Ethernet Cable Descriptions

'N<Signaling>-X

N = signaling rate in Mbps

<Signaling> = Base or broad (Baseband or Broadband)

X = Unique identifier for Ethernet cabling scheme

Firewire

'IEEE 1394 standard (Sony calls i.Link).

? 15 ft (4.5 meters) 100,200,400Mbps (800 Mbps in 1394b standard)

6 pin connector: powers devices (2 pairs, or 4 conductors)

4 pin connector: data transfer only

USB

127 devices (although practical amount is 12 devices)

? 480 Mbps (USB 2.0)

Fiber-Optic Cable

Uses light impulses, immune to Electromagnetic and Radio Frequency Interference

(EMI and RFI)

1) Carried down glass or plastic core (glass = greater distance plastic = cheaper)

2) Core surrounded by glass/plastic cladding w/ different refraction to send light

3) Flexible plastic buffer covers previous layers

4) Optional armor coating (Kevlar) when necessary for protection

5) Sheathed in PVC/plenum

Fiber-Optic Connectors

Straight Tip (ST): Uses BNC attachment mechanism

Square/Subscriber Connector (SC): uses latching mechanism, lasts for around 1000 matings

Small Form Factors (SFF)

Allow more fiber-optic terminations in the same space

Mechanical Transfer RJ (MTRJ): designed by AMP, keyed for single polarity

Local Connector (LC): designed by Lucent, uses ceramic insert

[edit section] Common Network Connectivity Devices

NIC: either an expansion card or built into motherboard.

?Link LED (good connection) and Activity LED (shows transfer of frames)

Hub: connects all segments of the network together. One sends, all receive, only one addressed to "accept" it. Collision possible.

Switch: Acts as Hub, but recognizes MAC address of recipient and sends to only them. Supports full wire speed on each and every port.

Bridge: connects two similar network segments together; keep traffic separated on both sides of the bridge (divide busy network into 2 segments, or connect two segments)

Router: connects multiple, often dissimilar, networks into an internetwork. Make intelligent decisions about how to forward packets of information. (also gateway/firewall)

Gateways: any hardware and software combination that connects dissimilar network environments. Examples are LAN-based email and connecting a LAN to mainframe environment.

Modem: modulator/demodulator, three different types:

POTS: traditional, plain old telephone service, in most computers today

DSL: digital subscriber line, higher data rates, use frequency above 3200Hz

ISDN Terminal Adapters: Integrated Services Digital Network, high-speed Internet access. 64Kbps channels over conditioned telephone copper pairs, doesn’t change from analog to digital, but rather changes between digital transmission formats.

? Older TA’s (terminal adapters) use EIA/TIA-232 serial port for PC connections

Wireless Access Points (WAP): wireless equivalent of a hub or switch, ideal for small business networks

CSU/DSUs: Channel Service Unit/Data Service Unit, common device used to connect to T1 or Digital Data Server (DDS).

Channel Service Unit: terminates the line at the customer’s premises, diagnostics, remote testing

Data Service Unit: actual transmission of the signal through the CSU, buffering/data control

Transceivers (Media Converters): allow NIC or other networking device to connect to different type of media than it was designed for

Firewalls: protect LAN resources from attackers on the Internet, filter packets, can be standalone "blackboxes" or set up in software.

Internet (public)

Network (private)

Both public/private, such as web and email servers = demilitarized zone (DMZ)

[edit section] The OSI Model

Minimum Ethernet frame size = 64 bytes

ISO: International Organization for Standardization (not an acronym)

Application: Set of tools that an application can use (HTTP, FTP, etc). Error recovery, file, print, messaging services.

Presentation: Formatting and code conversion of data being passed up to the Application layer. Character sets converted (ASCII to Unicode), data is encrypted/compressed. Receiving Presentation layer must know how to convert file into something the Application layer can use.

Multipurpose Internet Mail Extensions (MIME): denotes file types of incoming data

Session: Defines how 2 computers establish, synchronize, maintain, and end a session. Includes security authentication, connection ID establishment, data transfer, acknowledgements, and connection release. ("Have you got the data I sent?")

**Upper Level Devices = Gateways**

Transport: Checks that the data was delivered error-free. Divide message that is too long into smaller segments/take series of short messages and combines them (segment sequencing done by appending number to each segment). Logical name/address resolution. ACK (acknowledgement) that data packet received. Error flow/control.

To provide error and flow control, use two types of connection services

1) Connection-Oriented: use ACK and responses, no user data will be sent without virtual circuit already having been established

Ex: Think of how phone call conversation works

2) Connectionless services: don’t have error recovery/flow control, one advantage is SPEED.

Ex: Think of a postcard

Fully Qualified Domain Name (FQDN): type of name that you use when surfing the web

http://www.Comptia.org

Here: www - Server Name

Comptia - Second Level

org - Top Level

Network: Logical addressing and translating logical addresses into physical addresses. Prioritizes data (QoS, or quality of service). Controls congestion, routes data from source to destination, builds/tears down packets.

Each logical network address is protocol dependent (protocol addresses)

IPX address: (8 Hex Digits for Net Address):(12 Hex digits for Node Address)

Net? Installed randomly or assigned Node ? MAC address

TCP/IP address: (0-255).(0-255).(0-255).(0-255)

Depends on class of address (subnet mask)

Routing

• Determines which path to take through internal Routing Tables
• Won’t pass unknown/broadcast packets by default
• Gets into routing tables through static and dynamic routing
• Static routing = manually configured (Route command)
• Dynamic routing = uses dynamic discovery protocols, send out special packets to updates of other routers. 2 types: Distance Vector and Link State

Distance Vector

Router sends out routing table once it is brought online, and every minute after. When another router receives routing table, it adds one to hop count and resubmits routing table. Adds overhead over network.

Link State

More efficient than Distance Vector, sends out routing table via Multicast/Unicast only when there is an update.

Routing Information Protocol (RIP) ? Distance Vector

NetWare Link Services Protocol (NLSP) for IPX -and-

Open Shortest Path First (OSPF) for TCP/IP ? Link State

**Only Non-Routable Protocol is NetBEUI**

Default Gateway Setup (Windows)

Cmd | route print | route add 0.0.0.0 mask 0.0.0.0 (gateway address)

Default Gateway Setup (Cisco)

show ip route (make sure you see Gateway of last resort not set)

Router configure terminal

Router(config) *These two lines enter global configuration mode

Router(config) ip route 0.0.0.0 0.0.0.0 serial0

Router(config) end

Router

Network Layer Devices

Routers: connect multiple networks/segments to form a larger internetwork, by adding software, can filter packets and act as firewall

Layer 3 Switches: multiport, virtual LAN, data-pipelining functions and routing functions between virtual LANS

Data-Link: Takes raw data from the physical layer and gives it a logical structure called a frame. Frames include: where the data is meant to go, sender of data. Creating, transmitting, and receiving frames. Controls functions of logical network topologies and physical addressing. Data transmission synchronization and connection.

