MIKE MEYERS

SCOTT JERNIGAN

New York • Chicago • San Francisco

Lisbon • London • Madrid • Mexico City

Milan • New Delhi • San Juan

Seoul • Singapore • Sydney • Toronto

Mike Meyers’ CompTIA Network+® Certification Passport, Fourth Edition (Exam N10-005)

Copyright © 2012 by The McGraw-Hill Companies. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.

ISBN: 978-0-07-178906-6
MHID: 0-07-178906-5

The material in this eBook also appears in the print version of this title: ISBN 978-0-07-178905-9, MHID 0-07-178905-7.

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw-Hill is an independent entity from CompTIA®. This publication and digital content may be used in assisting students to prepare for the CompTIA Network+ exam. Neither CompTIA nor McGraw-Hill warrants that use of this publication and digital content will ensure passing any exam. CompTIA and CompTIA Network+ are trademarks or registered trademarks of CompTIA in the United States and/or other countries. All other trademarks are trademarks of their respective owners.

McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate training programs. To contact a representative please e-mail us at bulksales@mcgraw-hill.com.

Sponsoring Editor

Tim Green

Editorial Supervisor

Jody McKenzie

Project Editor

Emilia Thiuri (Fortuitous Publishing Services)

Acquisitions Coordinator

Stephanie Evans

Technical Editor

Jonathan Weissman

Copy Editor

Lisa McCoy

Proofreader

Emilia Thiuri (Fortuitous Publishing Services)

Indexer

Jack Lewis

Production Supervisor

James Kussow

Composition

Cenveo Publisher Services

Illustration

Cenveo Publisher Services

Art Director, Cover

Jeff Weeks

Cover Series Design

Ted Holladay

TERMS OF USE

This is a copyrighted work and The McGraw-Hill Companies, Inc. (“McGraw-Hill”) and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED “AS IS.” McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

Dedication

We dedicate this book to our acquisitions editor at McGraw-Hill, Tim Green, who’s been such an instrumental part of our success over the years.

Acknowledgments

The team at McGraw-Hill managed the process and kept us moving, jumping, skipping, (and other assorted mobility words that should be substituted for “writing”). So a big salute to Tim Green, Stephanie Evens, and Jody McKenzie. Project editor and proofreader Emilia Thiuri, copy editor Lisa McCoy, and compositor Cenveo did a fabulous job turning text into a printed book. It was great working with you again.

Our team at Total Seminars’ Orbital HQ once again demonstrated creativity, professionalism, and self-deprecating humor during the usual tough process of creating a book. Thank you—Aaron Verber, Ford Pierson, and Michael Smyer—for the great work on writing, editing, illustrating, and photographing. Our networking instructors also played a big role as sounding boards and fellow networking enthusiasts. Thanks to Scott Strubberg, Doug Jones, and Dave Rush.

Our technical editor, Jonathan Weissman, did an outstanding job catching errors, flaws, imperfections, typos, and wacky grammar, and not being afraid to point it all out. Looking forward to the next project together!

About the Authors

Mike Meyers, lovingly called the “AlphaGeek” by those who know him, is the industry’s leading authority on CompTIA Network+ certification. He is the president and co-founder of Total Seminars, LLC, a provider of PC and network repair seminars, books, videos, and courseware for thousands of organizations throughout the world. Mike has been involved in the computer and network repair industry since 1977 as a technician, instructor, author, consultant, and speaker. Author of numerous popular PC books and videos, including the best-selling CompTIA Network+ Certification All-in-One Exam Guide, Mike is also the series editor for the highly successful Mike Meyers’ Certification Passport series, the Mike Meyers’ Computer Skills series, and the Mike Meyers’ Guide To series, all published by McGraw-Hill. As well as writing, Mike has personally taught (and continues to teach) thousands of students, including U.S. senators; U.S. Supreme Court justices; members of the United Nations; every branch of the U.S. Armed Forces; most branches of the U.S. Department of Justice; and hundreds of corporate clients, academic students at every level, prisoners, and pensioners.

Email: michaelm@totalsem.com

Facebook: Mike Meyers (Houston, TX)

Twitter/Skype/Most IMs: desweds

Web Forums: www.totalsem.com/forums

Scott Jernigan wields a mighty red pen as editor in chief for Total Seminars. With a master of arts degree in medieval history, Scott feels as much at home in the musty archives of London as he does in the warm computer glow of Total Seminars’ Houston headquarters. After fleeing a purely academic life, he dove headfirst into IT, working as an instructor, editor, and writer. Scott has edited and contributed to dozens of books on computer literacy, hardware, operating systems, networking, and certification. His latest books are CompTIA Strata IT Fundamentals All-in-One Exam Guide (with Mike Meyers) and Computer Literacy: Your Ticket to IC³ Certification. Scott co-authored the best-selling CompTIA A+ Certification All-in-One Exam Guide and the Mike Meyers’ A+ Guide to Managing and Troubleshooting PCs (both with Mike Meyers). He has taught computer classes all over the United States, including stints at the United Nations in New York and the FBI Academy in Quantico, Virginia.

About the Technical Editor

Jonathan S. Weissman earned his master’s degree in computer and information science from Brooklyn College (CUNY), and holds 19 industry certifications, including Cisco CCNA, CompTIA Security+, CompTIA i-Net+, CompTIA Network+, CompTIA A+, CompTIA Linux+, Novell CNE, Novell CNA, Microsoft Office Master, Microsoft MCAS Word, Microsoft MCAS PowerPoint, Microsoft MCAS Excel, Microsoft MCAS Access, Microsoft MCAS Outlook, and Microsoft MCAS Vista.

Jonathan is a tenured assistant professor of computing sciences at Finger Lakes Community College (FLCC), in Canandaigua, New York, and also teaches graduate and undergraduate computer science courses at nearby Rochester Institute of Technology (RIT). In addition, Jonathan does computer, network, and security consulting for area businesses and individuals. Between FLCC and RIT, Jonathan has taught nearly two dozen different computer science courses, including networking, security, administration, forensics, programming, operating systems, hardware, and software courses.

About Total Seminars

Total Seminars provides certification training services to thousands of schools, corporations, and government agencies. Total Seminars produces the #1 selling CompTIA A+ and best-selling CompTIA Network+ certification books, and develops training materials such as the Total Tester for superior exam preparation. You can find Total Seminars on the Web at www.totalsem.com.

CompTIA Network+

The CompTIA Network+ certification ensures that the successful candidate has the important knowledge and skills necessary to manage, maintain, troubleshoot, install, operate, and configure basic network infrastructure, describe networking technologies, basic design principles, and adhere to wiring standards and use testing tools.

It Pays to Get Certified

In a digital world, digital literacy is an essential survival skill. Certification proves you have the knowledge and skill to solve business problems in virtually any business environment. Certifications are highly valued credentials that qualify you for jobs, increased compensation, and promotion.

CompTIA Network+ certification is held by many IT staffers across many organizations. Twenty-one percent of IT staff within a random sampling of U.S. organizations within a cross-section of industry verticals hold CompTIA Network+ certification.

    • The CompTIA Network+ credential—proves knowledge of networking features and functions and is the leading vendor-neutral certification for networking professionals.

    • Starting Salary—the average starting salary of network engineers can be up to $70,000.

    • Career Pathway—CompTIA Network+ is the first step in starting a networking career, and is recognized by Microsoft as part of their MS program. Other corporations, such as Novell, Cisco, and HP, also recognize CompTIA Network+ as part of their certification tracks.

    • More than 325,000—individuals worldwide are CompTIA Network+ certified.

    • Mandated/recommended by organizations worldwide—Apple, Cisco, HP, Ricoh, the U.S. State Department, and U.S. government contractors such as EDS, General Dynamics, and Northrop Grumman recommend or mandate CompTIA Network+.

How Certification Helps Your Career

CompTIA Career Pathway

CompTIA offers a number of credentials that form a foundation for your career in technology and that allow you to pursue specific areas of concentration. Depending on the path you choose, CompTIA certifications help you build upon your skills and knowledge, supporting learning throughout your career.

*Source: Computerworld Salary Survey 2010–U.S. salaries only

Steps to Getting Certified and Staying Certified

    1. Review exam objectives. Review the certification objectives to make sure you know what is covered in the exam: www.comptia.org/certifications/testprep/examobjectives.aspx

    2. Practice for the exam. After you have studied for the certification, take a free assessment and sample test to get an idea what type of questions might be on the exam: www.comptia.org/certifications/testprep/practicetests.aspx

    3. Purchase an exam voucher. Purchase exam vouchers on the CompTIA Marketplace, which is located at: www.comptiastore.com

    4. Take the test! Select a certification exam provider, and schedule a time to take your exam. You can find exam providers at the following link: www.comptia.org/certifications/testprep/testingcenters.aspx

    5. Stay Certified! Continuing education is required. Effective January 1, 2011, CompTIA Network+ certifications are valid for three years from the date of certification. There are a number of ways the certification can be renewed. For more information go to: http://certification.comptia.org/getCertified/steps_to_certification/stayCertified.aspx

Join the Professional Community

The free online IT Pro Community provides valuable content to students and professionals. Join the IT Pro Community:

http://itpro.comptia.org

Career IT job resources include:

    • Where to start in IT

    • Career assessments

    • Salary trends

    • U.S. job board

Join the IT Pro Community and get access to:

    • Forums on networking, security, computing, and cutting-edge technologies

    • Access to blogs written by industry experts

    • Current information on cutting-edge technologies

    • Access to various industry resource links and articles related to IT and IT careers

Content Seal of Quality

This courseware bears the seal of CompTIA Approved Quality Content. This seal signifies this content covers 100 percent of the exam objectives and implements important instructional design principles. CompTIA recommends multiple learning tools to help increase coverage of the learning objectives.

Why CompTIA?

    • Global recognition   CompTIA is recognized globally as the leading IT nonprofit trade association and has enormous credibility. Plus, CompTIA’s certifications are vendor-neutral and offer proof of foundational knowledge that translates across technologies.

    • Valued by hiring managers   Hiring managers value CompTIA certification because it is vendor- and technology-independent validation of your technical skills.

    • Recommended or required by government and businesses   Many government organizations and corporations (for example, Dell, Sharp, Ricoh, the U.S. Department of Defense, and many more) either recommend or require technical staff to be CompTIA certified.

    • Three CompTIA certifications ranked in the top 10   In a study by DICE of 17,000 technology professionals, certifications helped command higher salaries at all experience levels.

How to Obtain More Information

    • Visit CompTIA online   Go to www.comptia.org to learn more about getting CompTIA certified.

    • Contact CompTIA   Please call 866-835-8020, ext. 5 or e-mail questions@comptia.org.

    • Join the IT Pro Community   Go to http://itpro.comptia.org to join the IT community to get relevant career information.

    • Connect with CompTIA   Find us on Facebook, LinkedIn, Twitter, and YouTube.

CAQC Disclaimer

The logo of the CompTIA Approved Quality Curriculum (CAQC) program and the status of this or other training material as “Approved” under the CompTIA Approved Quality Curriculum program signifies that, in CompTIA’s opinion, such training material covers the content of CompTIA’s related certification exam.

The contents of this training material were created for the CompTIA Network+ exam covering CompTIA certification objectives that were current as of the date of publication.

CompTIA has not reviewed or approved the accuracy of the contents of this training material and specifically disclaims any warranties of merchantability or fitness for a particular purpose. CompTIA makes no guarantee concerning the success of persons using any such “Approved” or other training material in order to prepare for any CompTIA certification exam.

Contents

      Check-In

1   Network Fundamentals

    Objective 1.01   Overview of How Networks Work

          Servers and Clients

          Network Components

              Ethernet

              Hubs and Switches

              Software

              Applications

              Connecting LANs

    Objective 1.02   The OSI Seven-Layer Model

          The Layers and What They Represent

              Layer 1: Physical Layer

              Layer 2: Data Link Layer

              Layer 3: Network Layer

              Layer 4: Transport Layer

              Layer 5: Session Layer

              Layer 6: Presentation Layer

              Layer 7: Application Layer

          Using the Seven-Layer Model

    Objective 1.03   The TCP/IP Model

          The Link Layer

          The Internet Layer

          The Transport Layer

              Connection-oriented vs. Connectionless Communication

              Segments Within Packets and Datagrams Within Packets

          The Application Layer

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

2   Network Media

    Objective 2.01   Coaxial Cabling

          Coaxial Cable Types

          Coaxial Connectors

    Objective 2.02   Twisted-Pair Cabling

          UTP Cable Types

              Variations in Core Wires and Sheath Materials

          UTP Connectors

          UTP Wiring Standards

              T568A and T568B Wiring Standards

              Straight-through and Crossover Cables

              Rollover and Loopback

          Wiring Distribution

              Patch Panel

              Cross-connects, MDF, and IDF

          UTP Testing

    Objective 2.03   Optical Fiber

          Optical Fiber Connectors

          Uses for Fiber

          Implementing Multiple Types of Ethernet

    Objective 2.04   Wireless Media Types

          802.11 Wireless Networks

          Wireless Basics

              BSSID, SSID, and ESSID

              Wireless Standards

              Wireless Frequency Ranges

          Laser Links

          Bluetooth

          Infrared Wireless Networking

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

3   Network Topologies and Standards

    Objective 3.01   The Bus Topology and Ethernet

          Ethernet Overview

          How Ethernet Works

              CSMA/CD

              Collisions

              Termination

              Cable Breaks

              Broadcast

              Bonding

          Ethernet Standards

          Ethernet on the Bus

    Objective 3.02   The Star Bus Topology

          10BaseT and 100BaseT

          Gigabit Ethernet

              10/100/1000BaseT Summary

          10 Gigabit Ethernet (10 GbE)

    Objective 3.03   Ring Topologies

    Objective 3.04   Other Topologies

          Mesh Topology

          Point-to-point and Point-to-multipoint

              CSMA/CA

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

4   Network Hardware

    Objective 4.01   Network Interfaces

          MAC Address

          Organizing the Data: Ethernet Frames

              Preamble

              Destination and Source MAC Addresses

              Type

              Data

              Frame Check Sequence

    Objective 4.02   Repeaters, Hubs, and Bridges

    Objective 4.03   Switched Ethernet

          The Trouble with Hubs

          Switches to the Rescue

          Spanning Tree Protocol

    Objective 4.04   Connecting Ethernet Segments

          Uplink Ports

          Crossover Cables

    Objective 4.05   Routers

    Objective 4.06   Wireless Access Points

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

5   TCP/IP

    Objective 5.01   The TCP/IP Protocol Suite

          Application Protocols

              Port Numbers

              Sockets

              List of Application Protocols

              Compound Application Protocols

          Transport Protocols

              TCP

              UDP

          Internet Protocols

              Internet Protocol

              Internet Control Message Protocol (ICMP)

    Objective 5.02   IPv4 Addressing

          IP Addresses

          IP Addresses in Action

              Network IDs

              Interconnecting

              Subnet Mask

          Class IDs

          Private vs Public IP Addresses

              Need for Changes

    Objective 5.03   CIDR and Subnetting

          Subnetting

              Calculating Hosts

              Your First Subnet

              Calculating Subnets

    Objective 5.04   IPv6 Addressing

          IPv6 Addresses

          IPv6 Protocols

              ICMPv6

    Objective 5.05   Domain Name System

          DNS Records

          DHCP

              Living with DHCP

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

6   Routing

    Objective 6.01   Routing Tables

          Freedom from Layer 2

    Objective 6.02   Network Address Translation

          The Setup

          Port Address Translation

          Port Forwarding

          Configuring NAT

    Objective 6.03   Dynamic Routing

          Routing Metrics

          Distance Vector

              RIPv1

              RIPv2

              BGP

          Link State

              OSPF

              IS-IS

          EIGRP—The Lone Hybrid

          Dynamic Routing Makes the Internet

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

7   Virtualization

    Objective 7.01   Virtual LANs

          Trunking

          Configuring a VLAN-capable Switch

          VLAN Trunking Protocol

          InterVLAN Routing

    Objective 7.02   Virtual Computing

          Meet the Hypervisor

          Why Do We Virtualize?

              Power Saving

              Hardware Consolidation

              System Recovery

              System Duplication

              Research

    Objective 7.03   Virtualization in Modern Networks

          VMMs and Hypervisors

          Virtual Machine Managers

              VMware Workstation

              Virtual PC

              Parallels

              KVM

          Hypervisors

              ESX

              HyperV

          Virtual Switches

          Virtual PBX

          Network as a Service

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

8   Wide Area Networking

    Objective 8.01   Telephony and Beyond

          The Dawn of Long Distance

          Digital Telephony

              It All Starts with DS0

          Copper Carriers: T1 and T3

          Fiber Carriers: SONET/SDH and OC

          Packet Switching

              Frame Relay

              ATM

              MPLS

          Real-World WAN

          Alternative to Telephony WAN

    Objective 8.02   The Last Mile

          Dial-up

              Public Switched Telephone Network

              ISDN

          DSL

              SDSL

              ADSL

              VDSL

              DSL Features

              Installing DSL

          Cable Modems

          Satellite

          Cellular WAN

              Mobile Data Services

              802.16

              LTE

          Fiber

          BPL

          Which Connection?

              Going Connection Shopping

    Objective 8.03   Using Remote Access

          Dial-up to the Internet

          Private Dial-Up

          Dedicated Connection

              DSL and Cable

              Cable Issues

          Remote Terminal

              VoIP

              RTP

              SIP and H.323

              Skype

              Streaming Media with RSTP

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

9   Network Security

    Objective 9.01   Common Threats

          System Crash/Hardware Failure

          Administrative Access Control

          Malware

              Virus

              Worm

              Macro Virus

              Trojan

              Rootkit

              Adware/Spyware

              Dealing with Malware

              Antimalware Programs

          Social Engineering

              Phishing

          Man in the Middle

          Denial of Service

          Physical Intrusion

          Attacks on Wireless Connections

              Leeching

              Cracking Wireless Encryption

              Rogue Access Points

              Evil Twin

    Objective 9.02   Securing User Accounts

          Authentication

              Authentication Principles

              Authentication Protocols

          Authorization

          Logon and Access Security

              Implementing Share-Level Security

              Implementing User-Level Security

              Using Passwords

    Objective 9.03   Firewalls

          Hiding the IPs

          Port Filtering

          Packet Filtering

          MAC Filtering

          Personal Firewalls

          Network Zones

          Vulnerability Scanners

    Objective 9.04   Securing Remote Connections

          IPsec

          Virtual Private Networks

              PPTP VPNs

              L2TP VPNs

              SSL VPNs

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

10  The Complete Network

    Objective 10.01   Designing and Implementing a SOHO Network

          Define the Network Needs

          Network Design

          Compatibility Issues

          Internal Connections

          External Connections

          Peripherals

          Security

    Objective 10.02   Implementing a Wireless Network

          Installing the Access Point

              Set the Admin Password

              Change Wireless Settings

              Implement MAC Filtering

              Implement Encryption

              Upgrade the Antenna

              Security Concerns with Signaling

          Installing the Client

          Troubleshooting Wireless Networking

    Objective 10.03   Specialized Network Devices

    Objective 10.04   Network Configuration Management

          Configuration Management Documentation

              Network Connectivity

              Baselines

              Policies, Procedures, and Configurations

              Regulations

          Change Management Documentation

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

11  Troubleshooting Networks

    Objective 11.01   The Troubleshooting Process

          Identify the Problem

              Gather Information, Identify Symptoms, and Question Users

              Determine If Anything Has Changed

          Establish a Theory of Probable Cause

          Test the Theory to Determine Cause

          Establish a Plan of Action and Identify Potential Effects

          Implement and Test the Solution or Escalate as Necessary

          Verify Full System Functionality and Implement Preventative Measures

          Document Findings, Actions, and Outcomes

    Objective 11.02   Troubleshooting Network Hardware

          Power Issues

          Network Media

          Visual Indications of Problems

          Check the NIC

          Bad Modules

          Troubleshooting Other Physical Network Issues

              Issues That Need To Be Escalated

    Objective 11.03   Testing Equipment

          Multimeters

          Tone Locators and Toner Probes

          Cable Testers

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

12  Network Utilities and Optimization

    Objective 12.01   TCP/IP Utilities

          ipconfig and ifconfig

              ipconfig

              ifconfig

          tracert

          arp

          netstat

          nbtstat

          nslookup

          arping

          dig

          mtr

          route

    Objective 12.02   Troubleshooting Network Performance

          Protocol Analyzers

          Throughput Testers

          Network Performance Optimization

              Caching

              Controlling Data Throughput

          ISPs and MTUs

    Objective 12.03   Monitoring Networks

          Establishing a Baseline

          Performance Monitor

          Network Monitor

          Checking System Logs

          Logs and Network Traffic

          SNMP

          CHECKPOINT

          REVIEW QUESTIONS

          REVIEW ANSWERS

A   Career Flight Path

          CompTIA Server+ Certification

          CompTIA Security+ Certification

          Microsoft Certified Technology Specialist (MCTS) Certifications

          Cisco Certifications

B   About the Download

          System Requirements

          Installing and Running Total Tester

          About Total Tester

          Playing Mike’s Intro Video

          Mike’s Cool Tools

          Boson’s NetSim Network Simulator

          Technical Support

          Boson Technical Support

      Glossary

      Index

Check-In

May I See Your Passport?

What do you mean, you don’t have a passport? Why, it’s sitting right in your hands, even as you read! This book is your passport to a very special place. You’re about to begin a journey, my friend: a journey toward that magical place called certification! You don’t need a ticket, you don’t need a suitcase—just snuggle up and read this passport. It’s all you need to get there. Are you ready? Well then, let’s go!

Your Travel Agent: Mike Meyers

Hello! I’m Mike Meyers, president of Total Seminars and author of a number of popular certification books. On any given day, you’ll find me stringing network cable, setting up a website, or writing code. I love every aspect of this book you hold in your hands. It’s part of a powerful new book series called the Mike Meyers’ Certification Passports. Every book in this series combines easy readability with a condensed format—in other words, the kind of book I always wanted when I went for my own certifications. Putting a large amount of information in an accessible format is certainly a challenge, but I think we’ve achieved our goal, and I’m confident you’ll agree.

I designed this series to do one thing and only one thing: to get you the information you need to achieve your certification. You won’t find any fluff in here. I packed every page with nothing but the real nitty-gritty of the Network+ Certification exam. Every page has 100 percent pure concentrate of certification knowledge! But I didn’t forget to make the book readable, so I hope you also enjoy the casual, friendly style.

My personal e-mail address is mikem@totalsem.com. Please feel free to contact me directly if you have any questions, complaints, or compliments.

Your Destination: CompTIA Network+ Certification

This book is your passport to CompTIA’s Network+ Certification, the vendor-neutral industry-standard certification for basic networking skills. CompTIA Network+ Certification can be your ticket to a career in all-around networking or simply an excellent step in your certification pathway. This book is your passport to success on the CompTIA Network+ Certification exam.

Why the Travel Theme?

The steps in gaining a certification parallel closely the steps in planning and taking a trip. All of the elements are the same: preparation, an itinerary, a route, even mishaps along the way. Let me show you how it all works.

This book is divided into 12 chapters. Each chapter begins with an Itinerary section, which lists the objectives covered in that chapter, and an ETA section to give you an idea of the time involved in learning the skills in that chapter. Each chapter is organized by the objectives, which are either drawn from those officially stated by the certifying body or reflect our expert take on the best way to approach the topics. Also, each chapter contains a number of helpful items to highlight points of interest:

Exam Tip

Points out critical topics you’re likely to see on the actual exam.

Travel Assistance

Lists additional sources, such as books and websites, to give you more information.

Local Lingo

Describes special terms in detail in a way you can easily understand.

Travel Advisory

Warns you of common pitfalls, misconceptions, and downright physical peril!

The end of each chapter gives you two handy tools. The Checkpoint reviews each objective covered in the chapter with a handy synopsis—a great way to review quickly. End-of-chapter Review Questions (and answers) test your newly acquired skills.

But the fun doesn’t stop there! After you’ve read the book, take advantage of the free practice questions! (See Appendix B, “About the Download.”) Use the full practice exam to hone your skills, and keep the book handy to check your answers.

When you find yourself acing the practice questions, you’re ready to take the exam. Go get certified!

The End of the Trail

The IT industry changes and grows constantly, and so should you. Finishing one certification is only one step in an ongoing process of gaining more and more certifications to match your constantly changing and growing skills. Read Appendix A, “Career Flight Path,” at the end of the book, to find out where this certification fits into your personal certification goals. Remember, in the IT business, if you’re not moving forward, you’re way behind!

Good luck on your certification! Stay in touch!

Mike Meyers
Series Editor
Mike Meyers’ Certification Passport

Network Fundamentals

  ITINERARY  

      Objective 1.01   Overview of How Networks Work

      Objective 1.02   The OSI Seven-Layer Model

      Objective 1.03   The TCP/IP Model

When you link computers together to share files and communicate and do all the things we like to do, you create a network. Networks range in size from the smallest and simplest network—two computers connected together—to the largest and most complex network of all—the Internet.

This chapter begins with an overview of all the pieces that come together to make a computer network, including the hardware needed to make the physical connections. The chapter then dives into two network models techs use to discuss network components and functions.

Overview of How Networks Work

Networks come in many sizes and vary widely in the number of computers attached to them. Some people connect two computers in their house so that they can share files and play games together—the smallest network you can have. Compare this to companies that have thousands of employees in dozens of countries and need to network their computers together to get work done. Network folks put most networks into one of two categories: LANs and WANs. You’ll find a few other groupings as well.

A local area network (LAN) covers a small area and contains a modest number of computers (Figure 1.1). LANs are usually in a single building or group of nearby buildings. Typical LANs include home and school networks.

FIGURE 1.1   A local area network (LAN)

A wide area network (WAN) covers a large area and can have a substantial number of computers (Figure 1.2). Usually, a WAN is composed of two or more LANs connected together. All of the LANs in all of the schools in a city school district, for example, link together to form a WAN. Computers in a WAN usually connect through some type of public network, such as a telephone system, leased lines, or satellites. The largest WAN in existence is the Internet, which is a worldwide network that connects millions of computers and networks.

FIGURE 1.2   A wide area network (WAN)

An intranet, in contrast, is essentially a private TCP/IP network that is a scaled-down version of the Internet for a very specific group of users. Just like the Internet, an intranet will offer various network services, such as websites, FTP access, Voice over IP, and so on. The key difference is that it’s private rather than public.

Another similar term, extranet, is used to denote a private intranet that is also made accessible to a select group of outsiders using the Internet.

Here are a few other xANs in use in various networks:

    • A campus area network (CAN) is a group of interconnected LANs within a small geographical area, such as a school campus, university, hospital, or military base.

    • A metropolitan area network (MAN) is a group of networks with a sociopolitical boundary, such as a network of district authority offices in a town or city. MANs can range in size from a few city blocks to entire cities. Sites on a MAN are usually interconnected using fiber-optic cable or some other high-speed digital circuit, and the MAN itself may carry voice as well as data traffic.

    • A global area network (GAN) is a single network with connection points spread around the world. GANs are used mostly by large corporate organizations and consist of a series of networked, orbiting satellites. Note the subtle difference between a WAN and a GAN. The latter is a single network, not a number of interconnected networks.

Travel Advisory

The terms CAN and GAN don’t exist as official standards, but their use and definitions have become generally accepted over time. A MAN is an official standard of the Institute of Electronics and Electrical Engineers (IEEE) as the IEEE 802.6 standard.

Servers and Clients

People use two types of devices in networks these days: servers and clients. In a nutshell, servers share things—such as files, folders, and printers—and clients request access to those shared things. Let’s get one thing straight: Almost any personal computer can act as a server or a client or both! A lot of it has to do with how you set up the computer.

Computers running Windows, Macintosh, and the many varieties of Linux make up the vast majority of clients. You’ll also find other devices that are clients, though, such as the following examples:

    • Game consoles, like the Xbox 360

    • Smartphones and tablets, such as the iPad

    • DVRs, like TiVo and other set-top boxes

Server computers come in all shapes and sizes, but they serve—if you’ll pardon the pun—a similar purpose. Servers manage network resources (like printers and e-mail—all the stuff that makes a network valuable), provide central storage of files, and provide services for users (such as the printer server telling the printer to print, or the e-mail server sending your e-mail). See Figure 1.3.

FIGURE 1.3   A server sharing network resources

Client computers enable you to access the shared resources, programs, and services on server machines (Figure 1.4). Most users access servers via clients, although there’s no law that says you can’t access a server from another server machine. The latter machine, in that case, would be acting as a client regardless of the firepower of the box!

FIGURE 1.4   A client accessing network resources

Networks are traditionally classified into client/server and peer-to-peer designations, depending on the role played by each computer in the network. In a client/server network, one or more computer systems act as a server, while the remaining computers are clients that access resources from the server. On some home or small office networks, however, there may not be a separate server. Instead, every computer on the network acts as both a client and a server. Such networks are called peer-to-peer networks.

Exam Tip

The CompTIA Network+ exam uses the terms client/server topology and peer-to-peer topology to describe these two network arrangements. A topology more commonly refers to the way computers connect together rather than the roles they play on a network, but be prepared for the unusual use of the word on the exam. Chapter 3 covers the more commonly described network topologies.

Every operating system (OS) today can operate as a client, a server, or both, and many networks employ a mix. My network, for example, has a set of dedicated servers and each employee has one, two, or more computers in his or her office. Many of the office computers have shared folders, such as music or games, so they function as both clients and servers. This nice mishmash of machine roles creates a hybrid network.

Network Components

Whether you want to put together a LAN or connect a couple of LANs into a WAN, you need connectivity between the PCs and a way to handle communication. Computers connect to a network in one of two ways:

    • Directly to a LAN via a cable from the computer to a LAN port

    • Wirelessly to the LAN (this will be covered in Chapters 2 and 10)

A typical network client has a network adapter or network interface card (NIC) that connects to a cable that connects to a central network box, called a switch. Figure 1.5 shows a typical NIC.

FIGURE 1.5   A network interface card

Every NIC has a unique identifier called a media access control (MAC) address. I’ll go into more detail on these addresses in Chapter 4. For now, just know that a MAC address acts like a name for a computer on a LAN.

To make this into a nicely configured network, add another network client. Throw in a server. Don’t add water, but turn on network sharing, and voilà! You have a network. Each machine attaches to a network cable that then connects at the other end to the switch. Any device attached to a network—client, server, printer, or whatnot—is called a node.

Ethernet

You might be wondering how you can tell what sort of cable to use for this network and how to determine the type of switch required for a network. Networking means communicating; the computers need to be able to speak the same language and follow the same technology.

The Ethernet standard defines everything about modern network hardware. Ethernet cables have standard connectors, for example, such as the RJ-45 connectors shown in Figure 1.6. Ethernet defines electrical signaling as well. That way, the sending NIC will break data down into little pieces and the receiving NIC will know exactly how to put them back together.

FIGURE 1.6   RJ-45 connectors

If two machines do not have the same kind of networking technology—a common problem in the early days of computer networks—then they can’t network together. I won’t bore you with a list of all the networking technologies that have had a brief moment of glory and market share in the past. Suffice it to say that today, Ethernet is king of the LAN.

Most modern Ethernet networks employ one of three technologies (and sometimes all three), 10BaseT, 100BaseT, or 1000BaseT. As the numbers in the names suggest,10BaseT networks run at 10 Mbps,100BaseT networks—called Fast Ethernet—run at 100 Mbps, and 1000BaseT networks—called Gigabit Ethernet—run at 1000 Mbps, or 1 Gbps.

Each Ethernet technology requires a specific kind of cabling that can handle its top speed.100BaseT networks use Category 5 (CAT 5) or better Ethernet cables (Figure 1.7), while Gigabit Ethernet runs on Category 6 (CAT 6) or better Ethernet cables.

FIGURE 1.7   Category 5e (CAT 5e) cable

Hubs and Switches

Hubs and switches sit at the very center of networking, handling the tasks of receiving and sending packets of data to the connected computers. Each functions quite differently when it receives an Ethernet frame.

A hub repeats the frame down every network cable connected, hoping one of the computers connected is the recipient machine, such as Johan’s laptop, for example (Figure 1.8).

FIGURE 1.8   A hub repeating frames down every network cable

A switch, in contrast, learns the network address of every machine connected to it, reads the recipient address on the frames, and sends them along only on the appropriate connection (Figure 1.9).

FIGURE 1.9   A switch sending frames only to the recipient

The radically more efficient switches now have completely replaced the earlier hubs in the marketplace.

Software

Of course it takes both hardware and software to make network communication work well. If Johan’s computer requests an MP3 file from Michael’s computer, Michael’s operating system and other software take that MP3 file and break it into small, individually numbered units called packets. The NIC then takes the packets and, following the Ethernet standards, wraps up those packets into network frames that get sent out along the cable to the central network hub or switch (Figure 1.10).

FIGURE 1.10   Packets wrapped in frames sent along an Ethernet CAT 6 cable

All the machines on the network must use the same language—or protocol—for any sharing to happen. Over the years, various protocols have been developed, and you had to choose the protocol that worked best with a specific type of network or network needs. Today, that choice is easy because everybody uses Transmission Control Protocol/Internet Protocol (TCP/IP), the language of the Internet. Chapter 5 covers TCP/IP in depth, so I won’t go into the details here.

Applications

Finally, you need network-aware applications to accomplish things like accessing a shared file over a network. A commonly used network application is the web browser, such as Google Chrome, my personal favorite (Figure 1.11).

FIGURE 1.11   Chrome web browser

Connecting LANs

Enabling communication between two or more LANs requires several other pieces. First, you need a physical connection through cabling or radio waves. Second, you need special-purpose boxes to provide the intelligent direction so that data can properly flow either within a LAN (switches) or between the LANs (routers). Finally, devices need an address that goes beyond the LAN and applies WAN-wide. Today, that address is an IP address, because everyone uses TCP/IP to communicate. Chapter 5 covers IP addresses.

Travel Advisory

All nodes on a TCP/IP network have two addresses. The MAC address is the physical address of a computer on a LAN. The IP address enables communication across routers and thus between LANs as well as within a LAN.

The OSI Seven-Layer Model

The International Organization for Standardization (ISO) created a framework into which the major network hardware and software components and protocols could be placed to give every item a common reference point. This framework, called the Open Systems Interconnect (OSI) seven-layer model, provides a means of relating the components and their functions to each other and a way of standardizing some of the components and protocols.

Travel Advisory

The letters used for the International Organization for Standardization—ISO—don’t map to the initials in English, French, or Russian, the three official languages used by the body. Rumors abound that the word is derived from a Greek word that means equal, but those are just rumors.

The OSI model provides a critical common language that network hardware and software engineers can use to communicate and ensure that their equipment will function together. Each layer of the model represents a particular aspect of network function.

Exam Tip

The CompTIA Network+ exam expects you to know the layers by name (especially layers 1 through 4), how they function in relation to each other, and what they represent.

As well as helping to standardize the design elements of network components, the OSI model helps describe the relationships between network protocols. As you’ll see, more than one protocol or action is needed to get your data onto a network.

The Layers and What They Represent

Let’s run through the layers and an overview of their tasks and responsibilities. Figure 1.12 summarizes the layers and their functions.

FIGURE 1.12   The seven-layer OSI model

Layer 1: Physical Layer

Layer 1 of the OSI model, the Physical layer, defines the network standards relating to the electrical signals that travel the network cables, the connectors, and the media types (cables) themselves. The Physical layer also determines the way that data is placed on the network media.

For the CompTIA Network+ exam, you need to know examples of components that run at each layer of the OSI. Examples of network components that are considered the Physical layer are cabling and hubs (Figure 1.13).

FIGURE 1.13   Layer 1 components

Layer 2: Data Link Layer

Layer 2, the Data Link layer, defines the rules for gathering and completing all the elements that make up a data frame and putting the whole thing together so that it can be passed to a Physical-layer device and on to the network. The exact components of the frame will vary depending on the data-link protocol being used, but would typically include the data being sent, an identifier for the sending machine, an identifier for the receiving machine, and an error-correction mechanism such as a frame check sequence (FCS).

The Data Link layer on the sending machine assembles outgoing frames and calculates the FCS by applying a standard mathematical formula to the contents of the frame. The receiving machine performs the same calculation for incoming frames, enabling the receiving machine to verify the validity of the data by comparing its locally generated FCS value with that sent in the frame. If the values don’t match, the frame is discarded and requested again.

The Data Link layer also determines how data is placed on the wire by using an access method. The wired access method is carrier sense multiple access/collision detection (CSMA/CD), used by all wired Ethernet networks.

The Data Link layer is divided into two sublayers:

    • Logical Link Control (LLC) The LLC is the component layer responsible for error-correction and flow-control functions.

    • Media Access Control (MAC) The MAC is responsible for addressing network devices by using the physical address—that’s the MAC address that is burned into the ROM chip of each network card. This physical address is placed in the layer-2 header for the sending and receiving system.

Exam Tip

For the CompTIA Network+ exam, know that layer 2 is divided into two sublayers and is responsible for physical addressing. Any device, such as a switch, that works with a physical address runs at this layer.

Layer 3: Network Layer

Layer 3, the Network layer, is responsible for routing functions and logical addressing. The Network layer addresses identify not only a system, but also the network on which the system resides. The router uses this information to determine how to send data to the destination network. The IP address in a TCP/IP network is a layer-3 address; routers use this address to determine to which network and node to send a packet.

Exam Tip

Examples of layer-3 components are the IP protocol and a router. An IP address is considered a layer-3 address; a MAC address is a layer-2 address.

Layer 4: Transport Layer

If the data being sent is bigger than the packet size allowed by the lower-level protocols, layer 4, the Transport layer, breaks the data into smaller, manageable chunks that will fit inside two or more packets. Breaking up data into smaller chunks is known as fragmentation.

The Transport layer is also responsible for confirming whether transmitted packets have reached their destination intact and retransmitting them if they haven’t. For incoming packets, the Transport layer reassembles the fragmented data, ensuring that received packets are processed in the right order.

Exam Tip

Examples of layer-4 protocols are Transmission Control Protocol (TCP) and User Data Protocol (UDP), which are part of the TCP/IP protocol suite.

Layer 5: Session Layer

Layer 5, the Session layer, is responsible for the session setup. The Session layer also manages and terminates the data connections (called sessions) between programs on networked devices. These sessions enable networked systems to exchange information.

Layer 6: Presentation Layer

Layer 6, the Presentation layer, is responsible for managing and translating the information into an understandable format that the Application layer can process further. In fact, many “Application-layer” protocols function at the Presentation layer too, taking datagrams and segments and turning them into formats programs can use.

Layer 7: Application Layer

Layer 7, the Application layer, represents the network-related program code and functions running on a computer system that either initiate the request (on the sending system) or service the request (on the receiving system).

Note that the Application layer does not refer to applications such as Microsoft Outlook. Instead, it refers to the protocols on which those programs rely. For example, Post Office Protocol 3 (POP3) and Simple Mail Transfer Protocol (SMTP) are important Application-layer protocols for e-mail, but many different end-user applications use those protocols (such as Outlook and Mozilla Thunderbird).

Using the Seven-Layer Model

The seven-layer model is only a theoretical representation of how networks function. Although knowing it inside-out won’t change your life, it should help you pass the CompTIA Network+ exam. The conceptual use of the model assumes that an event on one computer system (for example, a user pressing ENTER on a login screen) creates some data that sets off a chain of events. The data runs down through the layers on the sending machine and then leaves the system, traveling across the network and then up through the layers on the receiving machine, until the data arrives intact at the Application layer and is processed by the receiving system. Later chapters in this book point out where certain key protocols and hardware fit into the model, and this can be useful stuff to know for both the CompTIA Network+ exam and real life.

The TCP/IP Model

The OSI model was developed as a reaction to a world of many different protocols made by different manufacturers that needed to play together. ISO created the OSI seven-layer model as the tool for manufacturers of networking equipment to find common ground between multiple protocols, enabling them to create standards for interoperability of networking software and hardware.

The adoption of TCP/IP as the sole protocol suite used in modern networks has rendered the OSI seven-layer model somewhat obsolete at the layers specific to TCP/IP. Many techs use a model specifically tailored to TCP/IP networks called, appropriately, the TCP/IP model.

Local Lingo

Internet model   A lot of techs and tech sites call the TCP/IP model the Internet model.

The TCP/IP model consists of four layers:

    • Link/Network Interface

    • Internet

    • Transport

    • Application

It’s important to appreciate that the TCP/IP model doesn’t have a standards body to define the layers. Because of this, there are a surprising number of variations on the TCP/IP model. Some even have it as five layers rather than four!

A great example of this lack of standardization is the Link layer. Without a standardizing body, we can’t even agree on the name. While “Link layer” is extremely common, the term “Network Interface layer” is equally popular. A good tech knows both of these terms and understands that they are interchangeable. Notice also that, unlike the OSI model, the TCP/IP model does not identify each layer with a number.

CompTIA has chosen one popular version of the TCP/IP model for the CompTIA Network+ competencies and exam. That’s the version you’ll learn right here. It’s concise, having only four layers, and many important companies, like Cisco and Microsoft, use it, although with a few variations in names as just described. The TCP/IP model gives each protocol in the TCP/IP protocol suite a clear home in one of the four layers.

The clarity of the TCP/IP model shows the flaws in the OSI model. The OSI model couldn’t perfectly describe all the TCP/IP protocols. The TCP/IP model fixes this ambiguity, at least for TCP/IP.

The Link Layer

The TCP/IP model lumps together the OSI model’s layer 1 and layer 2 into a single layer called the Link layer (or Network Interface layer).

A nice way to separate layers in the TCP/IP model is to think about packets and frames. Any part of the network that deals with complete frames is in the Link layer. The moment the frame information is stripped away from an IP packet, we move out of the Link layer and into the Internet layer.

Travel Advisory

At the Link layer, just about every network tech reverts back to the OSI model for troubleshooting. It’s important to distinguish between problems happening at the Physical layer, with cabling, for example, and problems that reflect the Data Link layer, with switches and MAC addresses. That’s why accomplished techs know both models!

The Internet Layer

The Internet layer should really be called the “IP packet” layer. Any device or protocol that deals with pure IP packets—getting an IP packet to its destination—sits in the Internet layer. IP addressing itself is also part of the Internet layer, as are routers and the magic they perform to get IP packets to the next router. IP packets are created at this layer.

The Transport Layer

The Transport layer combines features of the OSI Transport and Session layers with a dash of Application layer just for flavor. While the TCP/IP model is certainly involved with the assembly and disassembly of data, it also defines other functions, such as connection-oriented and connectionless communication.

Connection-oriented vs. Connectionless Communication

Some protocols, like the popular Post Office Protocol (POP) used for sending e-mail messages, require that the e-mail client and server verify that they have a good connection before a message is sent (Figure 1.14). This makes sense because you don’t want your e-mail message to be a corrupted mess when it arrives.

FIGURE 1.14   Connection between e-mail client and server

Alternatively, a number of TCP/IP protocols simply send data without first waiting to verify that the receiving system is ready (Figure 1.15). When using Voice over IP (VoIP), for example, the call is made without verifying first whether another device is there.

FIGURE 1.15   Connectionless communication

The connection-oriented protocol is called Transmission Control Protocol (TCP). The connectionless protocol is called User Datagram Protocol (UDP).

Travel Assistance

Chapter 5 covers TCP, UDP, and all sorts of other protocols in detail.

Everything you can do on the Internet, from web browsing to Skype phone calls to playing World of Warcraft, is predetermined to be either connection-oriented or connectionless.

Segments Within Packets and Datagrams Within Packets

To see the Transport layer in action, strip away the IP addresses from an IP packet. What’s left is a chunk of data in yet another container called a TCP segment or a UDP datagram.

TCP segments have many fields that ensure the data gets to its destination in good order. These fields have names such as Checksum, Flags, and Acknowledgement. Chapter 5 goes into more detail on TCP segments, but for now, just know that TCP segments have fields that ensure the connection-oriented communication works properly. Figure 1.16 shows a typical (although simplified) TCP segment.

FIGURE 1.16   TCP segment

Data comes from the Application-layer applications. The Transport layer breaks that data into chunks, adding port numbers and sequence numbers, creating the TCP segment. The Transport layer then hands the TCP segment to the Internet layer that, in turn, creates the IP packet, which encapsulates the segment.

UDP also gets data from the Application-layer programs and adds port and sequencing numbers to create a container called a UDP datagram. A UDP datagram lacks most of the extra fields found in TCP segments, simply because UDP doesn’t care if the receiving computer gets its data. Figure 1.17 shows a UDP datagram.

FIGURE 1.17   UDP datagram

Just like with TCP segments, when the Transport layer hands the UDP datagram to the Internet layer, it in turn creates the IP packet, which encapsulates the datagram.

The Application Layer

The TCP/IP Application layer combines features of the top three layers of the OSI model (Figure 1.18). Every application, especially connection-oriented applications, must know how to initiate, control, and disconnect from a remote system. No single method exists for doing this. Each TCP/IP application uses its own method.

FIGURE 1.18   TCP/IP Application layer compared to OSI layers 5–7

TCP/IP uses a unique port-numbering system that gives each application a unique number between 1 and 65,535. Some of these port numbers are very well known. The protocol that makes webpages work, HTTP, uses port 80, for example.

Although we can say that the OSI model’s Presentation layer fits inside the TCP/IP model’s Application layer, no application requires any particular form of presentation as seen in the OSI model. Standard formats are part and parcel with TCP/IP protocols. For example, all e-mail messages use an extremely strict format called Multipurpose Internet Mail Extension (MIME). All e-mail servers and clients read MIME without exception.

In the OSI model, we describe the Application Programming Interface (API)—the smarts that make applications network aware—as being part of the Application layer. While this is still true for the TCP/IP model, all applications designed for TCP/IP are, by definition, network aware. There is no such thing as a “TCP/IP word processor” or a “TCP/IP image editor” that requires the added ability to know how to talk to a network—all TCP/IP applications can talk to the network, as long as they are part of a network. That’s because they work directly with the APIs at the Application layer to send and receive data.

 Objective 1.01: Overview of How Networks Work   The most obvious pieces of network hardware are the computers on the network. These are divided into client and server systems unless they are desktop systems that are sharing resources, in which case they are known as peer-to-peer systems. Corporate networks generally use dedicated servers because they offer higher performance, greater stability, and better security than peer-to-peer options. Your network won’t be complete without some media—such as copper wiring, fiber optics, wireless, or infrared—to interconnect your systems, as well as a network interface card (NIC) to connect your system to the media. Other devices on the network—such as switches and routers—enable you to expand the system locally or to other sites.

