All about Networking

What is WINS?

2010-12-23T16:38:00.000+07:00

Not satisfied with DNS, Microsoft invented another naming service for Windows, called WINS (Windows Internet Name Service). WINS is a Windows-specific name service for TCP/IP and is meant for networking geographically distant Windows computers (it typically isn’t used on a local area network). WINS not only maps names of servers but also maps names of workgroups and NT domains.
It’s unlikely that WINS will be around in the next generation of Windows machines (although it’s still around in Windows 98); Microsoft is taking a page from the competition’s automatic name services and directory services and will be rolling TCP/IP name services together with their username and password services. This will be called Active Directory.
The notion of a directory is similar to the name services concept, but it goes one step further: Instead of simply resolving a name to a number, directory services offer many pieces of vital data on the network. In particular, directory services allow users from all over to log in to the network rather than into a specific server; each server on the network relies on the directory services to assign security rights, and so on.

This is terrific because administrators no longer need to update multiple servers with username and password information; instead, they can administer updates from one point and distribute them throughout the network. Although the long-term goal has been simplification, which makes troubleshooting easier, beware of early implementations. Even Novell’s NDS—arguably the “best” directory service around (it’s been around a number of years and has a lot of support)—had a lot of problems out of the gate.
Some sort of directory service—whether it’s Microsoft’s, Novell’s, or Acme’s—is definitely in your future.

What is DNS?

2010-12-23T06:37:00.000+07:00

Prologue for this article.
You’ve probably asked yourself in one of the preceding paragraphs, “How does www.co.chatham.ga.us get translated into 167.195.160.9?” Furthermore, why use names at all? People can deal with phone numbers, why not just use the IP number? These are good questions. The answer to the latter is that just because people can deal with a number doesn’t mean that they prefer to use a number. Which would you rather remember, 1-800-NETWORK or 1-800-638-9675? Obviously, most people prefer to remember a name. Actually, names are the better thing to use when networking, because numerical addresses can change during a reconfiguration or a move, whereas symbolic names typically stay the same.
Name-to-address translation (also known as name lookup or name resolution) occurs via name services. Very similar to the speed dial button on your phone, name services are the networking equivalent of an electronic phone book. They’re actually a lot cooler than your speed dial: For example, suppose you could say “Mom” to make your phone dial your mother.

DNS (Domain Name System)

Name services run as a service on any given name server; that is, a specific program runs on a name server that hands out an address when you give it a name. Like your speed dial buttons, you must program in a name entry; entering the correct number for a given name is important. In particular, TCP/IP name services, although powerful and able to handle millions and millions of names, isn’t exactly plug-and-play. The DNS (Domain Name Service) that you use when surfing the Web works pretty automatically for you once it’s configured correctly, and it will translate www.co.chatham.ga.us to 167.195.160.9. However, you’ll need to know the exact number of your DNS server. Unlike telephone information, DNS servers all have different addresses; verifying that a workstation’s DNS server is correct can be an important troubleshooting step

Note that most smaller sites that use TCP/IP usually don’t have DNS set up. Instead, each workstation has a local (hard drive) “hosts” file that lists the addresses and host names the workstation needs to get to. (Think of this as your personal phone book rather than the corporate directory.) As you can imagine, this gets hard to manage when you have more than a handful of workstations, unless the addresses of the servers never change. As sites grow, or as they get connected to the Internet, DNS servers are added. Can you imagine how big a single file with all the servers on the Internet would be? Fortunately, each DNS server for a given DNS zone is only responsible for its own information.
A DNS zone (its scope of responsibility for naming) can be huge—for example, .com has millions of subzones (yahoo.com, jotto.com, and so on); on the other hand, it can be small—for example, feldman.org lists only one host (www.feldman.org) and no subzones.
With DNS servers getting easier to manage and being a mandatory component of Internet access, you can expect to see more of them in smaller shops as time goes on. It’s worth mentioning that each DNS server is responsible for only its own zone, so if you can’t get to one particular address (say, yahoo.com) but can get to another (say, jotto.com), it may be that the name server responsible for that zone is down. On the Internet at large, this rarely happens, because the DNS organizers require back-up DNS servers for a zone. DNS problems are more likely to happen within a smaller organization’s intranet, particularly when all the eggs for that organization are in one basket.

What is LAN and WAN?

2010-12-12T13:53:00.000+07:00

A LAN is a high-speed, fault-tolerant data network that covers a relatively small geographic area. It typically connects workstations, personal computers, printers, and other devices. LANs offer computer users many advantages, including shared access to devices and applications, ﬁle exchange between connected users, and communication between users via electronic mail and other applications.

A WAN is a data communications network that covers a relatively broad geographic area and often uses transmission facilities provided by common carriers, such as telephone companies. WAN technologies function at the lower three layers of the OSI reference model: the physical layer, the data link layer, and the network layer.

