Network Probes

A network probe or sniffer is a very useful tool for troubleshooting network problems. You can find software and hardware network sniffers that collect data packets from the network and allow you to examine them to determine what is causing a problem on your network.

Because the purpose of a network probe is to intercept packets and examine them, you can easily see how this could be very damaging when used for purposes other than troubleshooting.

Remember that the less information known about your network by outsiders, the more difficult it is to infiltrate your network. However, when someone has broken in, it's a simple task to plant a program that does nothing except listen to the network and send information back to the person who planted the program in the first place. Using a network sniffer for this purpose enables an outsider to find out all sorts of useful information about your computers, users, and network configuration. For example, you already know it's a bad idea to use FTP, Telnet, and other utilities that use clear-text to send usernames and passwords. However, you might think it's safe to use these inside your network. Well, that's not so. If someone has planted a program in a server on your network and is "probing" the packets that pass around your network, they'll find it very easy to further infiltrate your network by obtaining more user account information, and thus be able to compromise one computer after another. Use safe utilities inside your network as well as for communications on the Internet. An example of this would be to use the Secure Shell utilities.

Spoofing and Impersonation

Just as it's a simple matter to create a program that can construct a steady stream of SYN packets and send them rapidly to your server, it's also easy to create network packets that have false information in other fields of the IP header. For example, you might have a firewall set up to reject packets from known sources of trouble, based on the source IP address found in the header. However, there's nothing to stop the hacker, cracker, or attacker from simply putting in another source address so that your firewall lets the packet through.

IP address spoofing is very easy to do. It's also very hard to detect. One thing a firewall can do, however, is guard against packets that contain a spoofed address, making it appear that the packet originated inside your network. Think about it. If the source address of a network packet falls within the address range of your internal network, it shouldn't be coming in through a firewall interface that's connected to the Internet. It should be the other way around! All good firewalls can be configured to drop packets that arrive from the outside world with an address that makes it look like the packet came from your network.

If It's Too Good to Be True, It Isn't

One of the more prevalent scams that has proliferated on the Internet in the past two years is the claim that you can make a fortune by helping out a civil servant, or the wife of an ex-legislator of a foreign country, usually Nigeria. When you get these emails, don't even try to respond. The scam involves your helping the sender transfer his secret funds to another bank outside the originating country. For a small fee, you can receive a few million in return. Yet, after you get involved, the person encourages you to open an account at a bank he uses (which is simply a Web site, not a bank) and transfer funds to that bank. In this manner e can (1) keep your cash and (2) in some cases gain access to your real account information from y r own bank.

This is just one example. Again, if it appears too good to be true, it isn't (true)! The Internet can be a great place to learn about new ideas, to get involved in e-commerce, and so on. It can also be a great place to get fleeced.

Another similar scam is an email that appears to come from a reputable company. Recently, emails from a site that appeared to be Microsoft was passed through the Internet. When you receive a suspicious email, look closely at the address of the email. Check the properties page of the email to see where it was sent from. You shouldn't get emails, for example, from Microsoft. com, or Ebay. . corn, unless you have granted them the right to send you emails. Yet, if you get an email from, say, Microsoft - readnow.com, don't open it! Check those emails carefully.

Preventative Measures

There are many standard techniques typically used to keep a network up and running. One of these preventative measures is regular backups. If your system becomes infected with virus programs or if you find that data has been corrupted, you'll understand the importance of regular, frequent backups. In addition, it's a good idea to keep offline copies of important data files for an extended period. Simply doing a backup each night and overwriting the tape or tapes the next night will provide you with very little protection. Damage to your system might not become evident until weeks or, in some cases, months after the initial intrusion.

There are also commercial and noncommercial products you can use to help safeguard your system. These include intrusion-detection mechanisms, antivirus programs, and programs that can monitor changes on important servers.

So where should you start when defining the defensive mechanisms needed to protect your network? Let's start at the edge of the network—the router.

Protecting Routers

Routers typically can be configured in several ways. You can attach a serial cable and terminal directly to most routers and perform configuration tasks. Another method is Telnet. Most modern routers allow you to Telnet into the router to perform configuration tasks. Turn this functionality on only when it is needed, and then turn it back off. The same goes for unnecessary protocols and services. In a manner similar to deciding what services you want to allow through a firewall (and in what direction), you should turn off all unnecessary services on a router. You'll have to consult your documentation to find out the particular commands you'll need to use.

