networking

Tuesday, February 9, 2010

RFC 1918

In the Internet addressing architecture, a private network is a network that uses private IP address space, following the standards set by RFC 1918 and RFC 4193. These addresses are commonly used for home, office, and enterprise local area networks (LANs), when globally routable addresses are not mandatory, or are not available for the intended network applications. Private IP address spaces were originally defined in an effort to delay IPv4 address exhaustion, but they are also a feature of the next generation Internet Protocol, IPv6.

These addresses are characterized as private because they are not globally delegated, meaning they are not allocated to any specific organization, and IP packets addressed by them cannot be transmitted onto the public Internet. Anyone may use these addresses without approval from a regional Internet registry (RIR). If such a private network needs to connect to the Internet, it must use either a network address translator (NAT) gateway, or a proxy server.

The most common use of these addresses is in residential networks, since most Internet service providers (ISPs) only allocate a single routable IP address to each residential customer, but many homes have more than one networked device, for example, several computers and a printer. In this situation, a NAT gateway is usually used to enable Internet connectivity to multiple hosts. Private addresses are also commonly used in corporate networks, which for security reasons, are not connected directly to the Internet. Often a proxy, SOCKS gateway, or similar devices, are used to provide restricted Internet access to network-internal users. In both cases, private addresses are often seen as enhancing security for the internal network, since it is difficult for an Internet host to connect directly to an internal system.

Because many private networks use the same private IP address space, a common problem occurs when merging such networks, the collision of address space, i.e. the duplication of addresses on multiple devices. In this case, networks must be renumbered, often a time-consuming task, or a NAT router must be placed between the networks to masquerade the duplicated addresses.

It is not uncommon for packets originating in private address spaces to leak onto the Internet. Poorly configured private networks often attempt reverse DNS lookups for these addresses, causing extra traffic to the Internet root nameservers. The AS112 project attempted to mitigate this load by providing special blackhole anycast nameservers for private addresses which only return negative result codes (not found) for these queries. Organizational edge routers are usually configured to drop ingress IP traffic for these networks, which can occur either by accident, or from malicious traffic using a spoofed source address. Less commonly, ISP edge routers will drop such egress traffic from customers, which reduces the impact to the Internet of such misconfigured or malicious hosts on the customer's network.

Private IPv4 address spaces

The Internet Engineering Task Force (IETF) has directed the Internet Assigned Numbers Authority (IANA) to reserve the following IPv4 address ranges for private networks, as published in RFC 1918:

RFC1918 name	IP address range	number of addresses	classful description	largest CIDR block (subnet mask)	host id size
24-bit block	10.0.0.0 – 10.255.255.255	16,777,216	single class A	10.0.0.0/8 (255.0.0.0)	24 bits
20-bit block	172.16.0.0 – 172.31.255.255	1,048,576	16 contiguous class Bs	172.16.0.0/12 (255.240.0.0)	20 bits
16-bit block	192.168.0.0 – 192.168.255.255	65,536	256 contiguous class Cs	192.168.0.0/16 (255.255.0.0)	16 bits

Classful addressing is obsolete and has not been used in the Internet since the implementation of Classless Inter-Domain Routing (CIDR) starting in 1993. For example, while 10.0.0.0/8 was a single class A network, it is common for organizations to divide it into smaller /16 or /24 networks.

Private IPv6 addresses

The concept of private networks and special address reservation for such networks has been carried over to the next generation of the Internet Protocol, IPv6.

The address block fc00::/7 has been reserved by IANA as described in RFC 4193. These addresses are called Unique Local Addresses (ULA). They are defined as being unicast in character and contain a 40-bit random number in the routing prefix to prevent collisions when two private networks are interconnected. Despite being inherently local in usage, the IPv6 address scope of unique local addresses is global (cf. IPv6 addresses, section "IPv6 Address Scopes").

A former standard proposed the use of so-called "site-local" addresses in the fec0::/10 range, but due to major concerns about scalability and the poor definition of what constitutes a site, its use has been deprecated since September 2004 by RFC 3879.

Link-local addresses

Main article: Zero configuration networking

Private use of other reserved addresses

Historically other address blocks than the private address ranges have been reserved for other potential future uses. Some organization have used them for private networking applications despite official warnings of possible future address collisions.

RFC References

RFC 1918 – "Address Allocation for Private Internets"
RFC 2036 – "Observations on the use of Components of the Class A Address Space within the Internet"
RFC 2050 – "Internet Registry IP Allocation Guidelines"
RFC 2101 – "IPv4 Address Behaviour Today"
RFC 2663 – "IP Network Address Translator (NAT) Terminology and Considerations"
RFC 3022 – "Traditional IP Network Address Translator (Traditional NAT)"
RFC 3330 – "Special-Use IPv4 Addresses" (superseded)
RFC 5735 – "Special-Use IPv4 Addresses"
RFC 3879 – "Deprecating Site Local Addresses"
RFC 3927 – "Dynamic Configuration of IPv4 Link-Local Addresses"
RFC 4193 – "Unique Local IPv6 Unicast Addresses"

RFC1918 Caching Security Issues

By Robert Hansen
Date: 08/06/2009

Preface: Intranets are intended to be secured from the outside by way of firewalls and other networking devices. Unfortunately, there has been a move towards non publicly-routable address space as a method of protection, rather than other methods of protecting private IP space. This paper will outline a number of flaws that can be exploited by an adversary because of the use of well known non publicly-routable IP address spaces.

