Dynamic Host Configuration Protocol (DHCP) is a protocol used by networked devices to obtain information required to operate on an Internet Protocol network.

When a DHCP client is first switched on, it sends a broadcast packet on the network with a DHCP request. If there is a DHCP server exists in the network, this request will be picked up by the DHCP server. The DHCP server will allocate an IP address to the PC, from one of the pools of addresses it managed.

DHCP clients use a broadcast packet to find a DHCP server, so if a client is on one side of a router, and the server on the other, normally these broadcast packets will be filtered out. Many routers today include support for DHCP- forwarding, but it is not enabled by default.

Many system administrators do not realize that DHCP service can be enabled in Cisco devices. In this article, we will show the method on configuring DHCP on a Cisco router.

Router1, a Cisco router with an IP address of 10.0.0.110 (/24), will be configured as DHCP server. it will be configured to hand out IP addresses in the range from 10.0.0.1 through 10.0.0.254. It will also provide the information identifying itself as the default gateway and DNS server. Our local domain name will be Domain.com.

First of all, enter the configuration mode in Router1.

Router1#config t

By default, the Cisco IOS DHCP server and relay agent features are enabled on your router. To re-enable these features if they are disabled, use the following command in global configuration mode:

Router1(config)# service dhcp

In the case that you may like to reserve few addresses, you are able to tell the router to do so. In the following example, we will exclude address from 10.0.0.110 to 10.0.0.120 and from 10.0.0.200 to 10.0.0.254.

Router1(config)#ip dhcp excluded-address 10.0.0.110 10.0.0.120

Router1(config)#ip dhcp excluded-address 10.0.0.200 10.0.0.254

The next step is to create a DHCP pool. In the following example, we created a DHCP pool named “LAN”.

Router1(config)#ip dhcp pool LAN

After DHCP pool is created, we will define the IP address pool. This is the IP address space which will be assigned to users automatically by Cisco router.

Router1(DHCP-config)#network 10.10.0.0 255.255.255.0

Other options for DHCP can be added after this step.

Router1(DHCP-config)#default-router 10.0.0.100

Router1(DHCP-config)#dns-server 10.0.0.105 10.0.0.106

Router1(DHCP-config)#domain-name Domain.com

Router1(DHCP-config)#

Router1(DHCP-config)#exit

If the interface of the router is not set yet, following is the configuration for it.

Router1(config)#

Router1(config)#interface f0/0

Router1(config-if)#ip address 10.0.0.100 255.255.255.0

Router1(config-if)#end

Router1#copy run start

It is possible to create multiple DHCP pools in the router configuration. By using the current DHCP pool as reference, create another DHCP pool using the network/mask and gateway that you plan to be assigned to hosts connected to another interface. The router will be able to determine which DHCP pool to be used based on which interface the client DHCP discover packet it received.

Clustering is the connection of multiple computers together in such a way that to the outside world, the cluster appears to be a single system. Each computer in a cluster is referred to as a node.

Business suffers when work stops because of critical service is offline. A properly installed and configured cluster provides continued operation during hardware failure, software failure, and/or planned maintenance. Ability to recover from failed server hardware and failed software is the main benefit of clustering.

Windows Server 2003 clustering consists of two different technologies: Server Cluster and Network Load Balancing (NLB). Each of these technologies can be used to provide high availability for different types of services.

Server Cluster is primarily used to provide availability for mission critical applications through fail-over. It is typically used for databases, e-mail services and custom applications. Windows 2003 supports server clusters of up to eight nodes. Most clustered applications, and their associated resources, are assigned to one cluster node at a time. Node failure in a cluster is detected by the absence of heartbeats from that node. If a node fails to transmit a heartbeat packet for a designated period of time, that node is considered to have failed and the remaining nodes will takeover the work load of the failed node. In this case, the clustered application will be started on remaining nodes. Client requests are immediately redirected to the backup cluster node and the impact of the failure will be minimized.

The NLB service provides a means for load balancing TCP/IP traffic among multiple nodes in an NLB cluster. It manages the incoming traffic and balances it out to the servers participating in the cluster. For example, in the case of a high-traffic web site, when a Web page request is sent to a “manager” server, it will forward this request to one of the server in the cluster. Such implementation allows traffic to be handled more quickly.

