Treasure of Networking Solutions

The basics of a Cisco PIX firewall

2012-03-26T00:42:00.000+05:30

A Cisco PIX firewall is meant to protect one network from another. There are PIX firewalls for small home networks and PIX firewalls for huge campus or corporate networks. In this example, we will be configuring a PIX 501 firewall. The 501 model is meant for a small home network or a small business.
PIX firewalls have the concept of inside and outside interfaces. The inside interface is the internal, usually private, network. The outside interface is the external, usually public, network. You are trying to protect the inside network from the outside network.

PIX firewalls also use the adaptive security algorithm (ASA). This algorithm assigns security levels to interfaces and says that no traffic can flow from a lower-level interface (like the outside interface) to a higher-level interface (like the inside interface) without a rule allowing it. The outside interface has a security level of zero and the inside interface has a security level of 100.

Here is what the output of the show nameif command looks like:
pixfirewall# show nameif
nameif ethernet0 outside security0
nameif ethernet1 inside security100
pixfirewall#
Notice the ethernet0 interface is the outside interface (its default name) and the security level is 0. On the other hand, the ethernet1 interface is named inside (the default) and has a security level of 100.

Guidelines
Before beginning the configuration, your boss has given you some guidelines that you need to follow. Here they are:

All passwords should be set to "cisco" (in reality, you make these whatever you want, but not "cisco").
The inside network is 10.0.0.0 with a 255.0.0.0 subnet mask. The inside IP address for this PIX should be 10.1.1.1.
The outside network is 1.1.1.0 with a 255.255.255.0 subnet mask. The outside IP address for this PIX should be 1.1.1.1.
You want to create a rule to allow all inside clients on the 10.0.0.0 network to do port address translation and connect to the outside network. They will all share the global IP address 1.1.1.2.
However, clients should only have access to port 80 (Web browsing).
The default route for the outside (Internet) network will be 1.1.1.254.

The configuration
When you boot up your PIX firewall for the first time, you should see a screen like this:

You will be prompted to answer YES or NO as to whether or not you want to configure the PIX through interactive prompts. Answer NO to this question because you want to learn how to really configure the PIX firewall, not just answer a series of questions.

After that, you will be sent to a prompt that looks like this:
pixfirewall>
With the "greater than" symbol at the end of the prompt, you are in the PIX user mode. Change to privileged mode with the en or enable command. Press "enter" at the Password prompt. Here is an example:
pixfirewall>en
Password:
pixfirewall#

You now have administrative mode to show things but would have to go into global configuration mode to configure the PIX.
Now, let's move on to basic configuration of the PIX:
Basic PIX configuration
What I am calling basic configuration is made up of three things:

Set the hostname
Set passwords (login and enable)
Configure IP addresses on interfaces
Enable interfaces
Configure a default route

Before you can do any of these things, you need to go into global configuration mode. To do this, type:
pixfirewall# config t
pixfirewall(config)#

To set the hostname, use the hostname command, like this:
pixfirewall(config)# hostname PIX1
PIX1(config)#

Notice that the prompt changed to the name that you set.
Next, set the login password to cisco, like this:
PIX1(config)# password cisco
PIX1(config)#

This is the password required to gain any access to the PIX except administrative access.
Now, configure the enable mode password, used to gain administrative mode access.
PIX1(config)# enable password cisco
PIX1(config)#

Now we need to configure IP addresses on interfaces and enable those interfaces. The PIX, unlike a router, has no concept of interface configuration mode. To configure the IP address on the inside interface, use this command:
PIX1(config)# ip address inside 10.1.1.1 255.0.0.0
PIX1(config)#
Now, configure the outside interface IP address:
PIX1(config)# ip address outside 1.1.1.1 255.255.255.0
PIX1(config)#

Next, enable both the inside and outside interfaces. Make sure that the Ethernet cable, on each interface, is connected to a switch. Note that the ethernet0 interface is the outside interface, and it is only a 10base-T interface on a PIX 501. The ethernet1 interface is the inside interface, and it is a 100Base-T interface. Here is how you enable these interfaces:
PIX1(config)# interface ethernet0 10baset
PIX1(config)# interface ethernet1 100full
PIX1(config)#

Note that you can do a show interfaces command, right from the global configuration prompt line.
Finally, let's configure a default route so that all traffic sent to the PIX will flow to the next upstream router (the 1.1.1.254 IP address that we were given). Here is how you do this:
PIX1(config)# route outside 0 0 1.1.1.254
PIX1(config)#

The PIX firewall can, of course, support dynamic routing protocols as well (such as RIP and OSPF).
Now, let's move on to some more advanced configuration.
Network Address Translation
Now that we have IP address connectivity, we need to use Network Address Translation (NAT) to allow inside users to connect to the outside. We will use a type of NAT, called PAT or NAT Overload, so that all inside devices can share one public IP address (the outside IP address of the PIX firewall). To do this, enter these commands:
PIX1(config)# nat (inside) 1 10.0.0.0 255.0.0.0
PIX1(config)# global (outside) 1 1.1.1.2
Global 1.1.1.2 will be Port Address Translated
PIX1(config)#

With this, all inside clients are able to connect to devices on the public network and share IP address 1.1.1.2. However, clients don't yet have any rule allowing them to do this.
Firewall rules
These clients on the inside network have a NAT translation, but that doesn't necessarily mean that they are allowed access. They now need a rule to allow them to access the outside network (the Internet). That rule will also allow the return traffic to come back in.
To make a rule to allow these clients port 80 (Web browsing), you would type this:
PIX1(config)# access-list outbound permit tcp 10.0.0.0 255.0.0.0 any eq 80
PIX1(config)# access-group outbound in interface inside
PIX1(config)#

Note that PIX access lists, unlike router access lists, use a normal subnet mask, not a wildcard mask.
With this access list, you have restricted the inside hosts to accessing Web servers only on the outside network (routers).
Showing and saving the configuration
Now that you have configured the PIX firewall, you can show your configuration with the show run command.
Make sure that you save your configuration with the write memory or wr m command. If you don't, your configuration will be lost when the PIX is powered off.

Configure SNMP on Cisco Devices

2012-03-25T18:28:00.001+05:30

The Simple Network Management Protocol (SNMP) is a necessary tool for every network administrator. You can easily configure it with just a few commands. SNMP is still the most popular way to monitor the performance of network devices, including Cisco routers and switches. With an SNMP management station, you can graph the performance of network devices.

The Simple Network Management Protocol (SNMP) is a necessary tool for every network administrator. You can easily configure it with just a few commands.
In addition, Cisco devices can send alerts (called traps) to the management station, which you can configure to alert you.

How does it work :-

There are three versions of SNMP — v1, v2, and v3. Each has more features than the next. Most network admins today use v2, but v3 offers many more security features.

How does SNMP work? SNMP devices contain configured SNMP agents. The network management system (NMS) talks to the SNMP agents on each device.
The NMS could be a huge system such as HP OpenView or an application that’s only there to track performance such as PRTG.

How can SNMP help me?

SNMP can do a variety of things. Here are some ways it has helped me:

It can graph Cisco router/switch bandwidth utilization over time, per interface, per direction, etc.
It can graph errors on network devices (e.g., CRC errors).
It can send alerts when an interface goes up or down.

Do I need an NMS?

Yes, you do need some kind of NMS to make SNMP useful. Configuring SNMP on its own really won’t tell you anything. You need an NMS that you can configure to receive, report, and graph the SNMP information.

How can I configure SNMP monitoring?

To configure SNMP, I suggest starting off with the optional step of identifying your device. Here’s an example:

Router(config)# snmp-server contact
David Davis – Network Admin – 555-1212

Router(config)# snmp-server location Dallas, Texas, USA
Router(config)# snmp-server chassis-id Cisco2610-Router

Next, we need to configure SNMP so that the NMS can monitor it. There are a great many ways to configure SNMP. For this example, we’ll configure the bare minimum to allow you to manage a Cisco router or switch.