Overview: One of the principle technologies employed by enterprises is the concept of non publicly-routable IP address space (otherwise known as RFC1918). RFC1918 as defined explains that one of the principle reasons people use it is to avoid the future IP exhaustion that IPv6 is intended to obviate. Unfortunately, it accomplishes this task by using the same set of IP spaces for everyone who uses this tactic.

     10.0.0.0        -   10.255.255.255  (10/8 prefix)
   172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
   192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

The bulk of intranet IP space falls in 10.* and 192.168.*, and further, the bulk falls in 10.0.0.*, 10.1.1.*, 10.10.10.*, 192.168.0.* and 192.168.1.*. Narrowing the most likely subnets down to 1280 addresses (256 addresses * 5 subnets). This tends to lead to collision of IP space where two separate networks will look virtually identical from an IP perspective. There are many technologies that use private IP addresses as a method of securing themselves. Likewise the browsers have implemented the same origin policy which prohibits a server on the Internet from reading content on another server (this includes internal address space).

Because of caching issues within the browser, and other technologies that may use the IP address as the single factor of security, it becomes possible to create situations where the collisions can be used to an attacker's advantage, and even allow them to compromise internal networks.

The Attacks: There are a number of potential attacks that are possible, and many of them reside around trust relationships people have with third parties. One such instance is a VPN (virtual private network) connection between a good entity and one that intends to compromise the victim's network.

Fig 1. Click to enlarge

The first attack, as seen in Fig 1 is where a user is using a client VPN and connecting into a hostile network. The user's browser is thwarted into routing then visiting and caching many pages that would normally be reserved for internal addresses within their own network. Because of caching issues within browsers, there is no need to break the same origin policy - only to wait. Once the VPN connection is destroyed (assuming the routes are then broken) the user's browser then connects to their real RFC1918 addresses, which are now under the control of an attacker by way of a JavaScript back door (Eg: BeEF). This sort of exploit would be most often seen between two competitive companies that share information only occasionally, or between two companies in a partner/vendor relationship.

Fig 2. Click to enlarge

The second attack as seen in Fig 2, similar to the first, requires instead of it being two office networks, it is a user who is using a client VPN from a home office. Like the first example, caching within the browser allows an evil administrator to persist their JavaScript backdoor beyond the lifetime of the VPN connection. The administrator in this way could compromise the user's home network. This may effect administrators who want to compromise executive management's home networks, without leaving as large a trail as traditional malware.

Fig 3. Click to enlarge

The third and final VPN issue found in Fig 3 is between two sets of servers that are interconnected by way of a client VPN. Like the previous examples, the evil administrator can push routes for RFC1918 address space, and cause the remote server to re-route it's traffic over the Internet. This could affect database connections, APIs, email, SMB backups and so on, allowing a remote administrator to temporarily interrupt services, compromise servers and so on.

Man in the middle RFC1918 caching security issue

Fig 4. Click to enlarge

Another issue that falls outside of the client VPN issues described above would be a man in the middle attack scenario as seen in Fig 4. Most security experts would say once a man in the middle attack is in progress there is little point discussing the issue further, because the user is already completely compromised. While this is somewhat true, it doesn't necessarily give the attacker what they are interested in. For instance an internet cafe may provide the attacker with access to webmail or social networking accounts, but it may not give the attacker access to the user's home network or work network.

An attacker in this scenario could interrupt and modify HTTP requests and inject malicious iframes to the possibly intended RFC1918 targets. Because of the aggressive caching policy within the browser, the malicious JavaScript can be cached well beyond that session. Once the user leaves the Internet Cafe and then turns on their portable device within the context of another RFC1918 network, it is simply a matter of time before the user visits one of these pages, if they are an administrator or someone who has access to physical devices.

In all of these attacks an attacker could do research on all modern networking devices that use JavaScript includes, stylesheets or other objects that can embed JavaScript within them. By forcing these included files to be cached and include the malicious JavaScript client within them, security devices can be thwarted, without necessarily having to know which one the user uses ahead of time, and without having to have them logged in ahead of time (as would be the case with CSRF and DNS rebinding attacks). Instead, the attacker can simply wait, theoretically indefinitely for the attack to work. Realistically the exposure to attack is a limit that is dependent on the duration of the compromised user's cache.

Caveats and Defenses: This attack relies on a number of factors. Firstly, the first three attacks rely on the fact that VPNs can be told what to route. If the VPN can be limited to only route the IP spaces that both parties agree upon, this attack would quickly fall down, or at minimum would only be affective against the IP addresses that were allowed to be routed. All of these attacks require that the browser caches content and that that content persists beyond the initial request.

Additionally, most of these attacks could be thwarted by simply not using actual IP addresses, but rather fully qualified but internal domain names because this would require an attacker to have prior knowledge about the IP to DNS mapping. Also, the use of SSL/TLS on all internal devices would cause a mis-match error if the attacker attempted to cache the JavaScript over HTTPS. Removing all scripting and dynamic content from the browser is also an option although severely limiting as well. Ultimately, most of these issues, aside from the ones found in Fig 3, could be mitigated by simply removing persistent cache regularly, or upon the change of any routing information at the operating system level.

Conclusions: Relying entirely upon RFC1918 and built in security functions within the browser to protect users is futile. The browser's same origin policy does not apply if the IP address is the same, and RFC1918 by definition must be the same. VPNs should have an option to define static routes as to mitigate arbitrarily changed routes on the client in a possibly adversarial situation. Ultimately RFC1918 is a poor alternative to IPv6.