Made up of two sub-layers

Media Access Control sublayer (MAC)

Logical link Control sublayer (LLC)

Frames: logical chunks of data, unit of data transmission

MAC Address: globally unique address, exists at MAC sublayer.

(aka Ethernet address or the physical address)

• 48-bit value, 12 digit hex value XX:XX:XX:XX:XX:XX (or with dashes)
• First three segments called Organizationally Unique Identifier (OUI), administered by the IEEE, identifies the manufacturer of the interface.
• Last three segments called device ID, manufacturer ensures is unique
• permanently embedded in ROM chip, called Burned-in address (BIA)
• Can override MAC address by factory supplied program or LLA (locally administered address) from an OS

Logical Topology: way the information flows

Physical Topology: way cables are laid out

Method of Media Access

1. Contention: every device competes w/ other for opportunity to transmit. If each transmit at same time, cause collision.

2. Polling: A central device, called a controller, polls each device in turn and asks if it has data to transmit (virtually eliminates collision)

3. Token Passing: This uses special data packet called a token, only when device has token can it transmit.

Media Access Methods

Carrier Sense/Multiple Access with Collision Detection (CSMA/CD): Detect is signal on wire, if nobody on, attempt to transmit. If 2 or more try to do this at same time, wait random amt of time and try again.

Token Passing: First computer turned on creates the token, passes token to next computer until one has data to send, modifies the token, and sends it back out. Every station looks at packet, if not for them, forward on to next one until designated station receives. NIC copies data, modifies token (saying it was received), and sends it back to original sender. Repeat process, if sender all done, sender modifies token as "free".

Carrier Sense/Multiple Access with Collision Avoidance (CSMA/CA): Transmits a request to send (RTS) packet and waits for clear to send (CTS) packet in return.

802.3 ? Specifies network that use bus topology, baseband signaling, and CSMA/CD

802.5 ? Token Ring speeds: 4/16/100 MBps Uses physical star/logical ring. Degrades w/ grace. Token ring works according to "weakest link", i.e. 4 MBps NIC w/ all others at 16MBps.

802.12 ? Hewlett-Packard’s Demand Priority, divides bandwidth according to priority of port. 100VG, 100VG-AnyLAN, 100Base-VG, AnyLAN

Data Link Layer Devices

Bridges: can connect dissimilar networks only at LLC layer (if at MAC, must be same)

Switches: builds table of all MAC addresses of all the devices connected to it

WAPs: wireless bridge/switch, connect wireless clients to wired network

Networking Protocols

TCP/IP

• Uses Address Resolution Protocol (ARP), router sends ARP request broadcast, matching device (matching IP) sends their MAC address, router then stores this in ARP Cache.
• To Route: must have IP address of sender/receiver/next router
• Very flexible and interoperable (multiple Operating Systems)
• Domain Name Services (DNS): host names resolved from IP addresses

IPX/SPX

• Internetwork Packet Exchange/Sequenced Packet Exchange
• IPX handles routing/addressing, only change is IPX network address
• Routing Protocols: RIP and NLSP
• Microsoft’s version called NWLink
• Only devices that have names are NetWare servers. (64 characters, not case sensitive, can’t use "illegal" characters)

NetBEUI

• Uses NetBIOS names (up to 15 characters, must follow special character rules)
• Not a routable protocol
• Support BY: Windows 9x, NT, 2000, 2003, LAN Manager, OS/2

AppleTalk/AppleTalk over IP

• AppleTalk version 2.0 supports Ethernet
• AppleTalk Filing Protocol (AFP): provides interface between application and a file server.
• AppleShare is the Mac service offered to implement AFP service
• Services for Macintosh: makes multiclient support possible (as shared folder or Macintosh volume)
• Use 24-bit address, can support 254 nodes, 16-bit network number or range of 16-bit network numbers (called Extended AppleTalk network > 254 nodes) Node address assigned by computer automatically
• Routing by: Routing Table Maintenance Protocol (RTMP)
• Naming: Uses Name Binding Protocol (NBP), broadcast based

• Physical: Responsible for controlling the functional interface, such as transmission technique, encoding scheme, cable specifications, pin layout, and connector type. Translation of data into signals = signal encoding.

Devices

NIC: connection between internal bus and network media. Layer 1 and 2.

Transceivers: transmits and receives network signals. NICs w/ Attachment Unit Interface (AUI)/DIX port need external transceiver.

Repeaters: regenerates the signals it receives by forwarding it (extends max. length of a network segment. Uses 5-4-3 rule (5 segments w/ 4 repeaters w/ 3 segments populated.)

Hubs: aka Ethernet concentrator, multiport repeater, also subject to 5-4-3 rule.

Passive: Unpowered, only physical/electrical connections. Distance shortened (draws power to do its job)

MAUs (Multistation Access Units): unique to token ring networks. Provides data path that creates logical ring, passes to port MAU deems as nearest active downstream port. Chained: Ring In ? Ring Out Up to 33 MAUs connected together

[edit section] TCP/IP

TCP

1. Flow control allows 2 systems to cooperate in datagram transmission

2. ACK lets the sender know that the recipient has received the information

3. Sequencing ensures that segments arrive in the proper order

4. Checksums allow easy detection of corrupted segments

5. Retransmission of lost or corrupted segments is managed in a timely way.

IP

1. Moves data from point A to point B (routing)

2. Connectionless (best effort transmission)

3. Considered unreliable (TCP is reliable)

IP Header

Version: IP version number

IHL (Internet Header Length): Defines length of header information, standard is 5 32-bit words

TOS (Type of Service): priority and congestion details

Total Length: Total length of the datagram (max packet length of 65,535 bytes)

Identification: Use when reassembling of packets is necessary (identify one packet from another)

Flags: Fragmented/Unfragmented frame

Fragmentation Offset: Indicates in units of 8 octets the position of the fragmented data used for reassembly

Time to Live (TTL): Number of hops able to make before packet "dies"

Protocol: Identifies the protocol whose header and data follow the IP header

Header Checksum: Error-checking value at each packet processing point

Source Address: 32-bit IP address of the original transmitting device

Destination Address: 32-bit IP address of the original destination device

Options and Padding: Security, Record Route, Internet Timestamp

Upper-Layer Information:Head/user datagram handed down by upper protocol

Internet Control Message Protocol (ICMP):works at Network layer, provides functions used for Network layer. (used by Ping)

Address Resolution Protocol (ARP): Network layer protocol, associates physical hardware address (MAC address) to an already known IP address. Creates ARP table.

**To route, router first checks if it knows how to reach destination. If it doesn’t, sends info to default gateway.**

[edit section] TCP/IP Application Protocols

Simple Network Management Protocol (SNMP): allows network administrators to collect information about the network. Each piece of info to be collected is defined in a Management Information Base (MIB). SNMP uses UDP.

File Transfer Protocol (FTP): single/multiple file transfers between computer systems, Uses TCP to actually move the files.