You might want to check vendor Web sites for other router products that are in use on your network to look for similar advice. Additionally, be sure to stay informed of router firmware updates and operating-system updates and patches. As new threats are discovered, a responsible vendor will release information or code that can be used to help improve the security of the routers that stand guard at the edge of the network.

Filtering Based on Port Numbers

The TCP and UDP protocols use port numbers in their header information to identify applications. Although filtering based on IP addresses blocks all network traffic from a particular source, you can use filtering rules that block only specific ports. Thus, you might allow customers to interact with Web servers inside your network using the ports set aside for WWW activity—port 80, for typical WWW traffic—but block other ports, such as port 23 that is used for Telnet functions.

As another example, you might want to allow some users to use Telnet (port 23) or FTP (ports 20 and 21) to connect to servers outside the corporate network while denying this capability to others. You can do this by setting up rules in the packet filter and specifying both a host source address and a port number. Ports are a two-way path. You can block incoming connections, outgoing connections, or both for each port.

Packet filtering is an integral component of most every firewall and has several advantages:

• Usually inexpensive—If you use a router to connect to external sources, you already have th hardware—you just need to configure it.

• Fast—It does only minimal processing on the header information and does not make decision based on multiple packets.

• Flexible—It is easy, although some would say cumbersome, to configure as many address inclusions or exclusions as you like.

However, there are also several disadvantages to using a packet filter firewall:

• Packet filters perform no authentication—A packet is a packet no matter "who" the sender is. The address is the only thing that counts. This is important because IP addresses, ports, and any other part of the packet can be forged using simple tools available on the Internet.

• Most system administrators don't take advantage of a router's auditing features– You will most likely not even know that attempts were made to break in to the network; if the router does provide some kind of statistical information, you won't be able to determine where the attack came from. If you turn on logging for every packet that comes through your router, you'll experience a tremendous slowdown in network response time through the router. Selectively logging events is a better option, but then again you might miss important events. Small SOHO routers do not provide logging, so keep that in mind if you use one.

• Packet filters operate at the network level—They are not very effective at stopping sophisticated attacks that are directed at higher-level protocols, such as TCP.

• Internal network information is not kept from outside prying eyes—Using ordinary utilities, such as Tracert and Ping, mischievous persons can gain knowledge about your network unless you specifically block the protocol used by these utilities (ICMP).

If you had the choice, which of the following would you choose:

• Allow everything, but deny specific addresses.

• Deny everything, but allow selected known good addresses.

If it's not obvious that the second choice is the best, you need to stop and think about this again.

A good approach for configuring the rules to use on a packet filter is to first deny all traffic. Then, selectively enable only those addresses or services that are essential to your business. If you try to do this in reverse—allowing all traffic and then denying specific items—there's no way you can create a set of rules that covers all possible sources of mischief. You might leave out something that didn't seem important at the time you did the configuration, or a new twist on an old technology might creep up and surprise you later.

Firewall Problems

If you have installed a router/switch device between your network and a broadband Internet connection, be sure to read the manual thoroughly and understand how the device should be configured. Many come with default settings, but you need to fill in some information, such as the address of the broadband lint, if your service provider gives you a static address. In most cases, the provider will be
using DHCP also, so you won't have to make any changes. If you do have to make changes, write them down and keep the information handy for later troubleshooting efforts.

It's not a good idea to mix computers you use for play with those you use for business on the same network. If you do, you are just asking for trouble. If you play Internet games—those that allow you to interact with other users playing the same game on the Internet—you might be instructed to change the port settings on a small switch/router that also functions as a firewall. If you start playing around with opening, disabling, or forwarding ports, keep track of the changes you make. If something stops working after you've made a change, undo the modification and see whether the changes you've made have caused the problem.

Some users prefer to use the demilitarized zone (DMZ) option as an alternative to fiddling around with router settings to make online gaming possible.

Remember that the firewall capabilities of a small switch/router are minimal and are designed to protect you from simple attacks from the Internet. It might be that the default settings are very stringent and if you end up making changes that relax the firewall settings, you might also be opening a door that can allow bad things into your small LAN.