To do this, we’ll create a community string. Think of a community string as a password for certain types of access to the device. Let’s configure this device to have a community string good for both reading and writing to the device. Here’s an example:

Router(config)# snmp-server community
MyCommunity972 RW

Now our NMS, wherever it is on the network, can both read (i.e., view) and write (i.e., change) device configurations and statistics. (With a more advanced NMS, you can use SNMP to make configuration changes on your device, but that isn’t SNMP’s most popular use.)
We set our community string to MyCommunity972 for this example. Of course, set it using your own internal complex password.

How can I configure SNMP to send alerts?

At this point, we could stop the configuration and still use the NMS like PRTG to begin graphing bandwidth utilization on router or switch interfaces. But let’s take it a step further and configure the router or switch to alert the NMS when an interface goes down or up. To do this, you could use a free open source NMS such as OpenNMS or a commercial NMS such as Ipswitch’s WhatsUp.

We’ll configure the router or switch to send an SNMP trap to host 192.168.1.23 (the NMS) with our community string so we know it’s authentic. We want SNMP to send these traps if the interfaces go down or go up, or if someone reboots the router. Here are the commands:

Router(config)# snmp-server host
192.168.1.23 version 2c MyCommunity972

Router(config)# snmp-server enable traps snmp linkdown linkup coldstart
warmstart

There are some SNMP vulnerabilities in certain versions of the Cisco IOS 12.0 to 12.3, so be cautious. Make sure you aren’t using one of the vulnerable versions, and take steps to configure SNMP as securely as possible.
While it’s easy to configure SNMP, configurations can also get very complex. I highly recommend taking the first step of using SNMP to develop a baseline of your router’s WAN interface utilization over time.

ITIL V3 Exam Dump

2012-03-17T00:51:00.003+05:30

QUESTION :1 Which of the following questions does guidance in Service Strategy help answer?

1: What services should we offer and to whom?

2: How do we differentiate ourselves from competing alternatives?

3: How do we truly create value for our customers?

A.1 only

B.2 only

C.3 only

D.All of the above

Answer: D

QUESTION :2. Which of the following is NOT a responsibility of the Service Design Manager?

A.Design and maintain all necessary Service Transition packages

B.Produce quality, secure and resilient designs for new or improved services, technology architecture, processes

or measurement systems that meet all the agreed current and future IT requirements of the organisation

C.Take the overall Service Strategies and ensure they are reflected in the Service Design process and the service

designs that are produced

D.Measuring the effectiveness and efficiency of Service Design and the supporting processes

Answer: A

QUESTION :3. Which of the following are valid examples of business value measures?

1: Customer retention

2: Time to market

3: Service Architecture

4: Market share

A.1 and 2 only

B.2 and 4 only

C.All of the above

D.1, 2 and 4 only

Answer: D

QUESTION :4. Understanding customer usage of services and how this varies over time is part of which process?

A.Service Portfolio Management

B.Service Level Management

C.Component Capacity Management

D.Demand Management

Answer: D

QUESTION :5. The MAIN objective of Service Level Management is:

A.To carry out the Service Operations activities needed to support current IT services

B.To ensure that sufficient capacity is provided to deliver the agreed performance of services

C.To create and populate a Service Catalogue

D.To ensure that an agreed level of IT service is provided for all current IT services

Answer: D

QUESTION :6. Which of the following are responsibilities of a Service Level Manager?

1: Agreeing targets in Service Level Agreements (SLAs)

2: Designing technology architectures to support the service

3: Ensuring required contracts and agreements are in place

A.All of the above

B.2 and 3 only

C.1 and 2 only

D.1 and 3 only

Answer: D

QUESTION :7. Which of the following is a good metric for measuring the effectiveness of Service Level Management?

A.Customer satisfaction score

B.Average number of daily Incidents managed by each service agent

C.Number of services in the Service Portfolio

D.Number of services deployed within agreed times

Answer: A

QUESTION :8. Major Incidents require:

A.Separate procedures

B.Less urgency

C.Longer timescales

D.Less documentation

Answer: A

QUESTION :9. Which of the following should be done when closing an Incident?

1: Check the Incident categorization and correct it if necessary

2: Decide whether a Problem needs to be logged

A.1 only

B.Both of the above

C.2 only

D.None of the above

Answer: B

QUESTION :10. Which of the following is NOT a valid objective of Request Fulfilment?

A.To provide information to users about what services are available and how to request them

B.To update the Service Catalogue with services that may be requested through the Service Desk

C.To provide a channel for users to request and receive standard services

D.To source and deliver the components of standard services that have been requested

Answer: B

QUESTION :11. Which of the following would NOT be a task carried out by the Request Fulfilment process?

A.The sourcing and delivering of the components of requested standard services (e.g. licenses and software media)

B.Provision of a channel for users to request and receive standard services for which a pre-defined approval and

qualification process exists

C.Provision of information to users and customers about the availability of services and the procedure for

obtaining them

D.Provision of information used to compare actual performance against design standards

Answer: D

QUESTION :12. How many numbered steps are in the Continual Service Improvement (CSI) process?

A.7

B.4

C.6

D.11

Answer: A

QUESTION :13. Which Functions are included in IT Operations Management?

A.Network Management and Application Management

B.Technical Management and Application Management

C.IT Operations Control and Facilities Management

D.Facilities Management and Technical Management

Answer: C

QUESTION :14. The ITIL CORE publications are structured around the Service Lifecycle. Which of the following statements about the ITIL COMPLEMENTARY guidance is CORRECT?

A.It is also structured around the Service Lifecycle

B.It provides guidance to specific industry sectors and types of organization

C.It consists of five publications

D.It provides the guidance necessary for an integrated approach as required by ISO/IEC 20000

Answer: B

QUESTION :15. Which of the following should be supported by technology?

1: Verification of Configuration Management System (CMS) data

2: Control of user desk-tops

3: Creation and use of diagnostic scripts

4: Visibility of overall IT Service performance

A.2, 3 and 4 only

B.1, 2 and 3 only

C.1, 3 and 4 only

D.All of the above

Answer: D

QUESTION :16. Which of the following CANNOT be provided by a tool?

A.Knowledge

B.Information

C.Wisdom

D.Data

Answer: C

QUESTION :17. The BEST Processes to automate are those that are:

A.Carried out by Service Operations

B.Carried out by lots of people

C.Critical to the success of the business mission

D.Simple and well understood

Answer: D

QUESTION :18. Which of the following areas would technology help to support during the Service Operation phase of the Lifecycle?

1: Identifying configuration of user desktop PCs when Incidents are logged

2: Control of user desk-top PCs

3: Create and use diagnostic scripts

4: Dashboard type technology

A.1, 2 and 3 only

B.All of the above

C.1, 3 and 4 only

D.2, 3 and 4 only

Answer: B

QUESTION :19. Which of the following are the two primary elements that create value for customers?

A.Value on Investment (VOI), Return on Investment (ROI)

B.Customer and User satisfaction

C.Understanding Service Requirements and Warranty

D.Utility and Warranty

Answer: D

QUESTION :20. What is the Service Pipeline?

A.All services that are at a conceptual or development stage, or are undergoing testing

B.All services except those that have been retired

C.All services that are contained within the Service Level Agreement (SLA)

D.All complex multi-user services

Answer: A

QUESTION :21. What are the types of activity within Demand Management?

A.Activity based, Access Management

B.Activity based, Business activity patterns and user profiles

C.Analytical based, Business activity patterns and user profiles

D.Analytical based, Shaping user behaviour

Answer: B

QUESTION :22. Which of the following is NOT a purpose of Service Transition?