Trivial File Transfer Protocol (TFTP): "Stripped down" version of FTP, used to boot diskless workstations and transfer boot images to and from routers. Uses UDP rather than TCP (fast connections/no reliability).

Secure File Transfer Protocol (SFTP): Used when transferring files over an encrypted connection (uses SSH session).

Simple Mail Transfer Protocol (SMTP): allows for simple email service, moves messages from one email server to another.

Post Office Protocol (POP): provides storage mechanism for incoming emails, all messages downloaded (can’t download selectively), delete/modify without interaction with server.

Internet Message Access Protocol (IMAP): download mail selectively, look at message header, download part of a message, search commands available, strong authentication (supports Kerberos)

Line Printer Daemon (LDP): resides on network printer/print server and responds to TCP/IP printing requests from the printing clients (LPR clients).

Network File System (NFS): allow shared file systems on UNIX servers to appear as local file systems on UNIX clients

Telnet: Terminal emulation protocol, remote logon

Secure Shell (SSH): establish a secure Telnet session, run programs on remote systems, maintain strong encrypted connection.

Hyptertext Transfer Protocol (HTTP): manages communication between web browser/server.

Hypertext Transfer Protocol Secure (HTTPS): sign, authenticate, and encrypt HTTP message.

Network Time Protocol (NTP): synchronize (set) computer clocks to a standard time zone.

Network News Transfer Protocol (NNTP): access Usenet news servers (newsgroups)

Secure Copy Protocol (SCP): Uses SSH to establish and maintain an encrypted login, then file transfer

Lightweight Directory Access Protocol (LDAP): standard method of accessing directories, perform object lookups

Internet Group Management Protocol (IGMP): manage multicast sessions, which hosts belong to which groups

Line Printer Remote (LPR): printing client that sends the print jobs to the LPD

User Datagram Protocol (UDP): connectionless protocol, provides best effort transmission (direct interface with IP, address via Port number)

Server Message Block (SMB): aka Common Internet File System (CIFS) ? presentation layer protocol, networking command message format.

Samba: for non-Microsoft market, to link UNIX/Linux commands with Windows machines. (uses services called smbd and nmbd)

AppleTalk Filing Protocol (AFP): Access AppleShare server

Internet Connection Sharing (ICS): Takes internet connection from one machine and shares it with other machines

[edit section] Port

Port is the numerical value that identifies the application associated with the data

FTP comes in 2 flavors

Active: Initiates at port 21, connects (after validating) on port 20

Passive: Initiates at port 21, uses registered port for data transfer

? Registered port: 1024, extend to 49,151

? Dynamic/private port: 49,152 to 65,635

** Socket = IP address + Port Number **

[edit section] IPv4

32-bit number (4 part decimal number)

Broadcast = host ID set to all 1’s Refer to network = host ID all 0’s

Class A: (126 or less) Very large networks, private network = 10.0.0.0

Class B: (128-191) Medium-sized networks, private network = 172.16.0.0 to 172.31.255.255

Class C: (192-223) Smaller networks, private network = 192.168.0.0 to 192.168.255.255

[edit section] IPv6

• 128-bit addressing scheme, eight sets of 4 hex digits
• can abbreviate by dropping leading 0’s (or group of 0’s w/ ":")
•  ::/0 reserved for host without an address
•  ::1/128 is reserved for loopback (like IP4’s 127.0.0.1)
• To migrate v4 to v6, last 4 octets reserved (::xxxx.xxxx.xxxx.xxxx)
• Host configured w/ 3 different addresses
• Address from each upstream supplier
• Local Address (local host)
• Link-local address (local subnet)

[edit section] Subnetting, Proxy & DNS

Variable Length Subnet Masking (VLSM): using varied subnet masks w/ the same classful network for the different subnet sizes

Advantages of Subnetting

• Minimizes network traffic (decreases congestion)
• Isolates networks from others
• Increases performance
• Optimizes use of IP address space
• Enhances the ability to secure a network

Classless Inter-Domain Routing (CIDR) pronounced "cider"

described as "/x" networks ? /8 = Class A /16 = Class B /12 = 255.240.0.0

IP Proxy Servers: handles traffic to external host systems on behalf of the client software running on the protected network; clients access internet through proxy server.

• Can control what users do (different capabilities for different users)
• Active Caching: server retrieves documents that it thinks will be requested
• Passive Caching: waits for client to make a request, retrieve document and stores
• Internet Cache Protocol (ICP): multiple proxy servers exchange cache information
• Cache Array Routing Protocol (CARP): uses multiple proxy servers with a single large cache

Name Resolution: The process of finding the IP address for any given hostname

HOSTS: create file called HOSTS, enter line for every system:

198.34.56.25 myserver.com Myserver’s information

? must be installed on every system (same with updates)

Virtual LANS (VLANs): "network within a network", isolates broadcast traffic, separate users sharing a switch into segments (VLAN 1, VLAN 2, etc.)

Domain Name Service (DNS): uses standardized lookup table (giant telephone directory).

• Address Record: maps IP to host name (and vice versa)
• Mail Exchange (MX): points to the mail exchanger for a particular host
• CNAME (canonical name): aka alias record, allows hosts to have more than one name.
• Start of Authority (SOA) Record: contains global parameters, most critical, only one per zone file

Windows Internet Naming Service (WINS): used in NetBIOS, allows use of NetBIOS names on non-NetBIOS/NetBEUI systemsto find IP address (ARP then used to get MAC addresses)

Summary

DNS: TCP/IP FQDN ?? IP address

WINS: NetBIOS names ?? IP address

-build its reference tables manually

[edit section] Configuring TCP/IP In Workstations

1. Start | Settings | Control Panel | Network and Dial-up Connections

2. Right-click network adapter | Properties | Install | Protocol | Add

3. Select Microsoft and Internet Protocol (TCP/IP) | Click Internet Protocol (TCP/IP) | Advanced Tab

Advanced Tab has several options:

• IP Settings Tab: Used when not using DHCP, manually set IP’s
• DNS Tab: Add/edit/remove DNS server addresses
• WINS Tab: Specify that server should be used in order to resolve NetBIOS name to an IP address, enable LMHOSTS file
• Options Tab: adjust IP security and TCP/IP filtering settings

Windows Registry

• Change using Network applet
• TTL, default type of service only changed through Regedit

Zero Configuration (ZeroConf)

• Automatic Interface address configuration
• Figure out link local address themselves (169.254.x.x)
• After assigned, uses ARP to announce to other machines to ensure no repeat addresses
• Windows version called Automatic Private IP Addressing (APIPA)
• Automatic multicast address configuration
• peer-to-peer allocation scheme
• Name Resolution
• Multicast DNS used (bypasses DNS server, queries by asking directly)
• Service location
• DNS Service-Discovery (DNS-SD)

[edit section] TCP/IP Utilities

Address Resolution Protocol (ARP): shows ARP table (or ARP cache), shows both dynamic and static tables.

arp: Ascertain IP address and related MAC address

Run alone, lists available switches.