 Objective 1.02: The OSI Seven-Layer Model   The OSI seven-layer model describes how data flows from one networked system to another—it’s a theoretical model into which many of the standards, components, and functions of a network fit. The model promotes the use of recognized network standards and helps ensure compatibility between network hardware and software from different manufacturers.

 Objective 1.03: The TCP/IP Model   The TCP/IP model describes how data flows from one networked system to another, specifically for TCP/IP networks. Every TCP/IP protocol and application fits into one of the four layers in the model, making the TCP/IP model ideal for troubleshooting modern networks.

REVIEW QUESTIONS

    1.  What name is given to a network in which computers act as both clients and servers?

          A.  A multitasking network

          B.  A mainframe network

          C.  A peer-to-peer network

          D.  A LAN network

    2.  What standard defines the hardware technology of modern LANs?

          A.  ARPANET

          B.  Ethernet

          C.  OSI

          D.  TCP/IP

    3.  Which device is being used if frames are repeated down every attached Ethernet cable?

          A.  Modem

          B.  Switch

          C.  Frame

          D.  Hub

    4.  What device enables LANs to connect and direct packets to the correct LAN?

          A.  Hub

          B.  Frame

          C.  Router

          D.  Switch

    5.  A protocol operating at which layer of the OSI model is responsible for logical addressing and routing?

          A.  Transport

          B.  Network

          C.  Session

          D.  Application

    6.  A protocol operating at which layer of the OSI model handles the formatting of data so upper or lower layers can work with them further?

          A.  Application

          B.  Presentation

          C.  Session

          D.  Transport

    7.  Layer 3 is the __________ layer of the OSI model.

          A.  Session

          B.  Application

          C.  Data Link

          D.  Network

    8.  At which layer of the TCP/IP model are UDP datagrams created?

          A.  Link/Network Interface

          B.  Internet

          C.  Transport

          D.  Application

    9.  Which type of communication requires the client and server to acknowledge the transmission?

          A.  ACK request

          B.  Connectionless

          C.  Connection-oriented

          D.  Session

    10.  At which layer of the TCP/IP model do cables fit?

          A.  Link/Network Interface

          B.  Internet

          C.  Transport

          D.  Application

REVIEW ANSWERS

    1.  C  A network with computers acting as both clients and servers is a peer-to-peer network.

    2.  B  Ethernet is the standard.

    3.  D  A hub repeats frames down every attached network cable.

    4.  C  A router connects LANs and directs packets to the correct LAN.

    5.  B  A protocol operating at the Network layer provides addressing and routing functions.

    6.  B  A protocol operating at the Presentation layer handles the formatting of data (among other functions).

    7.  D  Layer 3 of the OSI model is the Network layer.

    8.  C  Data is divided into chunks at the Transport layer and then bundled into UDP datagrams or TCP segments, depending on which protocol is used.

    9.  C  Connection-oriented communication requires the client and server to acknowledge the transmission.

    10.  A  Cabling is in the Link/Network Interface layer of the TCP/IP model.

Network Media

  ITINERARY  

      Objective 2.01   Coaxial Cabling

      Objective 2.02   Twisted-Pair Cabling

      Objective 2.03   Optical Fiber

      Objective 2.04   Wireless Media Types

Techs use the term network media rather than cabling because some parts of a network’s data highway can be made up of materials other than physical cable. A laser or microwave link might connect local area networks (LANs) in two buildings, for example, or a wireless device might connect laptops to your main network. Inside the building, you’ll find connectors, adapters, wall ports, and other such parts.

Local Lingo

bounded media   Physical network cabling (copper and fiber).

unbounded media   Microwave, wireless, infrared, and satellite network links.

As you might imagine, a number of different network media types are available. Some are faster than others, some will work over relatively long distances, and some don’t require a physical connection to the main network. This chapter covers all the major media types and their characteristics, uses, and key features.

Exam Tip

Network media and connectors and the electrical signals traveling over them are represented by standards at layer 1 (the Physical layer) of the OSI seven-layer model.

Coaxial Cabling

Coaxial cable is used to bring the signal down from a rooftop antenna to a TV set or radio receiver—or, in this case, to link together networked devices. “Coax” is the granddaddy of all mainstream network media types and is very much associated with the original designs of the popular Ethernet networking standard, developed in 1973, although today you’ll only see it used with broadband Internet solutions.

Travel Advisory

Baseband vs. Broadband   The coaxial cable used in early Ethernet networks carried only a single digital signal, thus baseband. The coaxial cable used for cable Internet and television, in contrast, carries many analog signals at once, thus broadband.

Coaxial cable has a central conducting core surrounded by a protective, insulating layer; an outer metal screen made of a woven copper mesh; a metal-covered plastic or foil (or both); and an overall insulating jacket (see Figure 2.1). The metal screen helps shield the data traveling down the central core from being corrupted by external signals, such as radio waves, and other sources of electromagnetic interference (EMI), such as high-current power cables, mobile phones, electric motors, fluorescent tubes, and local electrical storms. The screen also reduces the amount of data signals that can radiate from the cable to become another source of EMI and thus cause problems for other data cables and systems. The cable is referred to as coaxial (or simply coax) because both the center wire and the braided metal shield share a common axis, or centerline.

FIGURE 2.1   Coaxial (coax) cable

Coax is considered old technology and isn’t used these days for new LANs, except for in fairly specialized settings such as elevator shafts. Coax will crop up when connecting a LAN to an Internet connection provided by your local cable company, as high-speed Internet through the cable lines has become a popular broadband solution.

Exam Tip

Coax is often preferred when connections need to run through elevator shafts because it’s resistant to radio noise and is much cheaper than fiber (discussed later in this chapter.)

Coaxial Cable Types

A mind-boggling number of different types of coax are available, each one suitable for a specific purpose, such as audio, video, TV, satellite, cable, radio, and data. Each coax type has its own characteristics, closely matched to the type of signal that cable is designed to carry. These coax types are called radio-grade (RG). Table 2.1 shows the RG baseband coax types used for data networking.

The nominal impedance, a measure of the wire’s resistance that shows how much the cable impedes or resists the flow of electric current, is one of the factors that determines the RG type. As you can see, the nominal impedance of cable TV coax is different from that of Ethernet coax. This difference is the main reason why the cable types should not be used in conjunction with the wrong technology. The differences between Thick and Thin Ethernet are explained in the next chapter.

Coaxial Connectors

Coaxial cables have used many types of connectors over the years. Ancient Ethernet networks used a thin cable with a bayonet-style connector called a BNC connector (Figure 2.2).

FIGURE 2.2   Coaxial cable fitted with BNC connectors

The BNC refers to both the connection mechanism and the creators—Bayonet Neill-Concelman. You’ll still find these connectors, but only as potential answers on CompTIA Network+ exams. Modern coaxial cables use screw-on F connectors (Figure 2.3)

FIGURE 2.3   Coaxial cable with the common F connectors

Twisted-Pair Cabling

Many modern networks use a telephone-type cable known as unshielded twisted-pair (UTP). UTP network cables, as shown in Figure 2.4, have four pairs of twisted wires. The twists in the cable pairs reduce crosstalk and also act as a partial shield. As you might have guessed from the name, UTP has no overall metal screen—just the cable pairs inside the covering. UTP cable is popular because it is relatively cheap and simple to install. Better still, the same wiring infrastructure can be used for data and voice/telephony. That means when you install UTP cable as part of a building’s infrastructure, the same cabling system can be used for many of the building’s services, such as computer networks, security systems, telephones, and so on.

FIGURE 2.4   Four-pair UTP cable

Local Lingo

crosstalk   An unwanted interaction, or interference, between two electrical signals.

Although UTP cable provides a low-cost solution, it supports some fairly high-tech, high-spec, high-price kits to create very sophisticated, high-performance networks.

Shielded twisted-pair (STP) cable has a screen covering the wire pairs and a ground wire running the length of the cable. STP is intended for use in electrically noisy environments. In most cases, routing network cabling away from interference is cheaper than installing shielded cabling.

UTP Cable Types

UTP comes in a variety of grades, called categories, numbered Category 1 through Category 6a, as summarized in Table 2.2. These categories define the maximum supported data speed of the cable, and they have been developed over the years to cater to faster and faster network designs.

It might have caught your eye in Table 2.2 that UTP cable is used for Ethernet networks, but a few paragraphs ago, you learned about Ethernet and coax cable. Well, UTP is the way forward, and Ethernet was one of the first networking standards to be reengineered to work on this media type. In addition, most new cabling installations will use Category 6 (CAT 6) or Category 6a cabling because they support all current (and planned) data speeds and standards. The category level of a piece of cable will normally be written on the cable itself, as shown in Figure 2.4, or on the box, as shown in Figure 2.5.

FIGURE 2.5   Category 5e UTP cabling

All cable accessories, such as the wall- or pillar-mounted data ports, must also match the category of the cable being used. Mixing CAT 5 cable with CAT 3 wall sockets, for example, could cause that part of the network (known as a segment) not to work properly. The post-installation network testing should pick up this type of mismatch, but it is better to get things right the first time rather than find out later you need to replace all your data outlets!

Exam Tip

For the exam, be sure to know the UTP category cable types and their associated transfer rates.

Variations in Core Wires and Sheath Materials

UTP varies in both the construction of the internal copper cores and in the material of the protective sheath on the outside of the cable. You need to use the proper variety of cable in a specific area of a building.

Most UTP cables have core strands that are single copper wires. These are called solid-core cables. A typical eight-wire UTP cable would have eight copper wires inside a protective sheath. You would most definitely want the strength of solid-core cables when pulling cable through building walls or between floors.

In specific spaces where cables need to make a lot of tight turns, you would use a type of UTP with the conductive core of each wire made from fine strands of copper. This type of cable is called stranded-core or just stranded. Many folks use stranded cables to connect computers to wall plates. (See also “Patch Panel” later in this chapter for the most common use of stranded cabling.) Figure 2.6 shows solid- and stranded-core cables.

FIGURE 2.6   Solid- and stranded-core UTP cables

The sheaths on UTP cabling come in two varieties, called riser and plenum. Riser cable typically has a sturdy sheath made of polyvinyl chloride (PVC) that’s great for protecting the internal wires, but bad if it burns. The PVC gives off toxic fumes. You use riser cable in spaces in buildings where there’s not a lot of air flow, such as trunking shafts between floors. The typical computer-to-wall plate cable is riser grade.

Other spaces in buildings, such as between a drop ceiling and the true ceiling, are designed to facilitate air flow. That’s where air conditioning and heating returns typically run. This space is called the plenum. The sheath on plenum cable is made of some low-fume material, such as a fluorinated ethylene polymer (FEP), to reduce the risk of smoking out the people in the event of a fire. The sheath is often reinforced as well to facilitate pulling across long stretches. The box pictured in Figure 2.5 has “Riser” clearly marked.

Local Lingo

plenum   A fancy name for the gap between the real ceiling (or the bottom of the next floor up, if you want) and the suspended tiles.

UTP Connectors

UTP network cabling uses an eight-pin contact connector type known as an RJ45, as shown in Figure 2.7 (the RJ stands for registered jack). While network cables use an eight-pin connector, note that the telephone cable uses a four-pin connector known as the RJ11 connector.

FIGURE 2.7   An RJ45 connector

Local Lingo

8P8C   Technically, the term RJ45 defines the wiring scheme and the mechanical interface of the plug. What almost every tech in the world calls an RJ45 is officially known as an 8P8C connector, for eight positions and eight contacts. So now you know.

Many UTP networking standards use only two of the four UTP cable pairs, but the best practice is always to connect all four pairs at every network connector for compatibility with other, and future, standards. That way, the wiring does not have to change when you switch to a newer networking standard that uses all four pairs of wires, such as Gigabit Ethernet.

Travel Assistance

Chapter 3 gives you the scoop on the various Ethernet standards.

UTP Wiring Standards

It probably won’t come as a surprise to know that UTP connectors and wiring have associated color codes and wiring schemes. Each wire inside a UTP cable must connect to the proper pin on the connector at each end of the cable. The wires are color coded to assist in properly matching the ends; each pair of wires has a solid-colored wire and a striped wire: blue/blue-white, orange/orangewhite, brown/brown-white, and green/green-white. Industry organizations, such as the Telecommunications Industry Association (TIA) and the Electronic Industries Alliance (EIA), have developed a variety of standard color codes to facilitate installation.

T568A and T568B Wiring Standards

Two major wiring standards, T568A and T568B, determine the order of the wires placed in the RJ45 connector. Using an established color-code scheme ensures that the wires match up correctly at each end of the cable. This consistency makes troubleshooting and repair easier.

Local Lingo

TIA/EIA   Most techs refer to the two popular wiring standards either without the preceding letter, such as 568B, or with the full initials of the two groups who created the standards, such as TIA/EIA568A. The CompTIA Network+ competencies use the form in this book, with just the T.

The T568A wiring standard has the wires in the order white/green, green, white/orange, blue, white/blue, orange, white/brown, and finally brown. The most common wiring standard in use today is known as the T568B standard and has the wires in the order shown in Figure 2.8.

FIGURE 2.8   The T568B wiring standard

Straight-through and Crossover Cables

When crimping a UTP cable, you can create two types of cables—a straight-through cable or a crossover cable. The typical straight-through cable for CAT 5/5e, for example, uses only four wires—wires 1, 2, 3, and 6. With a straight-through cable, pin 1 of the RJ45 connector on one end follows the wire to pin 1 on the other end, and as a result, pin 1 on both ends of the wire are connected.

This straight-through cable works great when connecting a workstation to a switch because the network card on the computer uses pins 1 and 2 as the transmit pins, while pins 3 and 6 are the receive pins. On the switch, pins 1 and 2 are the receive pins, while pins 3 and 6 are the transmit pins. When using the straight-through cable, the transmit pins of the workstation will connect to the receive pins on the switch (via the straight-through cable), allowing data to be sent. Likewise, the receive pins on the workstation are connected to the transmit pins on the switch via the straight-through cable, allowing the workstation to receive data.

If you try to connect two computers directly (NIC-to-NIC) with a straight-through cable, the systems will not be able to communicate because the transmit pins (pins 1 and 2) on one system will be connected to the transmit pins on the second system, so neither system can receive data.

The transmit pins have to be connected to the receive pins at the other end, which is what the crossover cable creates. With a crossover cable, wires 1 and 2 (transmit) from one end of the cable are switched to the receive wire placeholders (wires 3 and 6) at the other end of the cable (shown in Figure 2.9).

FIGURE 2.9   A crossover cable connecting two computers

When you use a crossover cable to connect two computers directly, the crossover cable will connect the transmit pins on one computer to the receive pins on the second computer using wires 1 and 2 in the cable.

Exam Tip

For the exam, know the order of wires in the T568A and T568B standards and also know which wires are switched in a crossover cable.

Rollover and Loopback

In the networking world, you will come across a number of other cable types, including rollover cables and loopback cables.

    • Rollover cable   Also known as the console cable, it’s used to connect the administrator’s system to the console port of a Cisco router or switch. The administrator connects the console cable to his or her Universal Serial Bus (USB) port through an adapter and then to the console port of the switch or router to administer the device and change its configuration. They call this a rollover cable because the wires are rolled over from one end to the other—wire 1 on one end becomes wire 8 on the other end.

    • Loopback cable   This special cable is used for self-diagnostics and typically has the wires connecting the transmit pins to the receive pins on the same system, keeping the communication local. This cable type is used only as a testing tool and is not used for network communication.

Wiring Distribution

This section outlines different cabling components and terms you will need to know for the CompTIA Network+ exam, including the patch panel and wiring distribution.

Patch Panel

Most companies have network jacks located in the walls that allow systems to connect to the network. The network jacks are connected to cables that are routed a long distance to a patch panel in a server room (Figure 2.10).

FIGURE 2.10   Typical patch panel in server room

The patch panel has a patch cable that connects to the front of the patch panel and a port on a switch. When a computer connects to the network jack in the wall, the patch cable is used to map that system to the port on the switch. The concept of the patch panel allows ease of administration and flexibility in moving systems from one switch to another without visiting the workstation.

Exam Tip

Cables are typically connected from the wall jack to the patch panel by a punch-down tool. A couple of standards deal with wiring patch panels: 66 block is used for wiring the telephone system, while 110 block is used to wire the patch panel for CAT 5/6 UTP cable.

Cross-connects, MDF, and IDF

Connections from the outside world—whether network or telephone—come into a building at a location called a demarc, short for demarcation point. Demarc refers to the physical location of the connection and marks the dividing line of responsibility for the functioning of the network. You take care of the internal functioning; the person or company that supplies the upstream service to you must support connectivity and function on the far side of the demarc.

In a private home, the digital subscriber line (DSL) or cable modem supplied by your Internet service provider (ISP) is a network interface unit (NIU) that serves as a demarc between your home network and your ISP (Figure 2.11). Most homes have a network interface box in addition that provides the connection for your telephone.

FIGURE 2.11   Typical home network interface box

In an office environment, the demarc is usually more complex, given that a typical building simply has to serve a much larger number of telephones and computers. Figure 2.12 shows the demarc for a midsized building, showing both Internet and telephone connections coming in from the outside.

FIGURE 2.12   Typical office demarc

One challenge to companies that supply ISP/telephone services is the need to diagnose faults in the system. Most of today’s NIUs come with extra “smarts” that enable the ISP or telephone company to determine if the customer has disconnected from the NIU. These special (and very common) NIUs are known as smart jacks. Smart jacks also have the very handy capability to set up a remote loopback—critical for loopback testing when you’re at one end of the connection and the other connection is blocks or even miles away.

After the demarc, network and telephone cables connect to some type of box, owned by the customer, that acts as the primary distribution tool for the building. Any cabling that runs from the NIU to whatever box being used by the customer is the demarc extension. For telephones, the cabling might connect to a special box called a multiplexer and, on the LAN side, almost certainly to a powerful switch. This switch usually connects to a patch panel. This patch panel, in turn, leads to every telecommunications room in the building. This main patch panel is called a vertical cross-connect.

The combination of demarc, telephone cross-connects, and LAN cross-connects needs a place to live in a building. The room that stores all of this equipment is known as a main distribution frame (MDF) to distinguish it from the multiple intermediate distribution frame (IDF) rooms (aka telecommunications rooms) that serve individual floors. Workstations connect to the patch panels at the IDFs through cabling runs called horizontal cabling. The patch panel where the horizontal cabling connects is called a horizontal cross-connect (HCC). The IDFs connect to the MDF with cables called vertical cross-connect (VCC) cables.

Typically, the MDF connects to the cable coming from outside the building. Then a separate IDF panel may be used to represent each floor in the building, with the workstations on a particular floor connecting to the panel associated with that floor.

UTP Testing

Because UTP cable doesn’t have shielding, it is much more susceptible to EMI and crosstalk than coax cabling. As a result of this vulnerability, the installation of UTP cabling must meet specific requirements. Just like coax, for example, UTP should not be routed near light fixtures in the plenum, run parallel to heavy power cables, or get run over and squashed on a regular basis by your office chair! With UTP cables, the way the wires are attached to the wall plates and the number of sharp bends in a horizontal run can adversely affect performance.

Professional installers will test every single run (segment) of UTP cabling to satisfy themselves, and their customers, that the job has been done right using a special testing kit that measures the overall length of each segment, checks various electrical characteristics, and detects possible crosstalk (with fancy names such as “near-end crosstalk” and “far-end crosstalk”) between the wire pairs. Cable segments that fail to meet the required specs may not work properly at the intended (or future) data speeds and may have to be rejoined to the wall plates or, a worse case, be rerouted or replaced. Once everything has been sorted out, the printed test results are often presented to the customer as part of the network installation completion sign-off process.

Exam Tip

Two types of crosstalk are near-end crosstalk (NEXT) and far-end crosstalk (FEXT). NEXT occurs when a signal causes interference with a signal on an adjacent wire heading in the same direction, while FEXT occurs when a signal causes interference on an adjacent signal heading in the opposite direction.

Optical Fiber

Optical fiber is relatively expensive to purchase and install because it requires specialized handling and connection techniques. For this reason alone, fiber is not usually installed for desktop network connections unless a special need exists, such as locations with high levels of electromagnetic interference. In general, fiber will be used where one or more of the following apply:

    • Long distances need to be covered, up to the maximum segment distance of 40 km.

    • A link is needed between buildings, and other options, such as microwave and laser, are impractical (no line of sight, for example), too expensive, or electrically unworkable.

    • High speeds are required (initially, 1000 Mbps Ethernet required fiber-optic cabling, but “Gigabit over copper” is readily available today).

    • Security is a concern. Optical fibers don’t radiate signals that can be picked up by listening equipment, and it is difficult to tap a fiber without being detected.

    • The general environment is electrically unfriendly to data—that is, full of EMI, such as in a factory or in a radio/TV/radar transmitter room.

    • Any potential for an electrical spark must be eliminated, such as in a laboratory using flammable gases and other volatile chemicals.

Data can be sent down an optical fiber cable as either infrared or laser light, according to the system in use and the maximum distances involved. Each type of system requires a specific type of media; infrared LED systems use multimode fiber (MMF), whereas laser-diode-based systems (mainly used for high-speed, long-haul data and telecom links) use single-mode fiber (SMF) cable.

Travel Advisory

Infrared and laser diode light sources can cause eye damage if you stare at them directly, so never look down a fiber cable to see if it’s working. Professional testing kits use optical sensors and/or cameras. If you don’t have the proper equipment available, test for faults by replacing suspect fiber leads with known good ones.

An optical fiber cable has three components: the fiber itself; the cladding, which actually makes the light reflect down the fiber; and the insulating jacket. Fiber cabling is specified by its mode of operation and a two-number designator representing the core and cladding diameter in microns (μm, or millionths of a meter). The most common size used for general networking is multimode 62.5/ 125 μm, which can be used for cable runs of up to 275 meters. Almost all fiber networking standards require two fibers, and a pair is often connected together as duplex optical fiber cabling (Figure 2.13). Longer cable runs are possible with other types of fiber-optic cabling (up to 80 km as of this writing, though not through an IEEE 802.3 standard).

FIGURE 2.13   Duplex optical fiber cabling

As alluded to earlier, two types of fiber-optic cables are available:

    • Single-mode fiber   Uses a single ray of light, known as a mode, to carry the transmission over long distances (over 40+ km).

    • Multimode fiber   Uses multiple rays of light (modes) simultaneously, with each ray of light running at a different reflection angle to carry the transmission over short distances (under 2 km). MMF is cheaper than SMF and is typically used within the building due to the short distances that are required.

Exam Tip

Remember that SMF is used to reach long distances while MMF transmits over shorter distances.

Optical Fiber Connectors

Because they are optical rather than electrical, fiber cables have their own series of connector types. You cannot, for example, whack a BNC connector onto a piece of fiber (well, you probably could, but it won’t impress anyone!).

The two most common types of fiber-optic connectors are the ST (stick and twist) and SC (stick and click) types (see Figure 2.14). ST connectors do look a bit BNC-ish, but be careful, because unlike a BNC connector, which can be impaled on its socket and twisted with total abandon until the locking guides engage with the fixing lugs, ST connectors have a keying mechanism to stop just this kind of youthful exuberance. If you do get carried away, you can snap the ceramic connector body—so easy does it!

FIGURE 2.14   ST and SC fiber connectors

You’ll also find other fiber connectors, such as the fiber local connector (LC) and mechanical-transfer registered jack (MT-RJ). These connectors are similar to other connector types, such as the RJ and fiber SC shape. The fiber LC is the preferred connector of the two for communications exceeding 1 Gbps due to its small form factor.

Uses for Fiber

Although science programs often delight in telling you how many times a second the entire works of Shakespeare can be transmitted down a single fiber across a transatlantic phone link, that’s not the primary use for fiber cable. Most of the fiber you are likely to encounter provides interlocation links on Ethernet-based networks. Table 2.3 gives descriptions and speeds for some of the fiber-optic standards.

Implementing Multiple Types of Ethernet

Because Ethernet packets don’t vary among the many flavors of Ethernet, network hardware manufacturers have long built devices capable of supporting more than one flavor right out of the box. Ancient hubs supported 10Base2 and 10BaseT at the same time, for example.

You can also use dedicated media converters to connect any type of Ethernet cabling together. Most media converters are plain-looking boxes with a port or dongle on either side. They come in all flavors:

    • Single-mode fiber (SMF) to UTP/STP

    • Multimode fiber (MMF) to UTP/STP

    • Fiber to coaxial

    • SMF to MMF

Exam Tip

The CompTIA Network+ exam competencies erroneously describe some media converters as single-mode fiber to Ethernet and multimode fiber to Ethernet. It’s all Ethernet! Don’t be surprised if you get one of those terms on the exam, however. Now you’ll know what they mean.

The Gigabit Ethernet folks created a standard for modular ports called a gigabit interface converter (GBIC). With many Gigabit Ethernet switches and other hardware, you can simply pull out a GBIC module that supports one flavor of Gigabit Ethernet and plug in another. You can replace an RJ-45 port GBIC, for example, with an SC GBIC, and it’ll work just fine. Electronically, the switch or other gigabit device is just that—Gigabit Ethernet—so the physical connections don’t matter. Ingenious!

The small form-factor pluggable (SFP)—also known as a mini-GBIC—and the SFP+ transceivers work in a similar fashion as GBICs and include connectors for the 10 Gigabit standards, among others. SFPs are smaller than GBICs so manufacturers can pack more slots onto a networking device, and they’re backed by many different manufacturers.

Wireless Media Types

There have been multiple wired and wireless ways to connect computers into networks over the years, and more continue to be created all the time. The vast majority of networks use UTP cabling, with fiber to interconnect LANs and wide area networks (WANs). The CompTIA Network+ exam even expects you to know that you can link two computers together directly using a cable that plugs into a serial port with its DB-9 or RS-232 connector, something we haven’t used for decades because the serial connection supports only 150 KB per second transfer rates.

Wireless connections began rolling out a few years ago and arguably are the hottest growth area in networking. This final section looks at 802.11-based networks, Bluetooth, lasers, and infrared technologies.

802.11 Wireless Networks

The Institute of Electrical and Electronics Engineers (IEEE) 802.11 committee supports four standards for wireless networking: 802.11a, 802.11b, 802.11g, and 802.11n. Each of these wireless standards uses radio links to provide network connectivity to PCs and laptop computers through a transmitter/receiver unit (transceiver), generally known as an access point (AP) or wireless access point (WAP), which transmits and receives signals to and from the wireless network adapters (Figure 2.15). By installing a number of strategically placed transceivers, coverage over a wide area of floor space can be achieved.

FIGURE 2.15   Wireless network equipment for the office

Wireless Basics

Before we get into the wireless networking details, let’s take a look at the different methods to carry radio frequency (RF) traffic that are used on a wireless network:

    • Direct Sequence Spread Spectrum (DSSS)   DSSS is a modulation technique that transfers data using the full bandwidth of a frequency. 802.11b wireless networks use DSSS. (More on the 802.11 standards in a bit.)

    • Frequency Hopping Spread Spectrum (FHSS)   As the name implies, with frequency hopping, FHSS transmits radio signals by switching frequencies at a high rate. The benefit of FHSS is that it is harder for someone to tap into the data as the frequency continues to change.

    • Orthogonal Frequency-Division Multiplexing (OFDM)   With OFDM, the data is delivered by being spread across multiple parallel channels. This helps overcome some of the inherent problems in Wi-Fi networking, such as signal bounce. 802.11g and 802.11n wireless networks use OFDM transmission.

Travel Advisory

See Chapter 10 for a discussion of bounce problems.

802.11 networks can operate in one of two modes: ad hoc or infrastructure. In an ad hoc mode network, the wireless nodes communicate directly with each other; you don’t need a WAP for two hosts to communicate. Although this might be handy for transferring files between two laptops in the train station, ad hoc 802.11 networking doesn’t help you connect to your corporate network or the Internet.

To connect to an existing wired network, you need to use infrastructure mode, which uses a WAP device. The WAP is connected to the wired network and sends data between the wireless clients and systems on the wired network.

A single WAP servicing a given area is called a Basic Service Set (BSS). This service area can be extended by adding more access points. This is called, appropriately, an Extended Service Set (ESS).

BSSID, SSID, and ESSID

Wireless devices connected together into a network, whether ad hoc or infrastructure, require some way to identify that network. Frames bound for computers within the network need to go where they’re supposed to go, even when you have more than one Wi-Fi network overlapping. The jargon gets a little crazy here, especially because marketing has come into the mix.

The Basic Service Set Identifier (BSSID) defines the most basic infrastructure mode network—a BSS of one WAP and one or more wireless nodes. With such a simple network, the Wi-Fi folks didn’t see any reason to create some new numbering or naming scheme, so they made the BSSID the same as the Media Access Control (MAC) address for the WAP. Simple! Ah, but what do you do about ad hoc networks that don’t have a WAP? The nodes that connect in an ad hoc network randomly generate a 48-bit string of numbers that looks and functions just like a MAC address, and that BSSID goes in every frame.

You could, if required, discover the MAC address for the WAP in a BSS and manually type that into the network name field when setting up a wireless computer. But that causes two problems. First, people don’t want to remember strings of 48 digits, even if translated out as six hexadecimal octets, like A9–45–F2–3E–CA–12. People want names. Second, how do you connect two or more computers together into an IBSS when the BSSID has to be randomly generated?

The Wi-Fi folks created another level of naming called a Service Set Identifier (SSID), a standard name applied to the BSS or IBSS to help the connection happen. The SSID—sometimes called a network name—is a 32-bit identification string that’s inserted into the header of each frame processed by a WAP. Every Wi-Fi device must share the same SSID to communicate in a single network.

So let’s take it one step further into a Wi-Fi network that has multiple WAPs, an ESS. How do you determine the network name at this level? You just use the SSID, only you apply it to the ESS as an Extended Service Set Identifier (ESSID).

Unfortunately, most Wi-Fi devices just use the term SSID, not ESSID. When you configure a wireless device to connect to an ESS, you’re technically using the ESSID rather than just the SSID, but the manufacturer often tries to make it simple for you by using only the term SSID.

Exam Tip

The CompTIA Network+ certification exam uses the two terms—SSID and ESSID—interchangeably. Concentrate on these two terms for the exam.

Wireless Standards

Like all technologies, wireless has improved over the years, and as a result, different versions of wireless networking standards exist. Let’s look at each of the wireless standards—and definitely make sure you know these for the CompTIA Network+ exam!

    • 802.11b   Has a throughput of 11 Mbps and runs at the 2.4 GHz frequency. 802.11b was the first wireless standard to become the Wi-Fi standard.

    • 802.11a   Has a throughput of 54 Mbps and operates at the 5 GHz frequency. This wireless standard is incompatible with 802.11b/g, which runs at the 2.4 GHz frequency.

    • 802.11g   Improves upon the 802.11b standard by increasing the transfer rate to 54 Mbps, while staying compatible with 802.11b by running at the 2.4 GHz frequency.

    • 802.11n   Designed to run at both 2.4 GHz and 5 GHz so that it is compatible with 802.11b and 802.11g. An 802.11n-only network can take advantage of the less cluttered 5-GHz space for better coverage, and 802.11n devices are quickly becoming commonplace.

The 802.11n standard brings several improvements to Wi-Fi networking, including faster speeds and new antenna technology implementations.

The 802.11n specification requires all but handheld devices to use multiple antennas to implement a feature called multiple in/multiple out (MIMO), which enables the devices to make multiple simultaneous connections. With up to four antennas, 802.11n devices can achieve amazing speeds. They also can implement channel bonding to increase throughput even more, where the devices use multiple radio signals simultaneously. (The official standard supports throughput of up to 600 Mbps, although practical implementation drops that down substantially.)

Many 802.11n WAPs employ transmit beamforming, a multiple-antenna technology that helps get rid of dead spots—or at least make them not so bad. The antennas adjust the signal once the WAP discovers a client to optimize the radio signal.

Table 2.4 summarizes the key features of the main 802.11 networking standards. Keep in mind that the distance limitations specified in the table assume perfect conditions. In the real world, walls, plumbing, and other factors will often limit your wireless network to much smaller coverage areas. Be sure to know these specs for the CompTIA Network+ exam.

Exam Tip

Make sure you know the IEEE 802.11 wireless standards and their associated characteristics for the CompTIA Network+ exam.

Wireless Frequency Ranges

I have mentioned that the different wireless standards run at either the 2.4-GHz frequency or the 5-GHz frequency. It is important to note that these frequencies are actually a range of frequencies, and each frequency range is known as a channel. If you want, you can change the channel that your wireless devices use, which will change the frequency being used by your wireless network. This is important because you may have a wireless network running on the same channel (frequency) as some of your household devices (such as a cordless phone), which will cause them to interfere with one another. In this case, you can change the channel of the wireless network to prevent the interference from occurring. Table 2.5 shows the different frequencies used by the Wi-Fi channels. You do not need to memorize this chart for the exam. I just included it to aid in setting up a Wi-Fi network.

Notice in Table 2.5 that the frequencies overlap from one channel to another. In fact, in the United States, only channels 1, 6, and 11 don’t overlap! It’s important that if you need to change the channel, you do so by a difference of at least two. For example, if you are running on channel 6 and you are experiencing problems, try changing all your wireless devices to channel 11.

Travel Advisory

Latency Wireless networks experience much higher latency—the time delay between sending and receiving signals—than wired networks, so you might run into problems with latency-sensitive applications, such as Skype or a Google+ Hangout, which feature streaming voice and video.

Although the CompTIA Network+ competencies suggest different latencies among the various Wi-Fi standards, there doesn’t seem to be much variation. It’s in the wired vs. wireless that you’ll notice a difference.

Although wireless networks free us from the need to work with cabling and grant us mobility with our portable computers, wireless networks have three main drawbacks: cost, speed, and security. Cost is beginning to disappear as an issue—the price of wireless networking equipment has dropped dramatically as the technology has become more popular. In terms of speed, wireless networks can seem slow compared to their wired equivalents. Consider that mainstream, copper-based network solutions can give you speeds of 1000 Mbps or more for each system on a switched network, whereas a wireless network provides shared bandwidth around 300 Mbps at best.

As for security, stories abound of techno-addicts (and investigative journalists!) driving around with makeshift Mission Impossible antennas on their cars (often constructed from an old Pringles can), tapping into corporate wireless networks and surfing the Net for free.

Travel Assistance

See Chapter 10 for specifics on setting up and securing a Wi-Fi network.

Laser Links

Lasers are also an option for point-to-point links, but setup is a little trickier, and laser systems can suffer from weather-related problems (bright sun, rain, and fog) as well as loss of signal as the high-power laser emitter ages. In any case, laser (and microwave) systems require a line-of-sight path between the transmitter and receiver, so the possible effect of intermediate obstacles needs to be assessed.

Bluetooth

Bluetooth creates small wireless networks, called Wireless Personal Area Networks (WPANs), between PCs and peripheral devices such as personal digital assistants (PDAs) and printers; input devices such as keyboards and mice; and consumer electronics such as cell phones, home stereos, televisions, home security systems, and so on. Bluetooth was not originally designed to be a full-function networking solution, although many vendors have used it for this purpose.

Bluetooth uses the FHSS spread-spectrum broadcasting method, switching among any of the 79 frequencies available in the 2.45-GHz range. Bluetooth hops from frequency to frequency some 1600 times per second, making it highly resistant to interference. The Bluetooth specification allows for transfers of data at rates from 723 Kbps to 1 Mbps, with a maximum range of 10 meters (about 33 feet).

Bluetooth devices interoperate in a master/slave scheme, in which one master device controls up to seven active slave devices. These roles are designated automatically and do not require any configuration. The personal area network (PAN) created by Bluetooth is sometimes called a piconet. More than seven Bluetooth slave devices (up to 255) can participate in a piconet at one time, but only seven of those devices can be active at one time. Inactive slave devices are referred to as parked devices.

Bluetooth devices use a four-stage process to find each other and create the PAN, as detailed in Table 2.6.

The services supported by Bluetooth are called profiles. Here are the 13 common Bluetooth profiles:

    • Generic Access Profile   Defines how Bluetooth units discover and establish a connection with each other.

    • Service Discovery Profile   Enables the Bluetooth device’s Service Discovery User Application to query other Bluetooth devices to determine what services they provide. This profile is dependent on the Generic Access Profile.

    • Cordless Telephony Profile   Defines the Bluetooth wireless phone functionality.

    • Intercom Profile   Defines the Bluetooth wireless intercom functionality.

    • Serial Port Profile   Enables Bluetooth devices to emulate serial port communication using RS-232 control signaling, the standard used on ordinary PC serial ports. This profile is dependent on the Generic Access Profile.

    • Headset Profile   Defines the Bluetooth wireless telephone and PC headset functionality.

    • Dial-up Networking Profile   Defines the Bluetooth device’s capability to act as, or interact with, a modem.

    • Fax Profile   Defines the Bluetooth device’s capability to act as, or interact with, a fax device.

    • LAN Access Profile   Defines how the Bluetooth device accesses a LAN and the Internet.

    • Generic Object Exchange Profile   Defines how Bluetooth devices exchange data with other devices. This profile is dependent on the Serial Port Profile.

    • Object Push Profile   Bluetooth devices use this profile to exchange small data objects, such as a PDA’s vCard, with other Bluetooth devices.

    • File Transfer Profile   Used to exchange large data objects, such as files, between Bluetooth devices. This profile is dependent on the Generic Object Exchange Profile.

    • Synchronization Profile   Used to synchronize data between Bluetooth PDAs and PCs.

Bluetooth devices have to support identical profiles to communicate; for example, your PDA and PC both have to support the Bluetooth Synchronization Profile if you want them to sync up.

For security, Bluetooth offers proprietary 128-bit encryption and the ability to set per-user passwords to guard against unauthorized access to the Bluetooth network. Bluetooth also supports industry-standard encryption protocols such as Point-to-Point Tunneling Protocol (PPTP) and Secure Sockets Layer (SSL) (PPTP and SSL are discussed in Chapters 8 and 9) through browser-based remote access. Access to Bluetooth networks can be controlled through MAC address filtering, and Bluetooth devices can be set to nondiscovery mode to hide them effectively from other Bluetooth devices. Bluetooth specifications are shown in Table 2.7.

Infrared Wireless Networking

Wireless networking using infrared technology, although slow compared to 802.11x networks, comes standard on some laptop computers and can provide an easy way to transfer files between computers without purchasing additional hardware.

Communication through infrared devices is enabled via the Infrared Data Association (IrDA) protocol. The IrDA protocol stack is a widely supported industry standard and has been included in all versions of Windows since Windows 95. Apple computers also support IrDA, as do Linux boxes.

Infrared devices transmit data more slowly than most other wired or wireless networking options. Infrared devices can transfer data at up to 4 Mbps. The maximum distance between infrared devices is 1 meter, and connections must be in direct line of sight, making them susceptible to interference. An infrared link can be disrupted by anything that breaks the beam of light—a soda can, a coworker passing between desks, or even bright sunlight hitting the infrared transceiver can cause interference.

Exam Tip

Infrared devices transfer data at a maximum of 4 Mbps and have a maximum distance of 1 meter.

Infrared is designed only to make a point-to-point connection between two devices in ad hoc mode—no equivalent to the infrastructure mode or 802.11 exists for infrared. You could, however, use an infrared access point device to enable Ethernet network communication using IrDA (although no one really does).

In terms of security, the IrDA protocol offers exactly nothing in the way of encryption or authentication. Infrared’s main security feature is the fact that you have to be literally within arm’s reach to establish a link. Infrared is not the best solution for a dedicated network connection, but for a quick file transfer or print job, it’ll do in a pinch. Table 2.8 summarizes the key specifications for IrDA.

 Objective 2.01: Coaxial Cabling   Coax cable is the classic example of bounded network media. Coax cable consists of an inner core and an overall metal screen, plus layers of insulation. The screen gives the cable a degree of protection against electromagnetic interference, but still, as with most copper- based media, it should be kept away from sources of interference. A wide variety of coax cable types exist, but specific types must be used for networking—not just any coax will do. Early Ethernet networks used baseband coax, the last of which sported a bayonet-style connector called a BNC.

 Objective 2.02: Twisted-Pair Cabling   The vast majority of network installations use unshielded twisted-pair (UTP) cable, a four-pair cable originally intended for telephone circuits but enhanced to carry data. Over time, various categories of UTP cable have been developed, each capable of operating at faster data rates than its predecessor. Two general types of UTP wiring can be used: patch cable uses stranded copper to make the wiring flexible, and premises cable (so-called horizontal cable) uses a solid core to give the wiring more strength to withstand rougher handling as it is installed in ducting and cable trays. Mixing the cable types—for example, using horizontal cable for patch leads—can lead to reliability problems.

Most UTP installations use RJ45 connectors and wall ports. RJ45 connectors have eight contacts to match the four pairs of wires in the UTP cable. The cable pairs are color-coded to make it easier to follow a standard wiring pattern when connecting media or fitting the cable to wall ports, such as T568A and T568B. Because UTP cable is not screened, it must be installed well away from other sources of electrical interference, and most installations are thoroughly tested to make sure they meet basic functional criteria. A screened version of UTP— called STP—is available, but it is much more expensive and rarely used unless local conditions demand a high level of screening.

 Objective 2.03: Optical Fiber   Optical fiber cabling is much more expensive to install than copper alternatives, but it offers several advantages, including greater maximum distance and improved security. Two main types of optical fiber are used: single-mode fiber (SMF) and multimode fiber (MMF), the latter being the most commonly used type for general networking. Optical fiber is specified according to the core (fiber) and cladding diameter (in microns), the most common size being 62.5/125.

Optical fiber has its own set of connectors because it’s an optical system, not electrical. The most common connector types are ST, SC, LC, and MTRJ. Optical fiber connectors should always be handled with care because they can be broken fairly easily.

 Objective 2.04: Wireless Media Types   Wireless networking solutions exist for both point-to-point building links and general intraoffice connectivity. Today’s office-based solutions are using wireless networking standards such as 802.11g or 802.11n, allowing different manufacturers to produce compatible equipment and increasing competition in the marketplace. Wireless networks operate in the office by means of one or more cells, each connecting users to the main network via an access point (AP).

Other wireless media types are Bluetooth and infrared. Bluetooth devices create personal area networks (PANs) of up to 10 meters. Infrared devices, using the IrDA protocol, can make small (1 meter) point-to-point connections.

REVIEW QUESTIONS

    1.  Which of the following connector types is associated with fiber-optic cable?

          A.  RJ45

          B.  BNC

          C.  ST

          D.  RG-58

    2.  Which of the following UTP cable categories can support data transmissions at 100 Mbps?

          A.  CAT 1

          B.  CAT 4

          C.  CAT 5e

          D.  All of the above

    3.  You are planning an upgrade and future proof of your current office’s 10/100 network wiring. The new media must be capable of supporting up to 1000 Mbps up to 100 meters per network segment and 10 Gbps for shorter distances. Which of the following media type best satisfies your upgrade requirements?

          A.  CAT 5

          B.  CAT 6

          C.  CAT 5e

          D.  1000BaseT

          E.  1000BaseSX

    4.  Which of the following connector types is associated with UTP cable and is considered a Physical-layer device?

          A.  RJ45

          B.  BNC

          C.  SC

          D.  NBC

          E.  USB 3.0

    5.  What name is given to the problem caused when signals from adjacent cables interfere with each other?

          A.  Talkback

          B.  Crossover

          C.  Backchat

          D.  Crosstalk

    6.  Laptops seem to be losing their wireless connection when someone is talking on the cordless phone. What should you do?

          A.  Reboot the wireless router

          B.  Change the SSID

          C.  Enable WEP

          D.  Change the channel on the wireless router

    7.  What are the names associated with cable used to connect to a patch panel and cable used to connect an MDF to an IDF?

          A.  Horizontal and vertical cross-connect

          B.  Rollover and loopback

          C.  586A and 586B

          D.  Crossover and crossunder

    8.  Which wireless standard runs at the 2.4 GHz frequency range and has a maximum transfer rate of 54 Mbps?

          A.  802.11b

          B.  802.11g

          C.  802.11a

          D.  802.11n

    9.  What device enables two or more Wi-Fi–enabled devices to connect to each other wirelessly and connect to a wired network?

          A.  Router

          B.  Switch

          C.  MTRJ

          D.  WAP

    10.  What feature of 802.11n enables devices to use multiple antennas to make multiple simultaneous connections and thus increase throughput?

          A.  MIMO

          B.  OFDM

          C.  Transit beamforming

          D.  CSMA/CD

REVIEW ANSWERS

    1.  C   ST connectors are associated with fiber-optic cable.

    2.  C   CAT 5e (and higher) cabling can support data transmission at 100 Mbps.

    3.  B   CAT 6 UTP is the only solution mentioned capable of fulfilling the 10 Gbps requirement in the question.

    4.  A   RJ45 connectors are associated with UTP cable and considered OSI Physical-layer devices.

    5.  D   Crosstalk between adjacent cables causes interference.

    6.  D   Because the cordless phone is running on the same frequency range as the wireless router, you are most likely getting interference from the phone when it is in use. You should try to change the channel on the router to put the wireless network on a different frequency.

    7.  A   A patch cable that connects to the patch panel is called a horizontal cross-connect (HCC) cable. Cable that connects the MDF to the IDFs is called the vertical cross-connect (VCC) cable.

    8.  B   802.11g runs at the 2.4 GHz range and has a maximum transfer rate of 54 Mbps.

    9.  D   A wireless access point (WAP) enables wireless nodes to connect to both wireless and wired networks.

    10.  A   Multiple in/multiple out (MIMO) is the 802.11n standard for using multiple antennas simultaneously.

Network Topologies and Standards

  ITINERARY  

      Objective 3.01   The Bus Topology and Ethernet

      Objective 3.02   The Star Bus Topology

      Objective 3.03   Ring Topologies

      Objective 3.04   Other Topologies

A network topology provides a general description of how the devices on the network link to each other, either physically or logically. A physical topology describes precisely how devices connect, such as how the wires run from machine to machine. The devices could all connect to a single central box, for example, or in a daisy chain of one computer to another. A logical topology, in contrast, describes how the signals used on the network travel from one computer to another. In a logical topology, for example, all the computers might physically connect to a central box, but inside the box is a ring, so the signals flow as if the computers are all in a daisy chain. This chapter looks at both physical and logical topologies to help clarify these concepts.

Topologies do not define specifics about how to implement a network installation. They provide only a very high-level look at how network nodes connect. To move from a theoretical overview to a working solution, you must implement a specific network standard. This chapter also discusses the implementation of networks and network technologies, going into detail about Ethernet, the most widely used network standard.

Particular network topologies are generally associated with specific networking standards that provide the details that define how the network sends data between devices, the type of media used, the maximum network speed, and the number of devices (nodes) that can attach to the network. Questions regarding network topologies and network standards are well represented on the CompTIA Network+ exam.