A.To ensure that a service can be managed, operated and supported

B.To provide training and certification in project management

C.To provide quality knowledge of Change, Release and Deployment Management

D.To plan and manage the capacity and resource requirements to manage a Release

Answer: B

QUESTION :23. Which of the following statements BEST describes a Definitive Media Library (DML)?

A.A secure location where definitive hardware spares are held

B.A secure library where definitive authorised versions of all media Configuration Items (CIs) are stored and

protected

C.A database that contains definitions of all media CIs

D.A secure library where definitive authorised versions of all software and back-ups are stored and protected Answer: B

QUESTION :24. One organisation provides and manages an entire business process or function for another organisation. This is know as:

A.Business Process Management

B.Business Function Outsourcing

C.Business Process Outsourcing

D.Knowledge Process Outsourcing

Answer: C

QUESTION :25. Which Service Design process makes the most use of data supplied by Demand Management?

A.Service Catalogue Management

B.Service Level Management

C.IT Service Continuity Management

D.Capacity Management

Answer: D

Intrusion Detection System (IDS)

2012-03-14T00:53:00.002+05:30

An intrusion detection system (IDS) is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts. In addition, organizations use IDPSes for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. IDPSes have become a necessary addition to the security infrastructure of nearly every organization.

IDPSes typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPSes can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g., reconfiguring a firewall), or changing the attack’s content.

Terminology

§ Alert/Alarm: A signal suggesting that a system has been or is being attacked.

§ True Positive: A legitimate attack which triggers an IDS to produce an alarm.

§ False Positive: An event signaling an IDS to produce an alarm when no attack has taken place.

§ False Negative: A failure of an IDS to detect an actual attack.

§ True Negative: When no attack has taken place and no alarm is raised.

§ Noise: Data or interference that can trigger a false positive.

§ Site policy: Guidelines within an organization that control the rules and configurations of an IDS.

§ Site policy awareness: An IDS's ability to dynamically change its rules and configurations in response to changing environmental activity.

§ Confidence value: A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack.

§ Alarm filtering: The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks.

§ Attacker or Intruder: An entity who tries to find a way to gain unauthorized access to information, inflict harm or engage in other malicious activities.

§ Masquerader: A user who does not have the authority to a system, but tries to access the information as an authorized user. They are generally outside users.

§ Misfeasor: They are commonly internal users and can be of two types:

1. An authorized user with limited permissions.

2. A user with full permissions and who misuses their powers.

§ Clandestine user: A user who acts as a supervisor and tries to use his privileges so as to avoid being captured.

Types

§ For the purpose of dealing with IT, there are two main types of IDS:

§ Network intrusion detection system (NIDS) is an independent platform that identifies intrusions by examining network traffic and monitors multiple hosts. Network intrusion detection systems gain access to network traffic by connecting to a network hub, network switch configured for port mirroring, or network tap. In a NIDS, sensors are located at choke points in the network to be monitored, often in the demilitarized zone (DMZ) or at network borders. Sensors capture all network traffic and analyzes the content of individual packets for malicious traffic. An example of a NIDS is Snort.

§ Host-based intrusion detection system (HIDS) It consists of an agent on a host that identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability databases, Access control lists, etc.) and other host activities and state. In a HIDS, sensors usually consist of a software agent. Some application-based IDS are also part of this category. Examples of HIDS are Tripwire and OSSEC.

§ Stack-based intrusion detection system (SIDS) This type of system consists of an evolution to the HIDS systems. The packets are examined as they go through the TCP/IP stack and, therefore, it is not necessary for them to work with the network interface in promiscuous mode. This fact makes its implementation to be dependent on the Operating System that is being used.Intrusion detection systems can also be system-specific using custom tools and honeypots.

. In a passive system, the intrusion detection system (IDS) sensor detects a potential security breach, logs the information and signals an alert on the console and or owner. In a reactive system, also known as an intrusion prevention system (IPS), the IPS auto-responds to the suspicious activity by resetting the connection or by reprogramming the firewall to block network traffic from the suspected malicious source. The term IDPS is commonly used where this can happen automatically or at the command of an operator; systems that both "detect" (alert) and/or "prevent."

Comparison with Firewalls

Though they both relate to network security, an intrusion detection system (IDS) differs from a firewall in that a firewall looks outwardly for intrusions in order to stop them from happening. Firewalls limit access between networks to prevent intrusion and do not signal an attack from inside the network. An IDS evaluates a suspected intrusion once it has taken place and signals an alarm. An IDS also watches for attacks that originate from within a system. This is traditionally achieved by examining network communications, identifying heuristics and patterns (often known as signatures) of common computer attacks, and taking action to alert operators. A system that terminates connections is called an intrusion prevention system, and is another form of an application layer firewall.

All Intrusion Detection Systems use one of two detection techniques:

Statistical anomaly-based IDS

A statistical anomaly-based IDS determines normal network activity like what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other- and alert the administrator or user when traffic is detected which is anomalous(not normal).

Signature-based IDS

Signature based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures. The issue is that there will be lag between the new threat discovered and Signature being applied in IDS for detecting the threat. During this lag time your IDS will be unable to identify the threat.

Intrusion Prevention Systems (IPS)

2012-03-14T00:49:00.003+05:30

Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about said activity, attempt to block/stop activity, and report activity.

Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent/block intrusions that are detected. More specifically, IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/or blocking the traffic from the offending IP address. An IPS can also correct Cyclic Redundancy Check (CRC) errors, unfragment packet streams, prevent TCP sequencing issues, and clean up unwanted transport and network layer options.

Classifications

Intrusion prevention systems can be classified into four different types:

Network-based intrusion prevention (NIPS): monitors the entire network for suspicious traffic by analyzing protocol activity.

Wireless intrusion prevention systems (WIPS): monitors a wireless network for suspicious traffic by analyzing wireless networking protocols.

Network behavior analysis (NBA): examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations.

Host-based intrusion prevention (HIPS): an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host.

Detection Method

The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful protocol analysis.

Signature-Based Detection: This method of detection utilizes signatures, which are attack patterns that are preconfigured and predetermined. A signature-based intrusion prevention system monitors the network traffic for matches to these signatures. Once a match is found the intrusion prevention system takes the appropriate action. Signatures can be exploit-based or vulnerability-based. Exploit-based signatures analyze patterns appearing in exploits being protected against, while vulnerability-based signatures analyze vulnerabilities in a program, its execution, and conditions needed to exploit said vulnerability.

Statistical anomaly-based detection: This method of detection baselines performance of average network traffic conditions. After a baseline is created, the system intermittently samples network traffic, using statistical analysis to compare the sample to the set baseline. If the activity is outside the baseline parameters, the intrusion prevention system takes the appropriate action.

Stateful Protocol Analysis Detection: This method identifies deviations of protocol states by comparing observed events with “predetermined profiles of generally accepted definitions of benign activity.

ITIL Interview Preparation

2012-03-13T17:55:00.004+05:30

Access Management Process

The purpose of the Access Management process is to provide the rights for

users to be able to access a service or group of services, while preventing access

to non-authorized users.

Access Management helps to manage confidentiality, availability and integrity

of data and intellectual property.

Access Management is concerned with identity (unique information that

distinguishes an individual) and rights (settings that provide access to data

and services). The process includes verifying identity and entitlement, granting

access to services, logging and tracking access, and removing or modifying

rights when status or roles change.

Problem Management Process

A problem is a cause of one or more incidents. The cause is not

usually known at the time a problem record is created, and the

problem management process is responsible for further

investigation.

The key objectives of Problem Management are to prevent problems and

resulting incidents from happening, to eliminate recurring incidents and to

Minimize the impact of incidents that cannot be prevented.

Problem Management includes diagnosing causes of incidents, determining

the resolution, and ensuring that the resolution is implemented. Problem

Management also maintains information about problems and the appropriate

Workarounds and resolutions.