-a (or -g): Lists entire current arp table

-s [IP Address] [MAC Address]: statically add entry into table

-d [IP Address] : delete entry from arp table

Netstat

View TCP/IP connections, view packet statistics

-without parameters, useful in determining the status of outbound connections

• -a  ? displays all TCP/IP and UDP connections. For UDP, shows source port nicknames. broadcast is written as *:* (any address, any port)
• -e ? Displays summary of all packets sent over NIC as of that instant. To have it occur every few seconds, add integer value after switch (second interval)
• -r ? Display current route table for a workstation
• -s ? Displays variety of TCP, UDP, IP, and ICMP protocol statistics.
• -n ? Modifier for the other switches.
• -p ? Also a modifier, typically used with -s switch to specify exactly what protocol data is wanted (netstat -s -p UDP)

Nbtstat

Track NetBIOS over TCP/IP connections, resolve NetBIOS names, etc.

-only available in Windows-based OS

-switches are case-sensitive (lower = NetBIOS names, upper = TCP/IP addresses)

• -a ? Display a remote machine’s NetBIOS name table (nbtstat -a S1)
• -A ? same as -a, but different syntaz to execute (nbtstat -A 123.12.23.34)
• -c ? Display local NetBIOS name cache on the workstation it is run
• -n ? Display local NetBIOS name table on Windows device
• -r ? Displays statistics of how many NetBIOS names have been resolved to TCP/IP addresses (useful in troubleshooting WINS)
• -R ? Nothing to do w/ -r switch, purges NetBIOS name table cache and reloads the LMHOSTS file into memory
• -S ? Display NetBIOS sessions table (both workstations and server sessions)
• -s ? Same as -S, tries to resolve remote host IP addresses into host names

Using the File Transfer Protocol (FTP)

CMD: ftp -OR- ftp ftp.microsoft.com

Enter login information, or enter anonymous and password (email address)

File Types

• ASCII: contains text (type ascii in cmd prompt)
• Binary: all other files (type binary in cmd prompt)

To download: get [filename] *for multiple downloads, type mget *txt *

To upload: put [local file] [destination file] *for multiple uploads, type mput *.txt *

ls ? displays directory listing

cd ? change directory

pwd ? print current working directory

lcd ? Local Change Directory (changes where downloads are stored)

Type quit to exit ftp client

Ping

Find out if you can reach a host, or if the host is responding

ping [hostname/IP address]

to check your own workstation, ping 127.0.0.1 or localhost

-n  ? pings host N number of times (replace with desired number)

-t ? pings continuously until Ctrl+C is pressed

-r  ? Records the route taken during ping hops ( = number of hops to record)

-a ? resolves pinged address to host name simultaneously

Winipcfg

• In 9x/Me: type winipcfg to launch configuration application
• Release All/Renew All Buttons
• Troubleshoot DHCP/TCP/IP address conflicts

Ipconfig

ipconfig ? lists IP address, Subnet mask, default gateway

/all ? All TCP/IP settings displayed

/release ? Releases all info obtained from DHCP

/renew ? renews all info obtained from DHCP server

Ifconfig

• Linux/UNIX utility, similar to ipconfig. (interface configuration)
• Also configures protocol/network interface
• ifconfig interface [address [parameter]]
• Interface = UNIX name of the interface
• Address = statically assigned address

Tracert

Shows every router interface a packet passes through

tracert [DNS name/IP address]

Telnet

Acronym for terminal emulation for NETworks, evolved into a troubleshooting tool.

Telnet | Open [hostname][port number]

Nslookup
Allows you to query a name server and quickly find out which name resolves to which Ip address.

Options

• type=mx ? Sets future queries to e-mail servers
• Domain=domain name ? sets default domain name for lookups
• retry=x ? Specifies the number of retries

[edit section] Network Operating Systems

Microsoft Windows

• Windows User Interface (familiar, less training time)
• Third-party support (most software packages)
• Interoperability
• Gateway Services for NetWare (GSNW)
• Installed on Windows server, translates requests for Windows resources into NetWare requests. (SMB ? NCP)
• Client Services for NetWare
• Must be installed on every workstation, allows user to access resources on NetWare server.
• File and Print Services for NetWare (FPNW)
• Provides files and printers hosted by Windows Server to Novell clients.
• Authentication (Kerberos)
• Kerberization = all applications modified to include authorization information
• Security: Weak without patches, needs firewall implemented, vulnerable

Novell NetWare

• Popular in larger networks (more than 20 servers)
• Centralized administration of users and their properties
• Server-only platform (not desktop-type applications)
• Public key encryption, certified by National Security Agency (NSA)
• NDS Authentication (checks NDS in Directory and verify user information)
• Three types of Directory Services:
• Bindery: Flat database of users, groups, and security information that resides on a server (prior to NetWare 4.0) ? Server-centric

• Novell Directory Services: provides access to global, hierarchical database of network entities (objects) that is based on X.500 Internet directory standard called the Directory. ? Network-centric
• To change, use NetWare Administrator
• Structure of NDS called Directory Information Tree (DIT)

• EDirectory: Extension of NDS, allows NDS trees to be connected over the internet, creating a Meta directory.

Labels, Object Types, and Object Locations in the Tree

Example: Connie in Sales Organizational unit (which is in the Acme organization)

? .CN=CONNIE.OU=SALES.O=ACME

(Known as distinguished typefull context, or name of object plus its context)

? Just objects context = OU=SALES.O=ACME

? Can ditch the container labels and do: SALES.ACME or .CONNIE.SALES.ACME

UNIX/Linux

• Uses Shell (command line) and Graphical User Interface (X Windows System)
• Use primary internet services (TCP/IP, FTP, HTTP, LPR, etc)
• UNIX = Kerberos/Lightweight Directory Access Protocol (LDAP)
• Samba: software that makes UNIX appear as a Windows server (uses SMB)
• Applications usually made for specific flavor of UNIX
• Security well established, fixes are easy to come by.