Windows 2003 supports NLB clusters of up to 32 nodes. Typically, NLB is used to provide high availability for applications that need client requests distributed across nodes in a cluster such as Web servers, firewalls and proxy servers.

In summary, clustering services in Windows Server systems offer fail over capabilities and high system up time.

It is only a matter of time before an unsecured system becomes contaminated and losing valuable data. In addition, poorly secured system that is compromised can be used for a number of illegal activities. It was reported that several major Internet sites were disabled by attacks that were launch through the use of thousands of these devices.

Whether it is a Windows PC, router, switches, Linux machine or network enable device, it is recommended to stop unnecessary services that are run by default. Every running, but unused, service on your system is an unnecessary security vulnerability. Users may not even be aware that many of these services are running. Each additional service running on it may be a possible avenue for a network cracker to penetrate the system.

It is important to know the security implication of any network service before enabling it in. For example, if the telnet service is activated, a telnet client running on another device on the network can easily establish a telnet session to the system; it needs only the address of the system and the port or socket number of the network service running on the system. The rule of thumb for TCP and UDP ports is: Turn off any services or listeners that you do not need for your application to function. One way to check the list of ports running on your system is to go to one of the many web sites that can run a remote scan of your system and tell you how secure the system.

One way to check the list of ports running on your system is to go to one of the many web sites that can run a remote scan of your system and tell you how secure the system.

There are many good software packages available to allow users to secure their system. One of these software packages is known as a firewall. Firewall can be used to deny various ports from the access by another device located at another network. Majority of the routers installed today have basic NAT firewall protection, use them as the first firewall protection for Internet connection.

As a final note, the fewer services running in your system at boot time, the quicker the system will boot. Unnecessary services not only subject you to security risk. They also slow down the operation of your system. So stopping unnecessary services on your system is a highly recommended practice!

The nslookup command is a standard command-line tool provided in most DNS service implementations. It offers the ability to perform query testing of DNS servers and obtain detailed responses as the command output. This information is useful in troubleshooting name resolution problems, verifying that resource records (RRs) are added or updated correctly in a zone, and debugging other server-related problems.

When trying to join a Windows 2003 DC using NetBIOS name, you may receive this message: “A domain controller for the domain could not be contacted”. Common issue with this error may due to the DNS SRV records required to locate a domain controller for the domain are not registered in DNS. These records are registered with a DNS server automatically when a domain controller is added to a domain.

To verify DNS registration for domain controllers, we may use the nslookup command

On your Command Prompt.

Type:

nslookup

After the previous command completes, at the nslookup (”>”) prompt type:

set q=srv

where srv is the service location (SRV) resource record.

After the previous command completes, type:

_ldap._tcp.dc._msdcs.Active_Directory_domain_name

For example, if the DNS domain name of your Active Directory domain is asiavalueinvestor.com, type:

_ldap._tcp.dc._msdcs.asiavalueinvestor.com.

The following is an example of command-line output for an Nslookup session, used to verify SRV resource records that are registered by domain controllers. In this example, the two domain controllers are dc1 and dc2 and are registered for the “domain.com” domain.

C:\nslookup
Default Server: ds.abc.com
Address: 10.0.0.1
set type=srv
_ldap._tcp.dc._msdcs.domain.com

Server: ds.abc.comm
Address: 10.0.0.1
_ldap._tcp.dc._msdcs.domain.com SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = dc1.domain.com
_ldap._tcp.dc._msdcs.domain.com SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = dc2.domain.com
dc1.domain.com internet address = 202.224.1.1
dc2.domain.com internet address = 202.224.1.2

Whether it is a Windows PC, router, switches, Linux machine or network enable device, it is recommended to stop unnecessary services that are run by default. Every running, but unused, service on your system is an unnecessary security vulnerability. Users may not even be aware that many of these services are running. Each additional service running on it may be a possible avenue for a network cracker to penetrate the system.

It is important to know the security implication of any network service before enabling it in. For example, if the telnet service is activated, a telnet client running on another device on the network can easily establish a telnet session to the system; it needs only the address of the system and the port or socket number of the network service running on the system. The rule of thumb for TCP and UDP ports is: Turn off any services or listeners that you do not need for your application to function. One way to check the list of ports running on your system is to go to one of the many web sites that can run a remote scan of your system and tell you how secure the system.

Freeware that I think is useful are now available at:

The 88 Best Freeware

This site will list a maximum of 88 best freeware I found so far and going to find in the near future. The total is not 88 yet. I will add in whenever I found something good!