Problems are categorized in a similar way to incidents, but the goal is to

understand causes, document workarounds and request changes to

Permanently resolve the problems. Workarounds are documented in a Known

Error Database, which improves the efficiency and effectiveness of Incident

Management

Event Management Process

An event is a change of state that has significance for the

management of a configuration item or IT service.

An event may indicate that something is not functioning correctly, leading to an

incident being logged. Events may also indicate normal activity, or a need for

routine intervention such as changing a tape.

Event management depends on monitoring, but it is different. Event

management generates and detects notifications, whilst monitoring checks the

status of components even when no events are occurring.

Incident Management Process

An incident is an unplanned interruption to an IT service, or a

reduction in the quality of an IT service. Failure of a

configuration item that has not yet impacted service is also an

incident.

The purpose of Incident Management is to restore normal service as quickly as

possible, and to minimize the adverse impact on business operations.

Incidents are often detected by event management, or by users contacting the

service desk. Incidents are categorized to identify who should work on them

and for trend analysis, and they are prioritized according to urgency and

business impact.

If an incident cannot be resolved quickly, it may be escalated. Functional

escalation passes the incident to a technical support team with appropriate

skills; hierarchical escalation engages appropriate levels of management.

After the incident has been investigated and diagnosed, and the resolution has

been tested, the Service Desk should ensure that the user is satisfied before the

incident is closed.

An Incident Management tool is essential for recording and managing incident

information.

Service Measurement

There are four basic reasons to monitor and measure, to:

_ validate previous decisions that have been made

_ direct activities in order to meet set targets - this is the most prevalent

reason for monitoring and measuring

_ justify that a course of action is required, with factual evidence or proof

_ intervene at the appropriate point and take corrective action.

Transition Planning and Support

The goals of Transition Planning and Support are to:

_ plan and coordinate resources to ensure that the requirements of Service

Strategy encoded in Service Design are effectively realized in Service

Operations

_ identify, manage and control the risks of failure and disruption across

transition activities.

Effective Transition Planning and Support can significantly improve a service

provider’s ability to handle high volumes of change and releases across its

customer base.

Change Management

Change Management ensures that changes are recorded, evaluated,

authorized, prioritized, planned, tested, implemented, documented and

reviewed in a controlled manner.

The purpose of the Change Management process is to ensure that standardized

methods are used for the efficient and prompt handling of all changes, that all

changes are recorded in the Configuration Management System and that

overall business risk is optimized.

The process addresses all service change.

A Service Change is the addition, modification or removal of an

authorised, planned or supported service or service component

and its associated documentation.

Therefore change management is relevant across the whole lifecycle, applying

to all levels of service management – strategic, tactical and operational.

Supplier Management

The Supplier Management process ensures that suppliers and the services they

provide are managed to support IT service targets and business expectations.

The purpose of the Supplier Management process is to obtain value for money

from suppliers and to ensure that suppliers perform to the targets contained

within their contracts and agreements, while conforming to all of the terms and

conditions.

The Supplier and Contract Database (SCD) is a vital source of information on

suppliers and contracts and should contain all of the information necessary for

the management of suppliers, contracts and their associated services.

Capacity Management

Capacity Management includes business, service and component capacity

management across the service lifecycle. A key success factor in managing

capacity is ensuring that it is considered during the design stage.

The purpose of Capacity Management is to provide a point of focus and

management for all capacity and performance-related issues, relating to both

services and resources, and to match the capacity of IT to the agreed business

demands.

The Capacity Management Information System (CMIS) is the cornerstone of a

successful Capacity Management process. Information contained within the

CMIS is stored and analyzed by all the sub-processes of Capacity

Management for the provision of technical and management reports, including

the Capacity Plan.

Service Design is a stage within the overall service lifecycle and an important

element within the business change process. The role of Service Design within

the business change process can be defined as:

The design of appropriate and innovative IT services, including

their architectures, processes, policies and documentation, to

meet current and future agreed business requirements.

The main goals and objectives of Service Design are to:

_ design services to meet agreed business outcomes

_ design processes to support the service lifecycle

_ identify and manage risks

_ design secure and resilient IT infrastructures, environments, applications

and data/information resources and capability

_ design measurement methods and metrics

_ produce and maintain plans, processes, policies, standards, architectures,

frameworks and documents to support the design of quality IT solutions

_ develop skills and capability within IT

_ contribute to the overall improvement in IT service quality.

Service Portfolio Management (SPM)

SPM involves proactive management of the investment across the service

lifecycle, including those services in the concept, design and transition pipeline,

as well as live services defined in the various service catalogues and retired

services.

SPM is an ongoing process, which includes the following:

_ Define: inventory services, ensure business cases and validate portfolio

data

_ Analyze: maximize portfolio value, align and prioritize and balance supply

and demand

_ Approve: finalize proposed portfolio, authorize services and resources

_ Charter: communicate decisions, allocate resources and charter services.

Problems are categorized in a similar way to incidents, but the goal is to

understand causes, document workarounds and request changes to

permanently resolve the problems. Workarounds are documented in a Known

Error Database, which improves the efficiency and effectiveness of Incident

Management

Continual Service Improvement (CSI) is concerned with maintaining value for

customers through the continual evaluation and improvement of the quality of

services and the overall maturity of the ITSM service lifecycle and underlying

processes.

CSI combines principles, practices and methods from quality management,

Change Management and capability improvement, working to improve each

stage in the service lifecycle, as well as the current services, processes, and

related activities and technology.

CSI is not a new concept, but for most organizations the concept has not moved

beyond the discussion stage. For many organizations, CSI becomes a project

when something has failed and severely impacted the business. When the issue

is resolved the concept is promptly forgotten until the next major failure occurs.

Discrete time-bound projects are still required, but to be successful CSI must be

embedded within the organizational culture and become a routine activity.

Classful vs Classless Routing Protocols

2012-03-10T23:58:00.005+05:30

Classful routing protocols do not send subnet mask information with their

routing updates. A router running a classful routing protocol will react in one

of two ways when receiving a route:

• If the router has a directly connected interface belonging to the same

major network, it will apply the same subnet mask as that interface.

• If the router does not have any interfaces belonging to the same major

network, it will apply the classful subnet mask to the route.

Belonging to same “major network” simply indicates that they belong to the

same “classful” network. For example:

• 10.3.1.0 and 10.5.5.0 belong to the same major network (10.0.0.0)

• 10.1.4.5 and 11.1.4.4 do not belong to the same major network

• 192.168.1.1 and 192.168.1.254 belong to the same major network (192.168.1.0)

• 192.168.1.5 and 192.167.2.5 do not belong to the same major network.

Take the following example (assume the routing protocol is classful):

If Router B sends a routing update to Router A, it will not include the subnet

mask for the 10.2.0.0 network. Thus, Router A must make a decision.

If Router A has a directly connected interface that belongs to the same major

network (10.0.0.0), it will use the subnet mask of that interface for the route.

For example, if Router A has an interface on the 10.4.0.0/16 network, it will

apply a subnet mask of /16 to the 10.2.0.0 network. If Router A does not have

a directly connected interfacing belonging to the same major network, it will

apply the classful subnet mask of /8. This can obviously cause routing difficulties.

When using classful routing protocols, the subnet mask must remain

consistent throughout your entire network.

ITIL (Information Technology Infrastructure Library)

2012-03-10T19:22:00.000+05:30

ITIL (IT Infrastructure Library) provides a framework of Best Practice

guidance for IT Service Management and since its creation, ITIL has grown to

become the most widely accepted approach to IT Service Management in the

world.

The challenges for IT managers are to co-ordinate and work in partnership with

the business to deliver high quality IT services. This has to be achieved while

adopting a more business and customer oriented approach to delivering

services and cost optimization.