TYPES OF DOS ATTACKS

2010-10-22T19:17:00.000+07:00

To be able to perform, find, or protect against DoS activities, you must first understand the basic principles and types of these attacks. Three main types of DoS attacks exist:

Consumption of resources, such as bandwidth, hard disk space,
CPU resources, and so on
Disruption of configuration information, routing, DNS, and other information
Direct disruption of network communication between the client and the server

As information about common DoS attacks has been mentioned in many other Hacking Exposed books, we'll only briefly describe these types of DoS attacks and will then move on to spend more time on Cisco-centric issues. We'll also include details on the methods of stopping DoS attacks on the perimeter of your network using built-in functions of Cisco devices.

Consumption of Resources

The bandwidth consumption attack is the most common type of DoS in the world. Many Internet companies such as Yahoo!, eBay, Microsoft, Amazon, and others have experienced downtime and financial losses due to this type of attack.

This type of attack makes up the majority of distributed denial of service (DDoS) attacks, as well as the early DoS methods of using ping -f floods by attackers with larger Internet pipes than those of their targets. These attacks are more difficult, and sometimes even impossible, to mitigate due to the nature of the protocols on which the Internet is built. However, efficient means of traffic rate control have been implemented by Cisco Systems for routers, and we will review these methods in this chapter. CPU resource consumption attacks can be the result of programming flaws found in the TCP/IP stack, server-side services, and other network-interacting software to which attackers can connect. These attacks can usually be rectified by patching the buggy software code using vendor patches. Hard disk space consumption occurs when the software or service is tricked into storing excessive amounts of information on the server's storage facility, thus consuming all available storage resources and memory. This will most likely lead to a denial of services for legitimate users and can be rectified by cleaning up the disk space, fixing the buggy software code, and/or rebooting the server. An example of such an attack is the flooding of an unauthenticated syslog server (usually found on port 514/UDP) by junk messages. An attacker can send any information to that port and it will be stored in the system log files. Depending on the attacker's bandwidth and the storage available, this method can be effective in disabling the logging facilities of the server or even the entire enterprise, making attacker tracing and prosecution a very difficult task.

Disruption of Information Flow

This type of attack is less common than bandwidth consumption; however, such an attack can affect many users, organizations, and, if properly launched, even entire countries or continents. For instance, the DNS entry of a company or an entire country can be altered or diverted to a different location or to /dev/null, thus disabling connectivity of the targeted networks for the duration of the attack. The motives behind this type of attack are usually political or corporate in nature. Another example of such an attack can be discovered when an attacker fiddles with the routers responsible for Border Gateway Protocol (BGP) routing updates; this can easily bring a large chunk of the Internet to its knees with only a few packets.

Disruption of Communication

This type of attack causes a disruption of established communication channels between the client and server. A typical attack would involve resetting a management TCP session to the device, such as a PIX firewall, to stop a system administrator from reconfiguring the device to counter a different attack. These attacks are usually possible due to a system software fault and can be rectified by applying a vendor patch.

DOS ATTACK MOTIVES

2010-10-22T09:15:00.000+07:00

The Internet has experienced numerous cases of DoS attacks. Unfortunately, due to the nature and existing inherited drawbacks of current Internet-centric protocols, these attacks are likely to stay with us for a long time, causing havoc and financial losses to thousands of organizations all over the world.

As we have already stated, the usual cause behind the attacks from experienced Black Hat hackers is to achieve some level of remote control (be it enable or unprivileged access) over the device. Therefore, the main reason why these attacks are uncommon among experienced hackers is that after successfully performing a series of DoS attacks, the device or targeted equipment becomes useless or obsolete for the duration of the attack or until the device is restarted. This scenario is usually true unless the attacked device is being specifically targeted to disable its operations as a part of some malicious "master plan."

In contrast, many unskilled hackers who do not manage to gain remote access to a device are likely to be frustrated, pitiful people who also show their underdeveloped egos by bragging on Internet Relay Chat (IRC) channels or underground message boards to increase their device frag count. These attackers will try to crash the device by all means possible to satisfy their egos and boast about such "marvelous" achievements to their virtual friends. What motivates different types of crackers to perform DoS attacks? The list of reasons can go on forever, but here are just a few of them:

Industrial and corporate competition
Profit-related causes (racketeers or mafia)
Political or social reasons
Having fun
Bragging rights
Revenge
Hatred

7 Layer OSI : Physical Layer

2010-08-07T10:50:00.001+07:00

The physical layer is responsible for activating the physical circuit between the Data Terminal Equipment (DTE) and Data Circuit-terminating Equipment (DCE), communicating through it, and then deactivating it. Additionally, the physical layer is also responsible for the communication between DCEs. A computer or router can represent the DTE. The DCE, on the other hand, is usually represented by a modem or a multiplexer.

