with mirrors” is a popular saying among professional magicians.

Well, these days, digital photography artists are using mirrors, of sorts, to create magical effects on their computer monitors. Basically, a mirror image is one in which one side of a frame is perfectly mirrored (reflected) on the opposite side of the frame—side to side or top to bottom. In Photoshop, we use Canvas Size, Copy and Paste to create the effect. It’s that easy!

This mirror image of a sunrise on a mountaintop in China (where there is no lake) is one of many mirror images you will have fun creating.

Okay! Let’s take a look at how easy it is to create the magical mirror effect in Photoshop.

1.Start with a vision.

The first step is to start with a picture, or perhaps more accurately, a vision of your final mirror image. I started with a picture of a sunrise I took on a mountaintop in China. (I actually used a copy of the image because I never work on my original files. A good idea!)

2.Open the Canvas Size dialog box.

In Photoshop, we can increase the Canvas size (actual working area) of an image by going to Image > Canvas Size. In this screen shot, we see the actual size of my original image. When we first open Canvas Size, the center box in the tick-tac-toe grid is shaded.

3.Increase Canvas Size.

The next step is to increase the Canvas Size (again, the actual working area). We increase the Canvas Size by moving the shaded box into any of the other boxes—and then typing in a new height and/or width dimensions. Because I wanted to increase the height of my Canvas Size on the bottom side of my picture, I moved the shaded area to the top middle box. Then I typed in the new Canvas size—which, for ease of use, was a bit more than double the height of my original photograph.

After I approximately doubled the height of my image, my new working area (new Image Size) looked like this.

4.Create a flipped image of your original.

Creating a flipped image of your original is easy. Start by using the Marquee Tool to select the original image area, the sunrise in this case. Then go to Edit > Copy.

Next go to File > New. When the new document is created, it will be exactly the same size of your copied image.

Now go to Edit > Paste. Your image will be pasted into the new document—on a new layer.

To flip the image (vertically in this case), go to Edit > Transform > Flip Vertically. Now the image will be flipped.

5.Create the Magical Mirror Effect.

To create the Magical Mirror Effect, use the Move tool and drag your flipped image into the blank area of your original image. Now carefully line up both images so they look perfectly mirrored. Next flatten your image by going to Layers > Flatten.

6.Conclusion.

An optional and fun thing to do with some vertical mirror images (you can create horizontal mirror images, too) is to create the effect that your original image is reflected in water. Here is how it’s done. Select the mirrored part of your image (lower half) using the Marquee tool. Now go to Filters > Distort > Ocean Ripple. Play around with the Ripple Size and Ripple Magnitude until you are happy with the effect. Click on OK. Now go to Select > Deselect to deselect the area on which you have applied the Ocean Ripple filter.

Finally, use the Crop tool to trim your picture to your liking.

Most pros agree that Photoshop has changed the way that we not only make pictures—but the way we see potential images. Now that you know about the magical mirror effect, you may see way-cool potential mirror images in your travels. Good luck!