The primary objective of Service Management is to ensure that the IT services

are aligned to the business needs and actively support them. It is imperative

that the IT services underpin the business processes, but it is also increasingly

important that IT acts as an agent for change to facilitate business

transformation.

To understand what service management is, we need to understand what

services are, and how service management can help service providers to deliver

and manage these services.

A service is a means of delivering value to customers by

facilitating outcomes customers want to achieve without the

ownership of specific costs and risks.

A simple example of a customer outcome that could be facilitated by an IT

service might be: “Sales people spending more time interacting with

customers” facilitated by “a remote access service that enables reliable access

to corporate sales systems from sales people’s laptops”.

The outcomes that customers want to achieve are the reason why they purchase

or use the service. The value of the service to the customer is directly dependent

on how well it facilitates these outcomes. Service management is what enables

a service provider to understand the services they are providing, to ensure that

the services really do facilitate the outcomes their customers want to achieve, to

understand the value of the services to their customers, and to understand and

manage all of the costs and risks associated with those services.

Service Management is a set of specialized organizational

capabilities for providing value to customers in the form of

services.

These “specialized organizational capabilities” are described in this pocket

guide. They include all of the processes, methods, functions, roles and activities

that a Service Provider uses to enable them to deliver services to their

customers.

Service management is concerned with more than just delivering services. Each

service, process or infrastructure component has a lifecycle, and service

management considers the entire lifecycle from strategy through design and

transition to operation and continual improvement.

The outcomes that customers want to achieve are the reason why they purchase

or use the service. The value of the service to the customer is directly dependent

on how well it facilitates these outcomes. Service management is what enables

a service provider to understand the services they are providing

Service Management is a set of specialized organizational

capabilities for providing value to customers in the form of

services.

Effective service management is itself a strategic asset of the service provider,

providing them with the ability to carry out their core business of providing

services that deliver value to customers by facilitating the outcomes customers

want to achieve.

ITIL was published between 1989 and 1995 by Her Majesty’s Stationery Office

(HMSO) in the UK on behalf of the Central Communications and

Telecommunications Agency (CCTA) – now subsumed within the Office of

Government Commerce (OGC). Its early use was principally confined to the

UK and Netherlands. A second version of ITIL was published as a set of

revised books between 2000 and 2004.

Flie Systems (FAT & NTFS)

2012-03-07T13:14:00.002+05:30

File Allocation Table (FAT) is the name of a computer file system architecture and a family of industry standard file systems utilizing it.

The FAT file system is technically relatively simple yet robust. It offers reasonably good performance even in light-weight implementations and is therefore widely adopted and supported by virtually all existing operating systems for personal computers. This makes it a well-suited format for data exchange between computers and devices of almost any type and age from the early 1980s up to the present.

Originally designed in the late 1970s for use on floppy disks, it was soon adapted and used almost universally on hard disksthroughout the DOS and Windows 9x eras for two decades. With the introduction of more powerful computers and operating systemsits use on hard drives has since started to decline, but it continues to be used on many computer systems.

Today, FAT file systems are still commonly found on floppy disks, solid-state memory cards, flash memory cards, and on many portable and embedded devices.

The name of the file system originates from the file system's prominent usage of an index table, the FAT, statically allocated at the time of formatting. The table contains entries for each cluster, a contiguous area of disk storage. Each entry contains either the number of the next cluster in the file, or else a marker indicating end of file, unused disk space, or special reserved areas of the disk. The root file directory of the disk contains the number of the first cluster; the operating system can then traverse the FAT table, looking up the cluster number of each successive part of the disk file as a cluster chain until the end of the file is reached.

As disk drives have evolved, the maximum number of clusters has significantly increased, and so the number of bits used to identify each cluster has grown. The successive major versions of the FAT format are named after the number of table element bits: 12 (FAT12), 16 (FAT16), and 32 (FAT32).

FAT was also commonly used on hard disks throughout the DOS and Windows 9x eras, but its use on hard drives has declined since the introduction of Windows XP, which primarily uses the newer NTFS. FAT is still used in hard drives expected to be used by multiple operating systems, such as in shared Windows and Linux environments.

Due to the widespread use of FAT formatted media since its introduction many operating systems have provided support for FAT and subsequently VFAT and FAT32 through official or third-party file system handlers. For example, Mac OS 9 and Mac OS X also support FAT file systems on volumes other than the boot disk. AmigaOS supports FAT through the CrossDOS file system.

For many purposes, the NTFS file system is superior to FAT in terms of features and reliability; its main drawbacks are the size overhead for small volumes and the very limited support by anything other than the NT-based versions of Windows, since the exact specification is a trade secret of Microsoft. The availability of NTFS-3G since mid 2006 has led to much improved NTFS support in Unix-like operating systems, considerably alleviating this concern. It is still not possible to use NTFS in DOS-like operating systems without third-party drivers, which in turn makes it difficult to use a DOS floppy for recovery purposes. Microsoft provided a recovery console to work around this issue, but for security reasons it severely limited what could be done through the Recovery Console by default. The movement of recovery utilities to boot CDs based on BartPE or Linux (with NTFS-3G) is finally eroding this drawback.

Due to its long history of usage on desktops and portable computers meanwhile spanning over more than three decades and its frequent use in embedded solutions, the FAT file system continues to be the most widespread file system worldwide.

NTFS (New Technology File System) is the standard file system of Windows NT, including Windows 2000, Windows XP, and all their successors to date.

NTFS supersedes the FAT file system as the preferred file system for Microsoft’s Windows operating systems. NTFS has several improvements over FAT and HPFS (High Performance File System) such as improved support for metadata and the use of advanced data structures to improve performance, reliability, and disk space utilization, plus additional extensions such as security access control lists(ACL) and file system journaling.

In the mid 1980s, Microsoft and IBM formed a joint project to create the next generation of graphical operating system. The result of the project was OS/2, but Microsoft and IBM disagreed on many important issues and eventually separated. OS/2 remained an IBM project. Microsoft started to work on Windows NT. The OS/2 file system HPFS contained several important new features. When Microsoft created their new operating system, they borrowed many of these concepts for NTFS.

The new features in Windows XP require on-disk data structures that make these volumes unavailable to Microsoft Windows NT 4.0-based computers. In anticipation of dual-boot scenarios, Microsoft recommends that you upgrade Windows NT 4.0 to Service Pack 4 (SP4) before you start the Windows XP installation. The version of NTFS included with Windows XP cannot be interpreted correctly by Windows NT 4.0. However, there is an updated Ntfs.sys driver in Windows NT 4.0 SP4 that enables Windows NT 4.0 to read from and write to NTFS volumes in Windows XP. Features of the NTFS 3.1 file system include:

· Disk quotas: Administrators can limit the amount of disk space users can consume on a per-volume basis. The three quota levels are: Off, Tracking, and Enforced.

· Encryption: The NTFS 3.1 file system can automatically encrypt and decrypt file data as it is read and written to the disk.

· Reparse points: Programs can trap open operations against objects in the file system and run their own code before returning file data. This feature can be used to extend file system features such as mount points, which you can use to redirect data that is read and written from a folder to another volume or physical disk.

· Sparse files: This feature permits programs to create very large files, but to consume disk space only as needed.

· USN journal: This feature provides a persistent log of all changes made to files on the volume. This feature is one of the reasons that Windows domain controllers must use an NTFS 3.1 partition as the system volume.

NOTE:Microsoft Windows 2000 uses NTFS 3.0. NTFS 3.0 and 3.1 have compatible on-disk formats, so volumes upgraded to NTFS 3.1 by Windows XP can continue to be accessed by Windows 2000 or by Windows NT 4.0 with SP4 or later.

How to Upgrade the IOS of a Router

2012-03-03T00:33:00.003+05:30

Please Follow the below given steps to Upgrade the IOS of a Router.