Macintosh

1. System 1: Original, released in 1984, non-color, powerful GUI

2. System 6: Colored GUI

3. System 7: Multitasking, support TrueType fonts, access virtual memory

4. Mac OS 8: Internet Explorer default browser, Java Virtual Machine, long filenames

5. Mac OS 9: Multiuser settings improved, Keychain introduced, network browser

6. Mac OS X: Improved interface, save directly to PDF, user and internet friendly

• Support Samba: so Windows clients can authenticate to a Mac OS X server
• Function as a Internet Server (UNIX core, close ties to TCP/IP)
• Translations of applications to Macintosh are few and far between
• Good support for NT/2000 and NetWare
• Authentication: handled through Kerberos, Keychain, Open Directory (Active Directory/eDirectory)
• Comes with Apache Web Server and MySQL 4
• Reliable Security (vulnerable services turned off by default)

[edit section] Wired and Wireless Networks

Standard Operating Procedures (SOPs): company policy on system access

Naming Conventions: Names of system resources, combination of location/function

Test Accounts: account created within network to test access to resource

Service Accounts: give outside network maintenance access to network

Microsoft’s Systems Management Server (SMS) and Novell’s ZENworks

? Distributing unique applications on server

Environmental Issues (PEERC)

• Power
• Power Spike: power level rises less than one second (sag)
• Power Surge: power level rises more than one second (brownout)
• Surge Protectors: shut off after certain threshold maxed
• Line conditioners: clean power coming into them
• (UPS = power underage as well)
• 110 volts, 60 Hertz
• Oscilloscope: Detects Power Quality problems
• (fix with UPS/line conditioner)

• ESD (Electrostatic Discharge)
• EMI (Electromagnetic Interference)
• RFI (Radio Frequency Interference)
• Climate
• Temperature extremes (keep at 70 degrees, 40-60 humidity)

Log Files

Windows: Event Viewer Novell (CAS): Console.log, Abend.lof, Sys$log.err

WAP’s used to connect wired/wireless known as Wireless Router

Wireless NICs: have radio antenna, called cards or adapters (if uses PCMCIA slot)

Wireless Antenna Characteristics: Transceivers

1. Omni directional: point-to-multipoint

2. Directional: point-to-point (Yagi). Greater range

** dBd more powerful than same numerical value in dBi ** pg. 248

To convert: dBd ? dBi, add 2.2 to dBd rating

To convert: dBi ? dBd, subtract 2.2 from dBi

Infrared Networking: short distance, point-to-point (peripheral/PC). Uses IrDA standard. 16 Mbps (increased to 100 Mbps soon), range = 1 meter

Bluetooth Networking: 1 Mbps, good for peripheral devices within PAN

Bluetooth and Wireless LAN Standards

Ad-Hoc Mode: communicate directly without WAP, computers must be within 90-100m of each other.

Infrastructure Mode: communicate with an access point, which facilitates communication, SSID and security must be set.

SSID (Service Set Identifier): 32-character network name for wireless networks

? ability to turn off SSID broadcasting

WEP (Wired Equivalent Privacy): requires that both access point and workstation are configured with same 64/128/152/256 bit encryption key in order to communicate

MAC Filtering: Restrict/Allow according to MAC address

Signal Degradation

• Distance
• Walls
• Protocols used
• Interference

[edit section] Wired & Wireless Network Configurations

Workstation Configuration

• Install NIC and WAP
• Available Networks
• Preferred Networks (connected to before, want to connect automatically)
• Network Name (change SSID)
• Wireless Network Key (WEP): configure encryption

WAP Configuration

• Configure IP Address by connecting workstation to WAP (usually 192.168.x.x)
• Configure SSID
• Operating Mode (Access Point: allows transparent access) (Bridging: wired to wireless bridge between two wired segments)
• Configure Password
• Enable WEP

Configuring a Windows 9x Network

Control Panel | Network ? configure client software, protocols, NICs, network services

• Have to reboot after making changes

1. Components List (CCAPS)

a. Configuration Tab | Add

b. Client: talk to servers (Microsoft, Novell, Banyan)

c. Adapter: Network driver, how comp talks to hardware

d. Protocol: computer language that facilitates communication

e. Service: add functionality to the network (file/print sharing)

2. Primary Logon List

a. Determines which network type will be logged onto first

3. File and Printer Sharing List

Connect to Microsoft Servers (PAC)

Protocol (usually TCP/IP)

Adapter (whatever is in the PC)

Client (Client for Microsoft Networks)

Configuring a Windows 2000 Network

Uses Network and Dialup Connections

• New Connection
• Local Area Connection (right click | Properties to add client/protocol)
• File and Printer Sharing installed by default
• Banyan not supported
• Don’t have to reboot

Windows Clients for NetWare Network Access

9x: Add the client

2000: Install the client ** In both cases, NWLink protocol installed automatically **

[edit section] Network Installation Tools

• Wire Crimper
• Attaches ends onto different types of network cables (patch cables)
• Media Tester
• Wire Map Tester: Detect transposed wires, opens (broken/unconnected wires), and shorts (improper connection)
• Continuity Tester: Check copper cable connection (coaxial)
• Tone Generators: aka Generator/probe (Fox/Hound), locate one specific cable out of many, locate opens (no tone)/shorts (tone on two or more wires)/miswires (tone on wrong pin). Time consuming
• Optical Loss Test Set (OLTS): consist of power meter/light source, for fiber cables
• Multifunction Cable Testers: Most heavily marketed, aka certification tools. Copper/Fiber-optic networks, output is series of pass/fail ratings, easy-to-use, don’t need to understand but should know how to verify results
• Punchdown Tool
• Terminates twisted-pair cabling into IDC (Insulation Displacement Connector)

[edit section] WAN and Remote Access Technologies

External Modems

• Serial Ports
• UART Type: Universal Asynchronous Receiver-Transmitter, manages serial communications

 ? 8250 Series: 8-bit buffers, max speed = 9600 bps

 ? 16450 Series: 16-bit buffers, max speed = 115,200 bps

Remote Access Connection Methods

Public Switched Telephone Network (PSTN, plain old telephone service (POTS))
? Public: anyone can lease the use of the network, without need to run cabling

? Switched: Uses central office switching to route calls

• Inexpensive to set up (No LAN cabling costs)
• Connections available in many countries
• Limited bandwidth (53 Kbps)

Integrated Services Digital Network (ISDN)

• Digital, point-to-point network
• 2 Mbps (Primary Rate Interface (PRI))
• 128 Kbps (Basic Rate Interface (BRI)) ? In SOHO (Small-Office, Home-Office)
• Uses same cabling as POTS, but carries DIGITAL signals
• Two types of channels (Bearer Channels)
• 2 B Channels, one for voice, other for data transmission (time division multiplexing)
• Signaling Channel, aka D Channel, 16 Kbps (Setup and link management)
• These channels combined for max rate of 128 Kbps
• Fast connection, higher bandwidth, no conversions from analog to digital
• More expensive, specialized equipment required, connection must be initiated

xDSL Technology: Copper access technologies, use regular PSTN phone wires

• ADSL: Upload = 640 Kbps Download = 9 Mbps
• Splitter allows multiple frequencies on the POTS line (accept calls while online)
• Require DSL modem (endpoint)

Cable Modem: Data over Cable Servce Interface Specification (DOCSIS)

• Connect USB or Ethernet
• If using Ethernet, need Ethernet NIC

Frame Relay Technology: WAN technology, uses packet switching (packets can be sent over any number of routes)

• Use permanent virtual circuits (PVCs), allow virtual data communications
• Shared network, sometimes get much better throughput that what was paid for (Committed Information Rate, or CIR)

T-Series Connections: Digital connections that can be leased from Telephone Company.