To put it differently, the physical layer describes the electric or optical signals used for communicating between two computers. Physical circuits are created on the physical layer. Other appliances such as modems modulating a signal for a phone line are often put in the physical circuits created between two computers.
Physical layer protocols specify the following:
• Electrical signals (for example, +1V)
• Connector shapes (for example, V.35)
• Media type (twisted pair, coaxial cable, optical fiber, etc.)
• Modulation (for example, FM, PM, etc.)
• Coding (for example, RZ, NRZ, etc.)
• Synchronization (synchronous and asynchronous communication, time source, and so on)

7 Layer OSI : Data Link Layer

2010-08-06T10:39:00.000+07:00

As for serial links, the link layer provides data exchange between neighboring computers as well as data exchange between computers within a local network.
For the link layer, the basic unit of data transfer is the data link packet frame. A data frame is composed of a header, payload, and trailer.

A frame carries the destination link address, source link address, and other control information in the header. The trailer usually contains the checksum of the transported data. By using the checksum, we can find out whether the payload has been damaged during transfer. The network-layer packet is usually included in the payload.
The link layer does not engage in a conversation between DTE and DCE (the link layer does not see the DCE). It is engaged, however, in the frame exchange between DTEs. (It relies on the physical layer to handle the DCE issue.)
The following figure illustrates that different protocols can be used for each end of the connection on the physical layer. In our case, one of the ends uses the X.21 protocol while the other end uses the V.35 protocol. This rule is valid not only for serial links, but also for local networks. In local networks, you are more likely to encounter more complicated setups in which a switch that converts the link frames of one link protocol into link frames of a second one (for example, Ethernet into FDDI) is inserted between the two ends of the connection. This obviously results in different protocols being used on the physical layer.

A serial port or an Ethernet card can serve as a link interface. A link interface has a link address that is unique within a particular Local Area Network (LAN).

7 Layer OSI : Network Layer

2010-08-05T10:34:00.002+07:00

The network layer ensures the data transfer between two remote computers within a particular Wide Area Network (WAN). The basic unit of transfer is a datagram that is wrapped (encapsulated) in a frame. The datagram is also composed of a header and data field. Trailers are not very common in network protocols.

As shown in the figure above, the datagram header, together with data (network-layer payload), creates the payload or data field of the frame.
There is usually at least one router on WANs between two computers. The connection between two neighboring routers on the link layer is always direct. The router unpacks the datagram from a frame, only to wrap it again into a different frame (or, more generally, in a frame of different link protocol) before sending it to a different line. The network layer does not see the appliances on the physical and link layers (modems, repeaters, switches, etc.).
The network layer does not care about what kind of link protocols are used on route between the source and the destination.

A serial port or an Ethernet card can be used as a network interface. A network interface has a one or more unique address within a particular WAN.

7 Layer OSI : Transport Layer

2010-08-04T10:26:00.001+07:00

A network layer facilitates the connection between two remote computers. As far as the transport layer is concerned, it acts as if there were no modems, repeaters, bridges, or routers along the way. The transport layer relies completely on the services of lower layers. It also expects that the connection between two computers has been established, and it can therefore fully dedicate its efforts to the cooperation between two distant computers. Generally, the transport layer is responsible for communication between two applications running on different computers.
There can be several transport connections between two computers at any given time (for example, one for a virtual terminal and another for email). On the network layer, the transport packets are directed based on the address of the computer (or its network interface). On the transport layer, individual applications are addressed. Applications use unique addresses within one computer, so the transport address is usually composed of both the network and transport addresses.

In this case, the basic transmission unit is the segment that is composed of a header and payload.
The transport packet is transmitted within the payload of the network packet.

7 Layer OSI : Session Layer

2010-08-03T10:25:00.000+07:00

The session layer facilitates exchange of data between two applications. In other words, it serves as a checkpoint and is involved in synchronizing transactions, correctly closing files, and so on. Sharing a network disk is a good example of a session. The disk can be shared for a certain period of time, but the disk is not used for the entire time. When we need to work with a file on the network disk, a connection is established on the transport layer from the time when the file is opened to when it is closed. The session, however, exists on the session layer for the entire time the disk is being shared.
The basic unit is a session layer PDU (Protocol Data Unit), which is inserted in a segment. Other books often illustrate this with a figure of a session-layer PDU, composed of the session header and payload, being inserted in the segment. Starting with the session layer, however, this does not necessarily have to be the case. The session layer information can be transmitted inside the payload. This situation is even more noticeable if, for example, the presentation layer encrypts the data, and thus changes the whole content of the session-layer PDU.