Thanks: Special thanks to James Flom for technical oversight and editing help, and to HD Moore and Amit Klein for inspiration and helping me think through some of these ideas.

Tuesday, January 19, 2010

T1(T CARRIER)

In telecommunications, T-carrier, sometimes abbreviated as T-CXR, is the generic designator for any of several digitally multiplexed telecommunications carrier systems originally developed by Bell Labs and used in North America, Japan, and Korea.

The basic unit of the T-carrier system is the DS0, which has a transmission rate of 64 kbit/s, and is commonly used for one voice circuit.

The E-carrier system, where 'E' stands for European, is incompatible with the T-carrier (though cross compliant cards exist) and is used in most locations outside of North America, Japan, and Korea. It typically uses the E1 line rate and the E3 line rate. The E2 line rate is less commonly used. See the table below for bit rate comparisons.

The most common legacy of this system is the line rate speeds. "T1" now means any data circuit that runs at the original 1.544 Mbit/s line rate. Originally the T1 format carried 24 pulse-code modulated, time-division multiplexed speech signals each encoded in 64 kbit/s streams, leaving 8 kbit/s of framing information which facilitates the synchronization and demultiplexing at the receiver. T2 and T3 circuit channels carry multiple T1 channels multiplexed, resulting in transmission rates of 6.312 and 44.736 Mbit/s, respectively.

E1(E CARRIER)

In digital telecommunications, where a single physical wire pair can be used to carry many simultaneous voice conversations, worldwide standards have been created and deployed. The European Conference of Postal and Telecommunications Administrations (CEPT) originally standardized the E-carrier system, which revised and improved the earlier American T-carrier technology, and this has now been adopted by the International Telecommunication Union Telecommunication Standardization Sector (ITU-T). This is now widely used in almost all countries outside the USA, Canada and Japan.

The E-carrier standards form part of the Plesiochronous Digital Hierarchy (PDH) where groups of E1 circuits may be bundled onto higher capacity E3 links between telephone exchanges or countries. This allows a network operator to provide a private end-to-end E1 circuit between customers in different countries that share single high capacity links in between.

In practice, only E1 (30 circuit) and E3 (480 circuit) versions are used. Physically E1 is transmitted as 32 timeslots and E3 512 timeslots, but one is used for framing and typically one allocated for signalling call setup and tear down. Unlike Internet data services, E-carrier systems permanently allocate capacity for a voice call for its entire duration. This ensures high call quality because the transmission arrives with the same short delay (Latency) and capacity at all times.

E1 circuits are very common in most telephone exchanges and are used to connect to medium and large companies, to remote exchanges and in many cases between exchanges. E3 lines are used between exchanges, operators and/or countries, and have a transmission speed of 34.368 Mbit/s.

Sunday, January 17, 2010

Proxy server

Schematic representation of a proxy server, where the computer in the middle acts as the proxy server between the other two.

In computer networks,
a proxy server is a server (a computer system or an application program) that acts as an intermediary for requests from clients seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource, available from a different server. The proxy server evaluates the request according to its filtering rules. For example, it may filter traffic by IP address or protocol. If the request is validated by the filter, the proxy provides the resource by connecting to the relevant server and requesting the service on behalf of the client. A proxy server may optionally alter the client's request or the server's response, and sometimes it may serve the request without contacting the specified server. In this case, it 'caches' responses from the remote server, and returns subsequent requests for the same content directly.

A proxy server has many potential purposes, including:

To keep machines behind it anonymous (mainly for security).^[1]
To speed up access to resources (using caching). Web proxies are commonly used to cache web pages from a web server.^[2]
To apply access policy to network services or content, e.g. to block undesired sites.
To log / audit usage, i.e. to provide company employee Internet usage reporting.
To bypass security/ parental controls.
To scan transmitted content for malware before delivery.
To scan outbound content, e.g., for data leak protection.
To circumvent regional restrictions.

A proxy server that passes requests and replies unmodified is usually called a gateway or sometimes tunneling proxy.

A proxy server can be placed in the user's local computer or at various points between the user and the destination servers on the Internet.

A reverse proxy is (usually) an Internet-facing proxy used as a front-end to control and protect access to a server on a private network, commonly also performing tasks such as load-balancing, authentication, decryption or caching.

Saturday, January 16, 2010

Digital Signal 3

A Digital Signal 3 (DS3) is a digital signal level 3 T-carrier. It may also be referred to as a T3 line.

The data rate for this type of signal is 44.736 Mbit/s.
This level of carrier can transport 28 DS1 level signals within its payload.
This level of carrier can transport 672 DS0 level channels within its payload.

Cabling

DS3 interconnect cables must be made with true 75 ohm cable and connectors. Cables or connectors which are 50 ohm or which significantly deviate from 75 ohms will result in reflections which will lower the performance of the connection, possibly to the point of it not working. Bellcore standard GR-139-CORE defines type 734 and 735 cables for this application. Due to losses, there are differing distance limitations for each type of cable. 734 has a larger center conductor and insulator for lower losses for a given distance. The BNC connectors are also very important as are the crimping and cable stripping tools used to install them. Trompeter, Cannon, Amphenol, Kings, and Canare are some of the true 7.5 x 10 ohm connectors known to work. RG-6 or even inexpensive RG-59 cable will work in a pinch when properly connectorized, though it does not meet telephony technical standards.