• Connect Consol cable to Router.

• Give IP address 192.168.1.1 to Fast Ethernet interface.

• Enable Telnet in Router.

• Give the same range IP address to Computer (192.168.1.2)

• Install TFTP on Computer.

• Connect Cross cable to Router Fast Ethernet interface.

• Ping Router IP from PC.

• Click on TFTP.EXE

• It will automatically take the IP address of that computer.

• Telnet the Router.

• Type “Show flash” .

• Select the IOS File name.

• Type “copy flash tftp” to take the backup of current IOS.

• Give the IP address of Remote computer.

• Give the source & destination file name.

• Type “Delete c1841-Lank9.12.3.222.bin” to delete the old IOS from the router.

• Press enter key once more to confirm deletion of IOS.

• Type “copy tftp flash”

• Give the IP address of Remote computer.

• Give the source & destination file name.

• Reboot the router

• In Configuration Mode type “Boot system flash”

• Type “show flash” to confirm.

How to Break Router's Password

2012-03-03T00:27:00.000+05:30

Please Follow the Below given Steps to Break Router’s Password

• Reboot the Cisco Router.

• Press Ctrl key & Break Key together.

• It will come on Rommon Mode Exp:-(Rommon>)

• Type “Confreg” to check configuration register value.

• It will show (0x2102)

• Change it to “ Confreg 0x2142” press enter.

• Type “I” for initialization.

• Reboot the Cisco Router.

• It will ask you “ Would you like to enter in auto configuration mode? (Y/N): N

• It will come to “Router>”

• Go in configuration mode & change the configuration Register value to same as previous.

How Internet Begin

2012-03-02T16:54:00.003+05:30

How Internet Begin:

In 1957 United States formed the Advanced Research Project Agency (ARPA) within the Department of Defense (DOD) to lead the Military in Science & technology.

In 1962, Paul Baran was commissioned by the U.S Air Force to develop a method that would enable the U.S to maintain control over it’s military even after a Nuclear Attack. The final Proposal was to implement a Packet Switched Network.

*Important Note: Packet Switching breaks down data that travels over the network into small Packets. These Packets reach to the destination computer with the Direct Path or Alternative Path.

Stage 1: ARPANET -> In 1968, Bolt, Beranak & Newman [BBN] was contracted by ARPA to build this Packet Switching Network known as ARPANET.

There were four sites that were initially connected.

University of California at Los Angeles
Standford Research Institute
University of California at Santa Barbara
University of Uthah

The Network was wired together using 50 KBPS circuits and was managed by Information Message Processors [IMP] that run on Honeywell 516 minicomputers. The Protocol used to communicate between Host was the (NCP) Network Control Protocol, Which enabled host running on the same network to transfer data.

*Important Note: A Protocol is an agreement used for communication between two network Hosts. The Protocol defines how data should be packaged for transmission on the network so the receiving host can unpackage it on the receiving end.

By 1972, Ray Tomlinson created an email Program that enables a user to send personal message across the network. The ARPA was renamed DARPA.

In 1973, A Development began on the protocol suite is now known as TCP/IP Protocol Suite. Vinton Cerf & Bob Kalm from DARPA headed this Development.

In 1976, Two Major Networking developments occurred. BOB Metcalfe of Xerox developed Ethernet, Which allowed for the development of Local Area Networks. The other major Development was the Implementation of SATNET the Atlantic Packet Satellite network that linked the United States with Europe.

By 1983, The ARPANET had been split into the ARPANET & the MILNET (Military Network). This Separated the Public Portion of the ARPANET from the Military Component. The Year 1983 was also a cut off for use of NCP on the ARPANET. All Participating networks had to switch to TCP/IP Network.

As a Result of increase in participants on ARPANET & MILNET, The University of Wisconsin Introduced a better Name Resolution DNS – Domain Name Space

End Point Security Control Configuration in Cisco Switches

2012-03-01T12:58:00.000+05:30

Implementation step for end point protections:

a) Command to be applied on L2switch

Switch# config t

spanning-tree portfast bpduguard default

errdisable recovery cause all

errdisable recovery interval 30

b) Command to be applied on access ports of switch except critical devices, Uplinks and Trunk Ports.

interface GigabitEthernet< interface number>

switchport mode access

switchport access vlan

logging event link-status

spanning-tree portfast

spanning-tree bpduguard enable

switchport port-security

switchport port-security maximum 1

Rollback step for end point protections:

a) Command to be applied on L2switch

switch# config t

no spanning-tree portfast bpduguard default

no errdisable recovery cause all

no errdisable recovery interval 30

b) Command to be applied on access ports of switch except critical devices, Uplinks and trunk Ports.

interface GigabitEthernet< interface number>

logging event link-status

no spanning-tree portfast

no spanning-tree bpduguard enable

no switchport port-security

no switchport port-security maximum 1

All Three Classes(A,B,C) Subnets

2012-02-29T16:03:00.000+05:30

Class A Subnets
Subnet Mask	Networking Bits	Number of Networks	Number of Hosts
255.255.255.252	/30	4,194,304	2
255.255.255.248	/29	2,097,152	6
255.255.255.240	/28	1,048,576	14
255.255.255.224	/27	524,288	30
255.255.255.192	/26	262,144	62
255.255.255.128	/25	131,072	126
255.255.255.0	/24	65,536	254
255.255.254.0	/23	32,768	510
255.255.252.0	/22	16,384	1,022
255.255.248.0	/21	8,192	2,046
255.255.240.0	/20	4,096	4,094
255.255.224.0	/19	2,048	8,190
255.255.192.0	/18	1,024	16,382
255.255.128.0	/17	512	32,766
255.255.0.0	/16	256	65,534
255.254.0.0	/15	128	131,070
255.252.0.0	/14	64	262,142
255.248.0.0	/13	32	524,286
255.240.0.0	/12	16	1,048,574
255.224.0.0	/11	8	2,097,150
255.192.0.0	/10	4	4,194,302
255.128.0.0	/9	2	8,388,606
255.0.0.0	/8	1	16,777,216

Class B Subnets
Subnet Mask	Networking Bits	Number of Networks	Number of Hosts
255.255.255.252	/30	32,768	2
255.255.255.248	/29	8,192	6
255.255.255.240	/28	4,096	14
255.255.255.224	/27	2,048	30
255.255.255.192	/26	1,024	62
255.255.255.128	/25	512	126

255.255.255.0	/24	256	254
255.255.254.0	/23	128	510
255.255.252.0	/22	64	1,022
255.255.248.0	/21	32	2,046
255.255.240.0	/20	16	4,094
255.255.224.0	/19	8	8,190
255.255.192.0	/18	4	16,382
255.255.128.0	/17	2	32,764
255.255.0.0	/16	1	65,534

Class C Subnets
Subnet Mask	Networking Bits	Number of Networks	Number of Hosts
255.255.255.252	/30	64	2
255.255.255.248	/29	32	6
255.255.255.240	/28	16	14
255.255.255.224	/27	8	30
255.255.255.192	/26	4	62
255.255.255.128	/25	2	126
255.255.255.0	/24	1	254

Powers of 2(IP Addressing & Subnetting)

2012-02-29T16:00:00.000+05:30

Powers of 2
2¹ = 2	2⁹ = 512	2¹⁷ = 131,072	2²⁵ = 33,554,432
2² = 4	2¹⁰ =1,024	2¹⁸ = 262,144	2²⁶ = 67,108,864
2³ = 8	2¹¹ = 2,048	2¹⁹ = 524,288	2²⁷ = 134,217,728
2⁴ = 16	2¹² = 4,096	2²⁰ = 1,048,576	2²⁸ = 268,435,456
2⁵ = 32	2¹³ = 8,192	2²¹ = 2,097,152	2²⁹ = 536,870,912
2⁶ = 64	2¹⁴ =16,384	2²² = 4,194,304	2³⁰ = 1,073,741,824
2⁷ = 128	2¹⁵ = 32,768	2²³ = 8,388,608	2³¹ = 2,147,483,648
2⁸ = 256	2¹⁶ = 65,536	2²⁴ = 16,777,216	2³² = 4,294,967,296