Brief History of Internet Protocol

2010-02-22T09:49:00.000+07:00

This number is an exclusive number or address for all information technology devices (printers, routers, modems, et al) use which identifies and allows them the ability to communicate with each other on a computer network. There is a standard of communication, called an Internet Protocol standard (IP). In laymans terms it is the same as your home address. In order for you to receive snail mail at home the sending party must have your correct mailing address (IP address) in your town (network) or you do not receive bills, pizza coupons or your tax refund. The same is true for all equipment on the internet. Without this specific address, information cannot be received. IP addresses may either be assigned permanently for an Email server/Business server or a permanent home resident or temporarily, from a pool of available addresses (first come first serve) from your Internet Service Provider. A permanent number may not be available in all areas and may cost extra so be sure to ask your ISP.
Domain Name System (DNS): IP address to be translated to words. It is much easier to remember a word than a series of numbers. The same is true for email addresses.
For example, it is much easier for you to remember a web address name such as whatismyip.com than it is to remember 192.168.1.1 or in the case of email it is much easier to remember email@somedomain.com than email@192.168.1.1
Dynamic IP: One that is not static and could change at any time. This type of IP is issued to you from a pool of IP addresses allocated by your ISP or DHCP Server. This is for a large number of customers that do not require the same IP all the time for a variety of reasons. Your computer will automatically get this number as it logs on to the network and saves you the trouble of having to know details regarding the specific network configurations. This number can be assigned to anyone using a dial-up connection, Wireless and High Speed Internet connections. If you need to run your own email server or web server, it would be best to have a static IP.
Static IP: One that is fixed and never changes. This is in contrast to a dynamic IP which may change at any time. Most ISP's a single static IP or a block of static IP's for a few extra bucks a month.
IP version 4: Currently used by most network devices. However, with more and more computers accessing the internet, IPv4 IPs are running out quickly. Just like in a city, addresses have to be created for new neighborhoods but, if your neighborhood gets too large, you will have to come up with an entire new pool of addresses. IPv4 is limited to 4,294,967,296 IPs.
IP version 5: This is an experimental protocol for UNIX based systems. In keeping with standard UNIX (a computer Operating System) release conventions, all odd-numbered versions are considered experimental. It was never intended to be used by the general public.
IP version 6: The replacement for the aging IPv4. The estimated number of unique IPs for IPv6 is 340,282,366,920,938,463,463,374,607,431,768,211,456 or 2^128.
The old and current standard of IPs was this: 192.168.100.100 the new way can be written different ways but means the same and are all valid:
* 1080:0000:0000:0000:0000:0034:0000:417A
* 1080:0:0:0:0:34:0:417A
* 1080::34:0:417A

7 Layer OSI : Presentation Layer

2010-01-28T14:19:00.001+07:00

The Presentation layer gets its name from its purpose: It presents data to the Application layer and is responsible for data translation and code formatting.

This layer is essentially a translator and provides coding and conversion functions. A successful data-transfer technique is to adapt the data into a standard format before transmission. Computers are configured to receive this generically formatted data and then convert the data back into its native format for actual reading (for example, EBCDIC to ASCII). By providing translation services, the Presentation layer ensures that data transferred from the Application layer of one system can be read by the Application layer of another one.

The OSI has protocol standards that define how standard data should be formatted. Tasks like data compression, decompression, encryption, and decryption are associated with this layer. Some Presentation layer standards are involved in multimedia operations too.

The Presentation Layer is composed of two sublayers:

CASE (Common Application Service Element)
SASE (Specific Application Service Element)

CASE

The CASE sublayer provides services for the Application Layer and request services from the Presentation Layer. It provides support for common application services, such as:

ACSE (Association Control Service Element)
ROSE (Remote Operation Service Element)
CCR (Commitment Concurrency and Recovery)
RTSE (Reliable Transfer Service Element)

SASE

The SASE sublayer provides application specific services (protocols), such as

FTAM (File Transfer, Access and Manager)
VT (Virtual Terminal)
MOTIS (Message Oriented Text Interchange Standard)
CMIP (Common Management Information Protocol)
JTM (Job Transfer and Manipulation) a former OSI standard
MMS (Manufacturing Messaging Service)
RDA (Remote Database Access)
DTP (Distributed Transaction Processing)
Tel Net(a remote terminal access protocol)

7 Layer OSI : Application Layer

2010-01-25T18:12:00.000+07:00

Now we'll talk about layer in OSI. As we know, there are 7 layer for networking that usually used. Let we mention it below.

That's all layers we need to now. In this post, we will talk about the first layer, Application layer. The Application layer of the OSI model marks the spot where users actually communicate to the computer. This layer only comes into play when it’s apparent that access to the network is going to be needed soon. Take the case of Internet Explorer (IE). You could uninstall every trace of networking components from a system, such as TCP/IP, NIC card, and so on, and you could still use IE to view a local HTML document—no problem. But things would definitely get messy if you tried to do something like view an HTML document that must be retrieved using HTTP or nab a file with FTP or TFTP. That’s because IE will respond to requests such as those by attempting to access the Application layer. And what’s happening is that the Application layer is acting as an interface between the actual application program which isn’t at all a part of the layered structure and the next layer down by providing ways for the application to send information down through the protocol stack. In other words, IE doesn’t truly reside within the Application layer it interfaces with Application layer protocols when it needs to deal with remote resources.

The Application layer is also responsible for identifying and establishing the availability of the intended communication partner and determining whether sufficient resources for the intended communication exist.