The Bus Topology and Ethernet

If you can imagine your laundry hanging on a long, straight clothesline, you have a pretty good idea of how a bus topology network is constructed. Everything hangs off one long run of cable, as shown in Figure 3.1. The bus topology has been associated with one network standard in particular—Ethernet.

FIGURE 3.1   A bus topology uses a main cable trunk.

Ethernet Overview

Ethernet, introduced by Xerox in 1973, remained a largely proprietary technology until 1979, when Xerox looked for partners to help promote Ethernet as an industry standard. Working with Digital Equipment Corporation (DEC) and Intel, the company published what became the Digital-Intel-Xerox (DIX) networking standard. The standard describes a bus topology network using coaxial cable that enables multiple computing systems and other devices to communicate with each other at 10 Mbps.

Local Lingo

segment   A run of cable (media) linking one or more nodes on a network.

How Ethernet Works

Any network design must address a number of key elements: the type of media to use, how to send data across the wire, how to identify the sending and receiving computers, and how to determine which computer should use the shared cable next.

Chapter 2 discussed the physical cabling used in Ethernet. Ethernet networks can use coaxial cable, unshielded twisted-pair (UTP), shielded twisted-pair (STP), or fiber. Regardless of the physical cabling used, the data moves across the wire in essentially the same way. Any network requires a method for determining which device uses the network media at a given time.

CSMA/CD

Ethernet networks use carrier sense, multiple access/collision detection (CSMA/CD) to determine which computer should use the shared media at a given moment. Carrier sense means that each machine on the network examines the cable before sending a data frame (see Figure 3.2). If another machine is using the network, the node detects traffic and waits until the cable is free. If the node detects no traffic, the node sends its data frame.

FIGURE 3.2   A node on the Ethernet network listens for other traffic before sending a data frame.

Multiple access means that all machines have equal access to the wire. If the line is free, an Ethernet node does not have to get approval to use the wire—it just uses it. From the point of view of Ethernet, it does not matter what function the node is performing. The node could be a desktop system running Windows 7 or a high-end file server running Windows Server or Linux. In Ethernet, all nodes are created equal. But what happens when two machines listen to the cable and simultaneously determine that it is free? They both try to send.

Collisions

When two nodes use the cable simultaneously, a collision occurs, and both of the transmissions are lost (see Figure 3.3). Two nodes transmitting at the same time are like two people talking simultaneously: The listener hears the mixture of the two voices and can’t understand either voice.

FIGURE 3.3   If two nodes transmit data at the same time, a data collision occurs.

When a collision occurs, both nodes detect the collision by listening to their own transmissions. By comparing their own transmissions with the signal they receive, they can determine whether another node has transmitted at the same time, as shown in Figure 3.4. If the nodes detect a collision, both nodes immediately stop transmitting and wait for a short, random period of time before retrying.

FIGURE 3.4   An Ethernet node detects when its data has been corrupted by a collision.

Because CSMA/CD is easy to implement in hardware, Ethernet network interface cards (NICs) are relatively cheap. That simplicity comes at a price: An Ethernet node will waste some amount of its time dealing with collisions instead of sending data. As you add more devices to the network and/or increase the amount of traffic—for example, by installing new, data-intensive applications on the network—the number of collisions on the network will increase as the nodes generate more frames.

Every Ethernet network wastes some amount of its available bandwidth dealing with these collisions. The typical Ethernet network advertises that it runs at either 100 Mbps or 1000 Mbps, but the advertised speed assumes that no collisions ever take place!

Termination

Ethernet networks using a physical bus topology (such as those using coax cabling) function properly only if both ends of the network bus are fitted with terminating resistors. Without one or more of these terminators in place, some of the energy in the electrical signals that make up the data frames bounces back up the wire, a phenomenon known as reflection or signal bounce, as shown in Figure 3.5.

FIGURE 3.5   When a signal hits the end of an unterminated wire, signal bounce occurs.

Cable Breaks

A cable break on a bus topology network will create two incorrectly terminated segments, causing multiple reflections in both directions. In this scenario, all stations on the network go into perpetual wait mode (see Figure 3.6). This condition disables all nodes connected to the broken cable. Because a single break can take down the entire segment and all nodes connected to it, bus-based networks are said to have a “single point of failure.”

FIGURE 3.6   Signal bounces (reflections) caused by a cable break disrupting the entire network

Broadcast

Broadcast traffic is destined for all hosts on the network. This is different from unicast traffic, which is destined only for one host on the network.

When analyzing network traffic with a program such as Wireshark, you can easily identify broadcast traffic frames because they have a destination media access control (MAC) address of FF-FF-FF-FF-FF-FF. Broadcast traffic can be seen as wasted bandwidth because every system receives the frame.

If you determine that your network has too much broadcast traffic, you can control this by separating your network into different networks with a router. Broadcast traffic typically does not cross routers, so breaking up your network this way will minimize the amount of broadcast traffic your hosts receive.

Exam Tip

Don’t confuse broadcast traffic with multicast traffic. Multicast traffic is traffic destined for a selected group of systems—not all systems (broadcast) and not just one system (unicast). For the CompTIA Network+ exam, be familiar with the difference between broadcast, unicast, and multicast.

Bonding

Bonding, or port trunking, is a network term used to describe the action of joining the bandwidth of two network cards or modems together to create more bandwidth. For example, you could bond two 100 Mbps network cards to create a 200 Mbps connection.

Ethernet Standards

In the early 1980s, the Institute of Electrical and Electronics Engineers (IEEE), an organization that defines industry-wide standards in the fields of electronics and computing, adopted the DIX Ethernet standard as a general standard for networking. The IEEE working group (or committee) responsible for general networking standards is known as the 802 committee, and Ethernet became IEEE standard 802.3.

Exam Tip

IEEE 802.3 defines Ethernet standards.

Ethernet on the Bus

Two main standards exist for creating a bus-based Ethernet network, with wonderfully descriptive names: 10Base5 and 10Base2. The IEEE coined these labels, and they each describe three key features of the network, as shown in Figure 3.7:

    • The 10 signifies an Ethernet network that runs at 10 Mbps.

    • Base signifies that 10Base5 uses baseband signaling, meaning that just one channel of communication is on the cable at any time, as opposed to a broadband system (such as cable TV coax), which can have multiple signals on the cable.

    • The 5 indicates that 10Base5 cables may not be longer than 500 meters, which is really an indication to the type of cable. The cable length that is 500 meters is called Thicknet cabling.

    • The 2 in 10Base2 is the distance rounded up from 185 meters.

FIGURE 3.7   A term such as 10Base5 tells us three things about the network.

Ethernet networks using the pure bus topology have long been replaced by networks running twisted-pair or fiber-optic cable.

The Star Bus Topology

An early alternative topology to bus suggested connecting all the devices on a network into a single central box, effectively creating a star (Figure 3.8). This network design became known as a star topology.

FIGURE 3.8   A star topology

The key advantage of the star topology is that a break in a cable affects only the machine connected to that cable. In Figure 3.9, machine C cannot communicate with any other node, but machines A, B, D, E, and F communicate with each other just fine.

FIGURE 3.9   In a star topology, a broken cable affects only the machine connected to it.

A star topology network remained an interesting theory until some bright person got the idea to take a bus network and essentially shrink the central wire into a single box, called a hub. All the devices on the network would connect to the hub, creating a physical star topology network, but electronically—logically—the network would function just like a bus network. This created a hybrid topology called a star bus.

Exam Tip

A hybrid topology is a topology that mixes a bus, star, or ring topology (discussed later) together. For example, a star bus topology is a hybrid topology.

Modern Ethernet standards use a star bus topology, with a physical star topology that provides improved fault tolerance, as well as a logical bus that maintains compatibility with older Ethernet standards. All the devices on a network connect to a central box, called a switch (Figure 3.10).

FIGURE 3.10   A switch with four connected computers

Travel Advisory

Early star bus Ethernet networks used hubs as the central box or connection point. All modern networks use switches, devices vastly superior to hubs. Chapter 4 covers the details about how hubs and switches differ.

The way switches pass data between their ports represents the logical (bus) part of the star bus partnership; in effect, each switch behaves like a terminated Ethernet segment, with each port becoming a node on that segment. The nodes share the segment according to the same CSMA/CD rules used for 10Base2 and 10Base5. Using the star bus topology maintains compatibility with previous Ethernet standards but provides the stability of a star topology. If a cable gets cut, only one node drops off the network.

Exam Tip

10BaseT and 100BaseT are classic examples of star bus topology networks.

10BaseT and 100BaseT

The term 10BaseT describes an Ethernet cabling system that uses a star bus topology. 10BaseT uses twisted-pair cabling rather than coax. Most of the other basic characteristics remain the same—for example, the network operates at the same speed (10 Mbps) and supports a maximum of 1024 nodes.

The name 10BaseT doesn’t quite follow the naming convention used for earlier Ethernet cabling systems. The 10 still refers to the speed: 10 Mbps. Base still refers to the signaling type: baseband. The T, however, doesn’t refer to a distance limitation but to the type of cable used: twisted-pair. For the record, the maximum distance allowed between a node and a hub is 100 meters.

Once you have come to grips with 10BaseT, it is not a quantum leap to understand the key selling point of 100BaseT. Fast Ethernet, as 100BaseT is known, runs at 100 Mbps over twisted-pair cabling.

Most Ethernet NICs automatically switch between 10 Mbps and 100 Mbps operation to match the switch they’re plugged into, and all modern switches support a mix of devices running at either speed.

Exam Tip

The distance limitation between a node and a switch is 100 meters due to the use of UTP cabling.

Before we leave this section, you should know that there are two types of 100-megabit UTP Ethernet: 100BaseTX and 100BaseT4. 100BaseTX is, by far, the more popular version and runs over two pairs in a CAT 5 or better cable. 100BaseTX is so common that we just call it 100BaseT. 100BaseT4 is an earlier implementation that ran over CAT 3 cable, achieving the 100 Mbps speed by using all four pairs of wires.

Gigabit Ethernet

Modern developments have cranked Ethernet up to the heady speed of 1000 Mbps (1 Gbps) while retaining compatibility with the CSMA/CD standard. Various others have now been ratified by the IEEE 802.3ab and the IEEE 802.3z Gigabit Ethernet Standardization projects, as follows:

    • IEEE 802.3ab

        • 1000BaseT   Gigabit Ethernet over four pairs of wires in the CAT 5e or better UTP cabling.

    • IEEE 802.3z

        • 1000BaseX   Gigabit Ethernet over different cable types, which is broken down into 1000BaseSX, 1000BaseLX, and 1000BaseCX.

            • 1000BaseSX   Gigabit Ethernet over multimode fiber-optic cabling. You can remember this by the S, meaning “short distance.” Multimode fiber cabling is the type of cabling that is used over short distances (less than 2 km).

            • 1000BaseLX   Gigabit Ethernet over single mode fiber-optic cabling. You can remember this by the L, meaning “long distance.” Single mode fiber is the type of fiber used to cover large distances (greater than 2 km).

            • 1000BaseCX   Gigabit Ethernet over coaxial cable, supporting distances of up to 25 meters.

10/100/1000BaseT Summary

Here are the key features that distinguish 10/100/1000BaseT cabling:

    • Speed of 10, 100, or 1000 Mbps according to standard

    • Baseband signal type

    • Distance of 100 meters from node to hub or switch

Exam Tip

Be sure to focus on Fast Ethernet (100BaseT) and Gigabit Ethernet (1000BaseT) for the CompTIA Network+ exam. Also know that the standard known as 100BaseFX is 100 Mbps Ethernet over fiber-optic cabling.

10 Gigabit Ethernet (10 GbE)

For the highest bandwidth applications, such as interconnecting servers and connecting high-speed switches in corporate datacenters, the 10 Gigabit Ethernet standard, also known as 10 GbE, provides an amazingly fast Ethernet-based networking technology. The IEEE recognizes two 10 GbE standards: 802.3ae for 10 GbE over fiber-optic cabling and 802.3an for 10 GbE over copper cabling.

In addition to speed, most 10 GbE variations are designed to interoperate with Synchronous Optical Network (SONET), making it an ideal choice for connecting local networks to preexisting long-distance fiber-optic links that already use SONET. (Refer to Table 3.1, and see Chapter 8 for more information on SONET.)

Exam Tip

The CompTIA Network+ objectives focus on the 1 Gbps and 10 Gbps standards (10 GbE), so spend some time memorizing what standard is used with what type of cable and distance. To help you with Table 3.1, the S at the end of the standard stands for “short distance,” the L stands for “long distance,” and the E stands for “extended distance.” The W at the end of the standard implies “WAN,” which means it is used with SONET (a WAN-based technology).

Ring Topologies

In a true ring topology, every computer system is connected together in a complete loop, but the loop itself is vulnerable to a single point of failure, so two loops are often implemented in a fashion known as counter-rotating rings (see Figure 3.11). The goal is to ensure that if the primary ring suffers a cable failure, the two nodes on either side of the problem can detect the fault and reroute the data signals to the secondary ring (see Figure 3.12). The data flow on the secondary ring proceeds logically in the opposite direction of the primary ring, hence the counter-rotation.

FIGURE 3.11   A ring topology network with counter-rotating rings

FIGURE 3.12   If the primary ring breaks, data is looped through the secondary ring

The main selling point for ring networks was the complete lack of collisions. Devices on the ring played nicely and accessed the ring when it was their turn. Regardless, Ethernet was more efficient.

Hybrid star-ring topology networks competed with Ethernet in the early days of networking. IBM’s Token Ring, for example, had solid market share for a number of years. Ring and star-ring networks are long gone today.

Other Topologies

Having covered bus, star, and ring topologies, we’ve now considered the three main ways of stringing together network devices, but that’s not the whole story. Numerous otherways and means of linking systems have been tried over the years and are also evolving as technology improves. Although these topologies are not covered in as much detail as “the big three,” don’t skip over the next section, because you might learn something to your advantage.

Mesh Topology

The mesh topology connects each node with multiple links, providing multiple paths between any two nodes. The mesh topology is rarely, if ever, seen in LANs because of cost: It requires so many separate links. A partial mesh, however, is used to connect networks together (see Figure 3.13). In essence, any series of interlinked networks where more than one possible data path exists between network locations can be considered to be using a mesh topology.

FIGURE 3.13   A mesh topology

Because mesh topologies support multiple paths between networks, the level of fault tolerance improves as the number of paths increases.

Point-to-point and Point-to-multipoint

There are two popular layouts for topologies: point-to-point and point-to-multipoint. In a point-to-point, topology two systems connect directly to one another. In the past, these systems would connect directly through the serial ports with a null modem cable, but these days you can connect them using a crossover cable or a wireless connection.

A point-to-multipoint topology uses a central device that connects all the devices together. This topology is popular with wireless networks. With point-to-multipoint, when the central device sends data, it is received by all devices connected to the central device. But if one of the devices that are connected sends data, then it is received by only the destination system.

If you compare a star topology to a slightly rearranged point-to-multipoint topology, you might be tempted to say they’re the same thing. The subtle but important difference between the two topologies is that a point-to-multipoint topology requires an intelligent device in the center, whereas the device in the center of a star topology has little more to do than send or provide a path for a signal down all the connections.

CSMA/CA

Wi-Fi networks, whether configured in a point-to-point or point-to-multipoint topology, have some interesting obstacles to overcome so that communication happens properly. Wired Ethernet networks, as you’ll recall from earlier in this chapter, negotiate use of the bus through CSMA/CD. Devices listen, send if the bus is free, and resend in the case of a collision.

Modern switched networks work even more efficiently, because devices run in full duplex and switches all but eliminate collisions. Full duplex means that devices can send and receive at the same time. The switches negotiate the traffic and all the devices can chatter away happily.

Travel Assistance

I go into more detail on switches in Chapter 4.

CSMA/CD won’t work for wireless networking because wireless devices simply can’t detect collisions for two reasons. First, radio is a half-duplex transmission method, which means a wireless device cannot listen and send at the same time. Second, wireless clients may not know about the existence of another client due to signal strength. This is called the hidden node issue.

Exam Tip

You need to know the difference between full duplex and half duplex for the CompTIA Network+ exam. Old Ethernet devices ran in half duplex, as do Wi-Fi networks. Modern switched Ethernet is full duplex.

Wireless networks need another way to deal with potential collisions. Wi-Fi networks use carrier sense multiple access with collision avoidance (CSMA/CA) rather than CSMA/CD. The CSMA/CA access method, as the name implies, proactively takes steps to avoid collisions, as does CSMA/CD. The difference comes in the collision avoidance.

The 802.11 standard defines two methods for collision avoidance: Distributed Coordination Function (DCF) and Point Coordination Function (PCF). Currently, only DCF is implemented. DCF specifies rules for sending data onto the network media. For instance, if a wireless network node detects that the network is busy, DCF defines a slightly lengthy backoff period before a node can try to access the network again. DCF also requires that receiving nodes send an acknowledgement (ACK) for every frame that they process. The ACK also includes a value that tells other wireless nodes to wait a certain duration before trying to access the network media. This period is calculated to be the time that the data frame takes to reach its destination based on the frame’s length and data rate. If the sending node doesn’t receive an ACK, it retransmits the same data frame until it gets a confirmation that the frame reached its destination.

Exam Tip

Current CSMA/CA devices use the Distributed Coordination Function (DCF) method for collision avoidance.

 Objective 3.01: The Bus Topology and Ethernet   Ethernet is a very common networking standard and was first developed for use with a bus topology, where all computing devices are interconnected via a single run of coaxial cable, known as a segment. Although bus-based networks are relatively simple to install, their main drawback is that they have a single point of failure—one break will stop the entire segment from working. The ends of the bus must also be terminated properly for correct operation. Ethernet networks use a system called carrier sense multiple access/collision detection (CSAA/CD) to determine which computer should use the shared cable at a given moment. The IEEE 802.3 standard defines how Ethernet operates.

 Objective 3.02: The Star Bus Topology   This topology overcomes some of the limitations of the bus topology by placing a logical bus within a hub and allowing multiple hubs to be interconnected to form a larger network. The hubs isolate cable problems to individual ports and devices so that only the device attached to a faulty cable is stopped from using the network. Classic examples of this topology include the 10BaseT and 100BaseT standards.

 Objective 3.03: Ring Topologies   True ring topologies are expensive to install because they require a large amount of interconnection between all devices on the network, but a hybrid version, known as a star ring, was used for Token Ring networks.

 Objective 3.04: Other Topologies   The mesh topology is commonly used to interconnect networks, not just devices on individual networks. By providing multiple pathways between networks, the mesh topology provides fault tolerance in the event of problems on one or more pathways, and this is the topology used by the Internet.

Point-to-point topologies enable two devices to connect directly, whereas point-to-multipoint uses a central intelligent device to connect all devices together. Wireless networking is defined by the various IEEE 802.11x standards. 802.11g, the most widely implemented version, uses the 2.4 GHz band to provide up to 54 Mbps of bandwidth. 802.11n, the current favorite standard, cranks the speed up to ~600 Mbps. When using infrastructure mode, one or more access points (APs) provide access to the network for wireless devices. Direct NIC-to-NIC communication (ad hoc mode) is also possible. Wireless networking solves the problem of providing network connectivity where physical cabling is not possible or not wanted, but the actual distances that can be achieved vary according to local conditions. IEEE 802.11 networks use a system called carrier sense multiple access/collision avoidance (CSMA/CA) to determine which computer can use the network at a given moment.

REVIEW QUESTIONS

    1.  Which of the following network types uses a bus topology?

          A.  IEEE 802.5

          B.  IEEE 802.3

          C.  IEEE 802.11

          D.  FDDI

    2.  What name is given to the access method used by Ethernet networks to determine which device can have access to the media?

          A.  Token passing

          B.  Collision Domain Management (CDM)

          C.  CSMA/CA

          D.  CSMA/CD

    3.  You are monitoring network traffic and notice a number of frames are destined for a MAC address of FF-FF-FF-FF-FF-FF. What type of traffic is this?

          A.  Unicast

          B.  Multicast

          C.  Broadband

          D.  Broadcast

    4.  To create a more efficient network in your school lab, your instructor asks you to help join the bandwidth of two 100 Mbps NIC cards to create a 200 Mbps connection and configure multiple physical ports to appear as a single uplink port on the lab router. What terms describe what you and your instructor are doing?

          A.  Segmenting and preventing signal bounce

          B.  Bonding and port trunking

          C.  Converting multicast to unicast

          D.  Multihoming and preventing broadcasts

    5.  Which 10 Gbps Ethernet standard uses single-mode fiber-optic cabling, supports a distance of more than 2 km, and is not SONET-compatible?

          A.  10GBaseSR

          B.  10GBaseER

          C.  10GBaseLW

          D.  10GBaseEW

    6.  What network topology is most fault tolerant?

          A.  Bus

          B.  Ring

          C.  Star

          D.  Mesh

    7.  What access method do IEEE 802.11 wireless networks use to determine which computer can use the network at a given moment?

          A.  CSMA/CA

          B.  CSMA/CD

          C.  SSID/ESSID

          D.  Point-to-point

          E.  Point-to-multipoint

    8.  Which of the following represents the IEEE wireless network standard?

          A.  IEEE 802.3

          B.  IEEE 10BaseW

          C.  IEEE 802.5

          D.  IEEE 802.11

    9.  Which of the following is a Gigabit standard that uses multimode fiber-optic cabling?

          A.  1000BaseT

          B.  1000BaseCX

          C.  1000BaseLX

          D.  1000BaseSX

    10.  What method do Wi-Fi networks use for collision avoidance?

          A.  Wi-Fi CA

          B.  CA/CP

          C.  DCF

          D.  ACK

REVIEW ANSWERS

    1.  B   Of the possible answers, only IEEE 802.3 represents a bus standard.

    2.  D   Ethernet networks use CSMA/CD to determine which system can send data on the network.

    3.  D   A frame with the destination MAC address of FF-FF-FF-FF-FF-FF is broadcast traffic destined for every host on the network.

    4.  B   Bonding is a network term used to describe the action of joining the bandwidth of two network cards or modems. Port trunking (also sometimes referred to as bonding) allows multiple physical ports to appear as a single uplink port in switched networks.

    5.  B   10GBaseER is single-mode fiber over an extended range of up to 40 km.

    6.  D   The mesh topology is the only one that allows multiple pathways between networks.

    7.  A   IEEE 802.11 wireless networks use the CSMA/CA (carrier sense multiple access/collision avoidance) access method to determine which computer can use the network at a given moment. Note that wired Ethernet networks use CSMA/CD (carrier sense multiple access/ collision detection).

    8.  D   IEEE 802.11 is the wireless network standard.

    9.  D   1000BaseSX is the Gigabit standard that uses multimode fiber-optic cabling, which is the type of fiber cabling used to cover short distances.

    10.  C  Current CSMA/CA devices use the Distributed Coordination Function (DCF) method for collision avoidance.

Network Hardware

  ITINERARY  

      Objective 4.01   Network Interfaces

      Objective 4.02   Repeaters, Hubs, and Bridges

      Objective 4.03   Switched Ethernet

      Objective 4.04   Connecting Ethernet Segments

      Objective 4.05   Routers

      Objective 4.06   Wireless Access Points

Network hardware enables networking devices—nodes—to cable together into a network. That’s pretty straightforward and even redundant, at least in words. The CompTIA Network+ exam expects you to know the network hardware used in Ethernet and TCP/IP networks in some detail, even the hardware no longer in use. This chapter looks at network interfaces and the magic boxes that connect devices, both wired and wirelessly.

Network Interfaces

A network interface enables a computing device to send and receive data across a network. All modern computing devices have a network interface, either wired to connect to an Ethernet network or wireless to connect to a wireless access point. Traditionally called a network interface card (NIC) because the interface came on a separate expansion card, today most devices have built-in NICs (though most techs still call them NICs). Figure 4.1 shows a network interface on a motherboard.

FIGURE 4.1   Gigabit Ethernet network interface

NICs have several jobs. They provide a connection to the network media, of course, either through cables or wireless radio frequency waves. NICs also have a physical address to enable communication with other devices on the network. Finally, NICs take data from the operating system and encapsulate that data into a frame suitable for traversing the Physical-layer network.

MAC Address

Inside every NIC, burned onto some type of ROM chip, is special firmware containing a unique identifier with a 48-bit value called the media access control address, or MAC address.

No two NICs ever share the same MAC address—ever. Any company that makes NICs must contact the Institute of Electrical and Electronics Engineers (IEEE) and request a block of MAC addresses, which the company then burns into the ROMs on its NICs. Many NIC makers also print the MAC address on the surface of each NIC, as shown in Figure 4.2. Note that the NIC shown here displays the MAC address in hexadecimal notation. Count the number of hex characters—because each hex character represents 4 bits, it takes 12 hex characters to represent 48 bits.

FIGURE 4.2   MAC address

The MAC address in Figure 4.2 is 004005–607D49, although in print, we represent the MAC address as 00–40–05–60–7D–49. The first six digits, in this example 00–40–05, represent the number of the NIC manufacturer. Once the IEEE issues those six hex digits to a manufacturer—often referred to as the organizationally unique identifier (OUI)—no other manufacturer may use them. The last six digits, in this example 60–7D–49, are the manufacturer’s unique serial number for that NIC; this portion of the MAC is often referred to as the device ID.

Would you like to see the MAC address for your NIC? If you have a Windows system, type ipconfig /all from a command prompt to display the MAC address (see Figure 4.3). Note that ipconfig refers to the MAC address as the physical address.

FIGURE 4.3   Output from ipconfig /all

Local Lingo

MAC-48 and EUI-48  IEEE forms MAC addresses from a numbering name space originally called MAC-48, which simply means that the MAC address will be 48 bits, with the first 24 bits defining the OUI, just as described here. The current term for this numbering name space is EUI-48. EUI stands for Extended Unique Identifier. (IEEE apparently went with the new term because they could trademark it.)

Exam Tip

Most techs just call them MAC addresses, as you should, but you might see MAC-48 or EUI-48 on the CompTIA Network+ exam.

Travel Assistance

EUI-64  Although we’re not expected to exhaust the supply of 48-bit MAC addresses until the next century, IEEE has released a 64-bit successor called, appropriately, EUI-64. The numbering scheme is the same, but adds a couple more octets to bring it up to 64 bits. Currently, the only common uses for EUI-64 are FireWire and IPv6. (See Chapter 5 for information on the latter.)

Organizing the Data: Ethernet Frames

All network technologies break data transmitted between computers into smaller pieces called frames, as you’ll recall from Chapter 1. Functioning at the Data Link layer (layer 2), NICs encapsulate data from the higher levels of the OSI model into frames to enable communication at the Physical layer.

Using frames addresses two networking issues. First, frames prevent any single machine from monopolizing the shared bus cable. Second, they make the process of retransmitting lost data more efficient.

Looking at the first scenario, if a sending computer sends a file as a single huge frame, the frame will monopolize the cable and prevent other machines from using it until the entire file gets to the receiving system. Using relatively small frames enables computers to share the cable easily—each computer listens on the segment, sending a few frames of data whenever it detects that no other computer is transmitting.

Second, in the real world, bad things can happen to good data. When errors occur during transmission, the sending system must retransmit the frames that failed to get to the receiving system in good shape. If a word processing document were transmitted as a single massive frame, the sending system would have to retransmit the entire frame—in this case, the entire document. Breaking the file up into smaller frames enables the sending computer to retransmit only the damaged frames.

Because of these benefits—shared access and more efficient retransmission—all networking technologies use frames, and Ethernet is no exception to that rule. A basic Ethernet frame contains six pieces of information: the preamble, the MAC address of the frame’s recipient, the MAC address of the sending system, the type of data, the data itself, and a frame check sequence. Figure 4.4 shows these components.

FIGURE 4.4   Ethernet frame

Preamble

All Ethernet frames begin with a preamble, a 64-bit series of alternating ones and zeroes that ends with 11. The preamble gives a receiving NIC time to realize a frame is coming and to know exactly where the frame starts.

Destination and Source MAC Addresses

The second and third portions of the frame identify the destination and sending NICs, respectively. In early Ethernet networks, every node on the network received every frame because they were on a shared bus cable. Nodes would use the destination MAC address to determine whether to process each frame. In today’s switched Ethernet, the switch keeps a record of which node connects to which switch port and forwards data to the precise destination node. The only common traffic that goes to all nodes is broadcast traffic sent to the destination MAC of FF-FF-FF-FF-FF-FF, the broadcast address.

Travel Advisory

Switches Sending Multiple Frames  Switches send frames to all nodes in two nonbroadcast circumstances: unknown unicasts and multicasts. If the switch doesn’t recognize the MAC address, it sends the frame to every node. Additionally, some switches can’t filter multicasts and instead let the NICs handle the filtering.

Type

An Ethernet frame may carry one of several types of data. The Type field helps the receiving computer interpret the frame contents at a very basic level. This way, the receiving computer can tell if the frame contains, for example, IPv4 data or IPv6 data. (See Chapter 5 for more details on IPv4 and IPv6.)

The Type field does not tell you if the frame carries higher-level data, such as an e-mail message or webpage. You have to dig deeper into the data section of the frame to find that information.

Data

The data part of the frame contains whatever the frame carries, what’s called the payload. This can be an IP packet or some other type of packet used on the network. Regardless of the type of data in the payload, an Ethernet frame must have a payload of at least 46 bytes. If the payload is smaller than 46 bytes, the sending NIC will automatically add extra bytes—a pad—to bring the payload up to the minimum.

Frame Check Sequence

The frame check sequence (FCS)—Ethernet’s term for the cyclic redundancy check—enables Ethernet nodes to recognize when bad things happen to good data. Machines on a network must be able to detect when data has been damaged in transit.

To detect errors, the computers on an Ethernet network attach a special code to each frame. When creating an Ethernet frame, the sending machine runs the data through a special mathematical formula and attaches the result, the frame check sequence, to the frame. The receiving machine opens the frame, performs the same calculation, and compares its answer with the one included with the frame. If the answers do not match, the receiving machine asks the sending machine to retransmit that frame.

Repeaters, Hubs, and Bridges

Early 10-Mbps Ethernet networks ran through various evolutionary progressions, as you’ll recall from Chapter 3, and clever network designers came up with many ways to link any and all of the varieties together. They came up with devices to extend the bus topology networks from 500 m or 185 m to double or more in length. They invented devices to accommodate 10BaseT networks and sit in the center of the star bus topology.

A repeater takes in an electronic signal, corrects any voltage drops, and then retransmits the cleaned signals. That electronic signal with Ethernet is the frame. A repeater increases the maximum possible distance between machines by linking together two or more segments.

A hub enables a specific number of devices to connect to the network (one per port), and often, but not always, includes a separate port to enable hubs to be linked together to extend the network. Some hubs also include connectors for different media types—BNC, RJ-45, or fiber—but they cannot interface between networks that are based on different technologies.

Hubs are multiport repeaters, sending out every frame that one node sends to every other node connected to the hub. As a result, hubs enable multiple devices to be in the same network, but they’re also all in the same collision domain and the rules of CSMA/CD apply.

Exam Tip

Repeaters and hubs are considered layer-1 (Physical-layer) devices because they work with the electrical signal.

A bridge acts like a repeater or hub to connect two Ethernet segments, but it goes one step beyond—filtering and forwarding traffic between those segments based on the destination MAC addresses. To filter traffic means to stop it from crossing from one network to the next; to forward traffic means to pass traffic originating on one side of the bridge to the other.

Exam Tip

Because bridges work with MAC addresses, they operate at layer 2, the Data Link layer, of the OSI networking model. They function in the Link/Network Interface layer of the TCP/IP model.

A newly installed Ethernet bridge initially behaves exactly like a repeater, passing frames from one segment to another. Unlike a repeater, however, a bridge monitors and records the network traffic, eventually reaching a point where it can begin to filter and forward. A bridge usually requires only a few seconds to gather enough information to start filtering and forwarding.

Although bridges offer a good solution for connecting two segments and reducing bandwidth usage, these days you’ll mainly find bridges used in wireless, rather than wired, networks. (I cover those kinds of bridges at the end of this chapter.)

Switched Ethernet

While plain-vanilla 101 BaseT Ethernet performed well enough for first-generation networks (which did little more than basic file and print sharing), by the early 1990s networks used more-demanding applications, such as Lotus Notes, SAP business management software, and Microsoft Exchange, which quickly saturated a 10BaseT network. Fortunately, those crazy kids over at the IEEE kept expanding the standard, giving the network tech in the trenches a new tool that provided additional bandwidth—the switch.

The Trouble with Hubs

A classic 10BaseT network with a hub can only have one message on the wire at any time. When two computers send at the same time, the hub dutifully repeats both signals. The nodes recognize the collision and, following the rules of CSMA/CD, attempt to resend. Add in enough computers, and the number of collisions increases, lowering the effective transmission speed for the whole network. A busy network becomes a slow network because all the computers share the same collision domain.

Switches to the Rescue

An Ethernet switch looks like a hub because all nodes plug into it (Figure 4.5). But switches don’t function like hubs inside. Switches come with extra smarts that enable them to take advantage of MAC addresses, effectively creating point-to-point connections between two conversing computers. This gives every conversation between two computers the full bandwidth of the network.

FIGURE 4.5   Hub (top) and switch (bottom) comparison

To see a switch in action, check out Figure 4.6. When you first turn on a switch, it acts exactly as though it were a hub, passing all incoming frames right back out to all the other ports. As it forwards all frames, however, the switch copies the source MAC addresses and quickly creates an electronic table of the MAC addresses of each connected computer. The table is called a source address table (SAT).

FIGURE 4.6   A switch tracking MAC addresses

Exam Tip

One classic difference between a hub and a switch is in the repeating of packets during normal use. Although it’s true that switches initially forward all frames, they filter by MAC address in regular use. Hubs never learn and always forward all frames.

As soon as this table is created, the switch begins to do something amazing. When a computer sends a frame into the switch destined for another computer on the same switch, the switch acts like a telephone operator, creating an on-the-fly connection between the two devices. While these two devices communicate, it’s as though they are the only two computers on the network. Figure 4.7 shows this in action. Because the switch handles each conversation individually, each conversation runs at 10 Mbps.

FIGURE 4.7   A switch making two separate connections

Each port on a switch is in its own collision domain, plus the switch can buffer incoming frames. That means that two nodes connected to the switch can send data at the same time and the switch will handle it without any collision.

With half-duplex switches, collisions can occur and the rules of CSMA/CD apply. These collisions can only happen between the switch and a node, not between two nodes. If the switch forwards a frame to a node from any other node at the same time that the node tries to send a frame to any node through the same switchport, that’s a collision.

Network developers eventually figured out how to make switches and NICs run in full-duplex mode so they could send and receive data at the same time. With full-duplex Ethernet, CSMA/CD is disabled and no collisions can occur. Each node will always get the full bandwidth of the network.

Local Lingo

Layer 2 Switch   Because a switch filters traffic on MAC addresses (and MAC addresses run at layer 2 of the OSI seven-layer model), they are sometimes called layer 2 switches.

Unicast messages—from one node specifically to another node—usually go only to the intended recipient when you use a switch. (The exception is when the switch does not have a MAC address in its SAT, as mentioned earlier.) The switch will send all broadcast messages to all the ports. You’ll commonly hear a switched network called a broadcast domain to contrast it to a hub-based network with its collision domain.

Spanning Tree Protocol

Because you can connect switches together in any fashion, you can create redundant connections in a network. These are called bridging loops (Figure 4.8).

FIGURE 4.8   A bridging loop

Exam Tip

The CompTIA Network+ exam refers to bridging loops as switching loops. The terms mean the same thing, but bridging loop is more common. Be prepared for either term on the exam.

In the early days of switches, making a bridging loop in a network setup would bring the network crashing down. A frame could get caught in the loop, so to speak, and not reach its destination.

The Ethernet standards body adopted the Spanning Tree Protocol (STP) to eliminate the problem of accidental bridging loops. Switches with STP enabled can detect loops, communicate with other switches, and set the looped port’s state to blocking.

STP-enabled switches use a frame called a Bridge Protocol Data Unit (BPDU) to communicate with each other to determine things like the distances between them and to keep track of changes on the network.

Travel Assistance

Switches today all have STP enabled, and network designers create bridging loops in their networks to provide fault tolerance. Ports set as blocking still listen to the traffic on the network. If a link fails, the blocking port can become a forwarding port, thus enabling traffic to flow properly.

Connecting Ethernet Segments

You can combine multiple switches to create much bigger broadcast domains than any one switch can support. You can do this in two ways without using a bridge: via an uplink port or a crossover cable.

Uplink Ports

Uplink ports enable you to connect two switches using a straight-through cable. They’re always clearly marked on the switch, as shown in Figure 4.9. To connect two switches, insert one end of a cable to the uplink on one switch and the other end of the cable to any one of the regular ports on the other switch. To connect more than two switches, you must daisy-chain your switches by using one uplink port and one regular port. Figure 4.10 shows properly daisy-chained switches.

FIGURE 4.9   Typical uplink port

FIGURE 4.10   Daisy-chained switches

Working with uplink ports is sometimes tricky, so you need to take your time. Switch makers give their uplink ports many different names, such as crossover, MDI-X, and OUT. There are also tricks to using uplink ports. Refer to Figure 4.9. See the line connecting the uplink port and the port labeled 2X? You may use only one of those two ports, not both at the same time. Additionally, some switches place a button on one of the ports; you press this button to make it either a regular port or an uplink port (Figure 4.11). Pressing the button electronically reverses the wires inside the switch.

FIGURE 4.11   Pressing the Normal/Uplink button toggles the port between regular and uplink

Exam Tip

Two terms you might see on hubs and switches and, consequently, on the exams: MDI and MDIX. A media-dependent interface (MDI) is a regular port on a hub or switch. A media-dependent interface crossover (MDIX) is an uplink port.

Crossover Cables

Switches can also connect to each other via special twisted-pair cables called crossover cables. A standard cable cannot be used to connect two switches without using an uplink port because both switches will attempt to send data on the second pair of wires (3 and 6) and will listen for data on the first pair (1 and 2). A crossover cable reverses the sending and receiving pairs on one end of the cable. One end of the cable is wired according to the T568A standard, whereas the other end is wired according to the T568B standard (Figure 4.12). With the sending and receiving pairs reversed, the switches can hear each other; hence, the need for two standards for connecting RJ-45 jacks to UTP cables.

FIGURE 4.12   A crossover cable reverses the sending and receiving pairs.

A crossover cable connects to a regular port on each switch. Keep in mind that you can still daisy-chain even when you use crossover cables.

In a pinch, you can use a crossover cable to connect two computers together using 10BaseT NICs with no switch between them at all. This is handy for quickie connections, such as for a nice little home network or when you absolutely, positively must chase down a friend in a computer game!

Be careful about confusing crossover cables with uplink ports. First, never connect two switches by their uplink ports with a straight-through cable. This creates two crossings, and you always need an odd amount of crossings for this to work. Take a straight-through cable; connect one end to the uplink port on one switch and the other end to any regular port on the other switch. Second, if you use a crossover cable, just plug each end into any handy regular port on each switch.

Travel Advisory

Crossing Crossovers   If you mess up your crossover connections, you won’t cause any damage, but the connection will not work. Think about it. If you take a straight-through cable (that is, not a crossover cable) and try to connect two PCs directly, it won’t work. Both PCs will try to use the same send and receive wires. When you plug the two PCs into a switch, the switch electronically crosses the data wires, so one NIC sends and the other can receive. If you plug a second switch to the first switch using regular ports, you essentially cross the cross and create a straight connection again between the two PCs! That won’t work. Luckily, nothing gets hurt—except your reputation if one of your colleagues notes your mistake!

Routers

Routers connect networks together. They filter and forward traffic relying on layer-3 addresses to get the traffic to the proper network. Because of the more sophisticated addressing schemes used by routers, they can support multiple routes between networks. The networks connected by the routers can be different types of networks (for example, Ethernet and DOCSIS).

Local Lingo

DOCSIS Cable companies use the network standard called DOCSIS to enable communication via coax and cable modems. You’ll learn more about this in Chapter 8.

Router technology holds together the Internet, providing multiple pathways between the hundreds of networks that make up the entire system (see Figure 4.13). Most routers, however, see much more humble service doing the same kinds of things as bridges, linking networks or sites to form a wide area network (WAN).

FIGURE 4.13   A network with multiple routers

Exam Tip

Routers operate at layer 3 of the OSI model, also known as the Network layer.

Routers rely on layer-3 addressing, also called network addressing. A network address tells the router two pieces of information: the specific machine to which a packet should be delivered, and the network on which that machine resides. The IP addresses used on the Internet are examples of network addresses (see Chapter 5 for a discussion of IP addressing).

Given the destination network address, a properly configured router can determine the best route to the destination machine. In Figure 4.13, router 1 needs to deliver a packet from machine A to machine D. Assuming that all the links between the routers operate at the same speed, the most efficient route for the packet should be router 1 to 5 to 4 to 6. That route requires four hops. A hop is the process of passing through a router en route to the final destination. Alternative routes exist, but the router ignores them because they require more hops. In the event of a break in the link between routers 1 and 5, router 1 should automatically calculate the next-best route (if one exists) and redirect traffic to the alternative route: router 1 to 2 to 3 to 4 to 6 (see Figure 4.14).

FIGURE 4.14   Properly configured routers choose the best route.

Travel Assistance

You’ll find more discussion on routers and routing in Chapter 6. I can’t do them justice here before giving you details about addressing in a TCP/IP network, which you’ll get in Chapter 5.

Wireless Access Points

A wireless access point (WAP) enables nodes with Wi-Fi NICs to connect into a LAN using radio waves. WAPs support one or more 802.11 standards and nodes that use those standards. Many WAPs support multiple standards, thus enabling a variety of Wi-Fi devices to connect and network. All 802.11n WAPs, for example, can support devices running 802.11n, 802.11g, and 802.11b; some support 802.11a devices as well.

WAPs provide a bridge between wired and wireless networks. Wired nodes using CSMA/CD can communicate seamlessly with wireless nodes using CSMA/CA, and vice versa.

WAPs designed for small office/home office (SOHO) environments generally come as part of a much larger bundle of hardware, usually called a “router,” though routing is but one of the functions. The Linksys box in Figure 4.15, for example, is a combination WAP, router, and four-port switch, plus it offers excellent security features through its firmware.

FIGURE 4.15   Linksys WAP, router, and switch, all-in-one box

 Objective 4.01: Network Interfaces   A network interface card gets you on the network, but it must be the right fit for your computer system or whatever you’re plugging it into. You must also make sure that it has the right connectors for the network media and that it supports the right network standard and speeds—for example,100/1000 Mbps Ethernet. One very important task performed by a NIC is to give your computer system a unique address in the network; this is known as the media access control (MAC) address. This address is unique on every NIC produced, but the top 24 bits of the MAC address can be used to identify the NIC (or NIC component) manufacturer.

 Objective 4:02: Repeaters, Hubs, and Bridges   Repeaters provide a simple way to extend a bus-based network over the basic 185-meter (Thinnet) or 500-meter (Thicknet), 30/100-device (Thin/Thick) segment maximums. Hubs behave like multiport repeaters to connect machines to a star bus network. Both devices have no specific understanding of the data they are passing between ports and therefore do not provide any form of traffic management.

Bridges can link together segments of a network, just like a repeater, but they also build up an internal MAC address table, identifying the computer systems on either side of their interfaces so they can determine whether a data packet actually needs to pass across the bridge; this helps with traffic management and thus improves overall network performance. Bridges pass broadcast network traffic because they break up the collision domain, but not the broadcast domain.

 Objective 4.03: Switched Ethernet   Switches are layer-2 devices that act like a bridge, with each port on the switch creating a network segment. This means that each port on the switch is its own collision domain. The switch filters traffic by sending the data only to the port that has the destination MAC address connected to it. This increases overall network performance and adds to the security of the network.

 Objective 4.04: Connecting Ethernet Segments   You can combine multiple switches to create bigger broadcast domains in two ways without using a bridge: via an uplink port or a crossover cable. To connect two switches, insert one end of a straight-through cable to the uplink and the other end of the cable to any one of the regular ports on the other switch. The CompTIA Network+ name for an uplink port is MDIX. To connect using a crossover cable, plug the ends of the cable into regular ports on each switch.

 Objective 4.05: Routers   Routers can do all the things that bridges can do, but they also support multiple paths between networks and can link together dissimilar network types, such as Ethernet and fiber. Routers are often used for wide area networking, providing interconnectivity between networked sites. Routers do not pass broadcast traffic; instead, they manage the identification of machine locations themselves, using network addresses that contain both a machine’s address and the network on which it is located.

 Objective 4.06: Wireless Access Points   Wireless access points are popular network devices that allow a wireless client to connect to a wired network. Today’s WAPs offer a number of capabilities such as routing and switching.

REVIEW QUESTIONS

    1.  What is the minimum size of an Ethernet frame?

          A.  8 bytes

          B.  64 bytes

          C.  128 bytes

          D.  256 bytes

    2.  Which part of the frame contains information used for checking the validity of the frame?

          A.  FCS

          B.  Pad

          C.  Preamble

          D.  Type

    3.  Which device enables you to connect two networks, but discards broadcast traffic?

          A.  Bridge

          B.  Hub

          C.  Switch

          D.  Router

    4.  At which layer of the OSI model do switches work?

          A.  Layer 1

          B.  Layer 2

          C.  Layer 3

          D.  Layer 4

    5.  How are the connectors wired on a crossover cable?

          A.  One end is T568A; the other end is T568B.

          B.  Both ends are T568A.

          C.  Both ends are T568B.

          D.  One end is an RJ-45; the other end is an RG-6.

    6.  What is the purpose of a preamble in an Ethernet frame?

          A.  It gives the receiving NIC time to realize a frame is coming and to know when the frame starts.

          B.  It provides the receiving NIC with the sending NIC’s MAC address so communication can continue.

          C.  It provides error-checking to ensure data integrity.

          D.  It contains a description of the data that is to follow so the receiving NIC knows how to reassemble it.

    7.  Which device enables you to connect two networks that use different technologies?

          A.  Hub

          B.  Repeater

          C.  Router

          D.  Switch

    8.  Upon looking at the front of a switch, you notice something labeled MDI-X. What is this for?

          A.  It is a special receptacle for the power cable.

          B.  It is a regular port used to connect computers.

          C.  It is an uplink port used to connect the switch to another switch.

          D.  It is the brand name of the switch.

    9.  What feature of switches prevents the problem of bridging loops?

          A.  STP

          B.  TCP/IP

          C.  IEEE 802.3

          D.  UTP

    10.  What feature of switches keeps track of which MAC address goes to each port?

          A.  FCS

          B.  SAT

          C.  STP

          D.  UTP

REVIEW ANSWERS

    1.  B   The minimum size of an Ethernet frame is 64 bytes.

    2.  A   The frame check sequence FCS contains error-checking information.

    3.  D   Routers connect networks, but discard broadcast traffic.

    4.  B   Switches work at layer 2, the Data Link layer, because they manage traffic using MAC addresses.

    5.  A   A properly wired crossover cable is T568A on one end and T568B on the other. All T568A or all T568B defines a straight-through cable. RJ-45 is for UTP; RG-6 is for coaxial. You wouldn’t find them on the same cable.