• Can use regular copper wiring or brought in as part of a backbone (trunk line)
• Use time division multiplexing (TDM) to divide channels
• Most commonly used are T1 and T3

T1: carried over 2 pairs of copper wire, 24 discrete, 64 Kbps channels, carry either voice or data each channel

E1: European equivalent, 2.048 Mbps

J1: Japanese equivalent, 1.544 Mbps

T3: equivalent to 28 T1 circuits, generally on fiber-optic cabling

E3: 34.368 Mbps

J3: 32.064 Mbps

Asynchronous Transfer Mode (ATM): High-speed communications protocol that doesn’t depend on any specific LAN topology.

• Breaks data into 53-byte cells (similar to packet or frame)
• Connection-oriented service
• Cells may need to be reassembled
• Copper or fiber-optic cabling
• Implemented by hardware rather than software
• Common speeds are 51.84 Mbps and 155.52 Mbps

Synchronous Optical Network (SONET): data rate of 51.84 Mbps

? multiples of this rate known as optical carrier (OC) levels

Ex) OC-3 ? 155.52 Mbps (51.84 Mbps * 3)

Fiber Distributed Data Interface (FDDI): fiber-optic cabling, dual ring architecture

• Counter-rotating rings for fault tolerance
• 100 Mbps
• Dual-attached station (DAS): both rings connected
• Single-attached station (SAS): one ring connected

Remote Access Protocols

Serial Line Internet Protocol (SLIP)

• Operates at Physical and Data Link layers
• Use to transport TCP/IP over serial connections
• Doesn’t support encrypted passwords (no security at all)
• Primarily used to connect to UNIX machines (2000 forbids inbound SLIP)

Point-to-Point Protocol (PPP) and PPPoE (Point-to-Point Over Ethernet)

• Protocol that established TCP/IP connections
• Used for remote connections to ISPs and LANs
• PPP uses Link Control Protocol (LCP) to communicate btwn client/host
• Supports authentication negotiations (and encryption/compression)
• Allows error checking (almost completely replaces SLIP)
• High overhead

To Configure 2000 to Dialup a Remote Access Server (PPP)

Start | Programs | Accessories | Communications | Network and Dial-up Connections

? Make New Connection | Next | Select type of connection | Enter phone number

? Alt-Click Connection Made | Properties | Networking Tab

? Select PPP from Type of Server I Am Calling DDL

Point-to-Point Tunneling Protocol

• Microsoft based on PPP
• Creates virtual connections across the Internet using TCP/IP and PPP so 2 networks can use the internet as their WAN link and still retain private network security
• Establish PPP connection first, then create PPTP session
• Can reduce throughput, not available on all types of servers
• Can be implemented in 2 ways
• Set up server to act as gateway (does all the tunneling), workstations need no adjustment
• Configure single remote workstation to connect to network over the Internet

To Configure 2000 to create a VPN connection using PPTP over a PPP connection

Start | Programs | Accessories | Communications | Network and Dial-up Connections

? Make New Connection | Next | Select Type of connection (Connect to Private Network)

? Enter Host Name/IP of host you want to connect to

Windows Remote Access Services (RAS): NT/2000 allow users to connect to server AND server’s host network

Remote Desktop Protocol (RDP): allows remote access for Windows clients only

[edit section] Network Access and Security

Client Selection: Protocols are separate from the client software, but sometimes installation is integrated with installation of client software.

To Display 95/98 Installed Protocols/Clients

Start | Settings | Control Panel | Network | Configuration Tab

Installing Windows 95/98 and NT/2000 Client

Nic installed/configured

Connect network cable, check link light

Start | Settings | Control Panel | Network | Add | Click Client List | Add

Installing the NetWare Client

• Novell NetWare Client
• Found on Novell’s website/CD, SYS folder of server, and ZENworks CD
• Used if network is primarily Novell
• Microsoft Client for NetWare Networks
• Used if network is primarily Microsoft

On 9x computers, some files need to be copied from the CAB files. If not in Windows\Options\Cabs directory, prompt for installation CD will appear.

Installing the UNIX Client

9x needs client portion of the Network File System (NFS) to connect to UNIX.

? Not needed if UNIX system is running Samba.

? Client potion only available through 3^rd party vendors (Sun’s Solstice NFS Client) and (NetManage’s Chameleon UNIX Link).

Setting a Primary Client (The Client that will be used by default)

? choose the one that would likely be used most often

Start | Settings | Control Panel | Network | Configuration Tab | Select DDL of Primary

Managing User Account and Password Security

• Secure files at Share Level and User Level
• Share: individual files/resources, resources visible (need password), no way of knowing who is manipulating each resource
• Windows 9x and NT/2000/2003 support this
• User-Level: Assigned to specific users, provides for greater control
• Windows NT/2000/2003, NetWare, and UNIX support this

Disabling Accounts

Leave the account in place

• Anyone can log in if they know password
• Security issue

Delete the account

• If delete account and then create again, UID/SID is lost
• Lose settings of the old account this way

Disable the account.

• Best practice
• Allows further action to be taken at a later date
• To disable temporary accounts, set expiration to employee’s last day

Anonymous Accounts: Limited access for large number of users (Anonymous or Guest)

? Can’t track who manipulated a file if anonymous

? NT/2000/2003 default = Guest disabled NetWare default= no Guest Account

Limiting Connections: Limit number of times a user can connect to the network

? Only logged in for one instance (can only be at one location at a time)

? Can restrict access from specific workstations

• More administration required (not used often)
• Provides maximum security

? Windows servers don’t allow a regular user access to console directly (default)

Renaming Administrative Account: change the default to improve security

Windows = Administrator

UNIX = Root

NetWare = Admin

** Others to avoid are: Comptroller, Super, Analyst, Audit, Manager, Wizard **

"Good" Passwords: At least 8 characters (no more than 15), include letters, numbers, special characters

? can run crack programs to try to crack passwords

• Add special character in middle, not beginning/end (crack strips it)

Automatic Account Lockouts: After several unsuccessful login attempts, locks account and needs to either manually unlocked or wait specified duration of time

Password Expiration: Should be set every month or so, grace period of few logins/days

Unique Password and Password Histories: Stores old passwords previously used, should set to store 12/13 last passwords used to store year’s worth of passwords (forbids them from being used to increase security)

Access Control Lists (ACL): Reside in routers, lists who can/can’t send data

The Demilitarized Zome (DMZ): Network segment that is neither public nor local (Email Web, FTP)

Protocol-Switching: Use protocol other than TCP/IP on internal network (makes router a natural firewall) -OR- Use TCP/IP on both internal/external, and middle protocol (deadzone) use other protocol (IPX, for example)

Dynamic Packet Filtering: ability of router/firewall to discard packets that don’t meet certain criteria. Uses "current session" information only, avoids hacking using incorrect

Proxy Servers: Acton behalf of a network entity to completely separate packets from internal hosts from external hosts. Can filter according to keywords within document, can scan messages for viruses.