These tasks are important because computer applications sometimes require more than only desktop resources. Often, they’ll unite communicating components from more than one network application. Prime examples are file transfers and email, as well as enabling remote access, network management activities, client/server processes, and information location. Many network applications provide services for communication over enterprise networks, but for present and future internetworking, the need is fast developing to reach beyond the limits of current physical networking.

It’s important to remember that the Application layer is acting as an interface between the actual application programs. This means that Microsoft Word, for example, does not reside at the Application layer but instead interfaces with the Application layer protocols.

The Benefits of Using TCP/IP

2009-11-19T15:40:00.000+07:00

By using TCP/IP, it enables cross-platform, or heterogeneous, networking. For example, a Windows NT/2000 network could contain Unix and Macintosh workstations or even networks mixed in it. TCP/IP also has the following characteristics that make it unique:

Good failure recovery
The ability to add networks without interrupting existing services
High error-rate handling
Platform independence
Low data overhead

Because TCP/IP was originally designed for Department of Defense–related purposes, what we now call features or characteristics were actually design requirements. The idea behind “Good Failure Recovery” was that if a portion of the network were disabled during an incursion or attack, its remaining pieces would still be able to function fully. Likewise is the capability of adding entire networks without any disruption to the services already in place. The ability to handle high error rates was built in so that if a packet of information got lost using one route, there would be a mechanism in place to ensure that it would reach its destination using another route. Platform independence means that the networks and clients can be Windows, Unix, Macintosh, or any other platform or combination thereof. The reason TCP/IP is so efficient lies in its low overhead. Performance is key for any network. TCP/IP is unmatched in its speed and simplicity.

TCP Features : Connections

2009-11-09T20:53:00.001+07:00

Before application processes can send data by using TCP, they must establish a connection. The connections are made between the port numbers of the sender and the receiver nodes. A TCP connection identifies the end points involved in the connection. The end point on picture below is formally defined as a pair that includes the IP address and port number:

(IP address, port numbers)

The IP address is the internetwork address of the network interface over which the TCP/IP application communicates. The port number is the TCP port number that identifies the application. The end point contains both the IP address and port numbers because port identifiers are selected independently by each TCP, and they may not be unique. By concatenating the unique IP address with port numbers, a unique value for
the end point is created.
A TCP connection is established between two end points. The TCP connection is identified by the parameters of both end points, as follows:
(IP address1, port number1, IP address2, port number2)

These parameters make it possible to have several application processes connect to the same remote end point. Picture above shows that several application processes connect to the same remote end point (199.11.23.1, 2001). The TCP module at 199.11.23.1 can keep the different TCP connections separate because TCP uses both the local and remote end points to identify the connection. In that picture, the end point (199.11.23.1, 2001) is the same, but the end points at the other end of the connection are different. This difference enables TCP to keep these connections separate.
The picture also illustrates that TCP can support multiple connections concurrently. These connections are multiplexed over the same network interface.
A connection is fully specified by the pair of end points. A local end point can participate in many connections to different foreign end points. A TCP connection can carry data in both directions; that is, it is full duplex.

In relationship to TCP connections, it is also helpful to define the notion of a half association and a full association. A half association is an end point that also includes the transport protocol name, as follows:
(TransportProtocol, IP address, port number)

The half associations in picture are, therefore, the following:
(tcp, 199.21.32.2, 1400)
(tcp, 196.62.132.1, 21)
A full association consists of two half associations and is expressed by the following ordered pair:
(TransportProtocol, IP address1, port number1, IP address2, port number2)

The TransportProtocol is listed only once because it has to be the same on both parts of the half association. The concept of half and full associations is useful when dealing with different transport protocols. As an example, the full association in picture is listed as follows:
(tcp, 199.21.32.2, 1400, 196.62.132.1, 21)

A full association consisting of source and destination IP addresses, and source and destination port numbers uniquely identifies a TCP connection.

TCP Features : Multiplexing

2009-11-09T17:53:00.000+07:00

TCP enables many processes within a single computer to use the TCP communications services simultaneously; this is called TCP multiplexing. Because these processes may be communicating over the same network interface, they are identified by the IP address of the network interface. However, you need more than the IP address of the network interface to identify a process because all processes that are using the same network interface on a computer have a common IP address.
TCP associates a port number value for applications that use TCP. This association enables several connections to exist between application processes on remote computers because each connection uses a different pair of port numbers.

This picture shows several connections being multiplexed over TCP.
The binding of ports to application processes is handled independently by each computer. In many computer systems, a logger or super daemon process watches over the port numbers that are identified or well known to other computer systems.

TCP Features : Flow Control

2009-11-07T20:19:00.000+07:00

Computers that send and receive TCP data segments can operate at different data rates because of differences in CPU and network bandwidth. As a result, it is quite possible for a sender to send data at a much faster rate than the receiver can handle. TCP implements a flow control mechanism that controls the amount of data sent by the sender. TCP uses a sliding window mechanism for implementing flow control.
TCP flow control mechanism exhibits the following properties:
• Octets that are to the left of the window range have already been sent and acknowledged.
• Octets in the window range can be sent without any delay. Some of the octets in
the window range may already have been sent, but they have not been acknowledged. Other octets may be waiting to be sent.
• Octets that are to the right of the window range have not been sent. These octets can be sent only when they fall in the window range.