    6.  A   The preamble gives the receiving NIC time to realize a frame is coming and to know when the frame starts.

    7.  C   A router enables networks to connect even if the networks use different technologies.

    8.  C   Uplink ports are often labeled MDI-X.

    9.  A   Spanning Tree Protocol (STP) prevents bridging loops. STP also stands for shielded twisted-pair; knowing the context in which the acronym is being used is important.

    10.  B   A switch keeps track of which MAC address goes to each port with its source address table (SAT).

TCP/IP

  ITINERARY  

      Objective 5.01   The TCP/IP Protocol Suite

      Objective 5.02   IPv4 Addressing

      Objective 5.03   CIDR and Subnetting

      Objective 5.04   IPv6 Addressing

      Objective 5.05   Domain Name System

In 1973, the U.S. Defense Advanced Research Projects Agency (DARPA) first proposed TCP/IP as a standard for connecting various existing networks so that they could exchange information. One aim was to develop a common standard to replace the growing number of proprietary and incompatible networks that were emerging. The work undertaken as part of the DARPA project eventually led to the development of the TCP/IP protocol suite and the Internet as we know it today. In the early days of networking, many protocols competed for market share. Microsoft networks used NetBIOS/NetBEUI, for example, and NetWare networks used IPX/SPX. Today, everybody uses TCP/IP.

The TCP/IP Protocol Suite

TCP/IP is made up of a number of protocols that work together to make it the most popular protocol in networking today. Each protocol in the TCP/IP protocol suite performs a specific role; this section identifies some of the popular ones.

Application Protocols

Application-level protocols are responsible for initiating some sort of request (on the client) or answering that request (on the server). When you surf the Internet, for example, you use an application (a web browser) that sends a request to a web server for a specific page. This communication happens across TCP/IP using an Application-layer protocol known as Hypertext Transfer Protocol (HTTP).

Port Numbers

A TCP/IP client computer initiates contact with a server computer and uses specific values, called port numbers, to request a particular kind of service. Servers listen on ports that correspond to the services they offer. A web browser, for example, contacts a server at the destination port number 80; the web server listens to port 80 so it knows that the client wants a webpage.

The use of port numbers enables servers to provide more than one type of service. One of the servers in my office, for example, handles internal webpages for essential company policies. It also acts as a file server and a print server. Finally, it handles our lunchtime gaming needs by running as a Counter-Strike or Unreal Tournament server. Clients request each of these different services using different port numbers.

Clearly defined port numbers exist for every popular, or well-known, TCP/IP application. A port number is a 16-bit value between 0 and 65535. Port numbers from 0 to 1023 are called well-known port numbers and are reserved for specific TCP/IP applications. (No TCP or UDP application can use the reserved port 0.)

Exam Tip

TCP/IP port numbers between 0 and 1023 are the well-known port numbers. You’ll find them at every party.

Destination and Source Port Numbers   The client uses a destination port number to request a service. To communicate back and establish a session with the client, the server uses a port number specified by the client. The web client, in essence, says, “Hey, server! I’m requesting on port 80. You can reach me through my port 50002.” In this example, port 50002 is the source port number. Port numbers that devices allocate on the fly for a source port number are also called ephemeral ports.

Registered and Dynamic Port Numbers   The port numbers from 1024 to 49151 are called registered ports. Less-common TCP/IP applications can register their ports with the Internet Assigned Numbers Authority (IANA). Unlike well-known ports, anyone can use these port numbers for their servers or for ephemeral numbers on clients. Most operating systems steer away (or are in the process of steering away) from using these port numbers for ephemeral ports, opting instead for the dynamic/private port numbers. Here’s the full list of ports:

Sockets

Each computer on each side of a session must keep track of the status of the communication. In TCP/IP, the session information (a combination of the IP address and port number) stored in RAM is called a socket or endpoint. When discussing the information each computer stores about the connection between two computers’ TCP/IP applications, the term to use is socket pairs or endpoints. A session or connection refers to the connection in general, rather than anything specific to TCP/IP. Many people still use the term session, however. Here’s a summary of the terms used:

    • Terms for the connection information stored on a single computer—socket or endpoint

    • Terms for the connection information stored on two computers about the same connection—socket pairs or endpoints

    • Terms for the whole interconnection—connection or session

As two computers begin to communicate, they store the information about the session—the endpoints—so they know where to send and receive data. At any given point in time, your computer probably has a large number of communications going on. If you want to know who your computer is communicating with, you need to see this list of endpoints. Windows, Linux, and Mac OS X come with netstat, the universal “show me the endpoint” utility. The netstat utility works at the command line, so open one up and type netstat –n to see something like this:

Travel Advisory

Even though almost all operating systems use netstat, there are subtle differences in options and output among the different versions.

When you run netstat –n on atypical computer, you’ll see many more than just two connections! The preceding example is simplified for purposes of discussing the details. It shows two connections: My computer’s IP address is 192.168.4.27. The top connection is an open webpage (port 80) on a server at 209.29.33.25. The second connection is an open Windows Network browser (port 445) on my file server (192.168.4.10). Looking on my Windows desktop, you would certainly see at least these two windows open (Figure 5.1).

FIGURE 5.1   Two open windows

Both connections require open ports on my computer. These show up under the Local Address column. Ephemeral port 57913 is open for the web browser; port 61707 is open for the network browser.

List of Application Protocols

Here are some examples of popular Application-level protocols and the port number(s) they use by default. And yes, you need to memorize the port numbers for the CompTIA Network+ exam.

Compound Application Protocols

Some common Application-layer protocols use multiple protocols to accomplish their tasks. HTTPS and VoIP provide good examples.

HTTP over Secure Sockets Layer (SSL) provides an encrypted connection between a web server and a web client. Most web browsers display a closed padlock to indicate a secure connection. HTTPS provides the basic fabric for e-commerce on the Internet. Although the protocol name still refers to SSL, current HTTPS implementations use Transport Layer Security (TLS), an improved cryptographic protocol. HTTPS uses TCP port 443.

Exam Tip

TLS is up to version 1.2 as of this writing.

Voice over IP (VoIP) enables users to make phone calls over an IP network, such as the Internet. The user uses special VoIP boxes that support telephones that connect to the IP network instead of requiring the user to use a PC. VoIP uses a number of different protocols, two of which you must know for the CompTIA Network+ exam. The Session Initiation Protocol (SIP) establishes and takes down the communication channel for VoIP. The Real-time Transport Protocol (RTP) delivers the voice across the connection after it has been established.

SIP uses either TCP or UDP ports 5060 and/or 5061. RTP has no fixed port number, though many implementations use UDP ports 5004 and 5005.

Transport Protocols

When an application sends out a request, the request needs to be specified as either a connection-oriented request or a connectionless request, as you’ll recall from Chapter 1. Two protocols handle the Transport-layer traffic in TCP/IP networks: TCP and UDP.

TCP

The Transmission Control Protocol (TCP) enables connection-oriented communication in networks that use the TCP/IP protocol suite. TCP is, by far, the most common type of session on a typical TCP/IP network. Figure 5.2 shows two computers. One computer (Server) runs a web server and the other (Client) runs a web browser. When you enter a computer’s address in the browser running on Client, it sends a single packet with the SYN (synchronize) flag activated to the web server. If Server gets that packet, it returns a single packet with SYN, ACK (synchronize, acknowledge) flags active. Client then sends Server a single packet with an active ACK flag and immediately requests that Server begin sending the webpage. This process is called the TCP three-way handshake.

FIGURE 5.2   A connection-oriented session starting

Once Server finishes sending the webpage, it sends a FIN, ACK (finished, acknowledge) packet. Client responds with an ACK (acknowledge) packet and then sends its own FIN, ACK packet. The server then responds with an ACK; now both parties consider the session closed (Figure 5.3).

FIGURE 5.3   A connection-oriented session ending

Most TCP/IP applications use TCP because connection-oriented sessions are designed to check for errors. If a receiving computer detects a missing packet, it just asks for a repeat as needed.

Figure 5.4 shows a simplified TCP header. Notice the source port and the destination port, part of the TCP segment or UDP datagram encapsulated in the packet.

FIGURE 5.4   TCP header

Ports aren’t the only items of interest in the TCP header. The header also contains these fields:

    • Sequence number   This value is used to assemble/disassemble data.

    • ACK number   This value tracks the readiness of the two communicating systems to send/receive data.

    • Flags   These individual bits give both sides detailed information about the state of the connection.

    • Checksum   The checksum checks the TCP header for errors.

UDP

User Datagram Protocol (UDP) runs a distant second place to TCP in terms of the number of applications that use it, but that doesn’t mean UDP is not important. UDP is perfect for the types of sessions that don’t require the overhead of all that connection-oriented stuff.

Exam Tip

Be sure that you know the difference between TCP and UDP when preparing for the CompTIA Network+ exam.

A UDP datagram doesn’t possess any of the extras you see in TCP to make sure the data is received intact (Figure 5.5). UDP works best when you have a lot of data that doesn’t need to be perfect or when the systems are so close to each other that the chances of a problem occurring are too small to bother worrying about. A few dropped frames on a Voice over IP call, for example, won’t make much difference in the communication between two people. So there’s a good reason to use UDP: it’s smoking fast compared to TCP.

FIGURE 5.5   UDP header

Exam Tip

Data gets chopped up into chunks at the Transport layer. The chunks are called segments with TCP and datagrams with UDP.

Internet Protocols

Internet-layer protocols handle addressing in a TCP/IP network. They help devices determine whether an intended recipient is local or remote.

Internet Protocol

The Internet Protocol (IP) is responsible for the addressing and routing of data to the remote system. Addressing means that IP is responsible for some sort of addressing scheme used to identify each system on the network (or Internet) and for determining how to use that address to route the data to the destination. The addressing scheme that IP uses is known as an IP address. The IP address is a unique number assigned to your system that looks something like this: 192.168.1.10.

The full IP packet has 14 different fields. As you would expect, the destination and source IP addresses are part of the Network/Internet layer. Other fields include version, header length, and more. Dissecting the entire set of fields isn’t important, but here are a few descriptions just to whet your appetite:

    • Version   The version (Ver) field defines the IP address type: 4 for IPv4, 6 for IPv6.

    • Header Length   The total size of the IP portion of the packet in words (32 bits) is displayed in the header length field.

    • Differentiated Services Code Point (DSCP)   The DSCP field contains data used by bandwidth-sensitive applications like Voice over IP. (Network techs with long memories will note that this field used to be called the Type of Service field.)

    • Time to Live   Routers on the Internet are not perfect and sometimes create loops. The Time to Live (TTL) field prevents an IP packet from indefinitely spinning through the Internet by using a counter that decrements by one every time a packet goes through a router. This number cannot start higher than 255; many applications start at 128.

    • Protocol   In the vast majority of cases, the protocol field is either TCP or UDP.

Figure 5.6 shows a highly simplified IP header.

FIGURE 5.6   Simplified IP header

An entire section is devoted to IP addressing later in this chapter, so I will leave the rest of our discussion on IP for that section.

Internet Control Message Protocol (ICMP)

Sometimes applications are so simple that they’re always connectionless and never need more than a single packet. The Internet Control Message Protocol (ICMP) works at layer 3 to deliver connectionless packets. ICMP handles mundane issues such as disconnect messages (host unreachable) that applications use to let the other side of a session know what’s happening. ICMP is used for informational and error reporting.

TCP/IP users rarely start a program that uses ICMP. For the most part, ICMP features are called automatically by applications as needed without you ever knowing. There is one very famous program that runs under ICMP, however: the venerable Ping utility. Run Ping from a command prompt to query if a host is reachable. Ping will show the round trip time (RTT)—some call this the real transfer time—for the ICMP packet, usually in seconds. If Ping can’t find the host, the packet will time out and Ping will show you that information, too.

IPv4 Addressing

TCP/IP networks have long used the Internet Protocol version 4 (IPv4) protocol for addressing. (See “IPv6 Addressing” later in this chapter for a discussion about the protocol poised to replace IPv4.)

IPv4 addresses originally followed rigid blocks, called classes. Today’s IPv4 addresses don’t use classes, but are doled out under a different set of rules. Let’s look at classic IPv4 addressing first, and then turn to modern IPv4 usage.

Local Lingo

IPv4 Most writers drop the version number when discussing IP addressing. The assumption is that if there’s no version number listed, it must be IPv4.

When installing TCP/IP on a system, techs need to configure three settings:

    • IP address   A unique value that represents a node on a TCP/IP network.

    • Subnet mask   A value used to help devices distinguish the host’s network.

    • Default gateway   The IP address of the router interface for your network. The router is responsible for sending data off your network if needed.

IP Addresses

The most common type of IP address consists of a 32-bit value. Here’s an example:

11000000101010000000010000000010

Whoa! IP addresses are just strings of 32 binary digits? Yes, they are, but to make IP addresses easier for humans to use, the 32-bit binary value is broken down into four groups of eight, separated by periods, or dots, like this:

11000000.10101000.00000100.00000010

Each of these 8-bit values—called an octet—is, in turn, converted into a decimal number between 0 and 255.

If you took every possible combination of eight binary values and placed them in a spreadsheet, it would look something like the list in the left column. The right column shows the same list with a decimal value assigned to each.

Converted, the original value of 11000000.10101000.00000100.00000010 is displayed as 192.168.4.2 in IPv4’s dotted decimal notation (also referred to as the dotted octet numbering system). Note that dotted decimal is simply a shorthand way for people to discuss and configure the binary IP addresses computers use.

Travel Advisory

When you type an IP address into a computer, the computer ignores the periods and immediately converts the decimal numbers into binary. People need dotted decimal notation, but computers do not.

People who work on TCP/IP networks must know how to convert dotted decimal to binary and back. You can convert easily using any operating system’s calculator. Every OS has a calculator (UNIX/Linux systems have about 100 different ones to choose from) that has a scientific or programmer mode like the one shown in Figure 5.7.

FIGURE 5.7   Mac OS X Calculator in Programmer mode

To convert from decimal to binary, just go to decimal view, type in the value, and then switch to binary view to get the result. To convert to decimal, just go into binary view, enter the binary value, and switch to decimal view to get the result.

Figure 5.8 shows the result of Windows 7’s Calculator converting the decimal value 47 into binary. Notice the result is 101111—the leading two zeroes do not appear. When you work with IP addresses, you must always have eight digits, so just add two more to the left to get 00101111.

FIGURE 5.8   Converting decimal to binary with Windows 7’s Calculator

Travel Advisory

Using a calculator utility to convert to and from binary/decimal is a critical skill for a network tech. Later on you’ll do this again, but by hand!

Just as every MAC address must be unique on a network, every IP address must be unique as well. For logical addressing to work, no two computers on the same network may have the same IP address. In a small network running TCP/IP, every computer has both an IP address and a MAC address (Figure 5.9).

FIGURE 5.9   A small network with both IP and MAC addresses

Every GUI operating system comes with graphical and command-line utilities to display a system’s IP address and MAC address. Figure 5.10 shows a Mac OS X system’s Network utility. Note the MAC address (00:14:51:65:84:a1) and the IP address (192.168.4.57).

FIGURE 5.10   Macintosh OS X Network utility

You can use the command-line utility ipconfig to display the IP and MAC addresses. Run ipconfig /all to see the results shown in Figure 5.11.

FIGURE 5.11   The results from running ipconfig /all

In UNIX/Linux/Mac OS X, you can run the very similar ifconfig command. Figure 5.12, for example, shows the result of running ifconfig ("“eth0” is the NIC) in Ubuntu.

FIGURE 5.12   Results from running ifconfig in Ubuntu

Exam Tip

Make sure you know that ipconfig and ifconfig provide a tremendous amount of information regarding a system’s TCP/IP settings.

IP Addresses in Action

Both LANs and WANs use IP addresses. This can create problems in some circumstances, such as when a computer needs to send data both to computers in its own network and to computers in other networks. How can this be accomplished?

To make all this work, IP must do three things:

    • Create some way to use IP addresses so that each LAN has its own identification.

    • Interconnect all of the LANs using routers and give those routers some way to use the network identification to send packets to the right network.

    • Give each computer on the network some way to recognize if a packet is for the LAN or for a computer on the WAN so it knows how to handle the packet.

Network IDs

To differentiate LANs from one another, each computer on a single LAN must share a very similar IP address. Some parts of the IP address will match all the others on the LAN. Figure 5.13 shows a LAN where all of the computers share the first three numbers of the IP address, with only the last number being unique on each system.

FIGURE 5.13   IP addresses for a LAN

In this example, every computer has an IP address of 202.120.10.x. That means the network ID is 202.120.10.0. The x part of the IP address is the host ID. Combine the network ID (after dropping the ending 0) with the host ID to get an individual system’s IP address. No individual computer can have an IP address that matches the network ID.

Interconnecting

To organize all those individual LANs into a larger network, every TCP/IP LAN that wants to connect to another TCP/IP LAN must have a router connection. There is no exception to this critical rule. A router, therefore, needs an IP address on all the LANs that it serves (Figure 5.14) so it can correctly route packets.

FIGURE 5.14   LAN with router

That router is known as the default gateway. When configuring a client to access the network beyond the router, you use the IP address for the default gateway. Most network administrators give the LAN-side NIC on the default gateway the lowest host address in the network, usually the host ID of 1.

Routers use network IDs to determine network traffic. Figure 5.15 shows a diagram for a small, two-NIC router similar to the ones you see in many homes. Note that one port (202.120.10.1) connects to the LAN and the other port connects to the Internet service provider’s network (14.23.54.223). Built into this router is a routing table, the actual instructions that tell the router what to do with incoming packets and where to send them.

FIGURE 5.15   Router diagram

Travel Assistance

Routing tables are covered in more detail in Chapter 6.

Now let’s add in the LAN and the Internet (Figure 5.16). (The LAN, of course, connects via a switch to the router.) When discussing networks in terms of network IDs, by the way, especially with illustrations in books, the common practice is to draw circles around stylized networks. Here, you should concentrate on the IDs—not the specifics of the networks.

FIGURE 5.16   LAN, router, and the Internet

Network IDs are very flexible, as long as no two interconnected networks share the same network ID. If you wished, you could change the network ID of the 202.120.10.0 network to 202.155.5.0, or 202.21.8.0, just as long as you can guarantee no other LAN on the WAN shares the same network ID. On the Internet, powerful governing bodies carefully allocate network IDs to ensure no two LANs share the same network ID. I’ll talk more about how this works later in the chapter.

So far you’ve only seen examples of network IDs where the last value is zero. This is common for small networks, but it creates a limitation. With a network ID of 202.120.10.0, for example, a network is limited to IP addresses from 202.120.10.1 to 202.120.10.254. (202.120.10.255 is a broadcast address used to talk to every computer on the LAN.) This provides only 254 IP addresses: enough for a small network, but many organizations need many more IP addresses. No worries! You can simply use a network ID with more zeroes, such as 170.45.0.0 (for a total of 65,534 hosts) or even 12.0.0.0 (for around 16.7 million hosts).

Network IDs enable you to connect multiple LANs into a WAN. Routers then connect everything together, using routing tables to keep track of which packets go where. So that takes care of the second task: interconnecting the LANs using routers and giving those routers a way to send packets to the right network.

Now that you know how IP addressing works with LANs and WANs, let’s turn to how IP enables each computer on a network to recognize if a packet is going to a computer on the LAN or to a computer on the WAN. The secret to this is something called the subnet mask.

Subnet Mask

Picture this scenario. Three friends sit at their computers—Computers A, B, and C—and want to communicate with each other. Figure 5.17 illustrates the situation. You can tell from the drawing that Computers A and B are in the same LAN, whereas Computer C is on a completely different LAN. The IP addressing scheme can handle this communication, so let’s see how it works.

FIGURE 5.17   The three amigos, separated by walls or miles

The process to get a packet to a local computer is very different from the process to get a packet to a faraway computer. If one computer wants to send a packet to a local computer, it must send a broadcast to get the other computer’s MAC address. (It’s easy to forget about the MAC address, but remember that the network uses Ethernet and must have the MAC address to get the frame that encapsulates the packet to the other computer.) If the packet is for some computer on a faraway network, the sending computer must send the packet to the default gateway (Figure 5.18).

FIGURE 5.18   Sending a packet remotely

In the scenario illustrated in Figure 5.17, Computer A wants to send a packet to Computer B. Computer B is on the same LAN as Computer A, but that begs a question: How does Computer A know this? Every TCP/IP computer needs a tool to tell the sending computer whether the destination IP address is local or long distance. This tool is the subnet mask.

A subnet mask is nothing more than a string of ones followed by some number of zeroes, always totaling exactly 32 bits, typed into every TCP/IP host. Here’s an example of a typical subnet mask:

11111111.11111111.11111111.00000000

Convert each octet into decimal (use a calculator):

255.255.255.0

When you line up an IP address with a corresponding subnet mask in binary, the portion of the IP address that aligns with the ones of the subnet mask is the network ID portion of the IP address. The portion that aligns with the zeroes is the host ID. With simple IP addresses, you can see this with dotted decimal, but you’ll want to see this in binary for a true understanding of how the computers work.

The IP address 192.168.5.23 has a subnet mask of 255.255.255.0. Convert both numbers to binary and then compare the full IP address to the ones and zeroes of the subnet mask:

Before a computer sends out any data, it first compares the destination IP address to its own IP address using the subnet mask. If the destination IP address matches the computer’s IP wherever there’s a one in the subnet mask, then the sending computer knows the destination is local. The network IDs match.

If even one bit of the destination IP address where the ones are on the subnet mask is different, then the sending computer knows it’s a long-distance call. The network IDs do not match.

Travel Advisory

The explanation about comparing an IP address to a subnet mask simplifies the process, leaving out how the computer uses its routing table to accomplish the goal. We’ll get to routing and routing tables in Chapter 6. For now, stick with the concept of the node using the subnet mask to determine the network ID.

Exam Tip

At this point, you should memorize that 0 = 00000000 and 255 = 11111111. You’ll find knowing this very helpful throughout the rest of the book.

Let’s head over to Computer A and see how the subnet mask works. Computer A’s IP address is 192.168.5.23. Convert that into binary:

11000000.10101000.00000101.00010111

Let’s say Computer A wants to send a packet to Computer B. Computer A’s subnet mask is 255.255.255.0. Computer B’s IP address is 192.168.5.45. Convert this address to binary:

11000000.10101000.00000101.00101101

Computer A compares its IP address to Computer B’s IP address using the subnet mask, as shown in Figure 5.19. For clarity, I’ve added a line to show you where the ones end and the zeroes begin in the subnet mask. Computers certainly don’t need the line!

FIGURE 5.19   Comparing addresses

A-ha! Computer A’s and Computer B’s network IDs match! It’s a local call. Knowing this, Computer A can now send out an ARP request, which is a broadcast, as shown in Figure 5.20, to determine Computer B’s MAC address. The Address Resolution Protocol (ARP) is how nodes in a TCP/IP network figure out the destination MAC address based on the destination IP address.

FIGURE 5.20   Sending an ARP

The addressing for the ARP frame looks like Figure 5.21. Note that Computer A’s IP address and MAC address are included.

FIGURE 5.21   Simplified ARP frame

Computer B responds to the ARP by sending Computer A an ARP reply (Figure 5.22). Once Computer A has Computer B’s MAC address, it starts sending packets.

FIGURE 5.22   Computer B responds

Exam Tip

The long-dead Reverse Address Resolution Protocol (RARP) was used to get a layer-3 address when the computer’s MAC address was known, thus, the reverse of an ARP. You’ll see this sometimes as an incorrect answer on the CompTIA Network+ exam.

But what happens when Computer A wants to send a packet to Computer C? First, Computer A compares Computer C’s IP address to its own using the subnet mask (Figure 5.23). It sees that the IP addresses do not match in the ones part of the subnet mask—meaning the network IDs don’t match; therefore, this is a long-distance call.

FIGURE 5.23   Comparing addresses again

Whenever a computer wants to send to an IP address on another LAN, it knows to send the packet to the default gateway. It still sends out an ARP, but this time to the default gateway (Figure 5.24). Once Computer A gets the default gateway’s MAC address, it then begins to send packets with the destination MAC address of the default gateway in the frame, but with the destination IP address of the actual remote destination in the packet.

FIGURE 5.24   Sending an ARP to the gateway

Subnet masks are represented in dotted decimal like IP addresses—just remember that both are really 32-bit binary numbers. All of the following (shown in both binary and dotted decimal formats) can be subnet masks:

11111111111111111111111100000000 = 255.255.255.0

11111111111111110000000000000000 = 255.255.0.0

11111111000000000000000000000000 = 255.0.0.0

Most network folks represent subnet masks using special shorthand: a forward slash (/) character followed by a number equal to the number of ones in the subnet mask. Here are a few examples:

11111111111111111111111100000000 = /24 (24 ones)

11111111111111110000000000000000 = /16 (16 ones)

11111111000000000000000000000000 = /8 (8 ones)

An IP address followed by the / and number tells you the IP address and the subnet mask in one statement. For example, 201.23.45.123/24 is an IP address of 201.23.45.123 with a subnet mask of 255.255.255.0. Similarly, 184.222.4.36/16 is an IP address of 184.222.4.36 with a subnet mask of 255.255.0.0.

Fortunately, computers do all of this subnet filtering automatically. Network administrators need only to enter the correct IP address and subnet mask when they first set up their systems, and the rest happens without any human intervention.

Exam Tip

By definition, all computers on the same network have the same subnet mask and network ID.

Class IDs

To support the dispersion of IP addresses, and to make sure that no organizations used duplicate IP addresses on the Internet, IANA was formed to track and disperse IP addresses to those who need them. Initially handled by a single person (the famous Jon Postel) until 1998, IANA has grown dramatically and now oversees a number of Regional Internet Registries (RIRs) that parcel out IP addresses to large ISPs and major corporations. The RIR for North America is called the American Registry for Internet Numbers (ARIN). The vast majority of end users get their IP addresses from their respective ISPs. IANA passes out IP addresses in contiguous chunks called class licenses, which are outlined in the following table:

Travel Advisory

127.0.0.0 Careful readers might have picked up on the missing range of numbers in this list: 127.0.0.0–127.255.255.255. These numbers are used for loopback testing, running diagnostics on a local computer. Any number in this range automatically maps to 127.0.0.1, also called the loopback, the local machine, or simply home.

A typical Class A license, for example, has a network ID that starts between 1 and 126; hosts on that network have only the first octet in common, with any numbers for the other three octets. Having three octets to use for hosts means you have an enormous number of possible hosts—over 16 million different number combinations. The subnet mask for Class A licenses is 255.0.0.0, which means you have 24 bits for host IDs.

Do you remember binary math? 2²⁴ = 16,277,216. Because the host can’t use all zeroes or all ones (those are reserved for the network ID and broadcast IP, respectively), you subtract two from the final number to get the available host IDs.

Travel Assistance

The Internet Corporation for Assigned Names and Numbers (ICANN) manages the IANA. See www.icann.org for more details.

A Class B license, with a subnet mask of 255.255.0.0, uses the first two octets to define the network ID. This leaves two octets to define host IDs, which means each Class B network ID can have up to 65,534 different hosts.

A Class C license uses the first three octets to define only the network ID. All hosts in network 192.168.35.0, for example, would have all three first numbers in common. Only the last octet defines the host IDs, which leaves only 254 possible unique addresses. The subnet mask for Class C licenses is 255.255.255.0.

Multicast class licenses are used for one-to-many communication, such as in streaming video conferencing. There are three types of ways to send a packet: a broadcast, which is where every computer on the LAN hears the message; a unicast, where one computer sends a message directly to another user; and a multicast, where a single computer sends a packet to a group of interested computers. Multicast is often used when routers talk to each other.

Experimental addresses are reserved and never used except for occasional experimental reasons. These were originally called reserved addresses.

Exam Tip

Make sure you memorize the IP class licenses! You should be able to look at any IP address and know its class license. Here’s a trick to help: The first binary octet of a Class A address always begins with a 0 (0xxxxxxx); for Class B, it begins with a 10 (10xxxxxx); for Class C, with 110 (110xxxxx); for Class D, with 1110 (1110xxxx); and for Class E, it begins with 1111 (1111 xxxx).

Private vs Public IP Addresses

Lots of folks use TCP/IP in networks that either aren’t connected to the Internet or want to hide their computers from the rest of Internet. Certain groups of IP addresses, known as private IP addresses, are available to help in these situations. All routers destroy private IP addresses. Those addresses can never be used on the Internet, making them a handy way to hide systems. Anyone can use these private IP addresses, but they’re useless for systems that need to access the Internet—unless you use the mysterious and powerful NAT, which I’ll discuss in the next chapter. (Bet you’re dying to learn about NAT now!) For the moment, however, let’s just look at the ranges of addresses that are designated as private IP addresses:

    • 10.0.0.0 through 10.255.255.255 (1 Class A license)

    • 172.16.0.0 through 172.31.255.255 (16 Class B licenses)

    • 192.168.0.0 through 192.168.255.255 (256 Class C licenses)

All other Class A, B, and C IP addresses are public IP addresses, meaning they are routable and usable on the Internet.

Exam Tip

Make sure you can quickly tell the difference between a private and a public IP address for the CompTIA Network+ exam.

Need for Changes

IP class licenses worked well for the first few years of the Internet, but quickly ran into trouble due to the fact that they didn’t quite fit for everyone. Early on, IANA gave away IP class licenses rather generously—perhaps too generously. Over time, unallocated IP addresses became scarce. In addition, the IP class licenses concept didn’t scale well. If an organization needed 2,000 IP addresses, for example, it either had to take a single Class B license (wasting 63,000 addresses) or eight Class C licenses. As a result, a new method of generating blocks of IP addresses, called Classless Inter-Domain Routing (CIDR), was developed.

CIDR and Subnetting

CIDR is based on a concept called subnetting: taking a single network ID and chopping it up into multiple smaller subnets. CIDR and subnetting are virtually the same thing. Subnetting is done by an organization—the organization is given a block of addresses and then breaks the single block of addresses into multiple subnets. CIDR is done by an ISP—the ISP is given a block of addresses, subnets the block into multiple subnets, and then passes out the smaller individual subnets to customers. Subnetting and CIDR have been around for quite a long time now and are a critical part of all but the smallest TCP/IP networks. Let’s first discuss subnetting and then visit CIDR.

Subnetting

Subnetting enables a much more efficient use of IP addresses compared to class licenses. It also enables you to separate a network for security (separating a bank of public access computers from your more private computers) and for bandwidth control (separating a heavily used LAN from one that’s not so heavily used).

Exam Tip

You need to know how to subnet to pass the CompTIA Network+ exam.

The cornerstone to subnetting lies in the subnet mask. You take an existing /8, /16, or /24 subnet and extend the subnet mask by adding more ones by taking away the corresponding number of zeroes. For example, let’s say you have an Internet café with about 50 computers, 40 of which are for public use and 10 of which are used in the back office for accounting and such (Figure 5.25). Your network ID is 192.168.4.0/24. You want to prevent people using the public systems from accessing your private machines, so you decide to create subnets. You also have wireless Internet and want to separate wireless clients (never more than 10) on their own subnet.

FIGURE 5.25   Layout of the network

You need to keep two things in mind about subnetting. First, start with the given subnet mask and add more ones to the right until you have the number of subnets you need. Second, forget the dots. They no longer define the subnets.

Never try to subnet without first converting to binary. Too many techs are what I call “victims of the dots.” They are so used to working only with class licenses that they forget there’s more to subnets than just /8, /16, and /24 networks. There is no reason network IDs must end on the dots. The computers, at least, think it’s perfectly fine to have subnets that end at points between the periods, such as /26, /27, or even /22. The trick here is to stop thinking about network IDs and subnet masks just in their dotted decimal format and instead return to thinking of them as binary numbers.

Exam Tip

Some authors will drop the trailing zeros when using CIDR notation. I always do this when teaching because it’s faster to write. So you might see a network ID like 192.168.4/24. The last octet of zero is implied by the /24. Either way works.

Let’s begin subnetting the café’s network of 192.168.4/24. Start by changing a zero to a one on the subnet mask so the /24 becomes a /25 subnet:

11111111111111111111111110000000

Calculating Hosts

Before going even one step further, you need to answer this question: On a /24 network, how many hosts can you have? Well, if you used dotted decimal notation, you might say

192.168.4.1 to 192.168.4.254 = 254 hosts

But do this from the binary instead. In a /24 network, you have eight zeroes that can be the host ID:

00000001 to 11111110 = 254

There’s a simple piece of math here: 2x – 2, where x represents the number of zeroes in the subnet mask:

2⁸ – 2 = 254

If you remember this simple formula, you can always determine the number of hosts for a given subnet. This is critical! Memorize this!

If you have a /26 subnet mask on your network, what is the maximum number of hosts you can have on that network?

    1.  Because a subnet mask always has 32 digits, a /26 subnet means you have 6 zeroes left after the 26 ones.

    2.  2⁶ – 2 = 62 total hosts.

Excellent! Knowing how to determine the number of hosts for a particular subnet mask will help you tremendously in a moment.

Your First Subnet

Let’s now make a subnet. All subnetting begins with a single network ID. In this scenario, you need to convert the 192.168.4/24 network ID for the café into three network IDs: one for the public computers, one for the private computers, and one for the wireless clients.

Travel Advisory

You cannot subnet without using binary!

The primary tool for subnetting is the existing subnet mask. Write it out in binary. Place a line at the end of the ones, as shown in Figure 5.26.

FIGURE 5.26   Step 1 in subnetting

Now draw a second line one digit to the right, as shown in Figure 5.27. You’ve now separated the subnet mask into three areas that I call (from left to right) the default subnet mask (DSM), the network ID extension (NE), and the hosts (H). These are not industry terms so you won’t see them on the CompTIA Network+ exam, but they’re a handy Mike Trick that makes the process of subnetting a lot easier.

FIGURE 5.27   Organizing the subnet mask

You now have a /25 subnet mask. At this point, most people first learning how to subnet start to freak out. They’re challenged by the idea that a subnet mask of /25 isn’t going to fit into one of the three pretty subnets of 255.0.0.0, 255.255.0.0, or 255.255.255.0. They think, “That can’t be right! Subnet masks are made out of only 255s and 0s.” That’s not correct. A subnet mask is a string of ones followed by a string of zeroes. People only convert it into dotted decimal to enter things into computers. So convert /25 into dotted decimal. First write out 25 ones, followed by seven zeroes. (Remember, subnet masks are always 32 binary digits long.)

11111111111111111111111110000000

Insert the periods in between every eight digits:

11111111.11111111.11111111.10000000

Then convert them to dotted decimal:

255.255.255.128

Get used to the idea of subnet masks that use more than 255s and 0s. Here are some examples of perfectly legitimate subnet masks. Try converting these to binary to see for yourself.

255.255.255.224

255.255.128.0

255.248.0.0

Calculating Subnets

When you subnet a network ID, you need to follow the rules and conventions dictated by the good folks who developed TCP/IP to ensure that your new subnets can interact properly with each other and with larger networks. All you need to remember for subnetting is this: start with a beginning subnet mask and extend the subnet extension until you have the number of subnets you need. The formula for determining how many subnets you create is 2y, where y is the number of bits you add to the subnet mask.

Figure 5.28 shows a starting subnet of 255.255.255.0. If you move the network ID extension over one, it’s only a single digit: 2¹.

FIGURE 5.28   Organizing the subnet mask

That single digit is only a zero or a one, which gives you two subnets. You have only one problem—the café needs three subnets, not just two! So let’s take the original /24 and subnet it down to /26. Extending the network ID by two digits creates four new network IDs, 2² = 4. To see each of these network IDs, first convert the original network ID—192.168.4.0—into binary. Then add the four different network ID extensions to the end, as shown in Figure 5.29.

FIGURE 5.29   Creating the new network IDs

Figure 5.30 shows a sampling of the IP addresses for each of the four new network IDs.

FIGURE 5.30   New network ID address ranges

Now convert these four network IDs back to dotted decimal:

The host ranges start with the first address available after the network ID. The first one is obvious, because the network ID ends with 0 in the fourth octet, so the first host would have a 1 in the fourth octet. The last number available in the host range is one number before the start of the next network ID, because the last available address on the subnet is the broadcast address.

Congratulations! You’ve just taken a single network ID, 192.168.4.0/24, and subnetted it into four new network IDs! Figure 5.31 shows how you can use these new network IDs in a network.

FIGURE 5.31   Three networks using the new network IDs

You may notice that the café only needs three subnets, but you created four—you’re wasting one. Because subnets are created by powers of two, you will often create more subnets than you need—welcome to subnetting.

Travel Advisory

In terms of the café example, the unused network ID sets them up for scalability. If the café grows to need another subnet, it’s already there for them to use without messing with the existing subnets.

IPv6 Addressing

The word is out (actually, it has been for some time)—the Internet’s running out of spare 32-bit IP addresses. What is the Internet to do? Simple—use bigger addresses. But is that possible while making everything backward-compatible with the existing address scheme? Sure it is; here’s IP version 6.

It sounds easy, but it has taken many years to perfect a replacement for the 32-bit IP addressing scheme.

With a 128-bit address range, IPv6 supports a mind-blowing 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses, which equates to approximately 665,570,793,348,866,943,898,599 addresses per square meter of the surface of the planet Earth.

IPv6 is in use today on parts of the Internet, but it’s not having much impact on the desktop (yet). The new addressing scheme was designed to slide in place of IPv4 relatively seamlessly, and parts of the Internet infrastructure are being upgraded all the time without us noticing. IPv6 will address two major issues that plague IPv4: a shortage of addresses and the increasing complexity of routing information.

Exam Tip

For the CompTIA Network+ exam, you will need to know and identify an IPv6 address along with some basics about the IPv6 address schemes. You don’t need to memorize the long numbers mentioned earlier—they’re just there out of interest and to give you some sense of what “128-bit addressing” means.

IPv6 Addresses

An IPv6 address is a 128-bit address displayed in hexadecimal format and not the dotted decimal notation that is used by IPv4. The IPv6 address is divided into eight 16-bit groups that are separated by a colon (:). Many techs call these groups hextets, although that’s not an official name. The following is an example of an IPv6 address:

65b3:b834:45a3:0000:0000:762e:0270:5224

An IPv6 address is not case-sensitive, and you do not need to place leading zeros at the beginning of the address when referencing a system that has leading zeros at the beginning. You can also replace consecutive zeros with double colons (::) when referencing an address that has a group of zeros in the address. For example, the loopback address in IPv6 is 0:0:0:0:0:0:0:1 and can be shorted to ::1, with the :: replacing all the consecutive zeros at the beginning of the address. This process is known as compressing zeros.

Exam Tip

You need to know that IPv6 uses a 128-bit address space. You may also be asked to identify the IPv6 loopback address: 0:0:0:0:0:0:0:1.

IPv6 uses three types of addresses: unicast, multicast, and anycast:

    • Unicast   Used for one-to-one communication.

    • Multicast   Used to send data to a group of systems.

    • Anycast   Applied to a group of systems providing a service. Clients that send data to the anycast address could have the data sent to any of the systems that are part of the anycast address.

To make life more complicated, you should be familiar with different types of unicast addresses for the CompTIA Network+ exam: global unicast, site-local unicast, and link-local unicast addresses handle different types of unicast traffic. Following is a quick breakdown of each of the different types of unicast addresses:

    • Global unicast   A public IPv6 address that is routable on the Internet. The address assigned to the host must be unique on the Internet. This address type is equivalent to a public IP address with IPv4.

    • Site-local unicast   A private address for the IPv6 protocol; the address always starts with FEC0. Assigning a site-local address to a system is equivalent to using a private address in IPv4, such as 10.0.0.0. The site-local address cannot be used to communicate off the local site or network and is not reachable by other sites or systems on the Internet.

    • Link-local unicast   An address that’s automatically assigned to the system and is used to communicate only with other nodes on the link. Link-local addresses always start with FE80. This address type is equivalent to an APIPA address with IPv4.

Exam Tip

You should be familiar with two of the reserved addresses in IPv6: the loopback address, which is 0:0:0:0:0:0:0:1 (or ::1), and the address for a system with no address specified: 0:0:0:0:0:0:0:0 (or ::).

IPv6 Protocols

Not only has the address scheme changed with IPv6, but so have the protocols that exist in the IPv6 protocol suite. ICMPv6 provides a great example.

ICMPv6

The ICMPv6 protocol is responsible for error and status information as in IPv4, but it has been changed. ICMPv6 uses codes, while ICMPv4 used types and codes. For ICMPv6, each code indicates the type of message. Codes from 0 to 127 are used by error messages, while codes 128 to 255 are for information messages. For example, the echo request message is code 128 with ICMPv6, and the echo reply message is code 129.

ICMPv6 has expanded on its features from the ICMPv4 days. You should be familiar with the following two features of the ICMPv6 protocol:

    • Multicast Listener Discovery (MLD)   Replaces the multicast protocol in IPv4 known as Internet Group Management Protocol (IGMP) and is used for multicast communication.

    • Neighboring Discovery (ND)   Replaces ARP from the IPv4 days by performing the same function, but it’s also responsible for neighboring router discovery, automatic address assignment, and duplicate address detection, to name a few features.

IPv6 has been totally redesigned and offers many additional new features, but for the CompTIA Network+ exam, you need to know only the basics.

Travel Advisory

Further information on IPv6 can be found at http://techdressescrosoft.com/en-ca/network/bb530961.aspx.

Domain Name System

TCP/IP networks use Domain Name System (DNS) servers to translate IP addresses into names that humans can better handle and remember. DNS has a set of rules for names and rules for name resolution that enable computers to communicate over networks large and small.

DNS uses a hierarchical naming scheme. When a device wants to know the IP address for a device somewhere else in a network, it queries the local DNS server. The DNS server on a local network knows all the names and IP addresses for local computers. If the LAN connects to other LANs, the DNS server will know the IP address for a DNS server higher up the chain. That way, if a local computer needs to find the IP address for a remote computer, the DNS server doesn’t have to know it. It simply forwards the DNS request up to the next higher DNS server. This continues until resolution occurs (Figure 5.32).

FIGURE 5.32   A host’s DNS server resolves an FQDN using a hierarchy of DNS servers.

The top-dog DNS server is actually a bunch of powerful computers dispersed around the world. They work as a team and are known collectively as the DNS root servers (or simply as the DNS root). The Internet name of this computer team is “.”—that’s right, just “dot.” Sure, it’s weird, but it’s quick to type, and they had to start somewhere.

DNS root has the complete definitive name resolution table, but most name resolution work is delegated to other DNS servers. Just below the DNS root in the hierarchy is a set of DNS servers—called the top-level domain servers—that handle what are known as the top-level domain (TLD) names. These are the famous com, org, net, edu, gov, mil, and int names (although many TLDs have been added since 2001). The top-level DNS servers delegate to thousands of second-level DNS servers; these servers handle the millions of names, like totalsem.com and whitehouse.gov, that have been created within each of the top-level domains.

Exam Tip

The original top-level domain names were com, org, net, edu, gov, mil, and int.

A complete DNS name, including the host name and all of its domains (in order), is called a fully qualified domain name (FQDN), and it’s written with the root on the far right, followed by the names of the domains (in order) added to the left of the root, and the host name on the far left.

A typical DNS name for a web server, such as www.google.com, for example, has three components:

    • .com refers to the root domain.

    • .google refers to the google subdomain of the root domain.

    • www refers to the specific computer (or cluster of computers, in this case).

The www.google.com FQDN maps directly to an IP address. DNS servers at the .com level certainly know the IP address for the google.com DNS server; the google.com DNS server knows the IP address for the www host.

FQDNs work at the local level too, by the way, even in networks that don’t connect to the Internet. My office LAN is totalhome, with no .com or anything. So to access my file server, my employees and I type //fs7.totalhome in Network and the file server opens up. I’m using Internet FQDNs for the primary example of how DNS works because that’s what most people are used to seeing.

Although this process might sound a bit complex, it works very well and provides a great deal of flexibility. Prior to the existence of DNS, every computer that wanted to use domain names had to have a local file—called a HOSTS file—that contained a table of IP addresses and their associated names. This file was stored on every system’s hard disk. Because the HOSTS file changed on a daily basis, network techs had to keep downloading updates from the Internet! You can still use a HOSTS file today if you just have a small number of computers on a local network, but DNS is the way to go for bigger networks. A simple HOSTS file would look something like this:

109.54.94.197 scott.mikemeyersworld.com

138.125.163.17 mike.scottjernigansworld.com

127.0.0.1 localhost

Notice that the name localhost appears in the HOSTS file as an alias for the loopback address 127.0.0.1.

Exam Tip

Most DNS servers support a feature known as Dynamic DNS (DDNS), which means that client systems can automatically register their own records in DNS upon bootup using DHCP (see the DHCP section below). This is a popular feature with Windows DNS servers. You could add a special option to the DHCP server, which is generally called the DNS suffix. The DNS suffix helps clients access network resources more efficiently.

DNS Records

A DNS server maintains a database of information about the domain names it knows, separating them according to type, using different records. For example, an A record maps a hostname to its IPv4 address. An AAAA record does the same for a hostname in an IPv6 network.

Local Lingo

MX, CNAME, PTR Other, less common DNS record types are MX, used by SMTP servers to determine where to send mail; CNAME, which maps aliases to IP addresses; and PTR, which is used in reverse lookups. My computer’s name is mikespc.totalhome, but people in my office can ping mike.totalhome and reach the same physical computer. MX stands for Mail eXchanger; CNAME is short for canonical name; PTR is short for pointer.

DHCP

With so many settings (IP address, subnet mask, default gateway, DNS servers) to specify, the typical TCP/IP network administrator can spend days properly configuring each host manually. For troubleshooting purposes, you sometimes must put in all these settings manually, what we call static configuration, because the settings only change when you manually make the changes.

Fortunately, TCP/IP provides a protocol that takes much of the drudgery out of TCP/IP configuration: DHCP.

Travel Advisory

IPv6 uses DHCPv6 as its DHCP protocol, while the DHCP protocol that came with IPv4 is known as DHCPv4.

Dynamic Host Configuration Protocol (DHCP) servers distribute IP addresses and additional IP settings to machines on the network. Once a computer is configured to use DHCP, we call it a DHCP client. When a DHCP client boots up, it automatically sends out a special DHCP Discover packet using the broadcast address. This DHCP Discover message asks, “Are there any DHCP servers out there?” (See Figure 5.33.) What follows is a series of back-and-forth broadcasts.