IP Proxy (aka NAT proxy): hides the IP addresses of all stations on internal network (look as if IP is from Proxy)

Web (HTTP) proxy: Proxy acts as both the client and the server (request sent to proxy, proxy changes address, sends request to HTTP server, HTTP server sends back to proxy, proxy acts as server and send to original workstation) ? Caching also occurs

FTP Proxy: Filter out undesirable content, acts like HTTP proxy

SMTP Proxy: Contents of packet and mail can be automatically searched, scan viruses

Security Protocols (LISK Willy Wonka’s 8 Pound Chimp Mr. Red)

Layer 2 Tunneling Protocol (L2TP)

• Supports non TCP/IP protocols in VPN, Data-Link layer

Internet Protocol Security (IPSec)

• Authentication and Encryption over Internet, Network Layer, secures layers above it

Secure Socket Layer (SSL)

• Based on RSA public key encryption, secure Session Layer (service independent)

Kerberos

• Entire security system, establishes user’s identity at login, security credentials used throughout entire session (encryption)

Wired Equivalent Privacy (WEP)

• Security for 802.11b wireless network
• Uses RC4 encryption, 40, 64, 128 bits long
• Uses random key (Initialization Value, or IV, and preset key)

Wi-Fi Protected Access (WPA)

• Enhance WEP (integrated through simple software upgrade)
• TKIP: Temporal Key Integrity Protocol encrypts the key, harder to intercept
• User Authentication: Uses EAP (Extensible Authentication Protocol) to ensure user is valid

802.1x

• Asks access point for permission to enter and provides its credentials, server send back an accept message, no encryption (authentication only)

Password Authentication Protocol (PAP)

• Simple system of Username and Password

Challenge Handshake Authentication Protocol (CHAP)

• Improvement over PAP
• Shared secret stored locally in clear text
• Username/Password never cross the wire
• Client/Server configured with same text phrase (shared secret)
• Server sends out random value (nonce) plus an ID value
• Client takes two strings, concatenates shared secret, hashes, sends back
• If they match, client is validated

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

• Encrypt the shared secret locally
• Mutual Authentication (client ensures server is valid as well) (Version 2+ only)
• Windows-only protocol
• Encryption method used is DES

Remote Authentication Dial-In User Service (RADIUS)

• Authenticating users over various types of links (including dialup)
• Central location for usernames/password

Functional Firewall: Firewall software and at least 2 NICs (some use 3)

UNIX = More than 32 NICs

NetWare = 16 NICs

Windows = 4 NICs

UNIX-based firewalls good if using T3 or similar speeds

Novell uses BorderManager (client compatibility and fastest available)

Windows Firewall (managed through GUI, not that fast, least secure)

Black Box Implementation: Fastest throughput because they are designed as firewalls, simplicity, ease of use is NOT a feature, use RISC processors

Hacker Tools: Common Network Attacks

IP Spoofing: process of sending packets with a fake source address, pretending the packet is coming from somewhere it isn’t. Firewall’s overcome this (dynamic packet filtering)

The Ping of Death: denial of service (DoS) attach, prevent any users from using the system. Send larfe ICMP packet, causes host to reboot or hang.

WinNuke: Windows program that sends special TCP/IP packets with invalid TCP header, computers would crash because they didn’t know how to handle the packets. (only affects Windows computers)

SYN Flood: Dos attack, SYN Flag usually set to 1, server responds to say "ready to talk" SYN Flood barrages computer, computer spends all resources trying to answer all the "SYN" messages

Intruder Detection: Defense Techniques

• Active Detection: constantly scanning the network
• Passive: Logging all events to a file
• Proactive: using tools to prevent network from attacks

? Department of Defense gave responsibility to computer security to NSA (National Security Agency).

National Computing Security Center (NCSC) Standards

*A highest Class, D the lowest* ? Series called Rainbow Series (color of books)

Trusted Computer System

• Orange Book
• Accountability for the data (each user needs username/password, use of file can be traced to that user)
• 5200.28-STD standard (C2 - Controlled Access Protection)

Trusted Network Interpretation

• NCSC-TG-005 Standard (Red Book)
• Trusted Network Interpretation Environmental Guideline (TNIEG)
• NOS must provide a unique user account for each person, provide accountability.
• Network communications must be secure
• Only current certified one is NetWare 4.0

Encryption: Data sent through special formula (key), client and server both know

• Telnet/FTP don’t have ability to encrypt usernames/passwords
• Private Key = both sender and receiver know key
• Data Encryption Standard (DES): fast, uses 56-bit private key.
• Skipjack: officially called Escrowed Encryption Standard (EES), uses 80-bit key.
• Hardware implementation called clipper chip (proposed for telephones)

Public Key Encryption: aka Diffe-Hellman algorithm, uses 2 keys to encrypt/decrypt data.

? Used to encrypt a message to the receiver, receiver decrypts w/ a private key (one-way communication). A reply can be sent be encrypting the message w/ the public key, and only the receiver’s private key can decrypt it.

RSA Data Security: Named after Rivest, Shamir, and Adelman, public key encryption

Pretty Good Privacy (PGP): encryption utility based on public key encryption

? Postcard (anyone can read) vs. Envelope (concealed, but still accessible)

* ~80% of network break-ins occur from within the company of employees *

? International Computer Security Association (ICSA)

[edit section] Fault Tolerance and Disaster Recovery

Hot ? Warm ? Cold (High to Low) Fault Tolerance/Disaster Recovery

Hot: Every computer system has a redundant copy.

• Most expensive
• Needs 100% uptime (thus, no disaster recovery)
• Clustering (servers only, since workstation replaceable). 2 types of clustering:

Failover Clustering:

Active Device (current device that acts as server) and

Failover device (exact duplicate of active device, inactive and connected to the active device)

? Monitors active device by heartbeat, which is a signal from active device that is sent at a given interval, and becomes active device if known received.

? When previous active device sends heartbeat again, device hears it and becomes inactive again (turns control back over)

-Note- Both servers in cluster must be running failover clustering software

Disadvantages

• Only one level of fault tolerance
• No load balancing (either active or inactive, waste of resources)
• Cutover time (time it takes to respond to down system)
• Hardware and software must be IDENTICAL

True Clustering (multiple server clustering)

• Supports multiple devices
• Provides load balancing (20 servers act as one big server, network requests distributed)
• If one fails, the other servers "pick up the slack" until the server goes back online
• Increases performance, no cutover time

Disadvantages

• Complex clusters (usually limited to 64 servers)
• Very expensive

Warm: Network service/data available most of the time, fault tolerance handled by NOS.

• Most common is duplicate server (disaster recovery method)
• Must keep current backups
• Can lose data if information not backed up

Cold: Cannot guarantee server uptime (little or no fault tolerance)

Nearline: storage method that is neither online nor offline, but serves as backup

Power Management

Surge Protectors (Surge Suppressors): Limit voltage reaching computer components, minimizes damage from voltage surges/spikes

? Blocks large amounts, low surges/spikes over time can be just as damaging

? IEEE 587 Category A Let-Through Rating (330V is excellent)

Battery backup Systems: Battery powers computer to allow for saving data/graceful shutdown

• Standby Power Supply (SPS): contains battery, switchover circuit, and inverter (changes battery’s DC to AC for computer). If power goes out, takes very small time for power to switch over (can cause hangs in system/system reboot)
• Uninterruptible Power Supply (UPS): Always runs off the battery/inverter, battery charged constantly, when power failure occurs battery simply stops charging.