Usage

The level of transport or circuit is mostly used between telephony carriers, both wired and wireless.

Digital Signal 0 (DS0)

Digital Signal 0 (DS0) is a basic digital signalling rate of 64 kbit/s, corresponding to the capacity of one voice-frequency-equivalent channel.^[1] The DS0 rate, and its equivalents E0 and J0, form the basis for the digital multiplex transmission hierarchy in telecommunications systems used in North America, Europe, Japan, and the rest of the world, for both the early plesiochronous systems such as T-carrier and for modern synchronous systems such as SDH/SONET.

The DS0 rate was introduced to carry a single digitized voice call. For a typical phone call, the audio sound is digitized at an 8 kHz sample rate using 8-bit pulse-code modulation for each of the 8000 samples per second. This resulted in a data rate of 64 kbit/s.

Because of its fundamental role in carrying a single phone call, the DS0 rate forms the basis for the digital multiplex transmission hierarchy in telecommunications systems used in North America. To limit the number of wires required between two involved in exchanging voice calls, a system was built in which multiple DS0s are multiplexed together on higher capacity circuits. In this system, twenty-four (24) DS0s are multiplexed into a DS1 signal. Twenty-eight (28) DS1s are multiplexed into a DS3. When carried over copper wire, this is the well-known T-carrier system, with T1 and T3 corresponding to DS1 and DS3, respectively.

Besides its use for voice communications, the DS0 rate may support twenty 2.4 kbit/s channels, ten 4.8 kbit/s channels, five 9.67 kbit/s channels, one 56 kbit/s channel, or one 64 kbit/s clear channel.

E0 (standardized as ITU G.703) is the European equivalent of the North American DS0 for carrying a single voice call. However, there are some subtle differences in implementation. Voice signals are encoded for carriage over E0 according to ITU G.711. Note that when a T-carrier system is used as in North America, robbed bit signaling can mean that a DS0 channel carried over that system is not an error-free bit-stream. The out-of-band signaling used in the European E-carrier system avoids this.

software transactional memory (STM)

Software transactional memory (STM) is a concurrency control mechanism analogous to database transactions for controlling access to shared memory in concurrent computing. It functions as an alternative to lock-based synchronization. A transaction in this context is a piece of code that executes a series of reads and writes to shared memory. These reads and writes logically occur at a single instant in time; intermediate states are not visible to other (successful) transactions. The idea of providing hardware support for transactions originated in a 1986 paper and patent by Tom Knight[1]. The idea was popularized by Maurice Herlihy and J. Eliot B. Moss[2]. In 1995 Nir Shavit and Dan Touitou extended this idea to software-only transactional memory (STM)[3]. STM has recently been the focus of intense research and support for practical implementations is growing.]

Performance

Unlike the locking techniques used in most modern multithreaded applications, STM is very optimistic: a thread completes modifications to shared memory without regard for what other threads might be doing, recording every read and write that it is performing in a log. Instead of placing the onus on the writer to make sure it does not adversely affect other operations in progress, it is placed on the reader, who after completing an entire transaction verifies that other threads have not concurrently made changes to memory that it accessed in the past. This final operation, in which the changes of a transaction are validated and, if validation is successful, made permanent, is called a commit. A transaction may also abort at any time, causing all of its prior changes to be rolled back or undone. If a transaction cannot be committed due to conflicting changes, it is typically aborted and re-executed from the beginning until it succeeds.

The benefit of this optimistic approach is increased concurrency: no thread needs to wait for access to a resource, and different threads can safely and simultaneously modify disjoint parts of a data structure that would normally be protected under the same lock. Despite the overhead of retrying transactions that fail, in most realistic programs, conflicts arise rarely enough that there is an immense performance gain^{[citation needed]} over lock-based protocols on large numbers of processors.

However, in practice STM systems also suffer a performance hit relative to fine-grained lock-based systems on small numbers of processors (1 to 4 depending on the application). This is due primarily to the overhead associated with maintaining the log and the time spent committing transactions. Even in this case performance is typically no worse than twice as slow.^[4] Advocates of STM believe this penalty is justified by the conceptual benefits of STM.

Theoretically (worst case behaviour) when there are n concurrent transactions running in the same time, there could be need of O(n) memory and processor time consumption. Actual needs depends on implementation details (one can make transaction fail early enough to avoid overhead), but there will be also cases (although rare) where lock based algorithms have better theoretical computing time than software transactional memory.

Conceptual advantages and disadvantages

In addition to their performance benefits, STM greatly simplifies conceptual understanding of multithreaded programs and helps make programs more maintainable by working in harmony with existing high-level abstractions such as objects and modules. Lock-based programming has a number of well-known problems that frequently arise in practice:

They require thinking about overlapping operations and partial operations in distantly separated and seemingly unrelated sections of code, a task which is very difficult and error-prone for programmers.
They require programmers to adopt a locking policy to prevent deadlock, livelock, and other failures to make progress. Such policies are often informally enforced and fallible, and when these issues arise they are insidiously difficult to reproduce and debug.
They can lead to priority inversion, a phenomenon where a high-priority thread is forced to wait on a low-priority thread holding exclusive access to a resource that it needs.

In contrast, the concept of a memory transaction is much simpler, because each transaction can be viewed in isolation as a single-threaded computation. Deadlock and livelock are either prevented entirely or handled by an external transaction manager; the programmer need hardly worry about it. Priority inversion can still be an issue, but high-priority transactions can abort conflicting lower priority transactions that have not already committed.