Binary to Decimal to Hexadecimal Conversion for Bit Values

2012-02-29T15:58:00.002+05:30

Decimal	Binary	Hexadecimal
0	0000	0
1	0001	1
2	0010	2
3	0011	3
4	0100	4
5	0101	5
6	0110	6
7	0111	7
8	1000	8
9	1001	9
10	1010	A
11	1011	B
12	1100	C
13	1101	D
14	1110	E
15	1111	F

Run Command Shortcut Keys

2012-02-28T00:31:00.000+05:30

The following are windows short-cut keys that you can use in Run Commands

Appwiz.cpl -- Used to run Add/Remove wizard

Calc --Calculator

Cfgwiz32 -- ISDN Configuration Wizard

Charmap --Character Map

Chkdisk --Repair damaged files

Cleanmgr --Cleans up hard drives

Clipbrd --Windows Clipboard viewer

Control --Displays Control Panel

Cmd --Opens a new Command Window

Control mouse --Used to control mouse properties

Dcomcnfg --DCOM user security

Debug --Assembly language programming tool

Defrag --Defragmentation tool

Drwatson --Records programs crash & snapshots

Dxdiag --DirectX Diagnostic Utility

Explorer --Windows Explorer

Fontview --Graphical font viewer

Fsmgmt.msc -- Used to open shared folders

Firewall.cpl -- Used to configure windows firewall

Ftp --FTP.exe program

Hostname --Returns Computer's name

Hdwwiz.cpl -- Used to run Add Hardware wizard

Ipconfig --Displays IP configuration for all network adapters

Logoff -- Used to logoff the computer

MMC --Microsoft Management Console

Msconfig --Configuration to edit startup files

Mstsc -- Used to access remote desktop

Msinfo32 --Microsoft System Information Utility

Nbtstat --Displays stats and current connections using NetBIOS over TCP/IP

Netstat --Displays all active network connections

Nslookup--Returns your local DN S server

Osk ---Used to access on screen keyboard

Perfmon.msc -- Used to configure the performance of Monitor.

Ping -- Sends data to a specified host/IP

Powercfg.cpl -- Used to configure power option

Regedit --Registry Editor

Regwiz -- Registration wizard

Sfc /scannow -- System File Checker

Sndrec32 -- Sound Recorder

Shutdown -- Used to shutdown the windows

Spider -- Used to open spider solitaire card game

Sfc /scannow -- Used to run system file checker utility.

Sndvol32 --Volume control for soundcard

Sysedit -- Edit system startup files

Taskmgr --Task manager

Telephon.cpl -- Used to configure modem options.

Telnet --Telnet program

Tracert --Traces and displays all paths required to reach an Internet host

Winchat -- Used to chat with Microsoft

Wmplayer -- Used to run Windows Media player

Wab -- Used to open Windows address Book.

WinWord -- Used to open Microsoft word

Winipcfg --Displays IP configuration

Winver -- Used to check Windows Version

Wupdmgr --Takes you to Microsoft Windows Update

Write -- Used to open WordPad

Packeteer(Packetshaper) Useful Commands

2012-02-27T18:31:00.000+05:30

1 To assign IP Address

set ipaddress 192.1.6.64 255.255.255.0

set gateway 192.1.6.60

2 To check the License

ver ver

3 To see the Configuration

setup show

4 To check IOS

image show

5 To check Class

class show

6 To check the Partition

partition show

7 To check Access Status

set access show

8 To configure Sys Log on PS

set sys state on

sys set syslogwarnsenabled 1

set sys add host:192.68.141.10

sys set syslog

set syslog show

9 To check Syslog Configuration

set syslog show

10 To check Tacacs configuration

set tacacs show

11 To see CPU Utilization

sys health

12 To check Class and Partition limit of PS

sys limits

13 To display the top 10 Bandwidth Users:

hostdb info -sr -n 10

14 To get connection list of a IP:

traffic flow -n 100 -ItvpC -A 192.68.132.159

15 To check BW Consumed by a IP Address:

hostdb info 10.87.132.159

16 To check filter Table:

ipfilter show

17 To bypass the Traffic from Shaping

ipfilter passthrough inside src 192.68.132.159

ipfilter passthrough outside dst 192.68.132.159

18 To disable ssh ver 1 on PS

sys set showdebug 1

sys set enableSupportForSSHv1

sys set enableSupportForSSHv1 0

sys set enableSupportForSSHv1

sys set showdebug 0

Channelised E1/PRI Card Configuration in Router

2012-02-27T18:18:00.000+05:30

E1/PRI card Configuration
Please Follow the below given Steps:

1. Insert E1 Card in router's Slot.
2. Power on the Router.
3. Give User name & Password.

Cisco#show controllers E1
Cisco#Config t
Cisco(Config)#card type E1 0 0
Cisco(Config)#controller E1 0/0/0
Cisco(Config-controller)#channel-group 0 timeslots 1-31
Cisco(Config-controller)#framing no-crc4
Cisco(Config-controller)#exit
Cisco(Config)#exit

Cisco#Sh IP Interface brief

Trunk & Access Interface(Port) Configuration in Cisco Switch

2012-02-27T18:13:00.000+05:30

Trunk interface Configuration:

The below commands should be applied in switch interface which is connected to another switch.

interface GigabitEthernet< interface number>

switchport trunk encapsulation dot1q

switchport trunk native vlan < unused vlan >

switchport mode trunk

switchport nonegotiate

logging event link-status

Access port configuration:

The below commands should be applied in switch interface which is connected to single host.

interface GigabitEthernet< interface number>

switchport mode access

switchport access vlan

spanning-tree portfast

spanning-tree bpduguard enable

switchport port-security

switchport port-security maximum 1

IP Address Classification & Category

2012-02-26T00:40:00.002+05:30

IP Address is 32 bit logical address define in Network Header. This makes enable a computer to communicate with another computer on network. It is represented by Dotted decimal. It has four octets. Each octet is of 8 bit (8*4=32).

It has two versions. (i) IP v4 (ii) IPv6

IPv4 – 32 Bit

IPv6 – 128 Bit

It has two portions (i) Network Portion (ii) Host Portion

Class A, B, and C IP address formats.

Class A IP addresses are for big internetworks. The first octet is the network portion, and the last

three octets are the host portion. Only 256 numbers are available in the eight-bit network part, but 16,777,216 numbers are available in the host part of each of those network addresses.

Class B addresses are for medium-size internetworks. The first two octets are the network portion and the last two octets are the host portion. There are 65,536 available numbers in the

network part and an equal number in the host part.

Class C addresses are just the opposite of class A. The first three octets are the network portion,

and the last octet is the host portion.

Address masks for class A, B, and C network addresses.

Class Mask Dotted Decimal

A 11111111000000000000000000000000 255.0.0.0

B 11111111111111110000000000000000 255.255.0.0

C 11111111111111111111111100000000 255.255.255.0

The subnet mask may be represented in three different formats.

Reserved Range by IANA for Private IP Addresses are as below:

A Class - 10.0.0.0 - 10.255.255.255

B Class - 172.16.0.0 - 172.31.255.255

C Class - 192.168.0.0 - 192.168.255.255

Metrics of Routing Protocols

2012-02-25T16:10:00.002+05:30

Metric – Metric define distance between two IP Subnets. IP Subnets can be major networks, Sub-networks, Summary address, & Super-net address.