The left edge of the window is the lowest numbered octet that has not been acknowledged. The window can advance; that is, the left edge of the window can move to the right when an acknowledgment is received for data that has been sent. The TCP packet containing the acknowledgment contains information about the window size that the sender should use.
The window size reflects the amount of buffer space available for new data at the receiver. If this buffer space size shrinks because the receiver is being overrun, the receiver will send back a smaller window size. In the extreme case, it is possible for the receiver to send a window size of only one octet, which means that only one octet can be sent. This situation is referred to as the silly window syndrome, and most TCP implementations take special measures to avoid it.
A TCP module sending back a window size of zero indicates to the sender that its buffers are full and no additional data should be sent. TCP includes mechanisms to shrink window size when the receiver experiences congestion of data and to expand window size as the congestion problem clears.
The goal of the sliding window mechanism is to keep the channel full of data and to reduce to a minimum the delays experienced by waiting for acknowledgments.

TCP Features : Reliability

2009-06-23T21:03:00.001+07:00

One of the most important features of TCP is reliable end-to-end data
delivery. In order to provide reliability, TCP must recover from data
that is damaged, lost, duplicated, or delivered out of order by the
Network Layer. TCP uses the Positive Acknowledgment Retransmission
(PAR) scheme for achieving reliability.

TCP implements PAR by assigning a sequence number to each octet that
is transmitted and by requiring a positive acknowledgment (ACK) from
the receiving TCP module. If the ACK is not received within a time-out
interval, the data is retransmitted. At the receiver TCP module, the
sequence numbers are used to correctly order segments that may have
arrived out of order and to eliminate duplicates. Corruption of data
is detected by using a checksum field filed in the TCP packet header.
Data segments that are received with a bad checksum field are
discarded. Unless a physical break in the link causes physical
partitioning of the network, TCP recovers from most Internet
communications system errors.

TCP Features : Basic Data Transfer

2009-06-21T15:27:00.000+07:00

Basic data transfer is the capability of TCP to transfer a continuous stream of octets in each direction. The octets are sent among application processes running on remote systems that use TCP. The application processes then group a set of bytes that need to be sent/received into a message segment. Message segments can be of arbitrary length. Ultimately, the messages have to be sent in IP datagrams that are limited by the MTU size of a network interface. However, at the TCP level, there is no real restriction on message size because the details of accommodating the message segments in IP datagrams
is the task of the IP Layer. For reasons of efficiency in managing messages, TCP connections typically negotiate a maximum segment size.

Messages sent by TCP have an octet stream orientation (see Figure below). TCP keeps track of each octet that is sent/received. The TCP has no inherent notion of a block of data, unlike other transport protocols, which typically keep track of the Transport Protocol Data Unit (TPDU) number and not the octet number. TCP can be used to provide multiple virtual-circuit connections between two TCP hosts.

Application processes that use TCP send data in whatever size is convenient for sending. For example, an application can send data that is as little as one octet or as big as several kilo-octets. TCP numbers each octet that it sends. The octets are delivered to the application processes at the receiving end in the order in which they are sent. This process is called sequencing of octets.

An application can send data to TCP a few octets at a time. TCP buffers this data and sends these octets either as a single message or as several smaller message segments. All that TCP guarantees is that data arrives at the receiver in the order in which it was sent. For example, if an application sends 1,024 octets of data over a period of ten seconds, the data can be sent across the network in a single TCP packet of 1,024 octets, or in four TCP packets of 256 octets, or in any combination of octets.

Because TCP sends data as a stream of octets, there is no real end-of-message marker in the data stream. To ensure that all the data submitted to the TCP module has been transmitted, a push function is required to be implemented by TCP. The push causes the TCP promptly to send any data that it has received from an application up to that point. The actual data that is sent by TCP is treated as an unstructured stream of octets. TCP does not contain any facility to superimpose an application-dependent structure on the data. For example, you cannot tell TCP to treat the data as a set of records in a database and to send one record at a time. Any such structuring must be handled by the application processes that communicate by using TCP.

Hard Drive Data Recovery using Freeware Programs - Page 1

2009-06-20T09:11:00.001+07:00

Hi,

http://www.hiren.info/downloads/data-recovery/hard-drive/1

From ra7d_si2gar@yahoo.co.id r01-05.opera-mini.net_64.255.180.21 using 'Send this page to a Friend' service.