On the other hand, the need to abort failed transactions also places limitations on the behavior of transactions: they cannot perform any operation that cannot be undone, including most I/O. Such limitations are typically overcome in practice by creating buffers that queue up the irreversible operations and perform them at a later time outside of any transaction. In Haskell, this limitation is enforced at compile time by the type system.

ATM(Asynchronous Transfer Mode)

(ATM) is a standardized digital data transmission technology. ATM is implemented as a network protocol and was first developed in the mid 1980s.^[1] The goal was to design a single networking strategy that could transport real-time video conference and audio as well as image files, text and email.^[2] The International Telecommunications Union, American National Standards Institute, European Telecommunications Standards Institute, ATM Forum, Internet Engineering Task Force, Frame Relay Forum and SMDS Interest Group were involved in the creation of the standard.^[3]

Asynchronous Transfer Mode is a cell-based switching technique that uses asynchronous time division multiplexing.^[4]^[5] It encodes data into small fixed-sized cells (cell relay) and provides data link layer services that run over OSI Layer 1 physical links. This differs from other technologies based on packet-switched networks (such as the Internet Protocol or Ethernet), in which variable sized packets (known as frames when referencing Layer 2) are used. ATM exposes properties from both circuit switched and small packet switched networking, making it suitable for wide area data networking as well as real-time media transport.^[6] ATM uses a connection-oriented model and establishes a virtual circuit between two endpoints before the actual data exchange begins.^[7]

ATM is a core protocol used over the SONET/SDH backbone of the Integrated Services Digital Network.

ATM has proven very successful in the WAN scenario and numerous telecommunication providers have implemented ATM in their wide-area network cores. Many ADSL implementations also use ATM. However, ATM has failed to gain wide use as a LAN technology, and lack of development has held back its full deployment as the single integrating network technology in the way that its inventors originally intended. Since there will always be both brand-new and obsolescent link-layer technologies, particularly in the LAN area, not all of them will fit neatly into the synchronous optical networking model for which ATM was designed. Therefore, a protocol is needed to provide a unifying layer over both ATM and non-ATM link layers, as ATM itself cannot fill that role. IP already does that; therefore, there is often no point in implementing ATM at the network layer.

In addition, the need for cells to reduce jitter has declined as transport speeds increased (see below), and improvements in Voice over IP (VoIP) have made the integration of speech and data possible at the IP layer, again removing the incentive for ubiquitous deployment of ATM. Most Telcos now^[update] plan to integrate their voice network activities into their IP networks, rather than their IP networks into the voice infrastructure.

MPLS, a generic Layer 2 packet-switching protocol, adopted many technically sound ideas from ATM. ATM remains widely deployed, and is used as a multiplexing service in DSL networks, where its compromises fit DSL's low-data-rate needs well. In turn, DSL networks support IP (and IP services such as VoIP) via PPP over ATM and Ethernet over ATM (RFC 2684).

ATM will remain deployed for some time^[update] in higher-speed interconnects where carriers have already committed themselves to existing ATM deployments; ATM is used here as a way of unifying PDH/SDH traffic and packet-switched traffic under a single infrastructure.
It is often claimed that "ATM is increasingly challenged by speed and traffic shaping requirements of converged networks. In particular, the complexity of Segmentation and Reassembly (SAR) imposes a performance bottleneck, as the fastest SARs known run at 10 Gbit/s". However with ATM interfaces available at up to STM-16 (2.5Gbps - such as the Cisco SPA-1XOC48-ATM for their 7600 series routers) and even STM-64 (10Gbps for example the Cisco MGX 8950 OC-192c/STM-64) ATM can still readily challenge even 10GE interfaces for speed and typically exceed the ability of other protocols in terms of Quality of Service - especially on busy links.

As far as SAR issues are concerned, since SAR is carried out at the edge of an ATM network, this is not a core switching issue but rather a task left to the edge devices (or the applications themselves) and currently (as at 2009) it would be true to say that any single interface on a Router is struggling to exceed 10Gbps throughput and this 10Gbps limitation is not limited to merely ATM SAR but also the switching and routing capabilities of Router interfaces in general.

Currently, it seems likely that gigabit Ethernet implementations (10Gbit-Ethernet, Metro Ethernet) will replace ATM as a technology of choice in new WAN implementations.

Interest in using native ATM for carrying live video and audio has increased recently^[update]. In these environments, low latency and very high quality of service are required to handle linear audio and video streams. Towards this goal standards are being developed such as AES47 (IEC 62365), which provides a standard for professional uncompressed audio transport over ATM. This is worth comparing with professional video over IP.

Tuesday, January 5, 2010

Firewall

An illustration of how a firewall works.

A firewall is a part of a computer system or network that is designed to block

rt of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.

Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

There are several types of firewall techniques:

Packet filter: Packet filtering inspects each packet passing through the network and accepts or rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. In addition, it is susceptible to IP spoofing.
Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Sunday, December 13, 2009

CLASSES OF IP ADDRESS

IP Address Classes and Their Formats

Since networks vary in size, there are four different address formats or classes to consider when applying to NIC for a network number:

Class A addresses are for large networks with many devices.
Class B addresses are for medium-sized networks.
Class C addresses are for small networks (fewer than 256 devices).
Class D addresses are multicast addresses.