Metric	Routing Protocol
0	Metric of Static Routing
Hope Count (1-15)	Metric of RIP V1 & V2
Composite (Bandwidth) (Delay) (Load) (MTU) (Reliability)	Metric of IGRP
Composite (Bandwidth) (Delay) (Load) (MTU) (Reliability)	Metric of EIGRP
Cost (10^8/Bandwidth)	Metric of OSPF
Cost	Metric of IS-IS
Attribute	Metric of BGP

Protocol Services & Related Port no

2012-02-25T12:24:00.000+05:30

Port No	Protocol Service
1	ICMP – Internet Control Message Protocol (Ping Service)
2	IGMP - Internet Group Management Protocol
6	TCP – Transmission Control Protocol
8	EGP - Exterior Gateway Protocol
17	UDP – User Datagram Protocol
20, 21	FTP- File Transfer Protocol (20 port used in case of Unix Server)
22	SSH – Secure Shell (Putty)
23	Telnet (Access any device Remotely)
25	SMTP – Simple Mail Transfer Protocol
53	DNS – Domain Name Service
67,68	DHCP – Dynamic Host Configuration Protocol(Client & Server)
69	TFTP – Trivial File Transfer Protocol (use to upload IOS)
80	HTTP – Hyper Text Transfer Protocol (Use for web Services)
110	POP 3(Post office Protocol) Used receiving mails
123	NTP – Network Time Protocol
443	HTTPS
3389	RDP – Remote Desktop Protocol

Cloud Computing

2012-02-18T14:58:00.002+05:30

Cloud computing is the delivery of computing as a service rather than a product, whereby shared resources, software, and information are provided to computers and other devices as a metered service over a network. Cloud computing provides computation, software, data access, and storage resources without requiring cloud users to know the location and other details of the computing infrastructure. End users access cloud based applications through a web browser or a light weight desktop or mobile app while the business software and data are stored on servers at a remote location. Cloud application providers strive to give the same or better service and performance as if the software programs were installed locally on end-user computers.

Characteristics

Cloud computing exhibits the following key characteristics:

§ Empowerment of end-users of computing resources by putting the provisioning of those resources in their own control, as opposed to the control of a centralized IT service.

§ Agility improves with users' ability to re-provision technological infrastructure resources.

§ Application programming interface (API) accessibility to software that enables machines to interact with cloud software in the same way the user interface facilitates interaction between humans and computers. Cloud computing systems typically use REST-based APIs.

§ Cost is claimed to be reduced and in a public cloud delivery model capital expenditure is converted to operational expenditure. This is purported to lower barriers to entry, as infrastructure is typically provided by a third-party and does not need to be purchased for one-time or infrequent intensive computing tasks

§ Device and location independence enable users to access systems using a web browser regardless of their location or what device they are using (e.g., PC, mobile phone). As infrastructure is off-site (typically provided by a third-party) and accessed via the Internet, users can connect from anywhere.

§ Virtualization technology allows servers and storage devices to be shared and utilization be increased. Applications can be easily migrated from one physical server to another.

§ Multi-tenancy enables sharing of resources and costs across a large pool of users thus allowing for:

§ Centralization of infrastructure in locations with lower costs (such as real estate, electricity, etc.)

§ Peak-load capacity increases (users need not engineer for highest possible load-levels)

§ Utilisation and efficiency improvements for systems that are often only 10–20% utilized.

§ Reliability is improved if multiple redundant sites are used, which makes well-designed cloud computing suitable for business continuity and disaster recovery.

§ Performance is monitored, and consistent and loosely coupled architectures are constructed using web services as the system interface.

§ Security could improve due to centralization of data, increased security-focused resources, etc., but concerns can persist about loss of control over certain sensitive data, and the lack of security for stored kernels. Security is often as good as or better than other traditional systems, in part because providers are able to devote resources to solving security issues that many customers cannot afford. However, the complexity of security is greatly increased when data is distributed over a wider area or greater number of devices and in multi-tenant systems that are being shared by unrelated users. In addition, user access to security audit logs may be difficult or impossible. Private cloud installations are in part motivated by users' desire to retain control over the infrastructure and avoid losing control of information security.

§ Maintenance of cloud computing applications is easier, because they do not need to be installed on each user's computer and can be accessed from different places.

Deployment models

Public cloud

A public cloud is one based on the standard cloud computing model, in which a service provider makes resources, such as applications and storage, available to the general public over the Internet. Public cloud services may be free or offered on a pay-per-usage model.

Community cloud

Community cloud shares infrastructure between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally. The costs are spread over fewer users than a public cloud (but more than a private cloud)

Hybrid cloud

Hybrid cloud is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together, offering the benefits of multiple deployment models. It can also be defined as multiple cloud systems that are connected in a way that allows programs and data to be moved easily from one deployment system to another.

Private cloud

Private cloud is infrastructure operated solely for a single organization, whether managed internally or by a third-party and hosted internally or externally.

They have attracted criticism because users "still have to buy, build, and manage them" and thus do not benefit from less hands-on management essentially "[lacking] the economic model that makes cloud computing such an intriguing concept".

Architecture

Cloud architecture the systems architecture of the software systems involved in the delivery of cloud computing, typically involves multiple cloud components communicating with each other over a loose coupling mechanism such as a messaging queue.

The Intercloud

The Intercloud is an interconnected global "cloud of clouds" and an extension of the Internet "network of networks" on which it is based.

Cloud engineering

Cloud engineering is the application of engineering disciplines to cloud computing. It brings a systematic approach to the high level concerns of commercialisation, standardisation, and governance in conceiving, developing, operating and maintaining cloud computing systems. It is a multidisciplinary method encompassing contributions from diverse areas such as systems, software, web, performance, information, security, platform, risk, and quality engineering.

OSPF Routing Configuration

2012-02-16T22:02:00.001+05:30

Description: The purpose of this Lab is to configure OSPF on all the devices and test for ping and trace commands.

Instructions:

1) Assign the IP address of all the devices as given below

Device	Interface	IP Address	Mask
R1	S0 S1	192.168.1.1 192.168.3.1	255.255.255.0 255.255.255.0
R2	S0 S1	192.168.1.2 192.168.2.1	255.255.255.0 255.255.255.0
R3	S0 S1	192.168.3.2 192.168.2.2	255.255.255.0 255.255.255.0

2) Bring all the interfaces to up

3) Configure OSPF on all the Devices,Use Process ID 1 and Autonomous System number 0

4) From R1 issue a ping and trace command to R2-S1 and R3-S1 interfaces

On R1:

R1>enable
R1#configure terminal
R1(config)#interface serial 0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)#exit
R1(config)#interface serial 1
R1(config-if)#ip address 192.168.3.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)#exit
R1(config)#router ospf 1
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 192.168.3.0 0.0.0.255 area 0

On R2:

R2>enable
R2#configure terminal
R2(config)#interface serial 0
R2(config-if)#ip address 192.168.1.2 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)#exit
R2(config)#interface serial 1
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#network 192.168.1.0 0.0.0.255 area 0
R2(config-router)#network 192.168.2.0 0.0.0.255 area 0

On R3:

R3>enable
R3#configure terminal
R3(config)#interface serial 0
R3(config-if)#ip address 192.168.3.2 255.255.255.0
R3(config-if)# no shutdown
R3(config-if)#exit
R3(config)#interface serial 1
R3(config-if)#ip address 192.168.2.2 255.255.255.0
R3(config-if)# no shutdown
R3(config-if)#exit
R3(config)#router ospf 1
R3(config-router)#network 192.168.3.0 0.0.0.255 area 0
R3(config-router)#network 192.168.2.0 0.0.0.255 area 0

On R1:

R1#ping 192.168.2.2
R1#ping 192.168.2.1
R1#trace 192.168.2.2
R1#trace 192.168.2.1