Line Conditioners: filters out erroneous signals to condition line at 110-volt, 69 Hz power.  ? Highest level of power protection

Disk System Fault Tolerance

Disk Mirroring: One controller card, copy information onto two hard drives

Disk Duplexing: Two controller cards, copy information onto two hard drives

Disk Striping: Breaks up data and writes to multiple hard drives (only improves performance, not fault tolerant)

RAID 0: Disk Striping

RAID 1: Mirroring/Duplexing

RAID 2: Disk Striping w/ Error Correcting Code (ECC) Disks (bits)

RAID3: Disk Striping w/ Parity (bytes)

RAID4: Same as RAID 0, but w/ a parity drive

RAID5: Disk Striping w/ Distributed Parity (3 or more drives), parity put on multiple drives.

RAID6: Similar to RAID5, but additional drive copies parity (can handle failure of 2 drives)

Hot Spares: at failure, ready to take over immediately (no down time)

Cold Spares: at failure, need to bring system down to replace component

Backup Media

Small Capacity

Large Capacity

Removable Optical Disks

Magnetic Tape: backup media for offline (not readily accessible) data storage.

Backup Programs

• Windows: Backup
• Novell: SBACKUP
• Unix: command based utility tar

Backup Types

• Full: all network data is backed up (takes the longest)
• Differential: single, full backup done once a week, other six nights any file that was changed since last full back up is backed up (through archive bit)
• Incremental: Only backs up files that have been changed since last backup

Tape Rotation Schedule

• Weekly (different tape for every day of the week)
• Monthly (one for each Mon-Thur, 4-5 for each Friday of the month)
• Yearly (Build on top of monthly, 12 for each month)
• Grandfather-Father-Son (GFS)
• Daily = Son Weekly = Father Monthly = GF
• Long-Term: for archival purposes, copy once/twice a year and store in offsite storage (often for auditing purposes)

Types of Viruses

• File : Executable programs (exe, dll, com) Examples: Jerusalem and Nimda
• Macros : script of commonly enacted commands Examples: Cap/Cap A
• Boot Sector: Infect MBR, Shows "Missing OS or Hard Disk" Examples: Stoned, Monkey B, Stealth Boot

? More than 100 new viruses are found "in the wild" each month

Solution: Update definition files

Engine access definition files, runs the virus scans, cleans the files, etc

? Also needs to be updated regularly

Heuristic Scanning: allows antivirus technology to scan for undefined viruses by using predefined virus patterns (similarities)

1. Upgrade engine

2. Upgrade definition files

3. Create emergency boot disk

4. Run full scan

5. Schedule monthly full scans

6. Configure on-access scans (runs in the background)

7. Update definitions weekly

8. Make new boot disk monthly

9. Get latest update when outbreak comes out

10. Repeat all steps with new engine

Source of Patch = Manufacturer ONLY

[edit section] Network Troubleshooting

1. Did you check the simple stuff?

a. Correct login procedure/rights

b. Link lights/collision lights

c. Power switch

d. Operator error

2. Is hardware or software causing the problem?

3. Is it a workstation or server problem?

4. Which segments of the network are affected?

5. Are there any cabling issues?

• Check medium dependent interface/medium dependent interface-crossover (MDI/MDI-X)

Network+ Troubleshooting Model

1. Establish symptoms

2. Identify the affected area

3. Establish what has changed

a. Were you ever able to do this?

b. If so, when did it become unavailable?

c. Has anything changed since you were last able to do this?

d. Are any other users experiencing the problem?

4. Select the most probable cause

5. Implement a solution

6. Test the result

7. Recognize the potential effects of the solution

a. Is "cure worse than the disease"?

8. Document the solution

The Troubleshooter’s Resources

NetWare Log Files

CONSOLE.LOG: keeps history of all errors that have occurred since conlog utility has been loaded (Load CONLOG (required for NetWare 3.12 to 4.1x), erases existing console.log file and starts new file, to overcome this, Conlog archive=yes)

? Located in Sys:\ Etc

ABEND.LOG: Abnormal End, could cause lockup/shut down. Server cmd prompt has<#> to indicate number of times the server has Abended. Version 4.11 and later captures output to the ABEND.LOG file.

? Located in Sys:System

SYS$LOG.ERR: Lists any errors that occur on the server (lists time and date), Severity, Locus (what is affected), and Class (type of error)

Windows 2000 Server Log Files

Start | Progams | Admin Tools | Event Viewer

Application

System

• Error: component has failed that could cause problems
• Warning: An event occurred that can cause problems
• Information: An event occurred (service failed)

Security: tracks security events specified by system’s audit policy

? To set the audit policy, Start | Programs | Admin Tools | Local Security Policy

• Can track success and/or failure *

Manufacturer’s Troubleshooting Resources: README files, Telephone, Technical Support CD-ROM (Novell’s Network Support Encyclopedia (NSE) and Microsoft’s TechNet), Technical Support Website

Novell: http://support.novell.com

Microsoft: http://support.microsoft.com/servicedesks/technet

Hardware Network Troubleshooting Tools

Crossover Cable: connect 2 hubs, or bypass hub and connect 2 workstations directly (ONLY in Ethernet UTP connections)

Pin 1 and 2 connect to pins 3 and 6

Pin 3 and 6 connect to pins 1 and 2

Hardware Loopback: special connector for Ethernet 10Base-T NICs (test NICs ability to send/receive)

Pin 1 connected to 3

Pin 2 connected to 6

Tone Generator and Tone Locator: determine which UTP cable is which, don’t use on cables attached to NIC/Hub. (Fox and Hound approach)

Software Troubleshooting Tools

Protocol Analyzer: any software that can analyze/display packets it receives from four lowest layers (Transport, Network, Data Link, Physical), any errors that they detect.

• Capture packets and decode their contents
• nature of traffic, if users are viewing unauthorized material, protocols used
• Examples are Sniffer and Novell’s LANalyzer

Performance Monitoring Tools: determine bottlenecks when networks slow

• Novell: Monitor.NLM utility (type load monitor)
• Microsoft: Performance Monitor (Start | Programs | Admin Tools | Performance)

Check the Software Configuration

DNS

WINS

HOSTS file

AUTOEXEC.BAT

CONFIG.SYS

STARTUP.NCF, AUTOEXEC.NCF, server parameter settings

The Registry

[edit section] Download & Discuss This Comptia Network+ Study Guide

You can download and discuss this guide at: Study Guide Download & Discussion Thread On ProProfs Forum . Feedback and comments are welcome!

   You can help and contribute to the community by expanding or improving this article (or starting new interesting articles). Click "edit this page" to get started.