DNS or Domain Name System is one of the base system service in TCP/IP. It is used by email system, windows active directory, any web access and so on. Without DNS, a user will need to know the IP addresses of all the services s/he uses.

Understanding of DNS is a must in managing network system. As mentioned, almost all network service require the service of a DNS. A trouble happened in DNS will make everything not working properly. Using a DNS tools like nslookup may be useful in troubleshooting this problems.

The Internet Printing Protocol (IPP) is a standard network protocol for remote printing as well as managing print jobs, media size, resolution, and so forth in distributed environments.

The idea behind the IPP is to define a protocol for end users to print over the Internet, provide users with the same printing controls and concepts that they use to print locally or to LAN-attached printers. There are two main components to IPP:

- Web-based printer management which offers the ability to administer, to connect to, and to view printers by using a Web browser.
- Internet printing which allows you to use the printer’s URL to connect to a printer.

In IPP, print jobs are sent using Hypertext Transfer Protocol (HTTP), the same protocol used to connect to web pages. Unlike other printing protocols, IPP also supports access control, authentication, and encryption, making it a much more capable and secure printing solution than older ones.

As IPP transfers are made using HTTP v. 1.1, once a connection is made, multiple commands (files) can be sent over a single TCP connection. However, by using HTTP/1.1, IPP faces criticism for its protocol overloading. This allegedly makes for a more complex and bloated protocol and implementation than necessary — for example the venerable lp protocol was extended to cover the same functionality.

Anyway, the advantage of implementing IPP on top of HTTP is in the fact that the latter protocol is already well-tested on the Internet as a method to transfer files, which enables reuse of proven, well-tested and debugged client and server code.

It is a design goal of IPP to not invent new security features when existing protocols can be used. For example, the original RFC suggested authorization be done for example via HTTP’s Digest access authentication mechanism or via SSL3. Encryption is not done by IPP itself either, but it may be handled by SSL/TLS protocol layer.

Because the service is using HTTP or HTTPS, this is typically port 80 or port 443. As IPP supports HTTPS traffic, communication can be encrypted, depending on the user’s Internet browser settings. IPP printing via HTTPS is offered in Windows XP and Windows Server 2003. Windows Vista and Windows Server 2008 also support IPP printing over RPC in Medium-Low security zone. IPP uses the client/server model, where the client resides in a PC or workstation and the server is embedded in a printer device or resides in a separate print server machine. The process is as follows:

1. Client will always initiates the communication with the server. The user connects to a print server over the Internet by typing the URL for the print device.

2. The HTTP request is sent over the network to the print server.

3. The print server requires the client to provide authentication information. This ensures that only authorized users print documents on the print server.

4. Once the user is authenticated, the server presents status information to the user by using Active Server Pages (ASP), which contain information about currently available printers.

5. When the user connects to any of the printers on the Internet printing Web page, the client first tries to find a driver for the printer locally. If an appropriate driver cannot be found, the print server generates a cabinet file (.cab file, also known as a setup file) that contains the appropriate printer driver files. The print server downloads the .cab file to the client computer. The user on the client computer is prompted for permission to download the .cab file.

6. The client computer downloads printer drivers and connects to the printer using either IPP or a remote procedure call (RPC), depending on the security zone that the printer share is in. The security zone is configured on the client computer through Internet Options in Control Panel. With a Medium-high or Medium security zone, IPP is used, and with a Medium-low security zone, RPC is used.

7. Once this configuration is done, the user can send documents to the print server.

Many major vendors have adopted the IPP standard with IPP embedded in a single physical output device - in which case clients talk directly to the printer. For example, with IPP, you can print to an IPP ready printer like Canon iR5000 series copier machine through HTTP protocol. You can also use IPP to print to a non-IPP enabled printer through a IPP gateway. It is quite easy to install IPP gateway. In Windows system, install and run Internet Information Server (IIS) on the print server. When IIS is installed on a computer running Windows Server 2003, the Internet Printing and Active Server Pages components that are necessary to enable Web-based printer management and Internet printing are not installed by default. If you elect to install the Internet Printing component when you install IIS, the Active Server Pages component will also be installed by default. This behavior is controlled by the Internet Printing and Active Server Pages check boxes in the IIS installation. Once IIS is installed on the print server, you can manage a printer from Internet Explorer by accessing the address http://printserver/printers. Basically, IPP allows the user to:

- find out about a printer’s capabilities
- submit print jobs to a printer
- find out the status of a printer or a print job
- cancel a previously submitted print job

To print to the printer, use the Add Printer Wizard to add an HTTP printer using the URL http://printserver/printers/printersharename/.printer.