The first few bits of each IP address indicate which of the address class formats it is using. The address structures look like this:

Class A

Network (7 bits)

Local address (24 bits)

Class B

Network (14 bits)

Local address (16 bits)

Class C

110

Network (21 bits)

Local address (8 bits)

Class D

1110	Multicast address (28 bits)

The IP address is usually expressed as four decimal numbers, each representing eight bits, separated by periods. This is sometimes known as the dot address and, more technically, as dotted quad notation. For Class A IP addresses, the numbers would represent "network.local.local.local"; for a Class C IP address, they would represent "network.network.network.local". The number version of the IP address can (and usually is) represented by a name or series of names called the domain name.

The Internet's explosive growth makes it likely that, without some new architecture, the number of possible network addresses using the scheme above would soon be used up (at least, for Class C network addresses). However, a new IP version, IPv6, expands the size of the IP address to 128 bits, which will accommodate a large growth in the number of network addresses. For hosts still using IPv4, the use of subnets in the host or local part of the IP address will help reduce new applications for network numbers. In addition, most sites on today's mostly IPv4 Internet have gotten around the Class C network address limitation by using the Classless Inter-Domain Routing (CIDR) scheme for address notation.

Class	Leading bits	Start	End	CIDR equivalent	Default subnet mask
Class A	0	0.0.0.0	127.255.255.255	/8	255.0.0.0
Class B	10	128.0.0.0	191.255.255.255	/16	255.255.0.0
Class C	110	192.0.0.0	223.255.255.255	/24	255.255.255.0
Class D (multicast)	1110	224.0.0.0	239.255.255.255	/32
Class E (reserved)	1111	240.0.0.0	255.255.255.255	/32

Tuesday, November 24, 2009

canopy antenna

Motorola Canopy

Type of signal:	LOS (line-of-sight Line-of-sight propagation Line-of-sight propagation refers to electro-magnetic radiation including light emissions traveling in a straight line. The rays or waves are diffracted, refracted, reflected, or absorbed by atmosphere and obstructions with material and generally cannot travel over the horizon or behind obstacles.... ), NLOS
Maximum range (miles)	120 miles PtMP Point-to-multipoint For general information for point-to-multipoint communication, refer to Link #Point-to-multipoint.Point-to-multipoint communication is a term that is used in the telecommunications field which refers to communication which is accomplished via a specific and distinct type of multipoint connection, providing multiple paths from a single locat... , 155 miles PtP Point-to-point Point-to-point may refer to:* Point-to-point construction, an electronics assembly technique* Network_topology#Point-to-point* Point-to-Point Protocol , part of the Internet protocol suite...
Minimum range:	500 m (The Subscriber Modules (SMs) do not like having a "full blast" signal)
Maximum data throughput (Mbit/s)	21Mbit/s for PtMP, 300 Mbit/s using PTP 600.

Motorola

Motorola, Inc. is an United States, multinational, Fortune 100, telecommunications company based in Schaumburg, Illinois. It is a manufacturer of wireless telephone handsets, also designing and selling wireless network infrastructure equipment such as cellular transmission base stations and signal amplifiers....
Canopy is a wireless networking system designed for WISPs (wireless internet service providers) available in point-to-point and point-to-multipoint

Point-to-multipoint

For general information for point-to-multipoint communication, refer to Link #Point-to-multipoint.Point-to-multipoint communication is a term that is used in the telecommunications field which refers to communication which is accomplished via a specific and distinct type of multipoint connection, providing multiple paths from a single locat...
configurations. It includes both the original Motorola-designed products using the Canopy protocol and the PtP backhauls that were rebranded from Orthogon Systems which Motorola acquired in 2006.

Typical setup

A typical Canopy setup consists of a cluster of up to 6 co-located standard access point

Access Point

Access Point can refer to:*Access Point , a location on Anvers Island, Antarctica*Wireless access point, a wireless networking device...
s, each with a 60 degree horizontal beamwidth

Beamwidth

In telecommunication, the term beamwidth has the following meanings:1. In the radio regime, of an antenna pattern, the angle between the half-power points of the main lobe, when referenced to the peak effective radiated power of the main lobe....
antenna, to achieve 360 degree coverage. Also included would be one or more backhauls or otherwise out-of-band links (to carry data to/from other network ocations) and a Cluster Management Module (CMM) to provide power and synchronization to each Canopy AP or Backhaul Module(BM).

Customers of the system receive service through subscriber modules (SMs) aimed towards the AP. The SMs should be mounted on the tall point of a building to get a reliable connection else Fresnel zone

Fresnel zone

File:FresnelSVG.svgIn optics and radio telecommunication, a Fresnel zone, named for physicist Augustin-Jean Fresnel, is one of a number of concentric ellipsoids of revolution which define volumes in the radiation pattern of a circular aperture ....
obstruction will weaken the signal. Under ideal operating conditions connections at distances up to 3.5 miles can be achieved using equipment with integrated antennas

Antenna (radio)

An 'antenna' is a transducer designed to transmitter or receive Electromagnetic radiations. In other words, antennas convert electromagnetic waves into electrical currents and vice versa....
. Network operators can opt to install reflector dishes or Stinger antennas, or to use Canopy models that accept external antennas at one or both ends of the link to increase coverage distance.

Most Canopy equipment receives its power using Power over Ethernet

Power over Ethernet

Power over Ethernet or PoE technology describes a system to transfer electrical power, along with data, to remote devices over standard twisted-pair cable in an Ethernet network....
, however, none of its standards comply with IEEE 802.3af.