Keeping Your Network Healthy

Another good reason to keep your entertainment computers separate from your business LAN is that you don't want to be surfing the Web, find a neat program, and download a virus or some other bad program that will start to eat up things in your network. This is yet another reason other people shouldn't be using your business computer to access the Internet. Additionally, if you have children who want to use the Internet, you might want to buy them their own computer and provide a separate Internet connection. The shorthand is like this: Play games on your play computers; do business on your business computers. If at all possible, it's not a bad idea to adopt this policy. With computer prices falling and the fact that many people keep older computers after upgrades, this may be more feasible than ever.

And, of course, because business is business, back up your files on a regular basis. Above all, it's worth the cost to buy a good antivirus software package and keep it updated. The cost is a tax deduction and it will save you a lot of grief if something bad does get loose in your network.

For the safety of your network, a good antivirus program should be used to scan all disks on all computers on your LAN on a very frequent basis—such as nightly when you are asleep. A good antivirus program should also download updates (new virus definitions) frequently. Daily updates are recommended. If you hear of a new virus outbreak, you should immediately check for updates manually.

Keep in mind that if you don't keep your virus definitions up-to-date, then when one gets loose in even a large network, much less a small one, it can wreak havoc as it quickly spreads.

Lastly, a good antivirus program should detect malicious attachments when you are sending and receiving email, and should check removable media (such as a floppy disk) and block you from copying files if the removable media contains a virus or some other threatening program.

Unless your antivirus program was part of a security suite, you might not have anti-spyware software. Make sure you obtain and use two or more anti-spyware programs. Unlike antivirus programs, which can conflict with each other, it's okay to install more than one anti-spyware program.

From Bridges to Routers continue...

Using a Router to Segment the Network

Like bridges, routers can be used to isolate traffic between network segments. Unlike bridges, routers further reduce network bandwidth use because they do not pass broadcast messages from one segment to another unless programmed to do so. A router also does not have to take time to learn which nodes are connected to each segment. The information it needs is configured in advance—the administrator assigns protocols and addresses to each port. Routing protocols also use various methods to update each other about network topology as it changes.

One very important reason why routers are used to help organize a network into segments is that routers enable you to connect many network segments. Whereas bridges are limited to a few thousand nodes, depending on the topology used, routers can enable the LAN to be connected to an infinitely larger WAN, such as the Internet.

The internal processing that routers must perform make them slower than bridges (although that might not be the case with most high-end routers being manufactured today), which need to examine only a small amount of data in the packet header. Although this performance difference will not be noticed on network segments with only moderate traffic use, you might find that you need to place routers at only strategic locations throughout the network, retaining switches for connecting other computers or network segments. Remember that you can connect individual computers to a switch port or use the port to connect to other switches.

The method you use will depend on the usage patterns that can be monitored for each segment and the cost of the links used to connect different segments. Another thing to consider is that many of the high-end routers available today operate at what is called "wire speed." That means they can route packets at virtually the same speed as the network medium, with just the very slightest delay for processing time.

Connecting to a Larger WAN or the Internet

When connecting the LAN to a WAN, a router is required. When connecting to the Internet, for example, you cannot use a bridge or a repeater. The Internet is composed of a hierarchical IP address space and a router is needed to participate in this hierarchy. Or you might plan to use a dedicated line of some sort to connect to a larger corporate network. In that case, placing a router between your LAN and the WAN hardware, such as an ATM switch connection, will help reduce the traffic that crosses the expensive dedicated connection by keeping local traffic confined to the local network segments.

Note

There are two situations in which a router is not needed to make an Internet connection. The first is if you have a modem- based dial-up connection. Although it's possible to set up routing tables in operating systems such as Windows and Unix/Linux, this isn't really a practical method for connecting a small office IAN to the Internet due to the very limited speed.

The other situation is when you use a broadband connection, such as a cable or DSL modem. In this case, you can connect the high-bandwidth modem to a single computer and then set up routing tables so that other computers can send and receive traffic through the computer, which operates as a router. However, there's a better idea in a Small Office/Home Office (SOHO) or Remote Office Branch Office (ROBO) environment or a home environment where everyone from the parents to the kids have their own computers: Purchase an inexpensive 4-6 port router (for less than $100 in mast cases) that you can connect to the cable/DSL modem. These types of routers require very little knowledge about computers and can usually be set up in less than a half-hour.