FIGURE 5.33   Computer sending out a DHCP Discover message

The DHCP server responds to DHCP Discover requests with a DHCP Offer. The DHCP server is configured to pass out IP addresses from a range (called a DHCP scope) and a subnet mask (Figure 5.34). It also passes out other information, known generically as options, that cover an outrageously large number of choices, such as your default gateway, DNS server, Network Time server, and so on.

FIGURE 5.34   DHCP server main screen

Exam Tip

DHCP servers can be set up to reserve addresses for specific machines through what’s called, appropriately, DHCP reservations. You use these for servers inside your network, for example, so if you had to change their IP addresses for some reason, you could do it from a central location. The other option is to use static IPs, but then you’d need to log into each server to change the IP addresses.

Figure 5.35 shows the configuration screen from the popular DHCP Server that comes with Windows Server 2008. Note the single scope. Figure 5.36 shows the same DHCP Server tool, in this case, detailing the options screen.

FIGURE 5.35   DHCP Server configuration screen

FIGURE 5.36   DHCP Server options screen

The DHCP client sends out a DHCP Request—a poor name choice, as it is really accepting the offer. The DHCP server then sends a DHCP Acknowledge and lists the MAC address as well as the IP information given to the DHCP client in a database (Figure 5.37).

FIGURE 5.37   DHCP request and DHCP acknowledge

The acceptance from the DHCP client of the DHCP server’s data is called a DHCP lease. A DHCP lease is set for a fixed amount of time, generally five to eight days. Near the end of the lease time, the DHCP client simply makes another DHCP Discover message. The DHCP server looks at the MAC address information and, unless another computer has taken the lease, always gives the DHCP client the same IP information, including the same IP address.

Living with DHCP

DHCP is very convenient and, as such, very popular. It’s so popular that you’ll very rarely see a user’s computer on any network using static addressing.

You should know how to deal with the problems that arise with DHCP. The single biggest issue is when a DHCP client tries to get a DHCP address and fails. You’ll know when this happens because the operating system will post some form of error telling you there’s a problem (Figure 5.38) and the DHCP client will have a rather strange address in the 169.254/16 network ID.

FIGURE 5.38   DHCP error in Windows 7

This special IP address is generated by Automatic Private IP Addressing (APIPA). All DHCP clients are designed to generate an APIPA address automatically if they do not receive a response to a DHCP Discover message. The client only generates the last two octets of an APIPA address. This at least allows the dynamic clients on a single network to continue to communicate with each other because they are on the same network ID.

 Objective 5.01: The TCP/IP Protocol Suite   The TCP/IP suite is made up of a number of protocols that work together to make it the most popular protocol in networking today. Application-level protocols use port numbers to initiate some sort of request (on the client) and answer that request (on the server). TCP and UDP operate at the Transport layer, packaging data into segments and datagrams, and sending those to the IP for encapsulation into IP packets.

 Objective 5.02: IPv4 Addressing   The original IP addressing scheme (IPv4) uses a 32-bit address to identify a host address and its network address based on a series of addressing schemes known as IP classes. The associated subnet mask identifies where the boundary between the network and host address lies and also allows us to change this boundary if we wish.

 Objective 5.03: CIDR and Subnetting   CIDR did away with typical class IDs. Altering the default subnet mask enables you to subdivide a network ID into smaller sections, called subnets. Subnetting can help with general network management and also traffic management.

 Objective 5.04: IPv6 Addressing   IPv6 uses a 128-bit addressing scheme to provide (in effect) a limitless supply of IP addresses, and it is needed because the 32-bit address range of IPv4 is running out of spare addresses. Parts of the Internet are already using IPv6, but it is not generally in use at the desktop yet. Be sure that you can identify an IPv6 address, and know that the loopback address is 0:0:0:0:0:0:0:1 or (::1) and that an unspecified address shows as 0:0:0:0:0:0:0:0 (or ::).

 Objective 5.05: Domain Name System   Although it’s easier for humans to refer to computer systems using computer names or fully qualified domain names (such as www.totalsem.com), communication between two systems can take place only if the target machine’s IP address is known. TCP/IP environments use a database system called DNS (Domain Name System) to resolve IP addresses from fully qualified domain names, such as www.totalsem.com. DNS uses a hierarchical structure, with separate servers (or groups of servers) managing the resolution of various parts of a domain name. Use DHCP for automatic setup of hosts on a network, so you don’t have to provide the IP address, subnet mask, and so on manually.

REVIEW QUESTIONS

    1.  Which of the following does not represent an IPv6 address?

          A.  2001:0db8:3c4d:0015:0000:0000:abcd:ef12

          B.  0:0:0:0:0:0:0:1

          C.  255.255.0.0

          D.  ::1

    2.  Which of the following is a valid class B host address?

          A.  147.28.0.0

          B.  192.168.14.50

          C.  12.12.12.12

          D.  128.14.255.0

    3.  What is the minimum number of data bits required for subnet addressing to allow a total of five subnets to be created?

          A.  1

          B.  2

          C.  3

          D.  4

    4.  What port number does Telnet use?

          A.  443

          B.  23

          C.  80

          D.  43

    5.  Which of the following protocols provides TCP/IP name resolution?

          A.  DHCP

          B.  SNMP

          C.  Telnet

          D.  DNS

    6.  Which protocol provides automatic host IP address assignment?

          A.  DHCP

          B.  DNS

          C.  NetBIOS

          D.  BOOTR

    7.  Which protocol enables connectionless communication?

          A.  DNS

          B.  DHCP

          C.  TCP

          D.  UDP

    8.  What port number is used to connect to a DNS server?

          A.  20

          B.  23

          C.  53

          D.  67

    9.  A user calls and says his IP address is 169.154.50.12. What kind of address does he have?

          A.  APIPA

          B.  DHCP

          C.  DNS

          D.  Loopback

    10.  Which of the following is a valid class A address?

          A.  10.256.128.12

          B.  120.255.128.12

          C.  169.154.128.12

          D.  192.168.1.12

REVIEW ANSWERS

    1.  C   255.255.0.0 is an IPv4 class B subnet mask address. All other choices are valid IPv6 addresses.

    2.  D   128.14.255.0 is a valid class B address. Although choice A is a class B address, it is an invalid host address of all zeroes (x.x.0.0).

    3.  C   Three bits allow a total of six subnets to be created, giving scope for the five we want to create. Two bits (choice B) would allow only two subnets.

    4.  B   Telnet uses port 23.

    5.  D   DNS provides name resolution. DHCP dynamically dishes out IP addresses and other important information to clients. SNMP is for network management, and Telnet provides terminal emulation functionality.

    6.  A   DHCP, Dynamic Host Configuration Protocol, provides automatic host IP address assignment.

    7.  D   UDP enables connectionless communication.

    8.  C   DNS uses UDP and TCP port 53.

    9.  A   The poor guy’s computer can’t reach a DHCP server and thus has a default APIPA address.

    10.  B   Both A and B start in the right address range (first octet between 1 and 126), but the second octet in choice A contains an invalid number, because 255 is the highest number in an IPv4 octet.

Routing

  ITINERARY  

      Objective 6.01   Routing Tables

      Objective 6.02   Network Address Translation

      Objective 6.03   Dynamic Routing

Routers interconnect networks to enable communication and resource sharing among those networks. Routers connect through physical means, such as cables or wireless radio frequency waves. Various routing protocols enable routers to exchange information and thus govern the flow of data. We touched on routers in Chapter 4 and then briefly again in Chapter 5. This chapter explores routers in more detail and looks at the process and protocols for routing.

Classically, routers are dedicated boxes that contain at least two connections, although many routers contain many more connections. In a business setting, for example, you might see a Cisco 2600 Series device, one of the most popular routers ever made. These routers are a bit on the older side, but Cisco builds their routers to last. With occasional software upgrades, a typical router will last for many years. The 2611 router shown in Figure 6.1 has two connections (the other connections are used for maintenance and configuration). The two “working” connections are circled. One port leads to one network; the other leads to another network. The router reads the IP addresses of the packets to determine where to send the packets. (I’ll elaborate on how that works in a moment.)

FIGURE 6.1   Cisco 2611 router

Most techs today get their first exposure to routers with the ubiquitous home routers that enable PCs to connect to a DSL modem or a cable modem (Figure 6.2). The typical home router, however, serves multiple functions, often combining a router, a switch, and other features like a firewall (for protecting your network from intruders), a DHCP server, and much more into a single box.

FIGURE 6.2   Business end of a typical home router

Figure 6.3 shows the electronic diagram for a two-port Cisco router, whereas Figure 6.4 shows the diagram for a Linksys home router.

FIGURE 6.3   Cisco router diagram

FIGURE 6.4   Linksys home router diagram

Note that both boxes connect two networks. The big difference is that the LAN side of the Linksys home router connects immediately to the built-in switch. That’s convenient! You don’t have to buy a separate switch to connect multiple computers to the cable modem or DSL receiver. Many users, and even some new techs, look at that router, though, and say, “It has five ports so it’ll connect to five different networks,” when in reality it can connect only two networks. The extra physical ports belong to the built-in switch.

All routers—big and small, plain or bundled with a switch—examine packets and then send the packets to the proper destination. Let’s take a look at that process in more detail now.

Routing Tables

Routing begins as frames come into the router for handling (Figure 6.5). The router immediately strips off the layer-2 information and drops the resulting IP packet into a queue (Figure 6.6). The important point to make here is that the router doesn’t care where the packet originated. Everything is dropped into the same queue based on the time it arrived.

FIGURE 6.5   Incoming packets

FIGURE 6.6   All incoming packets stripped of layer-2 data and dropped into a common queue

The router inspects each packet’s destination IP address and then sends the IP packet out the correct port. To perform this inspection, each router comes with a routing table that tells the router exactly where to send the packets. Figure 6.7 shows the simple routing table for a typical home router. This router has only two ports internally: one that connects to whichever type of service provider you use to bring the Internet into your home (cable/DSL/fiber or whatever)—labeled as WAN in the Interface column of the table—and another one that connects to a built-in four-port switch—labeled LAN in the table. Figure 6.8 is a diagram for the router. Let’s inspect this router’s routing table; this table is the key to understanding and controlling the process of forwarding packets to their proper destination.

FIGURE 6.7   Routing table from a home router

FIGURE 6.8   Electronic diagram of the router

Each row in this little router’s simple routing table defines a single route. Each column identifies specific criteria. Reading Figure 6.7 from left to right shows the following:

    • Destination LAN IP   A defined network ID. Every network ID directly connected to one of the router’s ports is always listed here.

    • Subnet Mask   To identify the network ID from an IP address, you need a subnet mask (described in Chapter 5).

Your router compares the destination LAN IP in the packet with the network ID and subnet mask in each route of its routing table to see if a packet matches that route. For example, if you had a packet with the destination 10.12.14.26 coming into the router, the router would use its routing table to determine that the packet matches the first route shown in Figure 6.7. The other two columns in the routing table then tell the router what to do with the packet:

    • Gateway   The IP address for the next hop router; in other words, where the packet should go. If the outgoing packet is for a network ID that’s not directly connected to the router, the Gateway column tells the router the IP address of a router to which to send this packet. That router then handles the packet and your router is done (you count on well-configured routers to make sure your packet will get to where it needs to go!). If the network ID is directly connected, then you don’t need a gateway. Based on what’s needed, this is set to 0.0.0.0, or to the IP address of the directly connected port.

    • Interface   This tells the router which of its ports to use. On this router, it uses the terms “LAN” and “WAN.” Other routing tables use the port’s IP address or some other type of abbreviation. Cisco routers, for example, use f0/0, f0/1, and so on.

The router compares the destination IP address on a packet to every listing in the routing table and then sends the packet out. It reads every line and then decides what to do. Some routers compare a packet to the routing table by starting from the top down, and other routers read from the bottom up. The direction the router chooses to read the routing table isn’t important because the router must compare the destination IP address to every route in the routing table. The most important trick to reading a routing table is to remember that a zero (0) means “anything.” For example, in Figure 6.7, the first route’s destination LAN IP is 10.12.14.0. You can compare that to the subnet mask (255.255.255.0) to confirm that this is a /24 network. This tells you that any value (between 1 and 254) is acceptable for the last value in the 10.12.14/24 network ID.

Routing tables tell you a lot about the network connections. From just this single routing table, for example, the diagram in Figure 6.9 can be drawn.

FIGURE 6.9   The network based on the routing table in Figure 6.7

So how do I know the 76.30.4.1 port connects to another network? The third line of the routing table shows the default route for this router, and almost every router has one. This line says

(Any destination address) (with any subnet mask) (forward it to 76.30.4.1) (using my WAN port)

Travel Advisory

Exceptions to Default Routes   There are two places where you’ll find routers that do not have default routes: private (as in not on the Internet) internetworks, where every router knows about every single network, and the monstrous “Tier One” backbone, where you’ll find the routers that make the main connections of the Internet. Every other router has a default route.

The default route is very important because this tells the router exactly what to do with every incoming packet unless another line in the routing table gives another route. Excellent! Interpret the other two lines of the routing table in Figure 6.7 in the same fashion:

(Any packet for the 10.12.14.0) (/24 network ID) (don’t use a gateway) (just ARP on the LAN interface to get the MAC address and send it directly to the recipient)

(Any packet for the 76.30.4.0) (/24 network ID) (don’t use a gateway) (just ARP on the WAN interface to get the MAC address and send it directly to the recipient)

I’ll let you in on a little secret. Routers aren’t the only devices that use routing tables. In fact, every node (computer, printer, TCP/IP-capable soda dispenser, whatever) on the network also has a routing table.

At first, this may seem silly—doesn’t every computer only have a single Ethernet connection and, therefore, all data traffic has to go out that port? First of all, many computers have more than one NIC. (These are called multihomed computers.) But even if your computer has only a single NIC, how does it know what to do with an IP address like 127.0.01? Second, every packet sent out of your computer uses the routing table to figure out where the packet should go, whether directly to a node on your network or to your gateway. Third, the routing table tells the PC whether the communication is unicast, multicast, or broadcast.

Local Lingo

Multihoming   Multihoming is using more than one NIC in a system, either as a backup or to speed up a connection. Systems that can’t afford to go down (like web servers) often have two NICs that share the same IP address. If one NIC goes down, the other kicks in automatically.

Here’s an example of a routing table in Windows. This machine connects to the home router described earlier, so you’ll recognize the IP addresses it uses.

Unlike the routing table for the typical home router you saw in Figure 6.7, this one seems a bit more complicated, if for no other reason than it has a lot more routes. My PC has only a single NIC, though, so it’s not quite as complicated as it might seem at first glance. Take a look at the details. First note that my computer has an IP address of 10.12.14.201/24 and 10.12.14.1 as the default gateway.

Travel Advisory

Viewing Routing Tables in Linux and OS X   Every modern operating system gives you tools to view a computer’s routing table. Most techs use the command line or terminal window interface—often called simply terminal—because it’s fast. To see your routing table in Windows, Linux, or Mac OS X, for example, type this command at a terminal:

netstat –r

In Windows, try this command as an alternative:

route print

You should note two differences in the columns from what you saw in the previous routing table. First, the interface has an actual IP address—10.12.14.201, plus the loopback of 127.0.0.1—instead of the word “LAN.” Second—and this is part of the magic of routing—is something called the metric.

A metric is just a relative value that defines the “cost” of using this route. The power of TCP/IP is that a packet can take more than one route to get to the same place. Figure 6.10 shows a networked router with two routes to the same place. The router has a route to network B with a metric of 1 using route 1, and a second route to network B using route 2 with a metric of 10.

FIGURE 6.10   Two routes to the same network

Travel Advisory

When a router has more than one route to the same network, it’s up to the person in charge of that router to assign a different metric for each route. With dynamic routing protocols (discussed in detail later in the chapter in “Dynamic Routing”), the routers determine the proper metric for each route.

Lowest routes always win. In this case, the router will always use the route with the metric of 1, unless that route suddenly stopped working. In that case, the router would automatically switch to the route with the 10 metric (Figure 6.11). This is the cornerstone of how the Internet works! The entire Internet is nothing more than a whole bunch of big, powerful routers connected to lots of other big, powerful routers. Connections go up and down all the time, and routers (with multiple routes) constantly talk to each other, detecting when a connection goes down and automatically switching to alternate routes.

FIGURE 6.11   When a route no longer works, the router automatically switches.

I’ll go through this routing table one line at a time. Remember, every address is compared to every line in the routing table before it goes out, so it’s no big deal if the default route is at the beginning or the end. Windows machines read from bottom up, going through all local addresses before going out to the router, so that’s how I’ll go through it here.

The bottom line defines the default IP flooded broadcast, a packet with the destination address of all ones. All TCP/IP nodes that connect at the Data Link layer, regardless of network ID, will receive a packet directed to the IP broadcast of 255.255.255.255.

The next line up is the multicast address range. Odds are good you’ll never need it, but most operating systems put it in automatically.

The next route says that any addresses in the 169.254/16 network ID are part of the LAN (remember, whenever the gateway and interface are the same, the connection is local). If your computer uses Dynamic Host Configuration Protocol (DHCP) and can’t get an IP address, this route would enable you to communicate with other computers on the network that are also having the same DHCP problem. Note the high metric.

This next line shows that anytime you send communications to any address starting with 127, the operating system will automatically map it to 127.0.0.1 (notice the Interface column), which is the official loopback address bound to the IP address and NIC. While 127.0.0.1 is the official loopback address, do appreciate that using any 128/8 address will work as the loopback. Try typing the following into a command prompt:

Ping 127.34.32.61

You’ll see you get a successful ping—from 127.0.0.1!

The next line up is the directed broadcast. Occasionally, your computer needs to send a broadcast to the other computers on the same network ID. That’s what this row signifies. The difference between a directed broadcast and a flooded broadcast is the former goes only to the targeted subnet, not the full broadcast domain.

Travel Advisory

Directed vs. Flooded Broadcasts   In most networks, targeting a subnet is the same thing as targeting a broadcast domain. In a scenario where multiple subnets attach to a switched network, on the other hand, you would want to create a distinction between broadcasts that go to only the nodes on your network (a directed broadcast) or to all nodes (a flooded broadcast).

Okay, on to the next line. This one’s easy. Anything addressed to this machine should go right back to it through the loopback (127.0.0.1). When you ping your IP address or the loopback address, nothing leaves the NIC. Traffic goes down to the NIC and then right back up to the OS.

The next line defines the local connection: (Any packet for the 10.12.14.0) (/24 network ID) (don’t use a gateway) (just ARP on the LAN interface to get the MAC address and send it directly to the recipient) (Cost of 1 to use this route).

So, if a gateway of 10.12.14.201 here means “don’t use a gateway,” why put a number in at all? Local connections don’t use the default gateway, although every routing table has a gateway column. The Microsoft folks had to put something there, thus they put the IP address of the NIC. That’s why the gateway address is the same as the interface address. The NIC is the gateway between the local PC and the destination. Just pass it out the NIC and the destination will get it.

This is how Windows XP displays the gateway on this line. In Windows Vista and Windows 7, the gateway value for local connections just says “on-link”—a clear description! Part of the joy of learning routing tables is getting used to how different operating systems deal with issues like these.

The top line defines the default route: (Any destination address) (with any subnet mask) (forward it to my default gateway) (using my NIC) (Cost of 1 to use this route). Anything that’s not local goes to the router and from there out to the destination (with the help of other routers).

In this section, you’ve seen two different types of routing tables from two different types of devices. Even though routing tables have different ways to list the routes and different ways to show the categories, they all perform the same job: moving IP packets to the correct interface to ensure they get to where they need to go.

Freedom from Layer 2

Routers enable you to connect different types of network technologies. You now know that routers strip off all of the layer-2 data from the incoming packets, but thus far you’ve only seen routers that connect to different Ethernet networks—and that’s just fine with routers. But routers can connect to almost anything that stores IP packets. Not to take away from some very exciting upcoming chapters, but Ethernet is not the only networking technology out there. Once you want to start making long-distance connections, Ethernet disappears, and technologies with names like Data-Over-Cable Service Interface Specification (DOCSIS) (cable modems), Frame Relay, and Asynchronous Transfer Mode (ATM) take over. These technologies are not Ethernet, and they all work very differently than Ethernet. The only common feature of these technologies is they all carry IP packets inside their layer-2 encapsulations.

Most serious/industry-level (that is, not home) routers enable you to add interfaces. You buy the router and then snap in different types of interfaces depending on your needs. Note the Cisco router in Figure 6.12. Like most Cisco routers, it comes with removable modules.

FIGURE 6.12   Modular Cisco router

If you’re connecting Ethernet to ATM, you buy an Ethernet module and an ATM module. If you’re connecting Ethernet to a DOCSIS (cable modem) network, you buy an Ethernet module and a DOCSIS module.

Network Address Translation

The ease of connecting computers together using TCP/IP and routers creates a rather glaring security risk. If every computer on a network must have a unique IP address, and TCP/IP applications enable you to do something on a remote computer, what’s to stop a malicious programmer from writing a program that does things on your computer that you don’t want done? All he or she would need is the IP address for your computer and the attacker could target you from anywhere on the network. Now expand this concept to the Internet. A computer sitting in Peoria can be attacked by a program run from Bangkok as long as both computers connect directly to the Internet. And this happens all the time.

Security is one problem. The other is a deal breaker—the IANA assigned the last of the IPv4 addresses as of February 2011. Although you can still get an IP address from an ISP, the days of easy availability are over. Routers running some form of Network Address Translation (NAT) hide the IP addresses of computers on the LAN but still enable those computers to communicate with the broader Internet. NAT extended the useful life of IPv4 addressing on the Internet for many years. It is extremely common and heavily in use, so learning how it works is important. Note that many routers offer NAT as a feature in addition to the core capability of routing. NAT is not routing, but a separate technology. With that said, you are ready to dive into how NAT works to protect computers connected by router technology and conserve IP addresses as well.

Travel Advisory

Intent   Developers created NAT specifically to extend the life of IPv4. The fact that using NAT makes a network more secure is an added bonus.

The Setup

Here’s the situation. You have a LAN with eight computers that need access to the Internet. With classic TCP/IP and routing, several things have to happen. First, you need to get a block of legitimate, unique, expensive IP addresses from an Internet service provider (ISP). You could call up an ISP and purchase a network ID, say 1.2.3.136/29. Second, you assign an IP address to each computer and to the LAN connection on the router. Third, you assign the IP address for the ISP’s router to the WAN connection on the local router, such as 1.2.4.1. After everything is configured, the network looks like Figure 6.13. All of the clients on the network have the same default gateway (1.2.3.137). This router, called a gateway router (or simply a gateway), acts as the default gateway for a number of client computers.

FIGURE 6.13   Network setup

This style of network mirrors how computers in LANs throughout the world connected to the Internet for the first 20 years, but the major problems of security and a finite number of IP addresses worsened as more and more computers connected.

NAT solved both of these issues for many years. NAT is a simple concept: The router replaces the source IP address of a computer with its outside interface address on outgoing packets. The simplest NAT, called basic NAT, does exactly that, translating the private or internal IP address to a global IP address on a one-to-one basis.

Exam Tip

NAT replaces the source IP address of a computer with the source IP address from the outside router interface on outgoing packets. It is performed by NAT-capable routers.

Port Address Translation

Most internal networks today don’t have one machine, of course. Instead, they use a block of private IP addresses for the hosts inside the network. They connect to the Internet through one or more public IP addresses.

The most common form of NAT that handles this one-to-many connection—called Port Address Translation (PAT)—uses port numbers to map traffic from specific machines in the network. Let’s use a simple example to make the process clear. John has a network at his office that uses the private IP addressing space of 192.168.1.0/24. All the computers in the private network connect to the Internet through a single PAT router with the global IP address of 208.190.121.12/24 (see Figure 6.14).

FIGURE 6.14   John’s network setup

When an internal machine initiates a session with an external machine, such as a web browser accessing a website, the source and destination IP addresses and port numbers for the TCP segment or UDP datagram are recorded in the PAT’s translation table, and the private IP address is swapped for the public IP address on each packet. Plus, the port number used by the internal computer for the session is also translated into a unique port number and the router records this as well (see Figure 6.15).

FIGURE 6.15   PAT in action—changing the source IP address and port number to something usable on the Internet

Table 6.1 shows a sample of the translation table inside the PAT router. Note that more than one computer translation has been recorded.

When the receiving system sends the packet back, it reverses the IP addresses and ports. The PAT router compares the incoming destination port and source IP address to the entry in the NAT translation table to determine which IP address to put back on the packet. It then sends the packet to the correct computer on the network. This works even when two computers on the inside access the same server on the outside, like in Table 6.1.

This mapping of internal IP address and port number to a translated IP address and port number enables perfect tracking of packets out and in. PAT can handle many internal computers with a single public IP address because the TCP/IP port number space is big, as you’ll recall from Chapter 5, with values ranging from 0 to 65535. Some of those port numbers are used for common protocols, but many thousands are available for PAT to work its magic.

Local Lingo

Dynamic NAT   With dynamic NAT, many computers can share a pool of routable IP addresses that number fewer than the computers. The NAT might have 10 routable IP addresses, for example, to serve 40 computers on the LAN. LAN traffic uses the internal, private IP addresses. When a computer requests information beyond the network, the NAT doles out a routable IP address from its pool for that communication. Dynamic NAT is also called Pooled NAT. This works well enough—unless you’re the unlucky 11th person to try to access the Internet from behind the company NAT—but has the obvious limitation of still needing many true, expensive, routable IP addresses.

PAT takes care of all of the problems facing a network exposed to the Internet. You don’t have to use legitimate Internet IP addresses on the LAN, and the IP addresses of the computers behind the routers are invisible and protected from the outside world.

Since the router is revising the packets and recording the IP address and port information already, why not enable it to handle ports more aggressively? Enter port forwarding, stage left.

Port Forwarding

The obvious drawback to relying exclusively on PAT for network address translation is that it only works for outgoing communication, not incoming communication. For traffic originating outside the network to access an internal machine, such as a web server hosted inside your network, you need to use other technologies.

Static NAT (SNAT) maps a single routable (that is, not private) IP address to a single machine, enabling you to access that machine from outside the network. The NAT keeps track of the IP address or addresses and applies them permanently on a one-to-one basis with computers on the network. You could run a web server on an internal host, for example, that has a private IP address but could still be accessed over the Internet. Because outside traffic won’t know the internal IP address, you’ve added a layer of security from attacks on that IP address.

Exam Tip

Despite the many uses in the industry of the acronym SNAT, the CompTIA Network+ exam uses SNAT for Static NAT exclusively.

With port forwarding, you can designate a specific local address for various network services. Computers outside the network can request a service using the public IP address of the router and the port number of the desired service. The port-forwarding router would examine the packet, look at the list of services mapped to local addresses, and then send that packet along to the proper recipient.

You can use port forwarding to hide a service hosted inside your network by changing the default port number for that service. To hide an internal web server, for example, you could change the request port number to something other than port 80, the default for HTTP traffic. The router in Figure 6.16, for example, is configured to forward all port 8080 traffic to the internal web server at port 80.

FIGURE 6.16   Setting up port forwarding on a home router

To access that internal website from outside your local network, you would have to change the URL in the web browser by specifying the port request number. Figure 6.17 shows a browser that has :8080 appended to the URL, which tells the browser to make the HTTP request to port 8080 rather than port 80.

FIGURE 6.17   Changing the URL to access a website using a nondefault port number

Exam Tip

Most browsers require you to write out the full URL, including http://, when using a nondefault port number.

Configuring NAT

Configuring NAT on home routers is a no-brainer, as these boxes invariably have NAT turned on automatically. Figure 6.18 shows the screen on my home router for NAT. Note the radio buttons that say Gateway and Router.

FIGURE 6.18   NAT setup on home router

By default, the router is set to Gateway, which is Linksys-speak for “NAT is turned on.” If I wanted to turn off NAT, I would set the radio button to Router.

Figure 6.19 shows a router configuration screen on a Cisco router. Commercial routers enable you to do a lot more with NAT.

FIGURE 6.19   Configuring NAT on a commercial-grade router

Dynamic Routing

Based on what you’ve read up to this point, it would seem that routes in your routing tables come from two sources: either they are manually entered or they are detected at setup by the router. In either case, a route seems to be a static beast, just sitting there and never changing. And based on what you’ve seen so far, that is absolutely true. Routers have static routes. But most routers also have the capability to update their routes dynamically, assuming they’re provided with the extra smarts in the form of dynamic routing protocols.

Routing protocols have been around for a long time, and, like any technology, there have been a number of different choices and variants over those years. CompTIA Network+ competencies break these many types of routing protocols into three distinct groups: distance vector, link state, and hybrid. Let’s start with a deeper discussion of metrics and then sort out the various dynamic routing protocols.

Routing Metrics

Earlier in the chapter, you learned that routing tables contain a factor called a metric. A metric is a relative value that routers use when they have more than one route to get to another network. Unlike the gateway routers in our homes, a more serious router will often have multiple connections to get to a particular network.

Dynamic routing protocols enable routers to update routing tables by communicating with other routers. If a router suddenly loses a connection, it checks alternative routes to the same network. It’s the role of the metric setting for the router to decide which route to use. It always chooses the route with the lowest metric.

There is no uniform rule to set the metric value in a routing table. The various types of dynamic protocols use different criteria. Here are the most common criteria for determining a metric:

    • Maximum Transmission Unit   Better known by the abbreviation MTU, this determines the largest frame a particular technology can handle. Most Ethernet networks use 1500-byte data fields in frames. Other technologies use smaller or larger fields. If an IP packet is too big for a particular technology, that packet is broken into pieces to fit into the network protocol in what is called fragmentation. Fragmentation is bad because it slows down the movement of IP packets (see the “Latency” bullet item in this list). By setting the optimal MTU size before IP packets are sent, you avoid, or at least reduce, fragmentation.

    • Bandwidth   Some connections handle more data than others. An old dial-up connection moves, at best, 64 Kbps. A cable modem easily handles many millions of bits per second.

    • Latency   Hundreds of issues occur that slow down network connections between routers. These issues are known collectively as latency. A great example is a satellite connection. The distance between the satellite and the antenna causes a delay that has nothing to do with the speed of the connection.

Different dynamic routing protocols use one or more routing metrics to calculate their own routing metric. As you learn about these protocols, you will see how each of these calculates their own metrics differently.

Distance Vector

Distance vector routing protocols use one of several algorithms to determine the best route to other routers based on the distance (cost) and direction (vector).

The simplest total cost sums the hops (the hop count) between a router and a network. A hop is defined as each time a packet goes through a router. So if you had a router one hop away from a network, the cost for that route would be 1; if it were two hops away, the cost would be 2.

All network connections are not equal. A router might have a pair of one-hop routes to a network—one using a fast connection and the other using a slow connection. The slow single-hop route, for example, might have a metric of 10 rather than the default of 1 to reflect the fact that it’s slow. The total cost for this one-hop route is 10 even though it’s only one hop. Don’t assume a one-hop route always has a cost of 1.

Routers using a distance vector routing protocol transfer their entire routing table to other routers in the WAN. Each distance vector routing protocol has a maximum number of hops that a router will send its routing table to keep traffic down.

Assume you have four routers connected as shown in Figure 6.20. All of the routers have static routes set up between each other with the metrics shown. You add two new networks: one that connects to Router A and the other to Router D. For simplicity, call them Network ID X and Network ID Y. A computer on one network wants to send packets to a computer on the other network, but the routers in between Routers A and D don’t yet know the two new network IDs. That’s when distance vector routing protocols work their magic.

FIGURE 6.20   Getting a packet from Network ID X to Network ID Y? No clue!

Because all of the routers use a distance vector routing protocol, the problem gets solved quickly. At a certain defined time interval (usually 30 seconds or more), the routers begin sending each other their routing tables (the routers each send their entire routing table, but for simplicity, just concentrate on the two network IDs in question). On the first iteration, Router A sends its route to Network ID X to Routers B and C. Router D sends its route to Network ID Y to Router C (Figure 6.21).

FIGURE 6.21   Routes updated

This is great—Routers B and C now know how to get to Network ID X, and Router C can get to Network ID Y. There’s still no complete path, however, between Network ID X and Network ID Y. That’s going to take another interval. After another set amount of time, the routers again send their now-updated routing tables to each other, as shown in Figure 6.22.

FIGURE 6.22   Updated routing tables

Router A knows a path now to Network ID Y, and Router D knows a path to Network ID X. As a side effect, Router B and Router C have two routes to Network ID X. Router B can get to Network ID X through Router A and through Router C. Similarly, Router C can get to Network ID X through Router A and through Router B. What to do? In cases where the router discovers multiple routes to the same network ID, the distance vector routing protocol deletes all but the route with the lowest total cost (Figure 6.23).

FIGURE 6.23   Deleting higher-cost routes

On the next iteration, Routers A and D get updated information about the lower total-cost hops to connect to Network IDs X and Y (Figure 6.24).

FIGURE 6.24   Argh! Multiple routes!

Just as Routers B and C only kept the routes with the lowest costs, Routers A and D keep only the lowest-cost routes to the networks (Figure 6.25).

FIGURE 6.25   Last iteration

Now Routers A and D have a lower-cost route to Network IDs X and Y. They’ve removed the higher-cost routes and begin sending data.

At this point, if routers were human they’d realize that each router has all the information about the network and stop sending each other routing tables. Routers using distance vector routing protocols, however, aren’t that smart. The routers continue to send their complete routing tables to each other, but because the information is the same, the routing tables don’t change.

At this point, the routers are in convergence (also called steady state), meaning the updating of the routing tables for all the routers has completed. Assuming nothing changes in terms of connections, the routing tables will not change. In this example, it takes three iterations to reach convergence.

So what happens if the route between Routers B and C breaks? The routers have deleted the higher-cost routes, only keeping the lower-cost route that goes between Routers B and C. Does this mean Router A can no longer connect to Network ID Y and Router D can no longer connect to Network ID X? Yikes! Yes, it does. At least for a while.

Routers that use distance vector routing protocols continue to send their entire routing table to each other at regular intervals. After a few iterations, Routers A and D will once again know how to reach each other, although they will connect through the once-rejected slower connection.

Distance vector routing protocols work fine in a scenario such as the previous one that has only four routers. Even if you lose a router, a few minutes later the network returns to convergence. But imagine if you had tens of thousands of routers (the Internet). Convergence could take a very long time indeed. As a result, a pure distance vector routing protocol works fine for a network with a small number of routers (fewer than 10), but it isn’t good for large networks.

Routers can use one of three distance vector routing protocols: RIPv1, RIPv2, or BGP.

RIPv1

The granddaddy of all distance vector routing protocols is the Routing Information Protocol (RIP). The first version of RIP—called RIPv1—dates from the 1980s, although its predecessors go back all the way to the beginnings of the Internet in the 1960s. RIP had several limitations that made it unsuitable for the growing number of network connections. It had a maximum hop count of only 15. RIPv1 sent out an update every 30 seconds. This also turned into a big problem because every router on the network would send its routing table at the same time, causing huge network overloads. In addition, RIPv1 routers had no authentication, leaving them open to hackers sending false routing table information. RIP needed an update.

RIPv2

RIPv2, adopted in 1994, is the current version of RIP. It works the same way as RIPv1, but fixes many of the problems. The maximum hop count of 15 continues to apply to RIPv2, but the easy configuration makes it suitable for internetworks using only a few routers. Most routers support RIPv2 (Figure 6.26).

FIGURE 6.26   Setting RIP in a home router

BGP

The explosive growth of the Internet in the 1980s required a fundamental reorganization in the structure of the Internet itself, and one big part of this reorganization was the call to make the “big” routers use a standardized dynamic routing protocol. Implementing this was much harder than you might think because the entities that govern how the Internet works do so in a highly decentralized fashion. Even the organized groups, such as the Internet Society (ISOC), the Internet Assigned Numbers Authority (IANA), and the Internet Engineering Task Force (IETF), are made up of many individuals, companies, and government organizations from across the globe.

What came out of the reorganization eventually was a multitiered structure. At the top of the structure sits many Autonomous Systems. An Autonomous System (AS) is one or more networks, controlled by a single organization (like an ISP), whose routers are governed by a single dynamic routing policy, and often a single protocol within that AS. Figure 6.27 illustrates the central structure of the Internet.

FIGURE 6.27   The Internet

An Autonomous System does not use IP addresses, but rather uses a special globally unique Autonomous System Number (ASN) assigned by IANA. Originally a 16-bit number, the current ASNs are 32 bits, displayed as two 16-bit numbers separated by a dot. So, 1.33457 would be a typical ASN. Just as you would assign an IP address to a router, you would configure the router to use the ASN assigned by the IANA (see Figure 6.28).

FIGURE 6.28   Configuring a Cisco router to use an ASN

Autonomous Systems communicate with each other using a protocol, called generically an Exterior Gateway Protocol (EGP). The network or networks within an AS communicate with protocols as well; these are called generically Interior Gateway Protocols (IGPs).

Let me repeat this to make sure you understand the difference between EGP and IGP. Neither EGP nor IGP are dynamic routing protocols; rather, these are categories that represent routing protocols exchanged between routers of the same AS (IGP—further subdivided into distance vector vs. link state) or between different ASes (EGP).

The easy way to keep these terms separate is to appreciate that although many protocols are used within Autonomous Systems, such as RIP, the Internet has settled on one protocol for communication between each AS: the Border Gateway Protocol (BGP-4). BGP is the glue of the Internet, connecting all of the Autonomous Systems. Other dynamic routing protocols, such as RIP, are, by definition, IGP. The current version of BGP is BGP-4.

The CompTIA Network+ exam objectives list BGP as a distance vector routing protocol, but it’s really somewhat different. BGP doesn’t have the same type of routing table as you’ve seen so far. Instead, BGP routers advertise information passed to them from different Autonomous Systems’ edge routers—that’s what the AS-to-AS routers are called. BGP forwards these advertisements that include the ASN and other very non-IP items.

BGP also knows how to handle a number of situations unique to the Internet. If a router advertises a new route that isn’t reliable, most BGP routers will ignore it. BGP also supports policies for limiting which and how other routers may access an ISP.

BGP is an amazing and powerful dynamic routing protocol, but unless you’re working deep in the router room of an AS, odds are good you’ll never see it in action. Those who need to connect a few routers together usually turn to a family of dynamic routing protocols that work very differently from distance vector routing protocols.

Local Lingo

iBGP and eBGP   You can use BGP within an AS to connect networks, so you can and do run into situations where BGP is both the interior and exterior protocol for an AS. To distinguish between the two uses of the protocol, network folks refer to the BGP on the interior as the internal BGP (iBGP); the exterior connection then becomes the exterior BGP (eBGP).

Link State

The limitations of RIP motivated the demand for a faster protocol that took up less bandwidth on a WAN. The basic idea was to come up with a dynamic routing protocol that was more efficient than routers that simply sent out their entire routing table at regular intervals. Why not instead simply announce and forward individual route changes as they appeared? That is the basic idea of a link state dynamic routing protocol. There are only two link state dynamic routing protocols: OSPF and IS-IS.

OSPF

Open Shortest Path First (OSPF) is the most commonly used IGP. Most large Internet users (as opposed to ISPs) use OSPF on their internal networks. Even an AS, while still using BGP on its edge routers, will use OSPF internally, because OSPF was designed from the ground up to work within a single AS. OSPF converges dramatically faster and is much more efficient than RIP. Odds are good that if you are using dynamic routing protocols to connect your own routers, you’re using OSPF.

OSPF offers a number of improvements over RIP. When you first launch OSPF-capable routers, they send out link state advertisements (LSAs), called Hello packets, looking for other OSPF routers (Figure 6.29).

FIGURE 6.29   Hello!

A new router sends a lot of LSAs when it first starts. This is called flooding. Once all the routers communicate, they decide the optimal routes among them, and convergence happens almost immediately. If a route goes down, OSPF routers quickly reroute, eliminating the broken route

Exam Tip

OSPF corrects link failures and creates convergence almost immediately, making it the routing protocol of choice in most large enterprise networks. OSPF Version 2 is used for IPv4 networks, and OSPF Version 3 includes updates to support IPv6.

IS-IS

If you want to use a link state dynamic routing protocol and you don’t want to use OSPF, your only other option is Intermediate System to Intermediate System (IS-IS). IS-IS is extremely similar to OSPF. It uses the concept of areas and send-only updates to routing tables. IS-IS was developed at roughly the same time as OSPF and had the one major advantage of working with IPv6 from the start. IS-IS has some adoption with ISPs, but, for the most part, plays a distant second to the popularity of OSPF. Make sure you know that IS-IS is a link state dynamic routing protocol, and if you ever see two routers using it, call me, as I’ve never seen IS-IS in action.

EIGRP—The Lone Hybrid

There is exactly one protocol that doesn’t really fit into either the distance vector or link state camp: Cisco’s proprietary Enhanced Interior Gateway Routing Protocol (EIGRP). Back in the days when RIP was dominant, there was a huge outcry for an improved RIP, but OSPF wasn’t yet out. Cisco, being the dominant router company in the world (a crown it still wears to this day), came out with the Interior Gateway Routing Protocol (IGRP), which was quickly replaced with EIGRP.

EIGRP has aspects of both distance vector and link state protocols, placing it uniquely into its own “hybrid” category. EIGRP is (arguably) fading away in the face of nonproprietary IGP protocols, especially OSPF.

Dynamic Routing Makes the Internet

Without dynamic routing, the complex, self-healing Internet we all enjoy today couldn’t exist. So many routes come and go so often that manually updating static routes would be impossible. Review Table 6.2 to familiarize yourself with the differences among the different types of dynamic routing protocols.

 Objective 6.01: Routing Tables   Routers use routing tables to determine where to send incoming packets. After stripping off the incoming frame information, a router examines the IP packet’s destination address and begins comparing that address to the many routes in its routing table to determine the proper interface to use to send the packet to its destination. The router will encapsulate the packet into the appropriate frame and then send it along. You can use command-line tools to view routing tables in an OS, most commonly running netstat –r.

 Objective 6.02: Network Address Translation   Routers running some form of Network Address Translation (NAT) hide the IP addresses of computers on the LAN, but still enable those computers to communicate with the broader Internet. The most common form of NAT, called Port Address Translation (PAT), uses one or more public IP addresses to enable devices on the inside of a LAN to use a block of private IP addresses. The PAT router uses port numbers to map traffic to and from specific machines in the network.

 Objective 6.03: Dynamic Routing   Dynamic routing protocols enable routers to update routing tables by interacting with other routers rather than through human intervention. CompTIA expects techs to know about three categories: distance vector, link state, and hybrid. Routers using a distance vector protocol, such as RIP or BGP, send their routing tables to other routers at regular intervals. Routers using a link state protocol, such as OSPF or IS-IS, only send updates to routes, making them faster and more efficient, especially as you scale up the size of the internetwork. EIGRP doesn’t quite fit either category; it’s considered the only hybrid dynamic routing protocol.

REVIEW QUESTIONS

    1.  How many lines of a routing table does the router read when comparing the IP address and subnet mask of an incoming packet?

          A.  The router reads only the first two lines to determine the proper route.

          B.  The router reads the lines from the top until it reaches the proper route.

          C.  The router reads the lines from the bottom until it reaches the proper route.

          D.  The router reads all the lines and then determines the proper route.

    2.  What is the purpose of the default route in a routing table?

          A.  The default route tells the router where to send every packet.

          B.  The default route is used by routers solely for updating routing tables.

          C.  The default route tells the router where to send every packet if not explicitly listed on another line in the routing table.

          D.  The default route is used to configure the router.

    3.  How many IP addresses should a router have?

          A.  One

          B.  One or more

          C.  Two

          D.  Two or more

    4.  Which version of NAT maps a single routable IP address to a single network node?

          A.  Static NAT

          B.  Dynamic NAT

          C.  Pooled NAT

          D.  Secure NAT

    5.  What technology enables you to designate a specific local address for various network services?

          A.  Dynamic NAT

          B.  Port Address Translation

          C.  Port forwarding

          D.  Port filtering

    6.  How is the distance between routers measured?

          A.  In meters

          B.  In hops

          C.  In routes

          D.  In segments

    7.  Distance vector routing protocols include which of the following? (Select two.)

          A.  RIP

          B.  OSPF

          C.  BGP

          D.  ASN

    8.  What is one way in which Autonomous Systems differ from typical Ethernet networks?

          A.  They require a minimum of 10 nodes.

          B.  They cannot exceed a maximum of 255 nodes.

          C.  They are not able to interact with the Internet.

          D.  They do not use IP addresses.

    9.  Why are link state protocols more efficient than distance vector routing protocols?

          A.  Entire routing tables are updated on a stricter schedule.

          B.  They forward only changes to individual routes instead of forwarding entire routing tables.

          C.  Packets can be sent along multiple routes at the same time.

          D.  Link state can send larger packets.

    10.  Which of the following is a hybrid dynamic routing protocol?

          A.  RIP

          B.  OSPF

          C.  BGP

          D.  EIGRP

REVIEW ANSWERS

    1.  D   The router reads all the lines and then determines the proper route.

    2.  C   The default route tells the router where to send every packet unless another line in the routing table gives another route.

    3.  D   By definition, a router should have two or more IP addresses to connect different networks with its routing function.

    4.  A   Static NAT maps a single routable (that is, not private) IP address to a single machine.

    5.  C   Port forwarding enables you to designate a specific local address for various network services.

    6.  B   The distance between routers is measured in hops.

    7.  A and C   Distance vector routing protocols include RIP and BGP.

    8.  D   Autonomous Systems do not use IP addresses, but instead use a globally unique Autonomous System Number.

    9.  B   Link state protocols forward only changes to individual routes, whereas RIP forwards entire routing tables.

    10.  D   EIGRP is the sole hybrid dynamic routing protocol.

Virtualization

  ITINERARY  

      Objective 7.01   Virtual LANs

      Objective 7.02   Virtual Computing

      Objective 7.03   Virtualization in Modern Networks

Modern networks are often hugely complex and intricate, with many different devices filling many different roles. Hungry for greater flexibility and lower hardware costs, many network techs have started using software to do jobs traditionally done by hardware. In this chapter, you will learn about virtualization, which means using specialized programs to act like physical devices. First, you will learn about virtual LANs, which use a single switch to create multiple broadcast domains. After that, you will read about virtual computing, or using one physical computer to run multiple virtual systems. Finally, you will learn about the place virtualization has in today’s networking world.

Virtual LANs

It’s rare these days to see a serious network that doesn’t have remote incoming connections, public web or e-mail servers, and wireless networks, as well as the basic string of connected switches. Leaving all of these different features on a single broadcast domain creates a tremendous amount of broadcast traffic and creates a security nightmare. What if you could segment the network using the switches you already own? A virtual local area network (VLAN) enables you to do just that.

