* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download 2/6 Matt - Dr. John Durrett
Survey
Document related concepts
Parallel port wikipedia , lookup
Point-to-Point Protocol over Ethernet wikipedia , lookup
Piggybacking (Internet access) wikipedia , lookup
Asynchronous Transfer Mode wikipedia , lookup
Airborne Networking wikipedia , lookup
Network tap wikipedia , lookup
Computer network wikipedia , lookup
Internet protocol suite wikipedia , lookup
Multiprotocol Label Switching wikipedia , lookup
Deep packet inspection wikipedia , lookup
Wake-on-LAN wikipedia , lookup
Distributed firewall wikipedia , lookup
Routing in delay-tolerant networking wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Transcript
Corporate Firewalls and DMZs By Matt Bertram ISQS 6342 (Spring 2003) Professor John Durrett IP Routing Basics Every system has an “IP address” (e.g. 129.118.1.3) and a “subnet mask” (e.g., 255.255.0.0) subnet mask = mask = network mask = netmask A mask is NOT an IP address The first “n” bits of the mask are 1’s and denote the “network portion” of the IP address The remaining “24-n” bits are 0’s and denote the “host portion” of the address address = 129.118.1.3 = 10000001.01110110.00000001.00000011 mask = 255.255.0.0 = 11111111.11111111.00000000.00000000 “Prefix” notation: address/n (e.g., 129.118.1.3/16) Easier to work with, becoming more common Network Addresses You can choose any n-bit subnet mask you want provided you do not mix 1’s and 0’s 255.224.0.0 = 11111111.11100000.00000000.00000000 = OK 255.225.0.0 = 11111111.11100001.00000000.00000000 = NOT OK For hosts with a given subnet mask, you can use any IP address you want except: all host bits of “0” -- this is reserved as the “network address”, which addresses the subnet itself all host bits of “1” -- this is reserved as the “broadcast address”, which addresses all hosts on the subnet For the host 129.118.1.3/16: address = 10000001.01110110.00000001.00000011 mask = 11111111.11111111.00000000.00000000 network = 10000001.01110110.00000000.00000000 broadcast = 10000001.01110110.11111111.11111111 Routing Tables Every host maintains a routing table Use the “route” command in Linux and Windows Each row (or “entry”) in the routing table has the following columns: (1) destination address and (2) mask (3) gateway [i.e., the IP address of the host’s gateway/router] (4) interface [i.e., the IP address of a host interface] (5) metric [indicates the “cost” of the route, smaller is better] When the host wants to send a packet to a destination, it looks in the routing table to find out how Each OS handles routing somewhat differently Routing Tables Suppose host A/a wants to sends a packet to host B Each entry in the routing table on host A is examined: If a specific route to B exists, use this route (i.e., send the packet using the interface specified in the table) If a specific route to B’s network exists, use this route In the special case where A and B are in the same subnet (if the first a bits of A and B match), send the packet directly to B If a default route exists (i.e., A has is configured to use a “gateway” or “router”), send this packet to the router A default route is listed in the routing table as “0.0.0.0/0” The router has a routing table and follows this same process The packet is not sent If multiple entries for some destination exist, they are tried from smallest to largest metric Routing A host with two (or more) interfaces and addresses on two (or more) networks is referred to as “multihomed” Can be “hardware,” e.g., Cisco router X Can be “software,” e.g., a PC running Linux A multihomed host that has “IP forwarding” enabled can be configured to pass traffic between networks (i.e., to function as a “router”) In Linux, add “forward_ip4=yes” to “/etc/sysconfig/network” In Windows XP, create or edit the following registry key: Key: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value Name: IPEnableRouter Data Type: REG_DWORD Value Data: "0" (disabled) or "1" (enabled) In Windows 2000 Server, install and configure “Routing and Remote Access” Firewalls A router can also be configured as a “firewall” A firewall examines packets at layers 2/3/4 and makes decisions about what to do with them Current operating systems include firewall functionality In Linux (2.4 and later), use the “iptables” command In Linux (prior to 2.4), use the “ipchains” command In Windows XP, enable “Internet Connection Firewall” Some Microsoft applications open ports during installation In Windows 2000 Server, purchase “Microsoft Internet Security and Acceleration Server” Unswitched Devices “Dumb” Devices (forward all packets) Layer 1 = Hub, Repeater Technically, a hub passes signals without regenerating them “Intelligent” Devices (decide whether to forward packets) Layer 3 = Router Layer 2 = Bridge Connects different types of LANs (e.g., Ethernet and ATM, but not Token Ring if you’re lucky) Use routing table to make decisions Improved performance and security Layer 2/3 = Bridge/Router Switches Layer 2 = data link layer (MAC address) = + over hubs/repeaters Systems only see traffic they are supposed to see Unswitched versus switched (full duplex) 10 and 100 mb Ethernet = 40% of bandwidth versus 95%+ (no collisions) Layer 3 = network layer (IP address) = + over routers Routers moved to periphery Virtual LANs (VLANs) become viable Layer 4 = transport layer (TCP/UDP/ICMP headers) = + over L3 Firewall functionality (i.e., packet filtering) Significantly more expensive Layer 5 = session layer and above (URLs) = + over L4 for clusters Application proxy functionality (but MUCH faster than proxies) Special function, cutting-edge = significant specific performance gains 1999/2000: researchers (from IBM & Lucent) designed a layer 5 switch as front-end to a load-balanced 3-node cluster running AIX and Apache: 220% performance increase due to content partitioning 600% performance increase due to SSL session reuse