Although you'll certainly have to configure the ports that connect the local LAN and the WAN interface, you might have to reconfigure addressing information on clients. For example, if you're already using a valid TCP/IP network address, possibly a subnet of the corporate network address space, you'll need to configure only routers.

If your business has just been acquired by a larger concern, however, you might find that your LAN has been assigned a new subnet by the larger corporation. In such a case, you'll probably have to plan on downtime for end users in order to make changes to important servers, such as Domain Name System (DNS) servers. DHCP servers (which workstations can find themselves) are used to translate between user-friendly names and IP addresses. Although DHCP can dynamically assign configuration information to workstations, important servers, such as DNS servers or gateways to other networks (usually routers), must have a static (unchanging) address. This is because part of the configuration information that DHCP supplies to clients is those addresses! If the address of a DNS server changed with every reboot of the server, you would have to reconfigure the information on each workstation client—a tedious effort even in a small network!

By using DHCP, you can overcome client configuration headaches such as this. Just reconfigure the DHCP server with the address range for the new subnet, add in the DNS servers and default gateway, and reboot your client computers. This is a simple explanation of the information supplied by DHCP servers. Indeed, you can use DHCP to provide configuration information for many other network parameters.

From Bridges to Routers

Routers are inherently slower than bridges when it comes to forwarding network packets. This is because a router must read further into each network frame to get Network layer addressing information, whereas a bridge merely looks at a fixed location for the MAC address. Hubs, bridges, and switches can be set up in a short amount of time and usually require little or no configuration.

Routers require that the network administrator configure networking information for each port that's used. The command set available to configure a router is quite large because it's a very flexible device and can be confusing for a novice. The kinds of information you need to configure a new router are

1. A list of the network protocols for which you'll be using the router. For example, TCP/IP or IPX/SPX.
2. The routing protocol that you'll use for each network protocol. For example, RIP.
3. Whether or not you'll need to set filters to block certain addresses or IP or UDP ports—a tech• nique used to create a simple firewall.
4. Information about the address space used on each segment the router will connect.

Network Protocol Issues

In many networks, more than one network protocol is used on the same medium. To do their job, routers need configuration information about each protocol for each port. For example, because each port on the router connects to a different network segment, each port must have a unique network address that it can use to communicate on the segment. If you plan to restrict some segments for security or other reasons, you'll need to create a set of access control lists (ACLs) for each port, which indicate which frames are allowed through, in both directions.

When using a router to connect to a larger WAN, you'll probably be faced with having to configure a port on the router that uses a WAN protocol, such as Frame Relay, in addition to protocols you're already familiar with on your network. With a WAN connection, you'll have to coordinate your activities with other system administrators to ensure that the router is configured with the correct information for the larger network.

Network Addressing Issues

Because the router makes decisions based on a higher-level networking protocol, such as IP, you'll have to take into consideration your current address space when you decide to introduce a router into the network. If you're adding new segments to the LAN and have the freedom to choose a new network address, this can be an easy task. If you're going to take an existing LAN and use a router to separate it into more manageable segments, you have two possible choices. You can use your original network address for one segment and create new networks on the remaining segments or you can use subnetting.

Regardless, you'll have to then reconfigure each client with new addressing information. If you're using DHCP, the process is made simpler because you can make the changes at a central location and have clients request the new information after the changes have been made. DHCP is the most prevalent method used today to configure workstations and other non-server devices on a network.

If you're going to use a router to connect your LAN to a larger corporate network, you might not have to make any addressing changes on your network, depending on the company's overall network plan. You'll still have to configure the ports, however. If you're going to connect the LAN to the Internet, using a router configured as a firewall might be something to consider.

Other Router Management Issues

Routers are very much like smart PCs that have been customized to perform the routing function efficiently. They have CPUs, memory, and I/O ports just like an ordinary PC. They also have an operating system, which is subject to periodic updates by the manufacturer. So, in addition to learning how to configure the router, you'll also need to become familiar with the commands used for such functions as saving a copy of the system image to a server for backup purposes and performing troubleshooting and testing.

Managing a network that uses routers can seem a difficult task at first. However, by enabling you to organize your network according to the hierarchical network address spaces used by upper-level network protocols, the initial configuration problems will be worth the effort.