To create a VLAN, you take a single physical broadcast domain and chop it up into multiple virtual broadcast domains. VLANs require special switches loaded with extra programming to create the virtual networks. Imagine a single switch with a number of computers connected to it. Up to this point, a single switch is always a single broadcast domain, but that’s about to change. You’ve decided to take this single switch and turn it into two VLANs. VLANs typically get the name “VLAN” plus a number, like VLAN1 or VLAN275. The devices usually start at 1, although there’s no law or rules on the numbering. In this example, I’ll configure the ports on my single switch to be in one of two VLANs—VLAN1 or VLAN2 (Figure 7.1). I promise to show you how to configure ports for different VLANs shortly, but I’ve got a couple of other concepts to hit first.

FIGURE 7.1   Switch with two VLANs

Figure 7.1 shows a switch configured to assign individual ports to VLANs. But there’s another way to use VLANs that’s supported by most VLAN-capable switches. Instead of assigning ports to a VLAN, you can assign MAC addresses to determine VLAN membership. A computer in this type of VLAN is always a member of the same VLAN no matter which port you plug the computer into on the switch.

A single switch configured into two VLANs is the simplest form of VLAN possible. More serious networks usually have more than one switch. Let’s say you added a switch to a simple network. You’d like to keep VLAN1 and VLAN2, but use both switches. You can configure the new switch to use VLAN1 and VLAN2, but you’ve got to enable data to flow between the two switches, regardless of VLAN. That’s where trunking comes into play.

Trunking

Trunking is the process of transferring VLAN traffic between two or more switches. Imagine two switches, each configured with a VLAN1 and a VLAN2, as shown in Figure 7.2.

FIGURE 7.2   Two switches, each with a VLAN1 and a VLAN2

You want all of the computers connected to VLAN1 on one switch to talk to all of the computers connected to VLAN1 on the other switch. Of course, you want to do this with VLAN2 also. To do this, you configure a port on each switch as a trunk port. A trunk port is a port on a switch configured to carry all traffic, regardless of VLAN number, between all switches in a LAN (Figure 7.3).

FIGURE 7.3   Trunk ports

Today, every Ethernet switch prefers the IEEE 802.1Q trunk standard that enables you to connect switches from different manufacturers.

Configuring a VLAN-capable Switch

If you want to configure a VLAN-capable switch, you need a method to perform that configuration. One method uses a serial (console) port, but the most common method is to access the switch with a web browser interface, like the one shown in Figure 7.4. Any switch that you can access and configure is called a managed switch.

FIGURE 7.4   Catalyst 2950 Series Device Manager

Local Lingo

Unmanaged switch A simple switch without any configuration capability is called an unmanaged switch.

Though switches typically use MAC addresses, managed switches also come with an IP address for configuration. A brand-new managed switch out of the box invariably has a preset IP address similar to the preset, private IP addresses you see on routers. This IP address isn’t for any of the individual ports, but rather is for the whole switch. That means no matter where you physically connect to the switch, the IP address to get to the configuration screen is the same.

Every switch manufacturer has its own interface for configuring VLANs, but the interface shown in Figure 7.5 is a classic example. This is Cisco Network Assistant, a very popular tool that enables you to configure multiple devices through the same interface. Note that you first must define your VLANs.

FIGURE 7.5   Defining VLANs in Cisco Network Assistant

After you create the VLANs, you usually either assign computers’ MAC addresses to VLANs or assign ports to VLANs. Assigning MAC addresses means that no matter where you plug in a computer, it is always part of the same VLAN—a very handy feature for mobile users! Assigning each port to a VLAN means that whatever computer plugs into that port, it will always be a member of that port’s VLAN. Figure 7.6 shows a port being assigned to a particular VLAN.

FIGURE 7.6   Assigning a port to a VLAN

Local Lingo

Static and Dynamic   VLANs based on ports are the most common type of VLAN and are commonly known as static VLANs. VLANs based on MAC addresses are called dynamic VLANs.

Travel Advisory

If you’ve just plugged into a VLAN, but can’t seem to access the other computers on your VLAN, make sure you’ve plugged your computer into a port assigned to the correct VLAN. If there are no more available ports, you’ll have to configure the port you’re plugged into to be on the right VLAN.

VLAN Trunking Protocol

A busy network with many VLAN switches can require periods of intensive work to update. Imagine the work required to redo all the VLAN switches if you changed the VLAN configuration by adding or removing a VLAN. You’d have to access every switch individually, changing the port configuration to alter the VLAN assignment, and so on. The potential for errors is staggering.

If you misconfigure the port or assign the wrong VLAN to a set of ports, that would manifest as users who previously could access the proper resources no longer being able to access them. Or, worse, that you’d have users loose in places they should not be authorized to access. Manually tracking down and troubleshooting these kinds of errors takes way too much time.

Travel Advisory

VTP   The acronym list for the CompTIA Network+ exam refers to VTP as Virtual Trunk Protocol, a term that doesn’t exist or at least doesn’t apply to Cisco products. You’ll most likely only see the initials—VTP—on the exam.

Cisco uses a proprietary protocol called VLAN Trunking Protocol (VTP) to automate the updating of multiple VLAN switches. With VTP, you put each switch into one of three states: server, client, or transparent. When you make changes to the VLAN configuration of the server switch, all the connected client switches and other server switches update their configurations within minutes.

When you set a VLAN switch to transparent, you tell it not to update but to hold onto its manual settings. You would use a transparent mode VLAN switch in circumstances where the overall VLAN configuration assignments did not apply.

InterVLAN Routing

Once you’ve configured a switch to support multiple VLANs, each VLAN is its own broadcast domain, just as if the two VLANs were on two completely separate switches and networks. There is no way for data to get from one VLAN to another unless you use a router. The process of making a router work between two VLANs is called interVLAN routing. Figure 7.7 shows one possible way to connect two VLANs with a single router. Note that the router has one port connected to VLAN 100 and another connected to VLAN 200. Devices on VLAN 100 may now communicate with devices on VLAN 200.

FIGURE 7.7   One router connecting multiple VLANs

Adding a physical router like this isn’t a very elegant way to connect VLANs. This forces almost all traffic to go through the router, and it’s not a very flexible solution if you want to add more VLANs in the future. As a result, all but the simplest VLANs have at least one very special switch that has the ability to make virtual routers. Figure 7.8 shows an older but very popular interVLAN routing–capable switch, the Cisco 3550.

FIGURE 7.8   Cisco 3550

The Cisco 3550 not only supports VLANs, but also enables you to create virtual routers (Switched Virtual Interfaces) or even physical routed ports to interconnect these VLANs. Figure 7.9 shows the configuration screen for the 3550’s interVLAN routing between two VLANs.

FIGURE 7.9   Setting up interVLAN routing

Being a switch that also has the capability to create virtual routers and physical routed ports, the Cisco 3550 works at both layers 2 and 3 at the same time.

Virtual Computing

In the simplest terms, virtualization is the process of using special software—a class of programs called hypervisors or virtual machine managers—to create a complete environment in which a guest operating system can function as though it were installed on its own computer. That guest environment is called a virtual machine (VM). Figure 7.10 shows one such example: a system running Windows 7 using a program called VMware Workstation to host a virtual machine running Ubuntu Linux.

FIGURE 7.10   VMware running Linux

Meet the Hypervisor

A normal operating system uses programming called a supervisor to handle very low-level interactions among hardware and software, such as task scheduling, allotment of time and resources, and so on.

Because virtualization enables one machine—called the host—to run multiple operating systems simultaneously, full virtualization requires an extra layer of sophisticated programming to manage the vastly more complex interactions. One common method calls this extra programming a hypervisor or virtual machine manager (VMM).

A hypervisor has to handle every input and output that the operating system would request of normal hardware. With a good hypervisor like VMware Workstation, you can easily add and remove virtual hard drives, virtual network cards, virtual RAM, and so on. Figure 7.11 shows the Hardware Configuration screen from VMware Workstation.

FIGURE 7.11   Configuring virtual hardware in VMware Workstation

Local Lingo

Virtual desktop   A personal computer OS running in a virtual machine is also known as a virtual desktop. Virtual desktops were the first type of popular virtual machines seen in the PC world, championed by VMware and quickly copied by other virtualization programs.

Virtualization even goes so far as to provide a virtualized BIOS and System Setup for every virtual machine. Figure 7.12 shows VMware Workstation displaying the System Setup, just like you’d see it on a regular computer.

FIGURE 7.12   System Setup in VMware Workstation

Travel Advisory

The host machine allocates real RAM and CPU time to every running virtual machine. A host can only handle a finite number of virtual machines before experiencing degraded performance.

Why Do We Virtualize?

Virtualization has taken the networking world by storm, but for those who have never seen virtualization, the big question has got to be: Why? Let’s talk about the benefits of virtualization. While you read this section, keep in mind two important things:

    • A single hypervisor on a single system will happily run as many virtual machines as its RAM, CPU, and drive space allow. (RAM is almost always the main limiting factor.)

    • A virtual machine that’s shut down is little more than a file (or two) sitting on a hard drive.

Power Saving

Before virtualization, each server OS needed to be on a unique physical system. With virtualization, you can place multiple virtual servers on a single physical system, reducing electrical power use substantially. Rather than one machine running Windows 2008 and acting as a file server and DNS server, and a second machine running Linux for a DHCP server, for example, the same computer can handle both operating systems simultaneously. Expand this electricity savings over an enterprise network or on a data server farm, and the savings—both in terms of dollars spent and electricity used—is tremendous.

Hardware Consolidation

Similar to power saving, why buy a high-end server, complete with multiple processors, RAID arrays, redundant power supplies, and so on, and only run a single server? With virtualization, you can easily beef up the RAM and run a number of servers on a single box.

System Recovery

Possibly the most popular reason for virtualizing is to keep uptime percentage as high as possible. Let’s say you have a web server installed on a single system. If that system goes down—due to hacking, malware, or so on—you need to restore the system from a backup, which may or may not be easily at hand. With virtualization, you merely need to shut down the virtual machine and reload an alternate copy of it.

Local Lingo

Uptime   Uptime refers to the amount of time that a computer has been online.

Think of virtual machines like you would a word processing document. Virtual machines don’t have a “File | Save” equivalent, but they do have something called a snapshot that enables you to save an extra copy of the virtual machine as it is exactly at the moment the snapshot is taken. Figure 7.13 shows VMware Workstation saving a snapshot.

FIGURE 7.13   Saving a snapshot

System Duplication

Closely tied to system recovery, system duplication takes advantage of the fact that VMs are simply files, and like any file, they can be copied. Let’s say you want to teach 20 students about Ubuntu Linux. Depending on the hypervisor you choose (VMware does this extremely well), you can simply install a hypervisor on 20 machines and copy a single virtual machine to all the computers. Equally, if you have a virtualized web server and need to add another web server (assuming your physical box has the hardware to support it), why not just make a copy of the server and fire it up as well?

Research

Here’s a great example that happens in my own company. I sell my popular Total Tester test banks: practice questions for you to test your skills on a broad number of certification topics. As with any distributed program, I tend to get a few support calls. Running a problem through the same OS, even down to the service pack, helps me solve the problem. In the previrtualization days, I commonly had seven to ten PCs, using dual-boot, each keeping copies of a particular Windows version. Today, a single hypervisor enables me to support a huge number of Windows versions on a single machine (Figure 7.14)

FIGURE 7.14   Lots of VMs used for research

Clearly there are a number of good reasons to virtualize some of the computers in a network. Let’s look at implementation now.

Virtualization in Modern Networks

Virtualization manifests in many ways in modern networks. VMMs and hypervisors serve many roles in businesses, and you can choose from one of many varieties when you want to implement virtualization. In addition, virtual switches, virtual PBXes, and NaaS implementations provide solutions to very specific issues. This section examines modern virtualization.

VMMs and Hypervisors

You’ve already seen virtualization in action with the example shown using VMware Workstation earlier in this chapter. Many networks use a few virtual machines to augment and refine a traditional network closet. VMware Workstation is how I first performed virtualization on PCs, but the technology and power have grown dramatically over the last few years.

VMware Workstation requires an underlying operating system, so it functions essentially like a very powerful desktop application. What if you could remove the OS altogether and create a bare-metal implementation of virtualization?

VMware introduced ESX in 2001 to accomplish this goal. ESX is a hypervisor that’s powerful enough to replace the host operating system on a physical box, turning the physical machine into a machine that does nothing but support virtual machines. ESX, by itself, isn’t much to look at; it’s a tiny operating system/ hypervisor that’s usually installed on something other than a hard drive. Figure 7.15 shows how I loaded my copy of ESX: via a small USB thumb drive.

FIGURE 7.15   USB drive on server system

Power up the server; the server loads ESX off the thumb drive; and in short order, a very rudimentary interface appears where I can input essential information, such as a master password and a static IP address.

Local Lingo

ESX   For all you abbreviation lovers, I have some good news and some bad news about “ESX.” Officially, it means nothing. Unofficially, it stands for “Elastic Sky,” which is probably why it officially means nothing.

Travel Assistance

ESXi   VMware offers a free version of ESX for download. Called ESXi, it lacks a number of ESX’s features, but is still quite powerful. You can get it here: http://www.vmware.com/products/vspherehypervisor/overview.html

Don’t let ESX’s small size fool you. It’s small because it only has one job: to host virtual machines. ESX is an extremely powerful operating system/hypervisor.

Travel Advisory

Some writers will use the term virtual machine manager to describe virtual machine software that runs on top of a host operating system. They’ll use the term hypervisor to describe only software that does not need a host operating system. Using this terminology, VMware Workstation is a virtual machine manager and ESX is a hypervisor. Other writers call both the hosted and bare-metal—or native—virtualization software products hypervisors, but make a distinction in other descriptive words (such as hosted or native).

Notice the built-in USB port shown in Figure 7.15. The popularity of hypervisors on dedicated servers makes these ports extremely common in a serious server box like the Dell system shown.

Powerful hypervisors like ESXi are rarely administered directly at the box. Instead you use tools such as VMware’s vSphere Client, so you can create, configure, and maintain virtual machines on the hypervisor server from the comfort of a client computer running this program. Once the VM is up and running, you can close the vSphere client, but the VM will continue to run happily on the server. So you now really have two different ways to virtualize: using virtual machine managers like VMware’s Workstation to manage virtual desktops and using powerful hypervisors like ESX to manage virtual servers. Granted, you could run a server like a web browser in VMware Workstation, and you also could run a copy of Windows 7 Ultimate from an ESX system. Nothing is wrong with doing either of these.

Exam Tip

For the scope of the CompTIA Network+ exam, remember that virtual servers run on hypervisors like ESX, whereas virtual desktops run on virtual machine managers.

Thus far, this chapter sounds like an advertisement for VMware. VMware really brought virtualization to the PC world and still holds a strong presence, but there are a number of alternatives to VMware products. Let’s see what else is available.

Virtual Machine Managers

When it comes to the more basic virtual machine managers, you have a huge number of choices. The one you use is going to be based on features and prices.

VMware Workstation

The granddaddy and front leader for virtualization, VMware Workstation comes in both Windows and Linux versions. VMware Workstation runs on virtually (PUN!) any operating system you’ll ever need and is incredibly stable and proven. Too bad it’s not free.

One of the more interesting features of VMware Workstation is VMTools. VMTools adds useful features such as copy/cut and paste between the virtual desktop and the real desktop.

Virtual PC

Microsoft has offered a few different virtual machine managers over the years, and their current mainstream product is Windows Virtual PC (Figure 7.16). Windows Virtual PC is free, but has some serious limitations. First, it only works on Windows 7 Professional, Ultimate, and Enterprise. Second, it only officially supports Windows VMs, although a few intrepid souls have managed to get Linux working.

FIGURE 7.16   Windows Virtual PC

Parallels

Parallels is the most popular virtualization manager for Mac OS X, although VMware Fusion is a close second. Parallels supports all popular operating systems, and even has a fair degree of 3D graphics support; more so than even the mighty VMware. Parallels also offers Windows (Figure 7.17) and Linux versions.

FIGURE 7.17   Parallels Desktop for Mac running a copy of Windows

KVM

Of course, the open-source world has its players, too. While picking a single product to represent the Linux/UNIX world is hard, no one who knows virtualization would disagree that KVM from Redhat is a dominant player. Unlike the other virtual machine managers discussed, KVM also supports a few non-x86 processors.

Don’t think for a moment that this list is complete! There are lots of other virtual machine options for your desktop, especially if your host machine runs Linux. The most fun you’ll have learning about virtualization is the playtime involved experimenting with the many options available.

Hypervisors

While you have lots of choices when it comes to virtual machine managers, your choices for real embedded hypervisors are limited to the two biggies: VMware’s ESX and Microsoft’s HyperV. There are others, such as Oracle’s VM Server, but nothing has the market share of ESX or HyperV.

ESX

I’ve already discussed a few aspects of ESX, so instead I’ll delve into the features that make ESX so popular. When it comes to real server virtualization, VMware truly leads the pack with a host of innovations (some of which are add-on products) that make ESX almost unstoppable. Here are a few examples:

    • Interface with large storage   ESX virtual machines easily integrate with network attached storage (NAS) and storage area networks (SANs) to handle massive data storage.

    • Transparent fault tolerance   ESX can monitor and automatically recover failed VMs with little or no input.

    • Transparent server transfer   You can move a running VM from one machine to another. How cool is that?

    • High virtual CPUs   Most hypervisors support a limited number of virtual CPUs, usually two at most. ESX can support up to 32 CPUs, depending on the vSphere product version you purchase to support it.

HyperV

Although HyperV can’t stand toe-to-toe with ESX, it has a few aces up its sleeve that give it some appeal. First, it’s free. This is important in that ESX, with only a few extra add-ons, can cost thousands of dollars. Second, it comes as a stand-alone product or as part of Windows Server 2008 and even on some versions of Windows 7, making it easy for those who like to play to access it. Third, its simplicity makes it easier to learn for those new to using hypervisors. Watch HyperV. If Microsoft does one thing well, it’s taking market share away from arguably better, more powerful competitors, while slowly making its product better.

Virtual Switches

Imagine for a moment that you have three virtual machines running as virtual desktops. You want all of these machines to have access to the Internet. Therefore, you need to give them all legitimate IP addresses. The physical server, however, only has a single NIC. There are two ways in which virtualization gives individual VMs valid IP addresses. The oldest and simplest way is to bridge the NIC. Each virtual NIC is given a bridged connection to the real NIC (Figure 7.18). This bridge works at layer 2 of the OSI model, so each virtual NIC gets a legitimate, unique MAC address.

FIGURE 7.18   Bridged NICs

A subset of this type of bridging is to give every VM its own physical NIC (Figure 7.19). In this case, you’re still bridging, but every virtual NIC goes straight to a dedicated physical NIC.

FIGURE 7.19   Dedicated bridged NICs

Your second option is to create a virtual switch, which is special software that enables VMs to communicate with each other without going outside of the host system. A good hypervisor (like ESX and HyperV) enables you to connect all of your virtual machines to their own virtual switch. Depending on your hypervisor, this switch can do everything you’d expect from a typical managed layer-2 switch, including VLANs (Figure 7.20).

FIGURE 7.20   Virtual switch

If you really want to go crazy on virtual switches (and have lots of money), Cisco will sell you an appliance like the Cisco Nexus 1000V that offloads all of the virtual switching from the hypervisor and adds higher-layer features such as firewalls/ACLs, DHCP servers, and many other features.

Virtual PBX

The ancient PBX telephone systems used in offices since the 1970s have gone through many transformations over the last 40 years. One of the more common upgrades is to replace ancient PBX hardware with a single PC running many of the popular PBX programs like Asterisk (www.asterisk.org) or Virtual PBX (www.virtualpbx.com). Figure 7.21 shows Asterisk. These create a virtual PBX, software that functionally replaces a physical PBX.

FIGURE 7.21   Asterisk running on a system

Typically this requires a dedicated single system to run the PBX software. Why not stop wasting a dedicated computer and instead just place all this on a virtual machine? That’s the power of a virtual PBX system. All of the power that makes virtualization attractive is perfect for PBX systems.

Network as a Service

With hypervisor-based virtualization, you don’t need to worry about where the virtualized server is physically located—you just want it to serve your data. If a virtual computer is at your location, you call it onsite. If a virtual server is somewhere other than at your location, you call it offsite. Some companies rent virtual servers to others. This is, by definition, Network as a Service (NaaS), a small division of what is called cloud computing. Virtualization didn’t invent the concept of cloud computing, but it made it cheap and practical.

Exam Tip

Other Cloud Services   Cloud computing is a huge industry these days that encompasses far more than just NaaS. Another big area for cloud computing is in application service providers (ASP). As the name implies, an ASP provides an application as a service. This might be a broad selection of applications, such as Google Docs, or a single application, like the payment services of PayPal. A common term for this use of the cloud is Software as a Service (SaaS).

 Objective 7.01: Virtual LANs   A virtual local area network (VLAN) enables you to segment a network using VLAN-capable switches. To create a VLAN, you take a single physical broadcast domain and chop it up into multiple virtual broadcast domains. VLANs help manage busy networks by reducing traffic. With interVLAN routing, you can connect the virtual networks just as if you had a physical router between them.

 Objective 7.02: Virtual Computing   Virtualization uses special software called hypervisors or virtual machine managers to create a complete environment in which a guest operating system can function as though it were installed on its own computer. That guest environment is called a virtual machine (VM). Going virtual offers many benefits, such as power saving, hardware consolidation, easier system recovery and duplication, and risk-free testing and research environments.

 Objective 7.03: Virtualization in Modern Networks   Virtualization manifests in many ways in modern networks. VMMs and hypervisors serve many roles in businesses, and you can choose from one of many varieties when you want to implement virtualization, such as Virtual PC, Parallels, ESX, and HyperV. In addition, virtual switches, virtual PBXes, and NaaS implementations provide solutions to very specific issues.

REVIEW QUESTIONS

    1.  What is one benefit of a VLAN?

          A.  It enables remote users to connect to a local network via the Internet.

          B.  It reduces broadcast traffic on a LAN.

          C.  It can create a WAN from multiple disjointed LANs.

          D.  It provides encryption services on networks that have no default encryption protocol.

    2.  The number of running virtual machines on a single host is limited by what factor?

          A.  Physical RAM

          B.  Virtual RAM

          C.  Physical NICs

          D.  Virtual NICs

    3.  When a virtual machine is not running, how is it stored?

          A.  Firmware

          B.  RAM drive

          C.  Optical disc

          D.  Files

    4.  To enable computers connected to different switches to be members of the same VLAN, what do the switches have to support?

          A.  Content switching

          B.  Port authentication

          C.  Port mirroring

          D.  Trunking

    5.  Which of the following operating systems would not run on VMware Workstation for Windows?

          A.  Windows XP

          B.  Apple iOS

          C.  Ubuntu Linux

          D.  Windows Vista

    6.  Which of the following virtualization programs works well with Mac OS X? (Select the best answer.)

          A.  ESX

          B.  KVM

          C.  Parallels

          D.  Virtual PC

    7.  The boss flies into your office yelling that the virtualized web server has been hacked and now displays only purple dinosaurs. Which of the following would be the fastest way to fix the problem?

          A.  Restore from backup

          B.  Run System Restore

          C.  Reinstall Windows

          D.  Load an earlier snapshot

    8.  Which of the following is not a good reason for virtualization?

          A.  Power saving

          B.  Hardware consolidation

          C.  System recovery

          D.  Reduced hardware costs

    9.  Powerful hypervisors like ESX are often booted from _______________.

          A.  Floppy diskettes

          B.  USB thumb drives

          C.  Firmware

          D.  Windows

    10.  The entire hypervisor market is dominated by two players. (Select two.)

          A.  ESX

          B.  HyperV

          C.  Parallels

          D.  KVM

REVIEW ANSWERS

    1.  B   VLANs reduce broadcast traffic by segmenting local networks into distinct virtual networks.

    2.  A   Physical RAM imposes limits on the number of VMs you can run at the same time.

    3.  D   VMs are just files, usually stored on a hard drive.

    4.  D   Switches that support trunking enable each switch to be a member of multiple common VLANs.

    5.  B   Apple iOS won’t run on VMware for Windows.

    6.  C   Parallels is the dominant virtualization program for OS X.

    7.  D   The beauty of VMs is that you can load an earlier snapshot in a matter of moments.

    8.  D   Switching to virtual machines may or may not save money on hardware. A good virtual machine server can cost a lot more than a series of PCs, but operating costs are reduced.

    9.  B   A good hypervisor can be tiny, loading from something as small as a USB thumb drive.

    10.  A and B   ESX and HyperV are the two big players in the native hypervisor market.

Wide Area Networking

  ITINERARY  

      Objective 8.01   Telephony and Beyond

      Objective 8.02   The Last Mile

      Objective 8.03   Using Remote Access

Computers connect to other computers locally in a local area network (LAN)—you’ve read about LAN connections throughout this book—and remotely through a number of different methods. This chapter takes both a historical and a modern look at ways to interconnect a local computer or network with distant computers, what’s called remote connectivity.

Remote connections have been around for a long time. Before the Internet, network users and developers created ways to take a single system or network and connect it to another faraway system or network. These were private interconnections of private networks. These connections were very expensive and, compared to today’s options, pretty slow.

As the Internet developed, most of the same technologies used to make the earlier private remote connections became the way the Internet itself interconnects. Before the Internet was popular, many organizations used dedicated lines, called T1 lines (discussed in more detail later in this chapter), to connect far-flung offices. Some people still use T1 lines privately, but more often you’ll see them used as an Internet connection to a company’s local ISP. Private interconnections are only used today by organizations that need massive bandwidth or high security.

This chapter shows you all the ways you can make remote connections. You’ll see every type of remote connection currently in popular use, from good-old telephone lines to advanced fiber-optic carriers, and even satellites. Each discussion includes details of speed, distance, and transmission media (the wires or wireless signals used). There are so many ways to make remote connections that this chapter is broken into three parts. The first part, “Telephony and Beyond,” gives you a tour of the technologies that originally existed for long-distance voice connections that now also support data. The next part, “The Last Mile,” goes into how we as individual users connect to those long-distance technologies and demonstrates how wireless technologies come into play in remote connectivity. Last, “Using Remote Access” shows you the many different ways to use these connections to connect to another, faraway computer.

Telephony and Beyond

Describing the tier 1 Internet service providers (ISPs) of the Internet is always an interesting topic. Those of us in the instruction business invariably start this description by drawing a picture of the United States and then adding lines connecting big cities, as shown in Figure 8.1.

FIGURE 8.1   The tier 1 Internet

But what are these lines and where did they come from? If the Internet is just a big TCP/IP network, wouldn’t these lines be Ethernet connections? Maybe copper, maybe fiber, but surely they’re Ethernet? Well, traditionally they’re not (with one exception; see the following Travel Advisory). The vast majority of the long-distance connections that make up the Internet use a unique type of signal called SONET. SONET was originally designed to handle special heavy-duty circuits with names like T1. Never heard of SONET or T1? Don’t worry—you’re about to learn quite a bit.

Travel Advisory

Even as you read this, more and more of the Internet interconnections are moving toward Gigabit and 10 Gigabit Ethernet, and 100 Gigabit is just around the corner. Cable and telephone technologies, however, continue to dominate.

Most of the connections that make up the high-speed backbone of the Internet use technologies designed at least 20 years ago to support telephone calls. We’re not talking about your cool cell phone–type calls here, but rather the old-school, wire-runs-up-to-the-house, telephone-connected-to-a-phone-jack connections. (See “Public Switched Telephone Network” later in this chapter for more on this subject.) If you want to understand how the Internet connects, you have to go way back to the 1970s and 1980s, before the Internet really took off, and learn how the U.S. telephone system developed to support networks.

Travel Advisory

This section is just the lightest of overviews to get you through the CompTIA Network+ exam. The full history of long-distance communication is an incredible story, full of good guys, bad guys, crazy technology, and huge fortunes won and lost.

The Dawn of Long Distance

Have you ever watched one of those old-time movies in which someone makes a phone call by picking up the phone and saying, “Operator, get me Mohawk 4, 3-8-2-5!”? Suddenly, the scene changes to some person sitting at a switchboard like the one shown in Figure 8.2.

FIGURE 8.2   Old-time telephone operator (photo courtesy of the Richardson Historical and Genealogical Society)

That was the telephone operator. The telephone operator made a physical link between your phone and the other phone, making your connection. The switchboard acted as a circuit switch, as plugging in the two wires created a physical circuit between the two phones. This worked pretty well in the first few years of telephones, but it quickly became a problem as more and more phone lines began to fill the skies overhead (Figure 8.3).

FIGURE 8.3   Now that’s a lot of telephone lines!

These first generations of long-distance telephone systems (think 1930s here) used analog signals, because that was how your telephone worked. If you graphed out a voice signal, it looked something like Figure 8.4. This type of transmission had issues, however, because analog signals over long distances, even if you amplified them, lost sound quality very quickly.

FIGURE 8.4   Another problem of early long-distance telephone systems

The first problem to take care of was the number of telephone wires. Individual wires were slowly replaced with special boxes called multiplexers. A multiplexer took a circuit and combined it with a few hundred other circuits into a single complex circuit on one wire. A demultiplexer (devices were both multiplexers and demultiplexers) on the other end of the connection split the individual connections back out (Figure 8.5).

FIGURE 8.5   Multiplexers combine multiple circuits.

Over time, the entire United States was divided into hundreds, eventually thousands, of local exchanges. Local exchanges were a defined grouping of individual phone circuits served by a single multiplexer (calls within the exchange were handled first by human operators, who were replaced, eventually, with dial tones and special switches that interpreted your pulses or tones for a number). One or more exchanges were (and still are) housed in a physical building called a central office (Figure 8.6) where individual voice circuits all came together. Local calls were still manually connected (although dial-up began to appear in earnest by the 1950s, after which many operators lost their jobs), but any connection between exchanges was carried over these special multiplexed trunk lines. Figure 8.7 shows a very stylized example of how this worked.

FIGURE 8.6   A central office building

FIGURE 8.7   Interconnected central offices

How did they put a bunch of voice calls on a single piece of cable, yet still somehow keep them separate? To understand the trick, you need to appreciate a little bit about frequency. A typical telephone only detects a fairly limited frequency range—from around 350 Hz to around 4,000 Hz. This range covers enough of the human speech range to make a decent phone call. As the individual calls came into the multiplexer, it added a certain frequency multiplier to each call, keeping every separate call in its own unique frequency range (Figure 8.8). This process is called frequency division multiplexing (FDM).

FIGURE 8.8   Multiplexed FDM

This analog network still required a physical connection from one phone to the other, even if those phones were on opposite sides of the country. Long distance used a series of trunk lines, and at each intersection of those lines an operator had to connect the calls. When you physically connect two phones together on one circuit, you are using something called circuit switching. As you might imagine, circuit switching isn’t that great for long distance, but it’s your only option when you use analog.

This analog system worked pretty well from the 1930s through the 1950s, but telephones became so common and demand so heavy that the United States needed a new system to handle the load. The folks developing this new system realized that they had to dump analog and replace it with a digital system—sowing the seeds for the remote connections that eventually became the Internet.

Digital data transmits much easier over long distances than analog data does because you can use repeaters. (You cannot use repeaters on analog signals.) If you remember from earlier chapters, a repeater is not an amplifier. An amplifier just increases the voltage and includes all the pops and hisses created by all kinds of interference. A repeater takes the entire digital signal and re-creates it out the other end (Figure 8.9).

FIGURE 8.9   Repeater vs. amplifier

The downside to adopting a digital system was that the entire telephone system was analog: every telephone, every switch, every multiplexer. The task of converting the entire analog voice system to digital was a massive undertaking. Luckily, much of the U.S. phone system at that time was a monopoly run by a company called AT&T. A single company could make all of its own decisions and its own standards—one of the few times in history where a monopoly was probably a good thing. The AT&T folks had a choice here: completely revamp the entire U.S. phone system, including replacing every single telephone in the United States, or just make the trunk lines digital and let the central offices convert from analog to digital. They chose the latter.

Even today, a classic telephone line in your home or small office uses analog signals—the rest of the entire telephone system is digital. The telecommunications industry calls the connection from a central office to individual users the last mile. The telephone company’s decision to keep the last mile analog has had serious repercussions that still challenge us even in the 21st century (Figure 8.10)

FIGURE 8.10   Analog and digital

Travel Assistance

Attempts were made to convert the entire telephone system, including your telephones, to digital, but these technologies never took off (except in a few niches). See “ISDN” later in this chapter.

Digital Telephony

When you learned about networks in the first few chapters of this book, you learned about cabling, frame types, speeds, switching, and so on. All of these are important for computer networks. Well, let’s do it again (in a much simpler format) to see the cabling, frame types, speed, and switching used in telephone systems. Don’t worry—unlike computer networks, in which a certain type of cable might run different types of frames at different speeds, most of the remote connections used in the telephony world tend to have one type of cable that only runs one type of frame at one speed.

Let’s begin with the most basic data chunk you get in the telephone world: DS0.

It All Starts with DS0

When AT&T decided to go digital, it knew all phone calls had to be broken into a digital sample. AT&T decided (some people say “guessed” or “compromised”) that if it took an analog signal of a human voice and converted it into eight-bit chunks 8,000 times a second, it would be good enough to re-create the sound later. Figure 8.11 shows an example of the analog human voice seen earlier being converted into a digital sample.

FIGURE 8.11   Analog to digital

Local Lingo

Modem   A modulator takes a digital signal and converts it into an analog signal. A demodulator takes an analog signal and converts it into a digital signal. The typical modulator/demodulator device in computers is a modem.

Converting analog sound into eight-bit chunks 8,000 times a second creates a data stream (called a digital signal) of 8 × 8,000 = 64 kilobits per second (Kbps). This digital signal rate, known as DS0, makes up the simplest data stream (and the slowest rate) of the digital part of the telephone system. Each analog voice call gets converted into a DS0 signal at the telephone company’s central office. From there they are multiplexed into larger circuits.

Now that we have our voice calls converted to digital data, we need to get them to the right telephone. First, we need network technologies to handle the cabling, frames, and speed. Second, we need to come up with a method to switch the digital voice calls across a network. To handle the former, we need to define the types of interconnections, with names like T1 and OC3. To handle the latter, we no longer connect via multiplexed circuit switching, as we did back with analog, but rather are now using packet switching. I’ll show you what I mean as I discuss the digital lines in use today.

Copper Carriers: T1 and T3

The first (and still popular) digital trunk carriers used by the telephone industry are called T-carriers. There are a number of different versions of T-carriers, and the CompTIA Network+ exam expects you to know something about them. Let’s begin with the most common and most basic, the venerable T-carrier level 1(T1).

T1 has several meanings. First, it refers to a high-speed digital networking technology called a T1 connection. Second, the term T1 line refers to the specific, shielded, two-pair cabling that connects the two ends of a T1 connection (Figure 8.12). Two wires are for sending data and two wires are for receiving data. At either end of a T1 line, you’ll find an unassuming box called a channel service unit/digital service unit (CSU/DSU). The CSU/DSU provides an interface between the T1 line and some other device, often a router. A T1 connection is point-to-point—you cannot have more than two CSU/DSUs on a single T1 line. T1 uses a special signaling method called a digital signal 1 (DS1).

FIGURE 8.12   T1 line

Exam Tip

You can connect two CSU/DSU boxes together directly by using a T1 crossover cable. Like the UTP crossover cables you’ve seen previously in the book, the T1 crossover cable simply reverses the send/receive pairs on one end of the cable. You’ll only see this in use to connect older routers together. The CSU/DSU connections provide convenient link points.

DS1 uses a relatively primitive frame—the frame doesn’t need to be complex because with point-to-point no addressing is necessary. Each DS1 frame has 25 pieces: a framing bit and 24 channels. Each DS1 channel holds a single eight-bit DS0 data sample. The framing bit and data channels combine to make 193 bits per DS1 frame. These frames are transmitted 8,000 times/sec, making a total throughput of 1.544 Mbps (Figure 8.13). DS1 defines, therefore, a data transfer speed of 1.544 Mbps, split into twenty-five 64 Kbps DS0 channels. The process of having frames that carry a portion of every channel in every frame sent on a regular interval is called time division multiplexing (TDM).

FIGURE 8.13   DS1 frame

Exam Tip

Each 64 Kbps channel in a DS1 signal is a DS0.

With Ethernet, the whole frame encapsulates a single set of data, such as an IP packet that, in turn, encapsulates a single type of TCP segment or UDP datagram. It generally takes multiple frames to get the data to the recipient, where the frames are removed, the IP packet is removed, and the segment or datagram gets put together to make the data transfer complete.

The cool thing about the DS1 frame, though, is that you don’t have to use the whole frame for a single set of data. With the right CSU/DSU at either end, you can specify which channels go with a specific thread of data. The frame continues down the line even if some of the channels contain no data at all. The CSU/DSU at the other end collects the data streams and keeps them separate. To paraphrase the immortal words of Professor Egon, “Never cross the streams.” (You have seen Ghostbusters, right?) Otherwise, you’d lose data.

Travel Advisory

People rarely use the term “DS1.” Because T1 lines only carry DS1 signals, you usually just say T1 when describing the signal, even though the term DS1 is more accurate.

A T1 line is a dedicated phone connection that you lease, usually on a monthly basis, from the telephone company. It has no telephone number, and it’s always connected. An entire T1 bundle is expensive, so many telephone companies let you buy just some of these individual channels, a practice known as fractional T1 access.

A T3 line supports a data rate of about 45 Mbps on a dedicated telephone connection. It consists of 672 individual DS0 channels. T3 lines (sometimes referred to as DS3 lines) are mainly used by regional telephone companies and ISPs connecting to the Internet.

Similar to the North American T1 line, E-carrier level 1 (E1) is the European format for digital transmission. An E1 line carries signals at 2.048 Mbps (32 channels at 64 Kbps), compared to the T1’s 1.544 Mbps (24 channels at 64 Kbps). E1 and T1 lines can interconnect for international use. There are also E3 lines, which carry 16 E1 lines, with a bandwidth of about 34 Mbps.

Exam Tip

E1 and SONET use a derivative of the High-Level Data Link Control (HDLC) protocol as the control channel.

A CSU/DSU, as mentioned earlier, connects a leased T1 or T3 line from the telephone company to a customer’s equipment. A CSU/DSU has (at least) two connectors: one that goes to the T1/T3 line running out of your demarc and another connection that goes to your router. It performs line encoding and conditioning functions and often has a loopback function for testing. Many newer routers have CSU/DSUs built into them. Figure 8.14 shows the front of a Juniper Networks router with two T1 interfaces.

FIGURE 8.14   CSU/DSU on a Juniper router (photo courtesy of Juniper Networks, Inc.)

Many routers feature two interfaces on one router, with the dual links providing redundancy if one link goes down. The CSU part of a CSU/DSU protects the T1 or T3 line and the user equipment from lightning strikes and other types of electrical interference. It also stores statistics and has capabilities for loopback testing. The DSU part supplies timing to each user port, taking the incoming user’s data signals and converting the input signal into the specified line code and then framing the format for transmission over the provided line.

Make sure you know the four T-carriers shown in Table 8.1.

Fiber Carriers: SONET/SDH and OC

T-carriers were a great start into the digital world, but in the mid-1980s, fiber-optic cabling became the primary tool for long-distance communication all over the world. By then, AT&T’s monopoly was gone, replaced by a number of competing carriers. Competition was strong and everyone was making their own fiber transmission standards. In an incredible moment of corporate cooperation, in 1987, all of the primary fiber-optic carriers decided to drop their own standards and move to a new international standard called Synchronous Optical Network (SONET) in the United States and Synchronous Digital Hierarchy (SDH) in Europe.

All of these carriers adopting the same standard created a world of simple interconnections between competing voice and data carriers. This adoption defined the moment that truly made the Internet a universal network. Before SONET, interconnections happened, but they were outlandishly expensive, preventing the Internet from reaching many areas of the world.

SONET remains the primary standard for long-distance, high-speed, fiber-optic transmission systems. SONET, like Ethernet, defines interface standards at the Physical and Data Link layers of the OSI seven-layer model. The physical aspect of SONET is partially covered by the Optical Carrier standards, but it also defines a ring-based topology that most SONET adopters now use. SONET does not require a ring, but a SONET ring has fault tolerance in case of line loss. As a result, most of the big long-distance optical pipes for the world’s telecommunications networks are SONET rings.

Exam Tip

SONET is one of the most important standards for making all WAN interconnections—and it’s also the least likely standard you’ll ever see because it’s hidden away from all but the biggest networks.

The real beauty of SONET lies in its multiplexing capabilities. A single SONET ring can combine multiple DS1, DS3, and even European E1 signals and package them into single, huge SONET frames for transmission. Clearly, SONET needs high-capacity fiber optics to handle such large data rates. That’s where the Optical Carrier standards come into play!

The Optical Carrier (OC) standards denote the optical data-carrying capacity (in bps) of fiber-optic cables in networks conforming to the SONET standard. The OC standard describes an escalating series of speeds, designed to meet the needs of medium-to-large corporations. SONET establishes OC speeds from 51.8 Mbps (OC-1) to 39.8 Gbps (OC-768).

Still want more throughput? Many fiber devices now use a very clever feature called Wavelength Division Multiplexing (WDM) or its newer and more popular version, Dense WDM (DWDM). DWDM enables an individual single-mode fiber to carry multiple signals by giving each signal a different wavelength. The result varies, but a single DWDM fiber can support around 150 signals, enabling, for example, a 51.8 Mbps OC-1 line to run at 51.8 Mbps × 150 signals = 7.77 gigabytes per second! DWDM has become very popular for long-distance lines, as it’s usually less expensive to replace older SONET/OC-x equipment with DWDM than it is to add more fiber lines.

Exam Tip

DWDM isn’t just upgrading SONET lines; DWDM works just as well on long-distance fiber Ethernet.

SONET uses the Synchronous Transport Signal (STS) signal method. The STS consists of two parts: the STS payload (which carries data) and the STS overhead (which carries the signaling and protocol information). When folks talk about STS, they add a number to the end of “STS” to designate the speed of the signal. For example, STS-1 runs a 51.85 Mbps signal on an OC-1 line. STS-3 runs at 155.52 Mbps on OC-3 lines, and so on. Table 8.2 describes the most common optical carriers.

Packet Switching

All of these impressive connections that start with Ts and Os are powerful, but they are not in and of themselves a complete WAN solution. These WAN connections with their unique packets (DS0, STS, and so on) make up the entire mesh of long-range connections called the Internet, carrying both packetized voice data and TCP/IP data packets. All of these connections are point-to-point, so you need to add another level of devices to enable you to connect multiple T1s, T3s, or OC connections together to make that mesh. That’s where packet switching comes into play.

Exam Tip

The first generation of packet-switching technology was called X.25. It enabled remote devices to communicate with each other across high-speed digital links without the expense of individual leased lines. CompTIA also refers to X.25 as the CCITT Packet Switching Protocol.

Packets, as you know, need some form of addressing scheme to get from one location to another. The telephone industry came up with its own types of packets that run on T-carrier and OC lines to get data from one central office to another. These packet-switching protocols are functionally identical to routable network protocols like TCP/IP. Today’s WAN connections predominantly use two different forms of packet switching: Frame Relay and ATM.

Local Lingo

Packet switches   Machines that store and forward packets using any type of packet-switching protocol are called packet switches.

Frame Relay

Frame Relay is an extremely efficient packet-switching standard, designed for and used primarily with T-carrier lines. It works especially well for the off-again/on-again traffic typical of most LAN applications. Frame Relay switches packets quickly, but without any guarantee of data integrity at all. You can’t even count on it to deliver all the frames, because it will discard frames whenever there is network congestion. At first this might sound problematic—what happens if you have a data problem? In practice, however, a Frame Relay network delivers data quite reliably because T-carrier digital lines that use Frame Relay have very low error rates. It’s up to the higher-level protocols to error-check as needed. Frame Relay was extremely popular in its day, but newer technologies such as ATM and especially MPLS are beginning to replace it. If you decide to go with a T1 line in the United States, you’ll probably get a T1 line running Frame Relay, although many companies use the newer ATM standard as their packet-switching solution with T-carrier lines.

ATM

Don’t think automatic teller machine here! Asynchronous Transfer Mode (ATM) is a network technology originally designed for high-speed LANs in the early 1990s. ATM only saw limited success in the LAN world but became extremely popular in the WAN world. In fact, until the recent advent of MPLS (see “MPLS” next), most of the SONET rings that moved voice and data all over the world used ATM for packet switching. ATM integrated voice, video, and data on one connection, using short and fixed-length packets called cells to transfer information. Every cell sent with the same source and destination traveled over the same route.

ATM existed because data and audio/video transmissions have different transfer requirements. Data tolerates a delay in transfer, but not signal loss (if it takes a moment for a webpage to appear, you don’t care). Audio and video transmissions, on the other hand, tolerate signal loss but not delay (delay makes phone calls sound choppy and clipped). Because ATM transferred information in cells of one set size (53 bytes long), it handled both types of transfers well. ATM transfer speeds ranged from 155.52 to 622.08 Mbps and beyond. If your location was big enough to order an OC line from your ISP, odds were good that OC line connected to an ATM switch.

Travel Advisory

Referring to ATM in the past tense might seem a bit premature. Plenty of ISPs still use ATM, but it’s definitely on the way out due to MPLS.

MPLS

Frame Relay and ATM were both fantastic packet-switching technologies, but they were designed to support any type of traffic that might come over the network. Today, TCP/IP, the predominant data technology, has a number of issues that neither Frame Relay nor ATM address. For example, ATM uses a very small frame, only 53 bytes, which adds quite a bit of overhead to 1,500-byte Ethernet frames. To address this and other issues, many ISPs (and large ISP clients) use an improved technology called Multiprotocol Label Switching (MPLS) as a replacement for Frame Relay and ATM switching.

MPLS adds an MPLS label that sits between the layer-2 header and the layer-3 information. Layer 3 is always IP, so MPLS labels sit between layer 2 and the IP headers. Figure 8.15 shows the structure of an MPLS header.

FIGURE 8.15   MPLS header

The MPLS header consists of four parts:

    • Label   A unique identifier, used by MPLS-capable routers to determine how to move data.

    • Cost of Service (CoS)   A relative value used to determine the importance of the labeled packet. (This is also often labeled Exp, for experimental.)

    • S   In certain situations, a single packet may have multiple MPLS labels. This single bit value is set to 1 for the initial label.

    • Time to Live (TTL)   The TTL determines the number of hops the label can make before it’s eliminated.

Figure 8.16 shows the location of the MPLS header.