In general, the 900 MHz version is more effective for use in outlying areas because of its ability to penetrate through trees. However, it requires careful installation due to the easy propagation of interference on that band.

Comparison with other wireless networking systems

Canopy-protocol products have many advantages over wi-fi

Wi-Fi

Wi-Fi is a trademark of the Wi-Fi Alliance, founded in 1999 as Wireless Internet Compatibility Alliance , comprising more than 300 companies, whose products are certified by the Wi-Fi Alliance, based on the IEEE 802.11 standards ....
and other WLAN

Wireless LAN

A wireless LAN is a wireless local area network that links two or more computers or devices using Spread spectrum or OFDM modulation technology based to enable communication between devices in a limited area....
protocols:

transmission timing is explicitly controlled, so that all APs on all towers can be synchronized by GPS to prevent interference. APs of the same band can be placed right next to each other, and back-to-back units can use the exact same frequency.
designed for WISP use; polling-based (prevents one SM from "hogging" bandwidth), excellent interference rejection and easy management.
simple to install and configure and highly reliable.

Switches and routers

network switch is a small hardware device that joins multiple computers together within one local area network (LAN). Technically, network switches operate at layer two (Data Link Layer) of the OSI model.

Network switches appear nearly identical to network hubs, but a switch generally contains more intelligence (and a slightly higher price tag) than a hub. Unlike hubs, network switches are capable of inspecting data packets as they are received, determining the source and destination device of each packet, and forwarding them appropriately. By delivering messages only to the connected device intended, a network switch conserves network bandwidth and offers generally better performance than a hub.

As with hubs, Ethernet implementations of network switches are the most common. Mainstream Ethernet network switches support either 10/100 Mbps Fast Ethernet or Gigabit Ethernet (10/100/1000) standards.

Different models of network switches support differing numbers of connected devices. Most consumer-grade network switches provide either four or eight connections for Ethernet devices. Switches can be connected to each other, a so-called daisy chaining method to add progressively larger number of devices to a LAN.

ROUTERS

In packet-switched networks such as the Internet, a router is a device or, in some cases, software in a computer, that determines the next network point to which a packet should be forwarded toward its destination. The router is connected to at least two networks and decides which way to send each information packet based on its current understanding of the state of the networks it is connected to. A router is located at any gateway (where one network meets another), including each point-of-presence on the Internet. A router is often included as part of a network switch.

Ask your router questions at ITKnowledgeExchange.com

A router may create or maintain a table of the available routes and their conditions and use this information along with distance and cost algorithms to determine the best route for a given packet. Typically, a packet may travel through a number of network points with routers before arriving at its destination. Routing is a function associated with the Network layer (layer 3) in the standard model of network programming, the Open Systems Interconnection (OSI) model. A layer-3 switch is a switch that can perform routing functions.

An edge router is a router that interfaces with an asynchronous transfer mode (ATM) network. A brouter is a network bridge combined with a router.

For home and business computer users who have high-speed Internet connections such as cable, satellite, or DSL, a router can act as a hardware firewall. This is true even if the home or business has only one computer. Many engineers believe that the use of a router provides better protection against hacking than a software firewall, because no computer Internet Protocol address are directly exposed to the Internet. This makes port scans (a technique for exploring weaknesses) essentially impossible. In addition, a router does not consume computer resources as a software firewall does. Commercially manufactured routers are easy to install, reasonably priced, and available for hard-wired or wireless networks.

Also see bridge, gateway, hub, and switch.

Getting started with routers

To explore how routers are used in the enterprise, here are some additional resources:

A router by any other name is still a router: Learn about what a router does, the difference between a router and a switch, and what to consider when selecting a router for your home or your business.

Tasks for initial router configuration: Unlike some devices, routers require quite a bit of configuration before they will be useful. This tip examines the minimum tasks needed to get a Cisco router working.

Ten quick router security tips: Network administrators need to know the basics in router security. This quick tip lists10 basic router security tips.

Juniper routers

Juniper is a leading provider of core routing, edge routing and network security solutions for IP-based enterprise and carrier-class networks. Network Hardware Resale was one of the first to offer pre-owned, refurbished and used Juniper equipment and maintains the capital and resources to carry the largest inventory of second-hand Juniper product available on the market. Popular items include the:

Information Outlet

In a telephone wiring system in a building, a connection device designed for a fixed location (usually on a wall) in which telephone wiring terminates; the outlet contains a female jack to receive a male plug that is inserted into it. Such outlets are used to connect a telephone, FAX, telephone answering machine, etc., to a telephone line.

I/O MODULES

1746 I/O Module Overview

The 1746 I/O product line provides more than 60 modules to meet your application needs in a modular assembly—including intelligent I/O modules.

Digital I/O modules provide 4 through 32 I/O per module.
- Digital I/O circuits interface to on/off sensors/actuators.
- Ladder logic has direct access to I/O values.
- Input modules, output modules, and combination input/output modules.
- Ac and DC input modules.
- Ac, dc, and relay-contact output modules.
Analog I/O modules provide 4 through 16 I/O per module.
- D/A and A/D conversions interface analog signals to data-table values
- Ladder logic has direct access to I/O values.
- Input modules, output modules, and combination input/output modules.
- A high level of resolution for accurate control in a broad range of analog applications.
Intelligent I/O modules are available to enhance your control system. These modules include a high-speed counter module, a BASIC language module, a motion control module, and communication modules. Each provides a unique easy-to-use interface between the I/O circuits (digital and/or analog) and the CPU.