Intel Announces Intel® Atom™ Brand for New Family of Low-Power Processors

2009-06-19T17:22:00.000+07:00

Intel's Smallest Processor Built Using World's Smallest Transistors Designed for New Internet Devices, Low-Cost PCs

SANTA CLARA, Calif., March 2, 2008 – The Intel® Atom™ processor will be the name for a new family of low-power processors designed specifically for mobile Internet devices (MIDs) and a new class of simple and affordable Internet-centric computers arriving later this year. Together, these new market segments represent a significant new opportunity to grow the overall market for Intel silicon, using the Intel Atom processor as the foundation. The company also announced the Intel® Centrino® Atom™ processor technology brand for MID platforms, consisting of multiple chips that enable the best Internet experience in a pocketable device.

Product logos for download


Intel® Atom™ processor	Intel® Centrino® Atom™ processor technology

The Intel Atom processor is based on an entirely new microarchitecture designed specifically for small devices and low power, while maintaining the Intel® Core™ 2 Duo instruction set compatibility consumers are accustomed to when using a standard PC and the Internet. The design also includes support for multiple threads for better performance and increased system responsiveness. All of this on a chip that measures less than 25 mm², making it Intel's smallest and lowest power processor yet.¹ Up to 11 Intel Atom processor die -- the tiny slivers of silicon packed with 47 million transistors each -- would fit in an area the size of an American penny.

These new chips, previously codenamed Silverthorne and Diamondville, will be manufactured on Intel's industry-leading 45nm process with hi-k metal gate technology. The chips have a thermal design power (TDP) specification in 0.6-2.5 watt range and scale to 1.8GHz speeds depending on customer need. By comparison, today's mainstream mobile Core 2 Duo processors have a TDP in the 35-watt range.

"This is our smallest processor built with the world's smallest transistors," said Intel Executive Vice President and Chief Sales and Marketing Officer Sean Maloney. "This small wonder is a fundamental new shift in design, small yet powerful enough to enable a big Internet experience on these new devices. We believe it will unleash new innovation across the industry."

With personal computing increasingly going mobile and the computer industry rapidly developing new classes of products to connect the next billion people to the Internet, the Intel Atom processor offers customers the unique ability to innovate around the new low-power design. In addition to the MID opportunity, Intel believes the demand for a new category of low-cost, Internet-centric mobile computing devices dubbed "netbooks" and basic Internet-centric desktop PCs dubbed "nettops," will grow substantially over the next several years. The Intel Atom processor is perfectly suited to meet these new market segments.

Intel said the Intel Atom processor also has potential for future revenue opportunities in consumer electronic devices, embedded applications and thin clients.

Intel Centrino Atom Processor Technology
The Intel Centrino Atom processor technology brand represents Intel's best technology for MIDs. Formerly codenamed "Menlow," Intel Centrino Atom processor technology includes the Intel Atom processor, a low-power companion chip with integrated graphics, a wireless radio, and thinner and lighter designs. Together, these components are designed to enable the best mobile computing and Internet experience on these new devices.

TCP Features

2009-06-17T22:26:00.001+07:00

TCP has the following noteworthy features:

Basic data transfer
Reliability
Flow control
Multiplexing
Connections
Precedence and security

For more detail, I will write it in the next post.....

The TCP/IP Suite of Protocols

2009-06-17T22:20:00.000+07:00

Although they are frequently identified as just “TCP/IP,” several different component protocols actually exist within the IP suite of protocols. These include:

IP—The Internet Layer protocol.
TCP—The reliable Host-to-Host Layer protocol.
UDP—The best-effort Host-to-Host Layer protocol.
ICMP—A multilayer protocol designed to facilitate control, testing, and management functions within an IP network. The various ICMP protocols span the Host-to-Host Layer and the Process/Application Layer.

TCP Header Structure

2009-06-13T12:33:00.000+07:00

As with IP, the functionality of TCP is limited by the amount of
information that it carries in its header. Thus, understanding the
mechanics and capabilities of TCP requires an appreciation for the
contents of its header.

The TCP protocol header is a minimum of 20 octets and contains the
following fields:

• TCP Source Port—The 16-bit source port field contains the number of
the port that initiates the communications session. The source port and
source IP address function as the packet's return address.

• TCP Destination Port—The 16-bit destination port field is the address
of the port for which the transmission is destined. This port contains
the interface address of the application on the recipient's computer to
which the packet's data will be passed.

• TCP Sequence Number—The 32-bit sequence number is used by the
receiving computer to reconstruct the fragmented data back into its
original form. In a dynamically routed network, it is quite possible for
some of the packets to take different routes and, consequently, to
arrive out of order. This sequencing field compensates for this
inconsistency of delivery.

• TCP Acknowledgment Number—TCP uses a 32-bit acknowledgment (ACK) of
the first octet of data contained in the next expected segment. It may
seem counterintuitive to acknowledge something that hasn't occurred yet,
but a source TCP/IP machine that receives an ACK knows that all the data
up to, but not including, that specified segment has been received. The
number used to identify each ACK is the sequence number of the packet
being acknowledged. This field is only valid if the ACK flag (see Flags,
later in this list) is set.