The Post Office Protocol version 3 (POP3) as defined in RFC1939 is an application-layer Internet standard protocol used by local e-mail clients to retrieve e-mail from a remote server over a TCP/IP connection. The protocol defines how the server responds to requests sent from an e-mail client.

A POP3 mail server receives e-mails and filters them into the appropriate user folders. The POP3 service makes e-mail messages available for download from a server, enabling a server to host e-mail accounts and provide basic e-mail access. When a user connects to the mail server to retrieve his mail, the messages are downloaded from mail server to the user’s hard disk. Virtually all modern e-mail clients and servers support this protocol.

POP3 works over a TCP/IP connection using TCP on network port 110. POP3 listens on this TCP port 110 for connections from e-mail clients, authenticates the client, and manages the connection with the client. The design of POP3 and its procedures supports end-users with intermittent connections (such as dial-up connections), allowing these users to retrieve e-mail when connected and then to view and manipulate the retrieved messages without needing to stay connected. Although most clients have an option to leave mail on server, e-mail clients using POP3 generally connect, retrieve all messages, store them on the user’s PC as new messages, delete them from the server, and then disconnect.

Like many other older Internet protocols, POP3 originally supported only an unencrypted login mechanism. Although plain text transmission of passwords in POP3 still commonly occurs, POP3 currently supports several authentication methods to provide varying levels of protection against illegitimate access to a user’s e-mail. One such method, APOP, uses the MD5 hash function in an attempt to avoid replay attacks and disclosure of the shared secret. Clients implementing APOP include Mozilla Thunderbird, Opera, Eudora and Windows Live Mail. POP3 clients can also support SASL authentication methods via the AUTH extension.

POP3 is used only when downloading mail from the mailbox. When uploading mail, client access is to a server running Simple Mail Transfer Protocol (SMTP), which simply forwards mail after looking up the proper IP addresses on a Domain Name Server (DNS) server. All email message transmission uses the SMTP protocol until the message reaches the destination host.

nslookup is a computer program used in Windows and Unix to query Domain Name System (DNS) servers to find DNS details, including IP addresses of a particular computer, MX records for a domain and the NS servers of a domain. The name nslookup means “name server lookup”.

nslookup is also use as a command-line administrative tool for testing and troubleshooting DNS servers. In the very simple usage, if you enter a domain name, you get back the IP address to which it corresponds, and if you enter an IP number, then you get back the domain name to which it corresponds.

There are two modes available in nslookup: interactive and non-interactive. Interactive mode allows the user to query name servers for information about various hosts and domains or to print a list of hosts in a domain. Non-interactive mode is used to print just the name and requested information for a host or domain. Following is an example in using interactive mode of nslookup.

C:\>nslookup
Default Server: dns3.maxonline.com.sg
Address: 202.156.1.58

> ifreetuition.com
Server: dns3.maxonline.com.sg
Address: 202.156.1.58

Non-authoritative answer:
Name: ifreetuition.com
Address: 74.220.215.82

You may also use nslookup to find out the mail server for a particular domain. In this case we will need the MX record. For example:

C:\>nslookup
Default Server: dns3.maxonline.com.sg
Address: 202.156.1.58

> set type=MX
> asiatcm.com.
Server: dns3.maxonline.com.sg
Address: 202.156.1.58

Non-authoritative answer:
asiatcm.com MX preference = 0, mail exchanger = aspmx.l.google.com

asiatcm.com nameserver = ns1.hostmonster.com
asiatcm.com nameserver = ns2.hostmonster.com
aspmx.l.google.com internet address = 209.85.143.27

In this example, it shows that the MX record for asiatcm.com is 209.85.143.27. In another words, an email towards asiatcm.com should be forwarded to email gateway with the IP address of 209.85.143.27. As you can see, the MX record is rather important. Suppose however that your domain was having trouble receiving E-mail and you suspected that a DNS server issue was to blame. You could use nslookup to confirm that the domain does indeed have an MX record and that the MX record is pointed to the correct IP address.