FIGURE 8.16   MPLS header inserted in a frame

The original idea for MPLS was to give individual ISPs a way to move traffic through their morass of different interconnections and switches more quickly and efficiently by providing network-wide Quality of Service (QoS). QoS is a means of sorting IP packets to provide priority based on header information. MPLS-capable routers avoid running IP packets through their full routing tables and instead use the header information to route packets quickly. Where “regular” routers use QoS on an individual basis, MPLS routers use their existing dynamic routing protocols to send each other messages about their overhead, enabling QoS to span an entire group of routers (Figure 8.17). This creates an MPLS-topology network.

FIGURE 8.17   MPLS routers talk to each other about their overhead.

Let’s see how the MPLS-labeled packets, combined with MPLS-capable routers, create improved throughput. To see this happen, I need to introduce a few MPLS terms:

    • Forwarding Equivalence Class (FEC)   FEC is a group of devices (usually computers) that tend to send packets to the same place, such as a single broadcast domain of computers connected to a router.

    • Label switching router (LSR)   An LSR looks for and forwards packets based on their MPLS label. These are the “MPLS routers” mentioned previously.

    • Label edge router (LER)   An LER is an MPLS router that has the job of adding MPLS labels to incoming packets that do not yet have a label.

    • Label Distribution Protocol (LDP)   LSRs and LERs use the LDP to communicate dynamic information about their state. Figure 8.17 shows an example of LDP in action.

Figure 8.18 shows a highly simplified MPLS network. Note the position of the LERs and LSRs.

FIGURE 8.18   Sample MPLS-topology network

When an MPLS network comes online, administrators will configure initial routing information, primarily setting metrics to routes (Figure 8.19).

FIGURE 8.19   MPLS initial routes added

LERs have the real power in determining routes. Because LERs are the entrances and exits for an MPLS network, they talk to each other to determine the best possible routes. As data moves from one FEC, the LERs add an MPLS label to every packet. LSRs strip away incoming labels and add their own. This progresses until the packets exit out the opposing LER (Figure 8.20).

FIGURE 8.20   Data routing through an MPLS network

Although MPLS was originally used just to move data quickly between LERs, MPLS’s label-stacking ability makes it a perfect candidate for end-user VPNs. Instead of having to set up your own VPN, an ISP using MPLS can set up and lease you a fully functional connection to your network. The ISP makes the VPN for you; you just insert an RJ-45 plug into the switch in your office and it works. This feature of MPLS is called a permanent virtual circuit (PVC) and is a popular product sold by ISPs to connect two customer locations.

Real-World WAN

There are two reasons to use a telephony WAN connection: to get your LAN on the Internet or to make a private connection between two or more of your private LANs. How you go about getting one of these lines changes a bit depending on which you want to do. Let’s start with connecting to the Internet.

Traditionally, getting a WAN Internet connection was a two-step process: you talked to the telephone company to get the line physically installed and then talked to an ISP to provide you with Internet access. Today, almost every telephone company is also an ISP, so this process is usually simple. Just go online and do a web search of ISPs in your area and give them a call. You’ll get a price quote, and, if you sign up, the ISP will do the installation.

You can use a few tricks to reduce the price, however. If you’re in an office building, odds are good that a T1 or better line is already installed and that an ISP is already serving people in your building. Talk to the building supervisor. If there isn’t a T1 or better line, you have to pay for a new line. If an interconnect is nearby, this option might be inexpensive. If you want the telephone company to run an OC line to your house, however, brace for a quote of thousands of dollars just to get the line.

The telephone company runs your T-carrier (or better) line to a demarc. This demarc is important because this is where the phone company’s responsibility ends! Everything on “your” side of the demarc is your responsibility. From there, you or your ISP installs a CSU/DSU (for T-carriers) and that device connects to your router.

Depending on who does this for you, you may encounter a tremendous amount of variance here. The classic example (sticking with T-carrier) consists of a demarc, CSU/DSU, and router setup, as shown in Figure 8.21.

FIGURE 8.21   Old-school T-carrier setup

T-carriers have been around so long that many of these parts are combined. You’ll often see a single box that combines the CSU/DSU and the router in one handy device, such as the Juniper router shown earlier in Figure 8.14.

WAN telephony carriers are incredibly dependable—far more dependable than inexpensive alternatives (like cable modems)—and that’s one of the main reasons people still use them. But you should definitely know how to test your end of the connection if you ever suspect a problem. The single most important test is called the Bit Error Rate Test (BERT). A BERT test verifies the T-carrier connection from end to end. Every CSU/DSU has a different way to BERT test. Just make sure you know how to perform the test on yours!

Alternative to Telephony WAN

Over the last few years, many ISPs started replacing their T1, T3, and OCx equipment with good-old Ethernet. Well, not “good-old” Ethernet—rather, superfast 10 Gbps Ethernet running on single-mode fiber and connected to DWDM-capable switches. As a result, in many areas—especially metropolitan areas—you can get native Ethernet right to your office. Anyone want 10 Gbps to their router? If you’ve got the money and you’re in a larger city, you can get it now.

These Ethernet connections also work great for dedicated connections. A good friend of mine leases a dedicated 10 Gbps Ethernet connection from his company’s data center in Houston, Texas, to his office in London, England. It costs roughly $15,000/month. DSL and cable have been around for quite a while and deserve some serious discussion. You can’t install your own DSL or cable modem connection, however, as you can with telephony WAN carriers. For example, you can’t have your own private cable modem connection between two of your offices. DSL and cable modems are only for Internet connections and, as a result, are really more of a last-mile issue—let’s discuss DSL and cable in the next section.

The Last Mile

Speed is the key to the Internet, but historically there’s always been one big challenge: getting data from central offices to individual users. Although this wasn’t a problem for larger companies that could afford their own WAN connections, what about individuals and small companies that couldn’t or wouldn’t pay hundreds of dollars a month for a T1? This area, the infamous last mile, was a serious challenge early on for both Internet connections and private connections because the only common medium was standard telephone lines. A number of last-mile solutions have appeared over the years, and the CompTIA Network+ exam tests you on the most popular ones—and a few obscure ones as well. Here’s the list:

    • Dial-up

    • DSL

    • Cable

    • Satellite

    • Fiber

    • BPL

Dial-up

Many different types of telephone lines are available, but all the choices break down into two groups: dedicated and dial-up. Dedicated lines are always off the hook (that is, they never hang up on each other). They are always on.

A dedicated line (like a T1) does not have a phone number. In essence, the telephone company creates a permanent, hard-wired connection between the two locations, rendering a phone number superfluous. Dial-up lines, by contrast, have phone numbers; they must dial each other up to make a connection. When they’re finished communicating, they hang up. Two technologies make up the overwhelming majority of dial-up connections: PSTN and ISDN.

Public Switched Telephone Network

The oldest, slowest, and most common original phone connection is the public switched telephone network (PSTN). PSTN is also known as plain old telephone service (POTS). PSTN is just a regular phone line, the same line that used to run into everybody’s home RJ-11 telephone jacks from the central office of your Local Exchange Carrier (LEC). The LEC is the telephone company (telco) that provides local connections and usually the one that owns your local central office.

Because PSTN was designed long before computers were common, it was designed to work with only one type of data: sound. Here’s how it works. The telephone’s microphone takes the sound of your voice and translates it into an electrical analog waveform. The telephone then sends that signal through the PSTN line to the phone on the other end of the connection. That phone translates the signal into sound on the other end using its speaker. Note the word analog. The telephone microphone converts the sounds into electrical waveforms that cycle 2,400 times a second. An individual cycle is known as a baud. The number of bauds per second is called the baud rate. Pretty much all phone companies’ PSTN lines have a baud rate of 2,400. PSTN connections use a connector called RJ-11. It’s the classic connector you see on all telephones (Figure 8.22).

FIGURE 8.22   RJ-11 connectors (top and side views)

When you connect your modem to a phone jack, the line then runs to your network interface unit (NIU), or demarc. The term “network interface unit” is more commonly used to describe the small box on the side of a home that accepts the incoming lines from the telephone company and then splits them to the different wall outlets. “Demarc” more commonly describes large connections used in businesses. The terms are interchangeable and always describe the interface between the lines the telephone company is responsible for and the lines for which you are responsible (Figure 8.23).

FIGURE 8.23   Typical home demarc

Computers, as you know, don’t speak analog—only digital/binary (0 or 1) will do. In addition, the people who invented the way PCs communicate decided to divide any digital signal going in and out of your computer into eight bits at a time. To connect over phone lines, PCs need two devices: one that converts this eight-bit-wide (parallel) digital signal from the computer into serial (one-bit-wide) digital data and then another device to convert (modulate) the data into analog waveforms that can travel across PSTN lines. You already know that the device that converts the digital data to analog and back is called a modulator-demodulator (modem). The modem also contains a device called a Universal Asynchronous Receiver/Transmitter (UART). The UART takes the eight-bit-wide digital data and converts it into one-bit-wide digital data and hands it to the modem for conversion to analog. The process is reversed for incoming data. Even though internal modems are actually both a UART and a modem, we just say the word “modem” (Figure 8.24).

FIGURE 8.24   Internal modem

Exam Tip

Internal modems are both a UART and a modem. External modems use a serial or USB port. The serial or USB port contains the UART, so the external modem truly is just a modem.

Baud vs. Bits per Second   Modems use phone lines to transmit data at various speeds. These speeds cause a world of confusion and problems for computer people. This is where a little bit of knowledge becomes dangerous. Standard modems you can buy for your home computer normally transmit data at speeds up to 56 Kbps. That’s 56 kilobits per second, not 56 kilobaud! Many people confuse the terms baud and bits per second. This confusion arises because the baud rate and bits per second are the same for modems until the data transfer rate surpasses 2,400 bps.

A PSTN phone line takes analog samples of sound 2,400 times a second. This standard was determined a long time ago as an acceptable rate for sending voice traffic over phone lines. Although 2,400-baud analog signals are fine for voice communication, they are a big problem for computers trying to send data because computers only work with digital signals. The job of the modem is to take the digital signals it receives from the computer and send them out over the phone line in an analog form, using the baud cycles from the phone system. A 2,400 bps modem—often erroneously called a 2,400-baud modem—uses 1 analog baud to send 1 bit of data.

As technology progressed, modems became faster and faster. To get past the 2,400-baud limit, modems modulated the 2,400-baud signal multiple times in each cycle. A 4,800 bps modem modulated two bits per baud, thereby transmitting 4,800 bps. All PSTN modem speeds are a multiple of 2,400, with the latest (and last) generation of modems achieving 2,400 × 24 = 57,600 bps (56 Kbps).

V Standards   For two modems to communicate with each other at their fastest rate, they must modulate signals in the same fashion. The two modems must also negotiate with, or query, each other to determine the fastest speed they share. The modem manufacturers themselves originally standardized these processes as a set of proprietary protocols. The downside to these protocols was that unless you had two modems from the same manufacturer, modems often would not work together. In response, the International Telegraph and Telephone Consultative Committee (CCITT), a European standards body, established standards for modems. These standards, known generically as the V standards, define the speeds at which modems can modulate. The most common of these speed standards are as follows:

    • V.22   1,200 bps

    • V.22bis   2,400 bps

    • V.32   9,600 bps

    • V.32bis   14,400 bps

    • V.34   28,000 bps

    • V.90   57,600 bps

    • V.92   57,600 bps

Local Lingo

ITU-T   The CCITT was renamed the International Telecommunication Union Telecommunication Standardization Sector (ITU-T) way back in 1993.

The current modem standard now on the market is the V.92 standard. V.92 has the same download speed as the V.90, but upstream rates increase to as much as 48 Kbps.

Point-to-Point Protocol   Modems use a protocol for making a secure connection to an ISP, called Point-to-Point Protocol (PPP). PPP enables two devices to connect directly, authenticate with user name and password, and negotiate a network protocol. That protocol today, of course, is TCP/IP.

ISDN

PSTN lines traditionally just aren’t that good. While the digital equipment that connects to a PSTN supports a full 64 Kbps DS0 channel, the combination of the lines themselves and the conversion from analog to digital means that most PSTN lines rarely go faster than 33 Kbps—and, yes, that includes the 56 Kbps connections.

The phone companies were motivated to come up with a way to generate higher capacities. Their answer was fairly straightforward: make the last mile digital. Since everything but the last mile was already digital, by adding special equipment at the central office and the user’s location, phone companies felt they could achieve a true, steady, dependable throughput of 64 Kbps per line over the same copper wires already used by PSTN lines. This process of sending telephone transmission across fully digital lines end-to-end is called Integrated Services Digital Network (ISDN) service.

Exam Tip

ISDN also supports voice but requires special ISDN telephones.

ISDN service consists of two types of channels: Bearer channels (B channels) carry data and voice information using standard DS0 channels (64 Kbps), whereas Delta channels (D channels) carry setup and configuration information at 16 Kbps. Most ISDN providers let the customer choose either one or two B channels. The more common setup is two B/one D, called a Basic Rate Interface (BRI) setup. A BRI setup uses only one physical line, but each B channel sends 64 Kbps, doubling the throughput total to 128 Kbps.

Another type of ISDN is called Primary Rate Interface (PRI). ISDN PRI is actually just a full T1 line, carrying 23 B channels.

The physical connections for ISDN bear some similarity to PSTN modems. An ISDN wall socket is usually something that looks like a standard RJ-45 network jack. This line runs to your demarc. In home installations, many telephone companies install a second demarc separate from your PSTN demarc. The most common interface for your computer is a device called a terminal adapter (TA). TAs look like regular modems and, like modems, come in external and internal variants. You can even get TAs that also function as hubs, enabling your system to support a direct LAN connection (Figure 8.25).

FIGURE 8.25   A TeleWell ISDN terminal adapter

Exam Tip

Remember, a B channel is a DS0 channel.

You generally need to be within approximately 18,000 feet of a central office to use ISDN. When you install an ISDN TA, you must configure the other ISDN telephone number you want to call, as well as a special number called the Service Profile ID (SPID). Your ISP provides the telephone number, and the telephone company gives you the SPID. (In many cases, the telephone company is also the ISP.) Figure 8.26 shows a typical installation screen for an internal ISDN TA in an old version of Windows. Note that each channel has a phone number in this case.

FIGURE 8.26   ISDN settings in an old version of Windows

DSL

Many telephone companies offer a digital subscriber line (DSL) connection, an almost fully digital, dedicated (no phone number) connection. DSL represented the next great leap forward past ISDN for telephone lines. A physical DSL connection manifests as just another PSTN connection, using the same telephone lines and RJ-11 jacks as any regular phone line.

DSL comes in a number of versions, but the three most important to know for the CompTIA Network+ exam are Symmetric DSL (SDSL), Asymmetric DSL (ADSL), and the newer Very High Bitrate DSL (VDSL). SDSL lines provide the same upload and download speeds, making them excellent for those who send as much data as they receive, although SDSL is relatively expensive (VDSL is a new form of SDSL—see “VDSL” later in this section). ADSL uses different upload and download speeds. ADSL download speeds are much faster than the upload speeds. Most small office and home office (SOHO) users are primarily concerned with fast downloads for things like webpages and can tolerate slower upload speeds. ADSL is always much less expensive than SDSL, and VDSL is usually the most expensive.

Travel Advisory

To use DSL, you must be within 18,000 feet of a central office. The closer you are, the faster your connection will be. Several companies offer a service called Extended DSL (XDSL) that can go much farther away from the central office, but that’s not a standard. Depending on the implementation, Extended DSL is a rebranded T1 or partial T1 line or something completely proprietary to the telecommunications company offering the service. Buyer beware!

SDSL

SDSL provides equal upload and download speed and, in theory, provides speeds up to 15 Mbps, although the vast majority of ISPs provide packages ranging from 192 Kbps to 9 Mbps.

ADSL

ADSL provides theoretical maximum download speeds up to 15 Mbps and upload speeds up to 1 Mbps. All ADSL suppliers “throttle” their ADSL speeds, however, and provide different levels of service. Real-world ADSL download speeds vary from 384 Kbps to 15 Mbps, and upload speeds go from as low as 128 Kbps to around 768 Kbps.

VDSL

VDSL is the latest version of DSL to appear. Although not as many people use it as regular DSL (at least in the United States), its ability to provide speeds of 100+ Mbps in both directions makes it an attractive option. VDSL achieves these speeds by adding very advanced methods to encode the data. Don’t get too excited about these great speed increases. They are very distance dependent: you won’t get 100 Mbps unless you’re around 300 meters from the DSLAM (see “DSL Features”). VDSL is designed to run on copper phone lines, but many VDSL suppliers use fiber-optic cabling to increase distances. In the United States, these fiber VDSL services are fiber-to-the-home solutions. The two most popular carriers are AT&T’s U-verse and Verizon’s Fiber Optic Service (FiOS).

Exam Tip

The CompTIA Network+ objectives offer Variable Digital Subscriber Line as the words that match the VDSL initials. No such DSL variant exists. VDSL stands for Very High Bitrate DSL. You’ll probably only see the initials on the exam, so no worries on that score.

DSL Features

One nice aspect of DSL is that you don’t have to run new phone lines. The same DSL lines you use for data can simultaneously transmit your voice calls.

All versions of DSL have the same central office–to–end user distance restrictions as ISDN—around 18,000 feet from your demarc to the central office. At the central office, your DSL provider has a device called a DSL Access Multiplexer (DSLAM) that connects multiple customers to the Internet.

Travel Advisory

No DSL provider guarantees any particular transmission speed and will only provide service as a “best efforts” contract—a nice way to say that DSL lines are notorious for substantial variations in throughput.

Installing DSL

DSL operates using your preexisting telephone lines (assuming they are up to specification). This is wonderful but also presents a technical challenge. For DSL and your run-of-the-mill POTS line to coexist, you need to filter out the DSL signal on the POTS line. A DSL line has three information channels: a high-speed downstream channel, a medium-speed duplex channel, and a POTS channel. Segregating the two DSL channels from the POTS channel guarantees that your POTS line will continue to operate even if the DSL fails. You accomplish this by inserting a filter on each POTS line, or a splitter mechanism that enable all three channels to flow to the DSL modem but sends only the POTS channel down the POTS line. The DSL company should provide you with a few POTS filters for your telephones. If you need more, most computer/electronics stores stock DSL POTS filters.

The most common DSL installation consists of a DSL modem connected to a telephone wall jack and to a standard NIC in your computer (Figure 8.27). A DSL modem is not an actual modem—it’s more like an ISDN terminal adapter—but the term stuck, and even the manufacturers of the devices now call them DSL modems.

FIGURE 8.27   A DSL modem connection between a PC and telco

Many offices use DSL. In my office, we use a special DSL line (we use a digital phone system, so the DSL must be separate) that runs directly into our equipment room (Figure 8.28).

FIGURE 8.28   DSL line into equipment room

This DSL line runs into our DSL modem via a standard phone line with RJ-11 connectors. The DSL modem connects to our gateway router with a CAT 5e patch cable, which, in turn, connects to the company’s switch. Figure 8.29 shows an ADSL modem and a router, giving you an idea of the configuration in our office.

FIGURE 8.29   DSL connection

Home users often connect the DSL modem directly to their PC’s NIC. Either way, you have nothing to do in terms of installing DSL equipment on an individual system—just make sure you have a NIC. The person who installs your DSL will test the DSL line, install the DSL modem, connect it to your system, and verify that it all works. With DSL, be aware that you might run into an issue with something called Point-to-Point Protocol over Ethernet (PPPoE).

The first generation of DSL providers used a bridged connection; once the DSL line was running, it was as if you had snapped an Ethernet cable into your NIC. You were on the network. Those were good days for DSL. You just plugged your DSL modem into your NIC and, assuming your IP settings were whatever the DSL folks told you to use, you were running.

The DSL providers didn’t like that too much. There was no control—no way to monitor who was using the DSL modem. As a result, the DSL folks started to use PPPoE, a protocol that was originally designed to encapsulate PPP frames into Ethernet frames. The DSL people adopted it to make stronger controls over your DSL connection. In particular, you could no longer simply connect; you now had to log on with an account and a password to make the DSL connection. PPPoE is now predominant on DSL. If you get a DSL line, your operating system has software to enable you to log onto your DSL network. Most SOHO routers come with built-in PPPoE support, enabling you to enter your user name and password into the router itself (Figure 8.30).

FIGURE 8.30   PPPoE settings in SOHO router

Cable Modems

The first big competition for ADSL came from the cable companies. Cable modems have the impressive benefit of phenomenal top speeds. These speeds vary from cable company to cable company, but most advertise speeds in the (are you sitting down?) 5 to 100 megabits per second range. Many cable modems provide a throughput speed of 5 to 30 Mbps for downloading and 2 Mbps to 10 Mbps for uploading—there is tremendous variance among different providers.

A cable modem installation consists of a cable modem connected to a cable. The cable modem gets its own cable connection, separate from the one that goes to the television. It’s the same cable line, just split from the main line as if you were adding a second cable outlet for another television. As with ADSL, cable modems connect to PCs using a standard NIC (Figure 8.31).

FIGURE 8.31   Cable modem

Cable modems connect using coax cable to a head end, similar to a telephone company’s central office. Head ends, in turn, connect to the cable company’s network. This network uses a unique protocol called Data Over Cable Service Interface Specification (DOCSIS). Most recently, the specification was revised (DOCSIS 3.0) to increase transmission speeds significantly (this time both upstream and downstream) and introduce support for Internet Protocol version 6 (IPv6).

Exam Tip

Many companies sell routers with a built-in cable or DSL modem.

You’ll have a hard time telling a cable modem from a DSL modem. The only difference, other than the fact that one will have “cable modem” printed on it whereas the other will say “DSL modem,” is that the cable modem has a coax BNC connector and an RJ-45 port; the DSL modem has an RJ-11 port and an RJ-45 port.

Cable modems have proven themselves to be reliable and fast and have surpassed DSL as the broadband connection of choice in homes. Cable companies are also aggressively marketing to business customers with high-speed packages, making cable a viable option for businesses.

Satellite

Living in the countryside may have its charms, but you’ll have a hard time getting high-speed Internet out on the farm. For those too far away to get anything else, satellite may be your only option. Satellite access comes in two types: one-way and two-way. One-way means that you download via satellite but you must use a PSTN/dial-up modem connection for uploads. Two-way means the satellite service handles both the uploading and downloading.

Satellite isn’t as fast as DSL or cable modems, but it’s still faster than PSTN. Both one-way and two-way satellite connections provide around 500 Kbps download and 50 Kbps upload.

Travel Advisory

Companies that design satellite communications equipment haven’t given up on their technology. At the time of this writing, at least one company, HughesNet, offered speeds up to 2 Mbps download. You can surf with that kind of speed!

Satellite requires a small satellite antenna, identical to the ones used for satellite television. This antenna connects to a satellite modem, which, in turn, connects to your PC or your network (Figure 8.32).

FIGURE 8.32   Satellite connection

Exam Tip

Neither cable modems nor satellites use PPP, PPPoE, or anything else that begins with three Ps.

Cellular WAN

Anyone with a smart phone these days appreciates the convenience of using wireless cellular technology on the road. Who doesn’t love firing up an Android phone and cruising the Internet from anywhere? The CompTIA Network+ exam expects you to know a few abbreviations. I’ll divide these into three groups: mobile data services, 802.16 (WiMAX), and LTE.

Mobile Data Services

Mobile data services have names like GSM, GRPS, EDGE, and HSPDA (there are many more standards). These services use the cellular telephone network to provide access. Mostly used with cell phones and smart phones, most mobile data services also sell wireless NICs that you can plug into laptops and desktop computers (Figure 8.33).

FIGURE 8.33   Mobile wireless NIC

802.16

Products that use the 802.16 wireless standard—often called WiMAX—are appearing in select markets everywhere. Although speed for 802.16-compliant devices is about the same as 802.11b, manufacturers claim a range of up to 30 miles. This kind of range makes 802.16 perfect for so-called metropolitan area networks (MANs). Before you get too excited, though, keep in mind that the speed of the network will almost certainly decrease the farther away from the base station (the WAP) the nodes are. Effective range could be as little as three miles, but that still beats 300 feet in my book.

If you want WiMAX access right now, you’ll probably end up going to CLEAR or Sprint (currently the biggest WiMAX ISPs in America) for a WiMAX home router that plugs directly into your own router (Figure 8.34). They even sell WiMAX/802.11 wireless hot spots, although they limit the number of concurrent connections you can have.

FIGURE 8.34   CLEAR home modem (photo courtesy of CLEAR)

LTE

WiMAX has only one serious competitor—Long Term Evolution (LTE). LTE marks the latest evolution of the popular High-Speed Packet Access (HSPA), better known to the cellular world as GSM or 3G technology. LTE has some heavy-hitter companies behind it, such as AT&T, Verizon, and Sprint. LTE has become quite popular for portable Internet access (see Figure 8.33 for an example), but changes in the landscape in late 2011 and 2012 should see the end of WiMAX altogether. Sprint and CLEAR, the early WiMAX champions, are moving (or have moved, depending on when you’re reading this) to LTE in 2012.

Local Lingo

Evolved High-Speed Packet Access   Many companies have adopted a standard called HSPA+ that provides wireless speeds of up to 84 Mbps down and 22 Mbps up. This standard competes with LTE.

Fiber

DSL was the first popular last-mile WAN option, but over the years cable modems have taken the lead. In an attempt to regain market share, telephone providers are now rolling out fiber-to-the-home/fiber-to-the-premises options that are giving the cable companies a scare. In the United States, two companies, AT&T (U-verse) and Verizon (FiOS), are offering very attractive ISP, television, and phone services at speeds that will eventually increase above 100 Mbps. These services are quickly gaining in popularity and giving cable companies a run for their money.

To make rollouts affordable, most fiber-to-the-home technologies employ a version of passive optical network (PON) architecture that uses a single fiber to the neighborhood switch and then individual fiber runs to each final destination. PON uses WDM to enable multiple signals to travel on the same fiber and then passively splits the signal at the switch to send traffic to its proper recipient.

BPL

With the exception of fiber, most wired networks use electrical signaling to enable systems to interconnect. Rather than running all new wiring dedicated to networks, why not use the vast infrastructure of wiring already in place in just about every home and office in the developed world? Enterprising engineers have been working to provide networking over electrical power lines for many years now with varying degrees of success. The overall field is called powerline communications (PLC) and encompasses everything from voice transmission to home automation to high-speed Internet access.

Local Lingo

HomePlug   The most successful PLC technology is HomePlug, a collection of standards for creating LANs in houses, running smart meters for more efficient electrical use, and home automation. The HomePlug Powerline Alliance, with a membership of over 60 companies, actively promotes the various HomePlug standards and devices.

Broadband over Power Line (BPL) is one specific field of technologies that tries to bring usable Internet access to homes and businesses through the electrical power grid. The various companies that have rolled this out, such as Ambient Corporation, Current Technologies, and Motorola, have had some success, though the electrical grid poses serious challenges to networking because of noise and interference from other devices. Most BPL rollouts to date have failed, but companies continue to explore the possibilities.

Which Connection?

With so many connection options for homes and small offices, making a decision is often a challenge. Your first question is availability: Which services are available in your area? The second question is, How much bandwidth do you need? The latter is a question of great debate. Most services are more than happy to increase service levels if you find that a certain level is too slow. I usually advise clients to start with a relatively slow level and then increase if necessary. After all, once you’ve tasted the higher speeds, going slower is hard, but the transition to faster is relatively painless!

Going Connection Shopping

You’ve already checked the availability of DSL and ISDN in your neighborhood, but now you have more choices! Do you have cable or satellite available? A great website to start your search is www.dslreports.com. It has a handy search feature that helps you determine the types of service and the costs for DSL, cable, and other services. Which one makes sense for you?

Using Remote Access

Because most businesses are no longer limited to a simple little shop like you would find in a Dickens novel, many people need to be able to access files and resources over a great distance. Enter remote access. Remote access uses WAN and LAN connections to enable a computer user to log onto a network from the other side of a city, a state, or even the globe. As people travel, information has to remain accessible. Remote access enables users to connect a server at the business location and log into the network as if they were in the same building as the company. The only problem with remote access is that there are so many ways to do it! I’ve listed the six most common forms of remote access here:

    • Dial-up to the Internet   Using a dial-up connection to connect to your ISP

    • Private dial-up   Using a dial-up connection to connect to your private network

    • Virtual private network   Using an Internet connection to connect to a private network (discussed in Chapter 9)

    • Dedicated connection   Using a non-dial-up connection to another private network or the Internet

    • Remote terminal   Using a terminal emulation program to connect to another computer

    • VoIP   Voice over IP

In this section, I discuss the issues related to configuring these six types of connections. After seeing how to configure these types of remote connections, I move into observing some security issues common to every type of remote connection.

Local Lingo

Extranet   You’ll see the term extranet more in books than in the day-to-day workings of networks and network techs. So what is an extranet? Whenever you allow authorized remote users to access some part of your private network, you have created an extranet.

Dial-up to the Internet

Dial-up is the oldest and least expensive method to connect to the Internet and is still somewhat common. Even with broadband and wireless so prevalent, every self-respecting network tech (or maybe just old network techs like me) keeps a dial-up account as a backup. You buy a dial-up account from an ISP (many wireless and broadband ISPs give free dial-up—just ask). All operating systems come with dial-up support programs, but you’ll need to provide the following:

    • A modem (most operating systems check for a modem before setting up a dial-up connection)

    • The telephone number to dial (provided to you by the ISP)

    • User name and password (provided to you by the ISP)

    • Type of connection (dial-up always uses PPP)

    • IP information (provided to you by the ISP—usually just DHCP)

Every operating system comes with the software to help you set up a dial-up connection. In Windows Vista or Windows 7, for example, select the “Set up a dial-up connection” option in the Network and Sharing Center (Figure 8.35). Whatever the name, this tool is what you use to create dial-up connections.

FIGURE 8.35   Dial-up on Windows 7

Private Dial-Up

A private dial-up connection connects a remote system to a private network via a dial-up connection. Private dial-up does not use the Internet! Private dial-up requires two systems. One system acts as a remote access server (RAS). The other system, the client, runs a connection tool (usually the same tool you just read about in the previous section).

In Windows, a RAS is a server running Remote Access Service (RAS), dedicated to handling users who are not directly connected to a LAN but who need to access file and print services on the LAN from a remote location. For example, when a user dials into a network from home using an analog modem connection, she is dialing into a RAS. Once the user authenticates, she can access shared drives and printers as if her computer were physically connected to the office LAN.

You must set up a server in your LAN as a RAS server. That RAS server, which must have at least one modem, accepts incoming calls and handles password authentication. RAS servers use all the standard authentication methods (PAP, CHAP, EAP, 802.1X, and so on, which Chapter 9 covers in detail) and have separate sets of permissions for dial-in users and local users. You must also configure the RAS to set the rights and permissions for all of the dial-in users. Configuring a RAS system is outside the scope of this book, however, because each one is different (Figure 8.36).

FIGURE 8.36   Windows RAS in action

Creating the client side of a private dial-up connection is identical to setting up a dial-up connection to the Internet. The only difference is that instead of having an ISP tell you what IP settings, account name, and password to use, the person who sets up the RAS server tells you this information (Figure 8.37).

FIGURE 8.37   Dial-up on Macintosh OS X

Local Lingo

RAS   Remote access server refers to both the hardware component (servers built to handle the unique stresses of a large number of clients calling in) and the software service component of a remote access solution. You might call it a catchall phrase. When you run Microsoft’s Remote Access Service on a server, you turn that server into a remote access server.

Most techs call RAS “razz,” rather than using the initials “R-A-S.” This creates a seemingly redundant phrase used to describe a system running RAS: “RAS server.” This helps distinguish servers from clients and makes geeks happier.

Dedicated Connection

Dedicated connections are remote connections that are never disconnected. Dedicated connections can be broken into two groups: dedicated private connections between two locations and dedicated connections to the Internet. Dedicated private connections manifest themselves as two locations interconnected by a (usually high-speed) connection such as a T1 line (Figure 8.38).

FIGURE 8.38   Dedicated private connection

Each end of the T1 line goes into a router (after going through a CSU/DSU, of course). Note that this connection does not use the Internet in any way—it is not a VPN connection. Private dedicated connections of this type are expensive and are only used by organizations that need the high bandwidth and high security these connections provide. These connections are invisible to the individual computers on each network. There is no special remote connection configuration of the individual systems, although you may have to configure DHCP, DNS, and WINS servers to ensure that the network runs optimally.

DSL and Cable

Dedicated connections to the Internet are common today. Cable modems and DSL have made dedicated connections to the Internet inexpensive and very popular. In most cases, you don’t have to configure anything in these dedicated connections. Many cable and DSL providers give you a CD-ROM that installs different items, such as testing software, PPPoE login support, and little extras like e-mail clients and software firewalls. Personally, I prefer not to use these (they add a lot of stuff you don’t need) and instead use the operating system’s tools or a hardware router. Figure 8.39 shows the DSL wizard built into Windows 7. This program enables you to connect by entering your PPPoE information for your ADSL connection. Once started, these programs usually stay running in the system tray until your next reboot.

FIGURE 8.39   PPPoE connection

Cable Issues

Dedicated cable connections add a little complexity to the installation options because most cable networks bring television and often voice communication into the same line. This complicates things in one simple way: splitters.

If you have a cable connection coming to your house and you have a television set in two rooms, how do you get cable in both rooms? Easy, right? Just grab a two-way splitter from Radio Shack and run an extra pair of cables, one to each room. The problem comes from the fact that every time you split a cable signal, the signal degrades by half. This is called, logically, a split cable problem.

The quality of a signal can be measured in decibels (dB), a unit that describes a ratio between an ideal point—a reference point—and the current state of the signal. When discussing signal strength, a solid signal is 0 dB. When that signal degrades, it’s described as a dB loss and a negative number. An increase in signal is gain and gets a positive number. Decibels are logarithmic units that, if you’ve forgotten the high school math, means that going up or down the scale in a simple number translates into a huge number in a percentage scale.

For example, when you split a cable signal into two, you get half the signal strength into each new cable. That’s described as a –3 dB signal. Split it again and you’ve got a –6 dB signal. Although 6 isn’t a big number in standard units, it’s horribly huge in networking. You might have a 20 Mbps cable connection into your house, but split it twice and you’re left with a 5 Mbps connection. Ouch!

The standard procedure with cable connections is to split them once: one cable goes to the cable modem and the other to the television. You can then split the television cable into as many connections as you need or can tolerate as far as reception quality.

Remote Terminal

You can use a terminal emulation program to create a remote terminal, a connection on a faraway computer that enables you to control that computer as if you were sitting in front of it, logged in. Terminal emulation has been a part of TCP/ IP from its earliest days, in the form of good-old Telnet. Because it dates from pre-GUI days, Telnet is a text-based utility; all modern operating systems are graphical, so there was a strong desire to come up with graphical remote terminal tools. Citrix Corporation made the first popular terminal emulation products—the WinFrame/MetaFrame products (Figure 8.40).

FIGURE 8.40   Citrix MetaFrame

Remote terminal programs all require a server and a client. The server is the computer to be controlled. The client is the computer from which you do the controlling. Citrix created a standard called Independent Computing Architecture (ICA) that defined how terminal information was passed between the server and the client. Citrix made a breakthrough product—so powerful that Microsoft licensed the Citrix code and created its own product called Windows Terminal Services. Not wanting to pay Citrix any more money, Microsoft then created its own standard called Remote Desktop Protocol (RDP) and unveiled a new remote terminal called Remote Desktop Connection (RDC) starting with Windows XP. Figure 8.41 shows Windows Remote Desktop Connection running on a Windows 7 system, connecting to a Windows 2008 Server.

FIGURE 8.41   RDC in action

Exam Tip

All RDP applications run on port 3389 by default.

Unfortunately, Terminal Services only works in the Windows environment; however, a number of third parties make absolutely amazing terminal emulation programs that run on any operating system. The best of these, VNC (VNC stands for Virtual Network Computing) doesn’t let you share folders or printers because it is only a terminal emulator (Figure 8.42), but it runs on every operating system, is solid as a rock, and even runs from a web browser. It works nicely in Secure Shell (SSH) tunnels for great security, plus it comes by default with every copy of Mac OS X and almost every Linux distribution. Why bother sharing if you can literally be at the screen? Oh, and did I mention that VNC is completely free?

FIGURE 8.42   VNC in action

VoIP

Voice over IP (VoIP) uses an IP network to transfer voice calls. VoIP works so well because it uses an existing network you’re already paying for (your Internet connection) to replace another network you’re also paying for (PSTN lines). The technology needed for VoIP isn’t very challenging, but making a VoIP system that’s standardized so everyone can use it (and still contact those who choose to use PSTN) requires international standards, making it quite a bit harder. VoIP is still a very fractured world, but it’s getting closer to universally adopted standards—one day everyone will be able to contact everyone else, no matter what brand of VoIP they use. To do this, you need to know three important standards: RTP, SIP, and H.323.

RTP

The Real-time Transport Protocol (RTP), the heavily adopted bedrock of VoIP standards, defines the type of packets used on the Internet to move voice or data from a server to clients. The vast majority of VoIP solutions available today use RTP.

Exam Tip

The CompTIA Network+ objectives inexplicably drop the word “Transport” from this protocol and call it the Real Time Protocol. There’s no such thing. It’s the Real-time Transport Protocol.

SIP and H.323

Session Initiation Protocol (SIP) and H.323 handle the initiation, setup, and delivery of VoIP sessions. VoIP requires a lot of special features that are not very common in many other Internet protocols. The biggest one is multicasting. You don’t ever really use multicasting unless you want to show a number of people a video or want to make a conference call. SIP and H.323 both have methods for handling multicasting.

Exam Tip

SIP and H.323 both run on top of RTP. Most VoIP solutions are either SIP/RTP or H.323/RTP

Skype

Almost every VoIP solution available today uses SIP or H.323 running on top of RTP, with one huge exception: the very famous and incredibly popular Skype. Skype was unveiled in 2003 by Niklas Zennström, a Swedish computer guy famous for inventing the Kazaa peer-to-peer file-sharing system. Skype is completely different from and completely incompatible with any other type of VoIP solution: Skype doesn’t use servers, but instead uses a peer-to-peer topology that is identical to the old Kazaa network. Skype calls are also encrypted using a proprietary encryption method. No one has a standard method for VoIP encryption at this time, although many smart people are working hard on the issue.

Streaming Media with RSTP

VoIP isn’t the only thing that takes advantage of protocols such as RTP. Streaming video is now mainstream, and many streaming video servers (Windows Media Player, QuickTime, and many others) use a popular protocol called Real Time Streaming Protocol (RTSP). Like SIP and H.323, RSTP runs on top of RTP. RSTP has a number of features that are perfect for video streaming, such as the ability to run, pause, and stop videos. RSTP runs on TCP port 554.

 Objective 8.01: Telephony and Beyond   The Internet backbone uses technologies designed more than 20 years ago to support telephone calls. There are two reasons to use a telephony WAN connection: to get your LAN on the Internet or to make a private connection between two or more of your private LANs. T1, T3, E1, and E3 are all popular methods of high-speed communication. SONET is the primary standard for long-distance, high-speed, fiber-optic transmission in the United States. WANs use packet switching technologies like ATM and Frame Relay to transmit data over multiple connection types.

 Objective 8.02: The Last Mile   The last mile represents the challenge of increasing connection speeds between the user and the central office. Many technologies exist to facilitate this connection, including dial-up, ISDN, DSL, cable, satellite, fiber, and broadband over powerline (BPL). You can also use cellular WAN technologies, including WiMAX and LTE.

 Objective 8.03: Using Remote Access   Remote access allows users to log onto networks remotely, making files and network resources available to users across the city, state, or globe. There are six common forms of remote access. You can make a dial-up connection to the Internet. You can connect to another computer using a private dial-up connection. Virtual private networks enable you to tunnel from a local computer to a remote network. Dedicated connections use non-dial-up methods to connect to a private network or the Internet. A remote terminal uses a terminal emulation program to connect to another computer. VoIP (voice over IP) uses an IP network to make voice calls.

REVIEW QUESTIONS

    1.  Which standard supports a throughput of up to 39.8 Gbps?

          A.  ISDN

          B.  VDSL

          C.  SONET

          D.  MPLS

    2.  If you purchase a T1 line in the United States, how will packets be switched? (Select two.)

          A.  OC

          B.  Frame Relay

          C.  ATM

          D.  BERT

    3.  What describes the problem with “the last mile”?

          A.  The connection from a central office to a user’s home is analog, whereas the rest of the network is digital.

          B.  Users must live within a mile of a central office in order to guarantee Quality of Service (QoS).

          C.  SONET connections are limited to a maximum distance of one mile, and connecting central offices via multiplexers is expensive and difficult to maintain.

          D.  Copper wires that carry analog telephone signals are limited to a maximum distance of one mile.

    4.  What terms describe a common telephone connection? (Select two.)

          A.  ISDN

          B.  POTS

          C.  Fractional T1

          D.  PSTN

    5.  What marks where the telephone company’s responsibility ends and yours begins?

          A.  Multiplexer

          B.  Demarc

          C.  Primary Rate Interface

          D.  Bridges connection

    6.  The CCITT established which set of standards?

          A.  Optical Carrier (OC)

          B.  DSL (ADSL, SDSL, VDSL)

          C.  Data Over Cable Service Interface Specification (DOCSIS)

          D.  V standards

    7.  Which is the fastest ISDN connection?

          A.  BERT

          B.  BRI

          C.  PRI

          D.  ATM

    8.  Sinjay is 200 meters from his ISP’s DSLAM. Which DSL version will provide him with, theoretically, up to 100 Mbps of both download and upload speed?

          A.  DS3

          B.  ADSL

          C.  SDSL

          D.  VDSL

    9.  Which protocol is used by cable companies?

          A.  MPLS

          B.  DOCSIS

          C.  PSTN

          D.  SIP

    10.  What is the benefit to using a satellite connection?

          A.  It offers speeds faster than both DSL and cable.

          B.  The upload and download speeds are always equal.

          C.  It is often available in remote locations where DSL and cable are not.

          D.  It offers better security than both DSL and cable.

REVIEW ANSWERS

    1.  C   SONET supports throughput up to 39.8 Gbps as defined in the OC-768 standard.

    2.  B   and C  Frame Relay and ATM are packet-switching technologies used on T1 lines.

    3.  A   The last mile describes the analog run from the central office to a user’s location.

    4.  B   and D  POTS and PSTN are interchangeable terms for common telephone networks.

    5.  B   The telephone company’s responsibility ends at the demarc. All wires and equipment on the other side are the responsibility of the customer.

    6.  D   The CCITT developed the V standards for modems.

    7.  C   A Primary Rate Interface combines 23 B channels for a total throughput of about 1.5 Mbps.

    8.  D   Because he is within 300 meters of his ISP’s DSLAM, VDSL is a viable option, and it supports 100 Mbps in both directions.

    9.  B   Cable companies use Data Over Cable Service Interface Specification (DOCSIS).

    10.  C   Satellite connections are often the only option for users in remote locations.

Network Security

  ITINERARY  

      Objective 9.01   Common Threats

      Objective 9.02   Securing User Accounts

      Objective 9.03   Firewalls

      Objective 9.04   Securing Remote Connections

The very nature of networking makes networks vulnerable to many threats. By definition, a network must allow multiple users to access serving systems, but at the same time, you must protect the network from harm.

The news may be full of tales about hackers and other malicious people with nothing better to do than lurk around the Internet and trash the peace-loving systems of good folks like us, but in reality, hackers are only one of many serious network threats. The average network faces many more threats from the folks who are authorized to use it than from those who are not authorized.

Local Lingo

Hacker   In some circles, the term “hacker” describes folks who love the challenge of overcoming obstacles and perceived limitations—and that’s a positive thing! At least for this chapter, I define a “hacker” as an unauthorized person who intentionally tries to access resources on your network. That’s the way the term is generally used today.

In addition, don’t think all network threats are people. Let’s not forget natural disasters like floods and hurricanes. Even third parties can unintentionally wreak havoc—what will you do if your building suddenly lacks electricity? A network threat can be any number of factors or elements that share one essential feature: the potential to damage network data, machines, or users.

To protect your network, you need to implement proper network access control (NAC), which means control over information, people, access, machines, and everything in between.

This chapter begins with a discussion of common threats and then continues with securing user accounts. The third part talks about securing a network against unwanted action from the outside. The final part examines securing desired connections from outside the network. Let’s jump in.

Common Threats

The threats to your network are real and widespread. Here’s a list of some of the more common potential threats to your network. The sections that follow give details on these threats and explain how to deal with them.

    • System crashes and other hardware failures

    • Administrative access control weaknesses

    • Malware, such as viruses and worms

    • Social engineering

    • Man-in-the-middle attacks

    • Denial of Service (DoS) attacks

    • Physical intrusion

    • Attacks on wireless connections

System Crash/Hardware Failure

Like any technology, computers can and will fail—usually when you can least afford for it to happen. Hard drives crash, servers lock up, the power fails—it’s all part of the joy of working in the networking business. Because of this, you need to create redundancy in areas prone to failure (like installing backup power in case of electrical failure) and performing those all-important data backups. Beyond that, the idea is to deploy redundant hardware to provide fault tolerance. Take advantage of technologies like Redundant Array of Inexpensive Disks (RAID) to spread data across multiple drives. Buy a server case with multiple power supplies, or add a second NIC.

Administrative Access Control

All operating systems and many TCP applications come with some form of access control list (ACL) that defines what users can do with the server’s shared resources. An access control might be a file server giving a user read-only permission to a particular folder or an FTP server only allowing certain user IDs to use certain folders. Every operating system—and many Internet applications—are packed with administrative tools and functionality. You need these tools to get all kinds of work done, but by the same token, you need to work hard to keep these capabilities out of the reach of those who don’t need them.

Exam Tip

The CompTIA Network+ exam does not test you on the details of file system access controls. In other words, don’t bother memorizing details like NTFS permissions, but do appreciate that fine-grained controls are available.

Make sure you know the “super” accounts native to Windows (administrator), Linux (root), and Mac OS X (root). You must carefully control these accounts.

Travel Assistance

Administering your super accounts is only part of what’s called user account control. See “Securing User Accounts” later in this chapter for more details.

Malware

The term malware defines any program or code (macro, script, and so on) designed to do something on a system or network that you don’t want to have happen. Malware comes in quite a variety of guises, such as viruses, worms, macros, Trojans, rootkits, adware, and spyware. Let’s examine all these malware flavors and then finish with how to deal with them.

Virus

A virus is a program that has two jobs: to replicate and to activate. Replication means it makes copies of itself, often as code stored in boot sectors or as extra code added to the end of executable programs. Activation is when a virus does something like erase the boot sector of a drive. A virus only replicates to other drives, such as thumb drives or optical media. It does not replicate across networks. Plus, a virus needs human action to spread and a host file to infect.