This modular hardware design uses cost- and space-effective means to add I/O to your control system. These modules can be used:

In a local I/O chassis of an SLC modular-hardware controller.
At a location remote from the processor, in an I/O chassis with a 1747-ACN15 or -ACNR15 I/O adapter on a ControlNet link with the processor.
At a location remote from the processor, in an I/O chassis with a 1747-ASB I/O adapter on a Universal Remote I/O link with the processor.

Benefits

Hardware-platform sharing makes spare-parts stocking convenient.
Combinations of input and outputs in the same digital and analog modules provide expansion capabilities without sacrificing space or increasing cost.
Variety of voltages creates a precise power fit for your application.
No need to disconnect wiring to replace module of 16 or more I/O; removable terminal blocks are shipped with I/O modules.
Broad range of signal interfaces to AC and DC sensors/actuators for a wide variety of applications.
LED indicators show input/output status for easier troubleshooting.
Modules available in different densities (32 I/O per module max) for greater flexibility and cost savings.
1746 I/O modules include optical coupling and filter circuitry for signal noise reduction.
A wide range of analog signal levels including standard analog inputs and outputs, and direct thermocouple and RTD temperature inputs.

modular jacks

The DECconnect Modified Modular Jack (MMJ) is a variation of the 6P6C modular connector and was developed by Digital Equipment Corporation. The main difference from the conventional modular connector is that the hook is toward the side instead of the center of the plug, making it impossible to insert a standard modular cable plug such as those used telephone or Ethernet applications. MMJ connectors are used on Digital minicomputers, such as the PDP-11, VAX and Alpha based machines and to connect terminals, printers or serial console servers.

The six conductors of the DECconnect MMJ connector are used for the main signals in RS-423 serial communication: Tx and Rx for the data transmission and DSR and DTR for handshaking. The transmit and receive signals are differential, i.e. each signal is the voltage difference between two conductors, as opposed to a voltage on a single connector relative to a common reference. But one can in practice wire these signals to an RS-232 device, which uses the common reference method, by combining the lower voltage sides of each signal to the RS-232 signal ground line. For this type of connection there are a number of models of conversion adapter.

When connecting two DTE devices such as a computer and a printer, the Digital BC16E crossover cable is used.

patch panel

A patch panel or patch bay is a panel, typically rackmounted, that houses cable connections. One typically shorter patch cable will plug into the front side, whereas the back holds the connection of a much longer and more permanent cable. The assembly of hardware is arranged so that a number of circuits, usually of the same or similar type, appear on jacks for monitoring, interconnecting, and testing circuits in a convenient, flexible manner.

Patch panels offer the convenience of allowing technicians to quickly change the path of select signals, without the expense of dedicated switching equipment. This was first used by early telephone exchanges, where the telephone switchboard (a massive array of patch panels) and a large room full of telephone operators running it was ubiquitous.

Uses and connectors

In recording studios, television and radio broadcast studios, and concert sound reinforcement systems, patchbays are widely used to facilitate the connection of different devices, such as microphones, electric or electronic instruments, effects (e.g., compression, reverb, etc.), recording gear, amplifiers, or broadcasting equipment. Patchbays make it easier to connect different devices in different orders for different projects, because all of the changes can be made at the patchbay. As well, patchbays make it easier to troubleshoot problems such as ground loops; even small home studios and amateur project studios often use patchbays, because it groups all of the input jacks into one location. This means that devices mounted in racks or keyboard instruments can be connected without having to hunt around behind the rack or instrument with a flashlight for the right jack. Using a patchbay also saves wear and tear on the input jacks of studio gear and instruments, because all of the connections are made with the patchbay.

Normalling

Patch bays may be half-normal or full-normal, "normal" indicating that the top and bottom jacks are wired together internally. When a patch bay has half-normal wiring, its switching contacts flow through the bottom jacks of the bottom row while connected to the top row; plugging into the output connection will split the signal. If a patch bay is wired to full-normal, then it includes switching contacts in both rows of jacks

Switches

Dedicated switching equipment can be an alternative to patch bays in some applications. Switchers can make routing as easy as pushing a button, and can provide other benefits over patch bays, including routing a signal to any number of destinations simultaneously. However, switching equipment that can emulate the capabilities of a given patch bay is much more expensive.

Example: a 16-point S-Video patch panel, with 8 patch cables, may cost $300.00^{[citation needed]}, and connect 8 inputs and 8 outputs. An S-Video matrix routing switcher with the same capability (8x8) would probably cost between $2,000.00 and $4,000.00 new, though it would probably have more capabilities, including audio-follow-video and built-in distribution amplifiers.

There are various types of switchers for audio and video, from simple selector switches to sophisticated production switchers. However, emulating or exceeding the capabilities of audio and/or video patch bays requires specialized devices like routing switchers and matrix routers (aka "crosspoint switchers").

Like patch panels, switching equipment for nearly any type of signal is available, including analog and digital video and audio, as well as RF (cable TV), MIDI, telephone, networking, electrical, and just about anything else.

Switching equipment may be electronic, mechanical, or electro-mechanical. Some switcher hardware can be controlled via computer and/or other external devices. Some have automated and/or pre-programmed operational capabilities. There are also software switcher applications used to route signals and control data within a "pure digital" computer environment

Jude 1:3

The sin and doom of Godless men 3Dear friends, although I was very eager to write to you about the salvation we share, I felt I had to write and urge you to contend for the faith that was once for all entrusted to the saints.