• Data Offset—This 4-bit field contains the size of the TCP header,
measured in a 32-bit data structure known as a "word."

• Reserved—This 6-bit field is always set to zero. It is reserved for an
as-yet unspecified future use.

• Flags—The 6-bit flag field contains six 1-bit flags that enable the
control functions of urgent field, acknowledgment of significant field,
push, reset connection, synchronize sequence numbers, and finished
sending data. The flags, in their order of appearance in the string, are
URG, ACK, PSH, RST, SYN, and FIN. Given the preceding description of
their functions, these mnemonic abbreviations should be self-apparent.

• Window Size—This 16-bit field is used by the destination machine to
tell the source host how much data it is willing to accept, per TCP segment.

• Checksum—The TCP header also contains a 16-bit error-checking field
known as a "Checksum." The source host calculates a mathematical value,
based upon the segment's contents. The destination host performs the
same calculation. If the content remained intact, the result of the two
calculations is identical, thereby proving the validity of the data.

• Urgent—The Urgent field is an optional 16-bit pointer that points to
the last octet of urgent data within the segment. This field is only
valid if the URG flag was set. If that flag is not set, the Urgent field
is pre-empted with Padding. Segments of data that are identified as
urgent are treated to expedited handling by all TCP/IP devices that lie
in the network intervening the source and destination machines.

• Options—A variable length field of at least 1 octet identifies which
options, if any, are valid for the TCP segment. If no options are set,
this 1-octet field is set equal to 0, which indicates the end of the
Options field. A value of 1 in this octet indicates that no operation is
required. A value of 2 indicates that the next four octets contain the
source machine's Maximum Segment Size (MSS). The MSS is the greatest
number of octets that the data field can be, as agreed to by the source
and destination machines.

• Data—Although not technically a part of the TCP header, it is
important to recognize that segments of application data follow the
Urgent and/or Options fields, but precede the Padding field. The field's
size is the largest MSS that can be negotiated between the source and
destination machines. Segments may be smaller than the MSS, but never
larger.

• Padding—Contrary to any indication of superfluousity that its name
might suggest, padding always serves a mathematical purpose in data
communications. That purpose is to ensure predictability of spacing,
timing, or sizing. Extra zeros are added to this field to ensure that
the TCP header is always a multiple of 32 bits.

Subnetting

2009-06-10T14:08:00.000+07:00

In the mid-1980s, RFCs 917 and 950 were released. These documents proposed a means of solving the ever-growing problem posed by the relatively flat, two-level hierarchy of IP addressing. The solution was termed subnetting. The concept of subnetting is based on the need for a third level in the Internet’s hierarchy. As internetworking technologies matured, their acceptance and use increased dramatically. As a result, it became normal for moderate and large-sized organizations to have multiple networks. Frequently, these networks were LANs. Each LAN may be treated as a subnet.

In such multiple-network environments, each subnetwork would interconnect to the Internet via a common point: a router. The actual details of the network environment are inconsequential to the Internet. They comprise a private network that is (or should be) capable of delivering its own datagrams. Thus, the Internet need only concern itself with how to reach that network’s gateway router to the Internet. Inside the private network, the host portion of the IP address can be subdivided for use in identifying subnetworks. Subnetting, as specified in RFC 950, enables the network number of any classful IP address (A, B, or C) to be subdivided into smaller network numbers. A subnetted IP address actually consists of three parts:
• Network address
• Subnetwork address
• Host address

The subnetwork and host addresses are carved from the original IP address’s host address portion. Thus, your ability to subnet depends directly on the type of IP address being subnetted. The more host bits there are in the IP address, the more subnets and hosts you can create. However, these subnets decrease the number of hosts that can be addressed. You are, in effect, taking bits away from the host address to identify subnetwork numbers. Subnets are identified using a pseudo-IP address, known as a subnet mask. A subnet mask is a 32-bit binary number that can be expressed in dotted-decimal form. The mask is used to tell end systems (including routers and other hosts) in the network how many bits of the IP address are used for network and subnetwork identification. These bits are called the extended network prefix. The remaining bits identify the hosts within the subnetwork. The bits of the mask that identify the network number are set to 1s and the host bits are set to 0s.

For example, a mask of 11111111.11111111.11111111.11000000 (255.255.255.192 in dotted-decimal notation) would yield 64 mathematically possible host addresses per subnet. The values of the right-most six bits, the ones set equal to zero, sum to 64 in the base 10 number system. Thus, you can uniquely identify 64 devices within this subnet. Only 62 of these addresses, however, are actually usable. The other two host addresses are reserved. The first host number in a subnet is always reserved for identifying the subnet itself. The last host number is also reserved, but is used for IP broadcasts within the subnet. Thus, you must always subtract 2 from the maximum number of hosts in a subnet to get the maximum number of usable host addresses per subnet.

The number of mathematically possible subnets, however, depends on what class of IP address is being subnetted. Each class reserves a different number of the available bits for the network number. Thus, each class offers a different number of bits that can be used for subnetting.