Worm

A worm functions similarly to a virus, though it replicates exclusively through networks. A worm, unlike a virus, doesn’t have to wait for someone to use a removable drive to replicate, nor does it need a host file. If the infected computer is on a network, a worm will immediately start sending copies of itself to any other computers on the network it can locate. Worms can exploit inherent flaws in program code like buffer overflows, where a buffer cannot hold all the data sent to it. Finally, a worm doesn’t need to be inherently malicious; it could be an innocent file used to attack a computer repeatedly.

Macro Virus

Many applications include tools that enable you to create macros, a group of commands that you can run at once. Macros help users automate repetitive tasks, so they’re useful. Malicious programmers can take advantage of the macros available, however, to attack a computer. These are called macro viruses. You can embed a macro virus—since it’s just a macro, after all—in the affiliated program file. When that file is opened, the macro virus runs automatically and does its nefarious work.

Trojan

A Trojan is a piece of malware that looks or pretends to do one thing while, at the same time, doing something evil. A Trojan may be a game, like poker, or a free screensaver. The sky is the limit. The more “popular” Trojans turn an infected computer into a server and then open TCP or UDP ports so a remote user can control the infected computer. They can be used to capture keystrokes, passwords, files, credit card information, and more. This type of Trojan is called a remote administration tool (RAT), although you don’t need to know that for the CompTIA Network+ exam. Trojans do not replicate.

Local Lingo

Trojan horse   A Trojan is often called a Trojan horse, after the giant wooden horse created by the Greeks during the Trojan War. The Greeks sailed away from the city of Troy, but left the horse behind, so the Trojans wheeled the horse into the city. Unbeknownst to the Trojans, Greek soldiers were hidden in the horse. When the Greeks sailed back under the cover of darkness, the hidden soldiers had opened the city gates and thus opened the city to the loving arms of their comrades.

Rootkit

For a virus or Trojan to succeed, it needs to come up with some method to hide itself. As awareness of malware has grown, antimalware programs make it harder to find new locations on a computer to hide. A rootkit is usually a Trojan that takes advantage of very low-level operating system functions to hide itself from all but the most aggressive of antimalware tools. Worse, a rootkit, by definition, gains privileged access to the computer. Rootkits can strike operating systems, hypervisors, and even firmware.

Adware/Spyware

There are two types of programs that are similar to malware in that they try to hide themselves to an extent. Adware is a program that monitors the types of websites you frequent and uses that information to generate targeted advertisements, usually pop-up windows. Many of these programs use Adobe Flash. Adware isn’t, by definition, evil, but many adware makers use sneaky methods to get you to use adware, such as using deceptive-looking webpages ("“Your computer is infected with a virus—click here to scan NOW!”). As a result, adware is often considered malware. Some of the computer-infected ads actually install a virus when you click them, so avoid these things like the plague.

Spyware is a function of any program that sends information about your system or your actions over the Internet. The type of information sent depends on the program. A spyware program will include your browsing history. A more aggressive form of spyware may send keystrokes or all of the contacts in your e-mail. Some spyware makers bundle their product with ads to make them look innocuous. Adware, therefore, can contain spyware.

Dealing with Malware

You can deal with malware in several ways: antimalware programs, training and awareness, policies and procedures, patch management, and incident response.

At the very least, every computer should run an antimalware program. If possible, add an appliance that runs antimalware programs against incoming data from your network. Many such appliances exist, but they are most common in proxy servers (see Chapter 10). Also, an antimalware program is only as good as its updates—keep everyone’s definition file up to date with, literally, nightly updates. Users must be trained to look for suspicious ads, programs, and pop-ups, and understand that they must not click these things. Your organization should have policies and procedures in place so everyone knows what to do if they encounter malware. Finally, a good network administrator maintains proper incident response records to see if any pattern to attacks emerges. He or she can then adjust policies and procedures to mitigate these attacks.

Exam Tip

One of the most important malware mitigation procedures is to keep systems under your control patched and up to date through proper patch management. Microsoft does a very good job of putting out bug fixes and patches as soon as problems occur. If your systems aren’t set up to update automatically, then perform manual updates regularly.

Antimalware Programs

You can download many excellent antimalware programs for free, either for extended trial periods or for indefinite use. Download one or more antimalware programs, such as these:

    • Malwarebytes Anti-Malware (www.malwarebytes.org) Malwarebytes’ Anti-Malware program rocks the house in terms of dealing with malicious software. They offer both a free version that scans your computer for malware and quarantines it and a PRO version that actively protects against any incoming malware. Anti-Malware is my first choice in dealing with malware on a client’s computer.

    • SUPERAntiSpyware (www.superantispyware.com) Many techs absolutely love SUPERAntiSpyware, another antispyware program that tackles all sorts of unpleasant malware. Like Anti-Malware, SUPERAntiSpyware has both free and professional editions.

Social Engineering

A nice percentage of attacks against your network come under the heading of social engineering—the process of using or manipulating people inside the networking environment to gain access to that network from the outside. The term “social engineering” covers the many ways humans can use other humans to gain unauthorized information. This unauthorized information may be a network login, a credit card number, company customer data—almost anything you might imagine that one person or organization may not want a person outside of that organization to access.

Social engineering attacks aren’t hacking—at least in the classic sense of the word—although the goals are the same. Social engineering is where people attack an organization through the people in it or physically access the organization to get the information they need.

The most classic form of social engineering is the telephone scam in which someone calls a person and tries to get him or her to reveal his or her user name/ password combination. In the same vein, someone may physically enter your building under the guise of having a legitimate reason for being there, such as a cleaning person, repair technician, or messenger. The attacker then snoops around desks, looking for whatever he or she has come to find (one of many good reasons not to put passwords on your desk or monitor). The attacker might talk with people inside the organization, gathering names, office numbers, or department names—little things in and of themselves, but powerful tools when combined later with other social engineering attacks.

These old-school social engineering tactics are taking a backseat to a far more nefarious form of social engineering: phishing.

Travel Advisory

All these attacks are commonly used together, so if you discover one of them being used against your organization, it’s a good idea to look for others.

Phishing

In a phishing attack, the attacker poses as some sort of trusted site, like an online version of your bank or credit card company, and solicits you to update your financial information, such as a credit card number. You might get an e-mail message, for example, that purports to be from PayPal telling you that your account needs to be updated and provides a link that looks like it goes to http://www.paypal.com. Clicking the link, however, opens a site that resembles the PayPal login but is actually http://100.16.49.21/2s82ds.php, a phishing site.

Man in the Middle

In a man-in-the-middle attack, a person inserts him- or herself into a conversation between two others, covertly intercepting traffic thought to be only between those other people. The man in the middle might gather those conversations to gain access to passwords or other sensitive data or to the shared keys in an encrypted conversation. The attacker might then use a rogue access point to get into the network or social engineering techniques to gain access to a wired network.

Denial of Service

Denial of Service (DoS) attacks are the work of hackers whose only interest is in bringing a network to its knees. They accomplish this by flooding the network with so many requests that it becomes overwhelmed and ceases functioning. These attacks are most commonly performed on web and e-mail servers, but virtually any part of a network can be attacked via some DoS method.

The secret to a successful DoS attack is to send as many packets as possible to the victim. Not only do you want to send a lot of packets—you also want the packets to contain some kind of request that the victim must process as long as possible to force the victim to deal with each attacking packet for as long as possible.

You can employ one of several methods to get a good DoS going, but the CompTIA Network+ objectives expressly mention a smurf attack. A smurf attack is when an attacker floods a network with ICMP Echo Request packets sent to the broadcast address. The trick that makes this attack special is that the return address of the pings is spoofed to that of the intended victim. When all the computers on the network respond to the initial ping, they send their response to the intended victim. The attacker can then amplify the effect of the attack by the number of responding machines on the network. Due to modern network management procedures and controls built into modern operating systems, the danger of the smurf attack has been largely mitigated.

Far more menacing than a simple DoS attack are distributed denial of service (DDoS) attacks. A DDoS uses multiple (as in hundreds or up to hundreds of thousands of) computers under the control of a single operator to launch a devastating attack. DDoS operators don’t own these computers, but instead use malware to take control of them. A single computer under the control of an operator is called a zombie. A group of computers under the control of one operator is called a botnet.

Exam Tip

Zombified computers aren’t obvious. DDoS operators often wait weeks or months after a computer’s been infected to take control of it.

To take control of your network’s computers, someone has to install malware on the computer. Again, antimalware, training, and procedures will keep you safe from zombification (but feel free to make some joke about eating human brains).

Physical Intrusion

You can’t consider a network secure unless you provide some physical protection to your network. I separate physical protection into two different areas: protection of servers and protection of clients.

Server protection is easy. Lock up your servers to prevent physical access by any unauthorized person. Large organizations have special server rooms, complete with card-key locks and tracking of anyone who enters or exits. Smaller organizations should at least have a locked closet. While you’re locking up your servers, don’t forget about any network switches! Hackers can access networks by plugging into a switch, so don’t leave any switches available to them.

Physical server protection doesn’t stop with a locked door. One of the most common mistakes made by techs is walking away from a server while still logged in. Always log off your server when it’s not in use.

Locking up all of your client systems is difficult, but your users should be required to perform some physical security. First, all users should lock their computers when they step away from their desks. Instruct them to press the WINDOWS KEY-L combination to perform the lock. Hackers take advantage of unattended systems to get access to networks.

Second, make users aware of the potential for Dumpster diving and make paper shredders available. Dumpster diving means going through a company’s trash to find information, such as names, e-mail addresses, and so on. Last, tell users to mind their work areas. It’s amazing how many users leave passwords readily available. I can go into any office, open a few desk drawers, and will invariably find little yellow sticky notes with user names and passwords. If users must write down passwords, tell them to put them in locked drawers!

Attacks on Wireless Connections

With more and more wireless networks coming online every day, it shouldn’t be much of a surprise that they’ve drawn the attention of the bad guys. Attacks on wireless connections come in several forms, such as leeching, cracking wireless encryption, rogue access points, and evil twin attacks.

Leeching

Leeching is using another person’s wireless network without that person’s permission. Leeching takes some of the bandwidth the other person has paid for, so it’s simply theft with another name.

In the heady early days of Wi-Fi networks, people would seek out unprotected networks by using sniffer hardware and cruising neighborhoods. This process, called war driving, often resulted in marks or symbols stenciled onto a nearby fence, gate, door, wall, or whatever, marking the open Wi-Fi signal. The marking was called war chalking. Neither practice is common today, but you might see the terms on the CompTIA Network+ exam.

Travel Advisory

Many people concatenate the terms, so wardriving and warchalking. Be prepared to see them with or without the space.

Cracking Wireless Encryption

Most Wi-Fi networks today use some form of encryption to stop casual leeching, but that doesn’t necessarily stop the sophisticated thief. Wi-Fi networks use one of three types of encryption: WEP, WPA, and WPA2. All three are crackable, though WPA2 offers more security than WEP or WPA.

Local Lingo

Encryption   Encryption is a method of securing messages by scrambling and encoding each packet as it is sent across an unsecured medium, such as the Internet. Each encryption level provides multiple standards and options.

The techniques for WEP cracking and WPA cracking are simple: run a sniffer program, capture packets in the air with a packet sniffing program, and then run a program to sniff out the password or preshared key. WEP networks can be cracked in under a minute; WPA, with a very strong key using letters, numbers, and symbols, will take hours or longer to crack, depending on the computing power of the machine running the hacking software.

Travel Assistance

Chapter 10 discusses the differences among the Wi-Fi encryption standards.

Rogue Access Points

A rogue access point is an unauthorized wireless access point (WAP) installed in a computer network. Rogue access points are a huge problem today. Anyone can easily purchase an inexpensive WAP and just plug it into a network. To make the issue even worse, almost all WAPs are designed to work using the preinstalled configuration, giving bad guys easy access to your network from a location physically outside your network.

The biggest reason rogue access points exist is that members of an organization install them for convenience. Users like their own wireless networks and, due to lack of training, don’t appreciate the danger unsecured access points pose. Bad guys getting into your physical location and installing rogue access points is less common.

Evil Twin

Hackers can use an evil twin attack to fool people into logging into a rogue access point that looks very similar to a legitimate access point. The evil twin access point might have an SSID that matches a legitimate SSID, for example, only it’s off by a letter or a character. People who log into the evil twin will have their keystrokes recorded in the hopes of stealing passwords and other valuable information. An evil twin is basically a wireless phishing attack.

Securing User Accounts

Even the smallest network will have a number of user accounts and groups scattered about with different levels of permissions. Every time you give a user access to a resource, you create potential loopholes that can leave your network vulnerable to unauthorized access, data destruction, and other administrative nightmares. You can categorize all of these potential dangers as internal threats. To protect your network from these threats, you need to implement the right controls over passwords, user accounts, groups, and permissions. The whole process begins with authentication.

Authentication

Authentication is the process of identifying yourself to the network or to a system and then having your identification criteria verified. The most popular example of authentication is when you log on to the network first thing in the morning. You are typically presented with a dialog box asking for your user name and password. Once you type your user name and password and click the logon button, the information is verified against a database of user names and passwords that are allowed access to the network.

Authentication Principles

You can categorize ways to authenticate into three broad areas: ownership factors, knowledge factors, and inherent factors. A knowledge factor is something the user knows, like a password or personal identification number (PIN). An ownership factor is something the user has, like an ID card or security token. An inherent factor is something that is part of the user, like a fingerprint or retinal pattern.

Multifactor authentication provides the best authentication, where a user must use two or more factors to prove his or her identity. Note that multifactor means more than one factor, not just more than one thing. Logging in with a user name and password is two things, for example, but because both fall into the category of what a user knows, it’s not multifactor authentication.

Many organizations use two-factor authentication, typically some sort of physical token that, when inserted, prompts for a password. That way, the user authenticates with both what she has and what she knows.

Authentication Protocols

An authentication protocol determines how your user name and password are sent from your workstation to the authentication server, such as Microsoft Active Directory. Each authentication protocol is unique in how it sends the user name and password to the authentication server, with some protocols being more secure than others.

PAP   Password Authentication Protocol (PAP) is a simple authentication protocol that sends the user name and password to the authentication server in clear text. PAP is typically used in remote access situations in which the client is dialing in to the network. After a PPP link has been established, a user name/password pair is repeatedly sent (in plain text) until authentication is acknowledged or until the connection is terminated (see Figure 9.1).

FIGURE 9.1   PAP checking a password

Exam Tip

PAP sends user information as plain text and does not provide any encryption.

CHAP   The Challenge Handshake Authentication Protocol (CHAP) is more secure than PAP. After a remote connection is established, the server sends a challenge message to the client system (the requestor) for confirmation of the user’s password. The requestor generates a response using a one-way hash function—using a hashing protocol such as MD5—and the server compares the response to its expected hash value (see Figure 9.2). If the values match, the connection is acknowledged; otherwise, it is terminated.

FIGURE 9.2   CHAP checking a password

In this way, a server can ask you if you know what your password is without your actually having to send it to the server for comparison. The server can generate a new challenge message at any time, which makes CHAP very secure because the authentication can be refreshed at any time. Instead of using MD5, CHAP can also encrypt its messages using the Data Encryption Standard (DES) algorithm—a very popular way of encrypting information using a long binary key—but it’s not as secure as MD5.

Local Lingo

One-way hash function   A computing function that takes a variable-length string as the input and produces a fixed-length binary value (hash) as the output. The process is irreversible—it is extremely difficult to find a string that produces a given hash value (hence, it’s a one-way function). Message Digest 5 (MD5) is a common hash algorithm.

MS-CHAP   MS-CHAP is the Microsoft implementation of CHAP and has had a couple versions created over the years—MS-CHAPv1 and MS-CHAPv2. MS-CHAPv2 improved on some of the cryptography weaknesses of MS-CHAPv1 and is the only MS-CHAP version supported by Windows 7.

EAP   A newer authentication protocol called the Extensible Authentication Protocol (EAP) is popular in wireless security, but can also be used for remote access solutions. EAP is a framework that incorporates many facets of security such as authentication and encryption services.

802.1X   Another method of implementing authentication on a network is through network access control using the IEEE 802.1X standard. The IEEE 802.1X standard is popular in wireless solutions that require the client to authenticate before a connection is made.

The 802.1x standard involves three main systems:

    • Supplicant   The term used for the client that is authenticating to the network or that desires to have network access.

    • Authenticator   The device to which the client is trying to connect. This device has been configured to require authentication before the client is allowed to connect. Popular examples of authenticators are a wireless access point and a network switch.

    • Authentication server   The server to which the authentication request is sent. When the client connects to the authenticator, it then sends an authentication request to the authentication server, which then checks its authentication database to verify that the supplicant is allowed access to the network.

Local Lingo

Posture assessment   Some devices use posture assessment as part of the authentication or authorization process. They check to see if the machine that wants to connect meets specific requirements in terms of patches installed or whether an antivirus software is active. Routers configured for the Cisco-proprietary Network Admission Control (NAC) are a good example of devices that use posture assessment.

PKI   Private Key Infrastructure (PKI) is a cryptography system that can be used for authentication and encryption services. The PKI structure starts by having a certificate authority installed that is responsible for issuing digital certificates used for authentication or encryption services.

AAA   Authentication, Authorization, and Accounting (AAA) are three core services offered by popular AAA protocols such as RADIUS and TACACS+. The following list outlines the three services provided by AAA:

    • Authentication   Occurs when a user identifies herself to the system and the identity is verified against an authentication database.

    • Authorization   After the user is authenticated, she is then granted access to resources or services on the network.

    • Accounting   The tracking of network and resource usage on the network.

Examples of popular AAA protocols include:

    • RADIUS   Remote Authentication Dial-In User Service is a popular service for remote access, which you’ll read more about in Chapter 10. Many vendors offer RADIUS server solutions, such as Microsoft Windows Server.

    • TACACS+   Terminal Access Controller Access-Control System Plus is an AAA protocol that provides AAA services for access to routers, network access points, and other networking equipment. TACACS+ is Cisco proprietary.

Kerberos   Kerberos is an authentication protocol for TCP/IP networks with many clients all connected to a single authenticating server—no point-to-point here! Kerberos works nicely in a network, so nicely that Microsoft adopted it as the authentication protocol for all Windows networks using a domain controller.

Exam Tip

Kerberos uses UDP or TCP port 88 by default

The cornerstone of Kerberos is the Key Distribution Center (KDC), which has two processes: the Authentication Server (AS) and the Ticket-Granting Service (TGS). In Windows server environments, the KDC is installed on the domain controller (Figure 9.3).

FIGURE 9.3   Windows Kerberos setup

When your client logs onto the domain, it sends a request that includes a hash of the user name and password to the AS. The AS compares the results of that hash to its own hash (as it also stores the user name and password) and, if they match, sends a Ticket-Granting Ticket (TGT) and a timestamp (Figure 9.4). The ticket has a default lifespan in Windows of ten hours. The client is now authenticated but not yet authorized.

FIGURE 9.4   AS sending a TGT back to client

Exam Tip

The TGT is sometimes referred to as Ticket to Get Ticket.

The client then sends the timestamped TGT to the TGS for authorization. The TGS sends a timestamped service ticket (also called a token or access token) back to the client (Figure 9.5).

FIGURE 9.5   TGS sending token to client

The token authorizes the user to access specific resources without reauthenticating. Any time the client attempts to access a folder, printer, or service anywhere in the domain, the server sharing that resource uses the token to see exactly what access the client may have to that resource. If you try to access some other feature under Windows, you won’t need to log in again because the TGT is still valid. The TGS will authorize access with a new token.

Exam Tip

In Windows, the security token is called a Security Identifier (SID).

Timestamping is important for Kerberos because it forces the client to request a new token every eight hours or for different or new resources. This prevents third parties from intercepting the tokens and attempting to crack them. Kerberos tokens can be cracked, but it’s doubtful this can be done in under eight hours.

Authorization

Once a user has been authenticated to the system, he or she is then authorized, or not authorized, to access different network resources. Following are some examples of authorization in Windows networks:

    • Permissions   Depending on your user account, you may be given permission to access files, folders, and printers.

    • Rights   A right is your privilege to perform an operating system task. Examples of rights are changing the system time or backing up files.

Logon and Access Security

Basic security issues that are common to all networks include the level of security, the proper use of passwords, and the centralization of control. Most decent computer systems won’t let you get very far unless you have been authenticated and authorized to access the resource. Windows networks use two types of access control: share-level access control and user-level access control.

Implementing Share-Level Security

Older Windows operating systems use share-level access control, where a network administrator assigns each shared resource a password. These resources are generally either shared folders where data or programs are stored or shared printers. All users attempting to access the resource must supply the same password. Network administrators usually consider share-level control to be weak and difficult to manage.

With share-level security options, you can choose to have a password (or not), and it can be for read-only or full access to the resource—and that’s it!

Implementing User-Level Security

With user-level access control, a network administrator creates an account for each user, usually on a central server that can itself manage the access to resources on other systems. Most administrators prefer to have a single place to go when adding, changing, or deleting a user account. A user account defines the rights and privileges of a specific person when that person accesses a computer system or network. When a user sits down at the computer, he supplies an account name and password, which the computer checks against its security database. If the password specified matches the one listed for that user account in the database, the computer assumes from that point forward that the user is valid and grants him all the rights and permissions that have been assigned to that user account. The user doesn’t need to remember a share-level password for each resource he wants to access.

To avoid the excessive workload of assigning specific permissions to each user individually, network administrators organize users with similar needs into groups (see Figure 9.6). It would be possible to manage each user individually, but suppose 30 users need access to both the DEV shared resource and the STAFFPRINT printer—which would be easier?

    • To create a group called STAFF, add the 30 users to the group and give STAFF access permission to the two resources (by virtue of their membership in that group, the 30 users can now access both resources).

    • Or, give 30 user accounts permission to access DEV and then repeat the same exercise for STAFFPRINT.

FIGURE 9.6   Assigning permissions to the sales group

Clearly the former would be a bit less work initially. Over time, groups make things a lot easier. If you put a new resource online, say a shared media server called BREAKTIME, you could give access to all 30 users by making only one change—adding permission to the STAFF group to access BREAKTIME.

Using Passwords

Of course, user-level security works well only when users keep their passwords secure. Passwords should never be written down where another user might find them, and users should never reveal their passwords to anyone, even the administrator of the network. In most cases, the administrator can reset a user’s password without knowing the old password.

The most secure passwords contain a combination of eight or more letters (some in uppercase), numbers, and symbols. The following list contains examples of strong passwords:

    • Jar56o$imum

    • RhjP!!op11

    • 100bobot&w

A good network administrator should assume that, over time, some users’ passwords will become public knowledge. To limit the impact of these exposed passwords, a careful network administrator sets passwords to expire periodically, usually once every 30 days or less. Should a password become public knowledge, the gap in network security will automatically close when the user changes the password.

No matter how well your password implementation goes, using passwords always creates administrative problems. First, users forget passwords and someone (usually you) has to access their account and reset their passwords. Second, users will write down passwords, giving hackers an easy way into the network if those bits of paper fall into the wrong hands. If you’ve got the cash, you have two alternatives to passwords: smart devices and biometrics.

Smart devices are cards with magnetic stripes, USB keys, or other small devices that you insert into your PC in lieu of entering a password. They work extremely well and are incredibly difficult to bypass. The downside is that they might be lost or stolen.

Exam Tip

Many companies use smart devices for single sign-on, a method of authentication that, in one shot, both authenticates the user and gives the user access (authorization) to all the resources he or she has permission to access. That way the user only has to do the sign-on stuff once.

If you want to go seriously space age, then biometrics are the way to go (Figure 9.7). Biometric devices scan fingerprints, retinas, or even the sound of the user’s voice to provide a foolproof replacement for both passwords and smart devices. Biometrics have been around for quite a while, but were relegated to extremely high-security networks due to their high cost (thousands of dollars per device). That price has dropped substantially, making biometrics worthy of consideration for some networks.

FIGURE 9.7   A biometric fingerprint reader

Firewalls

Firewalls protect networks from external threats—potential attacks from outside your network—by filtering packets using a number of methods, such as hiding IP addresses using NAT, selectively blocking TCP/UDP ports, or even filtering traffic based on MAC addresses. From there, things get much more complex, so for now, let’s define a firewall as a device that filters IP traffic to protect networks and computers. But a firewall doesn’t have to be a dedicated device.

You run into firewalls in two very different places. The first place is a device at the edge of your network. Given that there’s already a router at the edge of your network, you’d be hard pressed to find a router today that does not also act as a firewall. Because the firewall is in a box on the network, these are called network-based firewalls (also called hardware firewalls, although many use software too). The second place is software installed on your computer that does the same job but only firewalls packets coming in and out of your system. These are called host-based firewalls (also called software firewalls). In a perfect world, your network has a network-based firewall at the edge of your network and all of your systems run a host-based firewall.

Hiding the IPs

The first and most common technique for protecting a network is to hide the real IP addresses of the internal network systems from the Internet. If a hacker gets a real IP address, he or she can begin to probe that system, looking for vulnerabilities. If you can prevent a hacker from getting an IP address to probe, you’ve stopped most hacking techniques cold. You already know how to hide IP addresses using Network Address Translation (NAT). That’s why most routers have built-in NAT capability. Not only does NAT reduce the need for true public IP addresses, but it also does a great job protecting networks from hackers because it is difficult to access a network using private IP addresses hidden behind a NAT-enabled router.

Travel Advisory

Because NAT was not designed as a security feature, it leaves a few glaring holes for bad guys to exploit. NAT does not stop inbound traffic that users inside the network request, for example, so malicious code could make its way into the network. NAT offers no packet inspection either. It just tracks port numbers. In a real-world network, you cannot rely on NAT for security. You must use some kind of firewall that offers port filtering, packet filtering, or some other kind of security. These are discussed in the sections that follow.

Port Filtering

The second most common firewall tool is assuring port security through port filtering, also called port blocking. Hackers often try less commonly used port numbers to get into a network. Port filtering simply means preventing the passage of any TCP or UDP segments or datagrams through any ports other than the ones prescribed by the system administrator. Port filtering is effective, but it requires some serious configuration to work properly. The question is always, “Which ports do I allow into the network?”

When you open your browser and access a webpage, your web browser sends out TCP segments to the web server with the destination port of 80. Web servers require this, and it’s how TCP/IP works. No one has problems with the well-known ports like 80 (HTTP), 21 (FTP), 25 (SMTP), and 110 (POP3), but there are a large number of lesser-known ports that networks often want opened.

Exam Tip

One early exploit of open ports came in the form of an FTP bounce attack, where a malicious user could run the port command on an FTP server to discover any open ports. Modern FTP servers block this kind of attack, but you get the idea. Open ports can be dangerous.

I recently installed port filtering on my personal firewall and everything worked great—until I decided to play the popular game World of Warcraft on the Internet. (Note to WoW nerds: On the Blackwater Raiders server, I’m “Pelape.”) I simply could not connect to the Internet servers until I discovered that World of Warcraft requires TCP port 3724 open to work over the Internet. After reconfiguring my port filter (I reopened port 3724), I was able to play WoW, but when I tried to help one of my friends using Microsoft Remote Desktop, I couldn’t access his system! Want to guess where the problem was? Yup, I needed to open port 3389. How did I figure these out? I didn’t know which ports to open, but I suspected that my problem was in the port arena so I fired up my web browser (thank goodness that worked!) and went to the World of Warcraft and Microsoft websites, which told me which ports I needed to open. This constant opening and closing of ports is one of the prices you pay for the protection of port filtering, but it sure stops hackers if they can’t use certain ports to gain access.

Most routers that provide port blocking manifest it in one of two ways. The first way is to have port filtering close all ports until you open them explicitly. The other port filtering method is to leave all ports open unless you explicitly close them. The gotcha here is that most types of IP sessions require dynamic port usage. For example, when my system makes a query for a webpage on HTTP port 80, the web server and my system establish a session using a different port to send the webpages to my system. Figure 9.8 shows the results of running the netstat -n switch while I have a number of webpages open—note the TCP ports used for the incoming webpages (the Local Address column). Dynamic ports can cause some problems for older (much older) port filtering systems, but almost all of today’s port filtering systems are aware of this issue and handle it automatically.

FIGURE 9.8   The netstat –n command showing HTTP connections

Packet Filtering

Port filtering deals only with port numbers; it completely disregards IP addresses. If an IP packet comes in with a filtered port number, the packet is blocked, regardless of the IP address. Packet filtering or IP filtering works in the same way, except it blocks packets based on IP addresses. Packet filters, also known as IP filters, will block any incoming or outgoing packet from a particular IP address or range of IP addresses. These addresses are stored in an access control list (ACL) of some kind.

Packet filters are far better at blocking outgoing IP addresses because the network administrator knows and can specify the IP addresses of the internal systems. Blocking outgoing packets is a good way to prevent users on certain systems from accessing the Internet. Figure 9.9 shows a configuration page from a router designed to block different ranges of IP addresses and port numbers.

FIGURE 9.9   Blocking IP addresses

This type of filtering is called stateless filtering because the device that does the filtering just checks the packet for IP addresses and port numbers and blocks or allows accordingly. Each packet is judged as an individual entity to determine whether it should be allowed into the network. Stateless filtering works at layer 3 of the OSI seven-layer model. Stateless filtering is inexpensive and easy to implement, but has one issue: once you’ve opened a particular path into your network, that path is open. Someone spoofing IP information could get in.

A more secure method of filtering is to use devices that do stateful filtering, or stateful inspection, where all packets are examined as a stream. Stateful devices can do more than allow or block; they can track when a stream is disrupted or packets get corrupted and act accordingly. The best of the stateful filtering devices are application proxies, working at layer 7 of the OSI seven-layer model. The only real problems with application proxies are that they tend to be slower than stateless filters and more expensive.

MAC Filtering

Similar to packet filtering, some firewall devices can allow or deny access to the network based on the MAC address of the client; what’s called MAC filtering. Because every network device has a unique 48-bit MAC address, MAC filtering should make for a very secure network. It’s often one of the implemented security measures in wireless networks, for example, because setting it up is quick.

Many programs enable you to spoof or mimic a MAC address, though, so MAC filtering is not a strong deterrent for a determined hacker. Plus it gets a little tedious to add a new MAC address every time a friend drops by with a new smart phone or tablet and wants to use your Wi-Fi.

Personal Firewalls

Although you can (and should) buy a hardware firewall to place between your system and the Internet, a single user should, at the very least, employ a personal software firewall program. Every operating system comes with some form of built-in personal firewall. Every copy of Windows comes with Windows Firewall that you can access through the Control Panel (Figure 9.10). There are also third-party software firewalls like ZoneAlarm Pro (Figure 9.11). These personal firewall programs are quite powerful and have the added benefit of being easy to use. These days, an individual Internet user has no excuse not to use a personal firewall.

FIGURE 9.10   Windows Firewall in Windows 7

FIGURE 9.11   ZoneAlarm Pro

By default, Windows Firewall blocks all incoming IP packets that attempt to initiate a session. This is great for networks that only use the Internet to browse the Web or grab e-mail, but will cause problems in circumstances where you want to provide any type of Internet server on your network. You can, however, manually open ports through the firewall (Figure 9.12).

FIGURE 9.12   Opening TCP/IP ports in Windows Firewall

Exam Tip

The settings on firewalls are called rules. Many firewalls use the term implicit deny any to describe a rule like Windows Firewall’s block setting for inbound traffic.

Windows Firewall is set to allow all outgoing traffic by default, though you can change this behavior.

Exam Tip

Look for the CompTIA Network+ exam to refer to network setups where the firewall resides in a dedicated box as a network-based firewall. The exam calls firewall programs installed on your computer, such as Windows Firewall, host-based firewalls.

Network Zones

Large networks need heavy-duty protection that not only protects from external threats, but also does so without undue restriction on the overall throughput of the network. To do this, large networks often use dedicated firewall boxes, which usually sit between the gateway router and the protected network. These firewalls are designed to filter IP traffic (including NAT and proxy functions), as well as to provide high-end tools to track and stop incoming threats. Some of the firewall systems even contain a rather interesting feature called a honeypot. A honeypot is a device (or a set of functions within a firewall) that creates a fake network called a honeynet, which seems attackable to a hacker. Instead of trying to access the real network, hackers are attracted to the honeypot, which records their actions and keeps them away from the true network. Plus, you can study the hackers’ methods to help shore up your vulnerabilities.

Once you start to add publicly accessible servers to your network, like web and e-mail servers, you’re going to have to step up to a more serious network protection configuration. Because web and e-mail servers must have exposure to the Internet, you will need to create what’s called a demilitarized zone (DMZ), a lightly protected network positioned between your firewall and the Internet. You can configure a DMZ in a number of ways. Figure 9.13 shows one classic example using an external and an internal router.

FIGURE 9.13   A DMZ configuration

Local Lingo

Intranet   A private, protected network is called an intranet.

Vulnerability Scanners

A number of fine utility programs can scan a network to determine things like open ports, passive applications, and more. Nmap, for example, has been around since 1997, is updated regularly, and has been made available as open-source software. It was designed initially to do what its name would suggest—map a network so a system administrator doesn’t have to walk from room to room, creating a physical map of all the computers. In numerous updates, features have been added, and Nmap is now used heavily as a vulnerability scanner. You can find Nmap at http://nmap.org/.

Another excellent tool is Nessus, also free for noncommercial use. Tenable Network Security maintains and updates the Nessus products. You can download Nessus from www.nessus.org.

Securing Remote Connections

The mad proliferation of high-speed Internet connections to most households in the United States has enabled a lot of workers to work partly from home. Although this provides one cost-effective solution to the rising price of gasoline and of physical commuting, from a network security standpoint, it opens up a potential can of worms. Network techs and administrators must strike a fine balance between making resources readily available over the Internet and making certain that only authorized users get access to those resources.

IPsec

Every authentication and encryption protocol and standard you’ve learned about so far works above the Network layer of the OSI seven-layer model. Internet Protocol Security (IPsec) is an authentication and encryption protocol suite that works at the Internet/Network layer (layer 3 of the OSI model).

Local Lingo

IPsec   The Internet Engineering Task Force (IETF) specifies the IPsec protocol suite, managing updates and revisions. One of those specifications regards the acronym for the protocol suite, calling it IPsec with a lowercase “s” rather than IPS or IPSec, which you might imagine to be the initials or acronym. Go figure.

IPsec works in two different modes: Transport mode and Tunnel mode. In Transport mode, only the actual payload of the IP packet is encrypted: the destination and source IP addresses and other IP header information are still readable. In Tunnel mode, the entire IP packet is encrypted and then placed into an IPsec endpoint where it is encapsulated inside another IP packet. The mode you use depends on the application (Figure 9.14).

FIGURE 9.14   IPsec’s two modes

The IPsec protocol suite uses many open-source protocols to provide both tight authentication and robust encryption. You do not need to know how each of the protocols works for the CompTIA Network+ exam, but you should recognize which protocols function within IPsec. Here are the main protocols:

    • Authentication Header (AH) for authentication

    • Encapsulating Security Payload (ESP) for implementing authentication and encryption

    • Internet Security Association and Key Management Protocol (ISAKMP) for establishing security associations (SAs) that define things like the protocol used for exchanging keys

    • Internet Key Exchange (IKE and IKEv2) and Kerberized Internet Negotiation of Keys (KINK), two widely used key exchanging protocols

In addition, IPsec can encrypt data using any number of encryption algorithms, such as MD5, which you read about earlier in this chapter.

Virtual Private Networks

Several standards use encrypted tunnels between a computer or a remote network and a private network through the Internet (Figure 9.15), resulting in what is called a virtual private network (VPN).

FIGURE 9.15   VPN connecting computers across the United States

An encrypted tunnel requires endpoints—the ends of the tunnel where the data is encrypted and decrypted. In the tunnels you’ve seen thus far, the client for the application sits on one end and the server sits on the other. VPNs do exactly the same thing. Either some software running on a computer or, in some cases, a dedicated box must act as an endpoint for a VPN (Figure 9.16).

FIGURE 9.16   Typical tunnel

Exam Tip

CompTIA calls devices that handle encrypted tunnels encryption devices.

The key with the VPN is that all of the computers should be on the same network—and that means they must all have the same network ID. For example, you would want the laptop that you are using in an airport lounge to have the same network ID as all of the computers in your LAN back at the office. But there’s no simple way to do this. If it’s a single client trying to access a network, that client is going to take on the IP address from its local DHCP server. In the case of your laptop in the airport, your network ID and IP address come from the DHCP server in the airport, not the DHCP server back at the office.

To make the VPN work, you need a VPN client program protocol that uses one of the many tunneling protocols available. This remote client connects to the local LAN via its Internet connection, querying for an IP address from the local DHCP server. In this way, the VPN client will be on the same network ID as the local LAN. The remote computer now has two IP addresses. First, it has its Internet connection’s IP address, obtained from the remote computer’s ISP. Second, the VPN client creates a tunnel endpoint that acts like a NIC (Figure 9.17). This virtual NIC has an IP address that connects it to the local LAN.

FIGURE 9.17   Endpoints must have their own IP addresses.

Clever network engineers have come up with many ways to make this work, and those implementations function at different layers of the TCP/IP model. PPTP and L2TP, for example, work at the Link layer. Many VPNs use IPsec at the Internet layer to handle encryption needs. SSL VPNs work at the Application layer.

SSL and TLS are Application-layer protocols, not Transport layer.

PPTP VPNs

So how do you make IP addresses appear out of thin air? What tunneling protocol have you learned about that has the smarts to query for an IP address? That’s right! Good old PPP! Microsoft got the ball rolling with the Point-to-Point Tunneling Protocol (PPTP), an advanced version of PPP that handles this right out of the box. The only trick is the endpoints. In Microsoft’s view, a VPN is intended for individual clients to connect to a private network, so Microsoft places the PPTP endpoints on the client and the server. The server endpoint is a special remote access server program, originally only available on Windows Server, called Routing and Remote Access Service (RRAS) on the server—see Figure 9.18.

FIGURE 9.18   RRAS in action

On the Windows client side, you run Create a New Connection. This creates a virtual NIC that, like any other NIC, does a DHCP query and gets an IP address from the DHCP server on the private network (Figure 9.19).

FIGURE 9.19   VPN connection in Windows

Exam Tip

A system connected to a VPN looks as though it’s on the local network, but performs much slower than if the system was connected directly back at the office because it’s not local at all.

When your computer connects to the RRAS server on the private network, PPTP creates a secure tunnel through the Internet back to the private LAN. Your client takes on an IP address of that network as if your computer is directly connected to the LAN back at the office, even down to the default gateway. If you open your web browser, your client will go across the Internet to the local LAN and then use the LAN’s default gateway to get to the Internet! Using a web browser will be much slower when you are on a VPN. Every operating system comes with some type of built-in VPN client that supports PPTP (among others). Figure 9.20 shows Network, the Mac OS X VPN connection tool.

FIGURE 9.20   VPN on a Macintosh OS X system

This type of VPN connection, where a single computer logs into a remote network and becomes, for all intents and purposes, a member of that network, is commonly called a client-to-site connection.

L2TP VPNs

Microsoft pushed the idea of a single client tunneling into a private LAN using software. Cisco, being the router king that it is, came up with its own VPN protocol called Layer 2 Tunneling Protocol (L2TP). L2TP took all the good features of PPTP and L2F and added support to run on almost any type of connection possible, from telephones to Ethernet to ultra-high-speed optical connections. Cisco also moved the endpoint on the local LAN from a server program to a VPN-capable router, called a VPN concentrator, such as the Cisco 2811 Integrated Services Router shown in Figure 9.21.

FIGURE 9.21   Cisco 2811 Integrated Services Router

Exam Tip

Cisco made hardware that supported PPP traffic using a proprietary protocol called Layer 2 Forwarding (L2F). L2F did not come with encryption capabilities, so it was replaced by L2TP a long time ago. You’ll sometimes see the term on the CompTIA Network+ exam as an incorrect answer.

Cisco provides free client software to connect a single faraway PC to a Cisco VPN. This creates a typical client-to-site connection. Network people often directly connect two Cisco VPN concentrators to connect two separate LANs permanently. It’s slow, but inexpensive, compared to a dedicated high-speed connection between two faraway LANs. This kind of connection enables two separate LANs to function as a single network, sharing files and services as if in the same building. This is called a site-to-site VPN connection.

L2TP differs from PPTP in that it has no authentication or encryption. L2TP generally uses IPsec for all security needs. Technically, you should call an L2TP VPN an “L2TP/IPsec” VPN. L2TP works perfectly well in the single-client-connecting-to-a-LAN world, too. Every operating system’s VPN client fully supports L2TP/IPsec VPNs.

Travel Advisory

The years have seen plenty of crossover between Microsoft and Cisco. Microsoft RRAS supports L2TP, and Cisco routers support PPTP.

SSL VPNs

Cisco has made a big push for companies to adopt VPN hardware that enables VPNs using Secure Sockets Layer (SSL). These types of VPNs work at the Application layer and offer an advantage over Link- or Internet-based VPNs because they don’t require any special client software. Clients connect to the VPN server using a standard web browser, with the traffic secured using SSL. The two most common types of SSL VPNs are SSL portal VPNs and SSL tunnel VPNs.

Travel Advisory

Many VPN connections use the terms client and server to denote the functions of the devices that make the connection. You’ll also see the terms host and gateway to refer to the connections, such as a host-to-gateway tunnel.

With SSL portal VPNs, a client accesses the VPN and is presented with a secure webpage. The client gains access to anything linked on that page, be it e-mail, data, links to other pages, and so on.

With tunnel VPNs, in contrast, the client web browser runs some kind of active control, such as Java or Flash, and gains much greater access to the VPN-connected network. SSL tunnel VPNs create a more typical client-to-site connection than SSL portal VPNs, but the user must have sufficient permissions to run the active browser controls.

Travel Advisory

There are other VPN options besides PPTP, L2TP, and SSL, and some of them are quite popular. First is OpenVPN, which, like the rest of what I call “Openxxx” applications, uses Secure Shell (SSH) for the VPN tunnel. Second is IPsec. The tech world is now seeing some pure (no L2TP) IPsec solutions that use IPsec tunneling for VPNs, such as Cisco Easy VPN.

 Objective 9.01: Common Threats   Attackers use many different means to hack into systems and compromise networks. Be familiar with social engineering attacks as well as the different types of network attacks! Remember that spoofing is the altering of the source address, a buffer overflow is sending too much data to a program, and a Denial of Service prevents the system from performing its job.

 Objective 9.02: Securing User Accounts   Authentication occurs when users identify themselves to the network and that identity is verified against a database and either allowed or denied access to the network. Once the users are authenticated, they are then authorized to access network resources or not allowed access to those resources. Even the smallest network will have a number of user accounts and groups scattered about with different levels of permissions. Every time you give a user access to a resource, you create potential loopholes that can leave your network vulnerable to unauthorized access, data destruction, and other administrative nightmares. To protect your network from these threats, you need to implement the right controls over passwords, user accounts, groups, and permissions.

 Objective 9.03: Firewalls   Firewalls protect networks from external threats—potential attacks from outside your network—by filtering packets using a number of methods, such as hiding IP addresses using NAT, selectively blocking TCP/UDP ports, or even filtering traffic based on MAC addresses. A firewall doesn’t have to be a dedicated device; it can be a program as well.

 Objective 9.04: Securing Remote Connections   Several standards use encrypted tunnels to create a virtual private network that enables users outside the network to connect securely inside the network. To make a VPN work, you need a VPN client and a VPN server. Some of the methods used are PPTP, L2TP, and SSL VPNs.

REVIEW QUESTIONS

    1.  What aspect of protecting your network involves theft of equipment?

          A.  Packet filtering

          B.  Physical security

          C.  Policies

          D.  Port filtering

    2.  What is another name for port filtering?

          A.  Port blocking

          B.  Port filing

          C.  Port folders

          D.  Port segments

    3.  Where would a DMZ more commonly be found?

          A.  On a single PC

          B.  On a server

          C.  On a SOHO

          D.  On a larger network

    4.  Just after opening a Microsoft Excel spreadsheet, Rowan notices that some of his filenames have changed and that his network connection no longer works. What type of malware has most likely infected his computer?

          A.  Worm

          B.  Macro

          C.  Trojan

          D.  Rootkit

    5.  What problem does a rogue access point introduce?

          A.  Unauthorized physical access to a server

          B.  Unauthorized access to a wired network

          C.  Unauthorized access to a wireless network

          D.  Unauthorized physical access to a router or gateway

    6.  Which statements about passwords are true? (Select two.)

          A.  You should change your password regularly.

          B.  You should use familiar terms, like your pet’s name or your birthday, as your password because it will be easy for you to remember.

          C.  Writing your password on a piece of paper in case you forget it is okay as long as you keep the paper in a locked drawer.

          D.  You may not use spaces in a password.

    7.  Which statement is true?

          A.  A DoS uses a zombie, whereas a DDoS uses a botnet to attack a single system.

          B.  A DoS uses a botnet, whereas a DDoS uses a zombie to attack a single system.

          C.  A DoS attacks a single system, whereas a DDoS attacks multiple systems.

          D.  A DoS attacks systems on the Internet, whereas a DDoS attacks systems in a DMZ.

    8.  What is a honeypot?

          A.  It acts as a fake network, luring potential hackers away from the actual network.

          B.  It is a security measure that slows unauthorized network access to a crawl (as if running in honey), making your network undesirable to hackers.

          C.  It is what hackers call an easily hacked network.

          D.  It is a specialized padlock manufactured for the sole purpose of securing computer systems.

    9.  You receive an e-mail from your credit card company informing you that your card number has been stolen. You click a link in the e-mail and are taken to what looks like your credit card company’s website, where you are asked to enter your credit card number to determine if it is among those that were recently stolen. What should you do?

          A.  Enter your credit card number immediately to determine if it is among those stolen because this is the only way to protect against unauthorized charges to your account.

          B.  Call the toll-free number listed on the website to verify it is legitimate before entering your card number.

          C.  Call the toll-free number listed on the website and read your card number over the phone to the customer service representative.

          D.  Close your browser without entering your card number because it is likely a phishing scam, and then call the toll-free number listed on the back of your actual credit card to verify that is the case.

    10.  Which authentication protocol is time sensitive and is the default authentication protocol on Windows domains?

          A.  PPP

          B.  MS-CHAP

          C.  IPsec

          D.  Kerberos

REVIEW ANSWERS

    1.  B   The theft of equipment can be prevented with adequate physical security.

    2.  A   Another name for port filtering is port blocking.

    3.  D   A demilitarized zone (DMZ) would normally be found protecting a larger network with web and e-mail servers.

    4.  B   Because the problems occurred after opening a file in its associated program, a malicious macro is likely embedded in the spreadsheet.

    5.  C   A rogue access point provides unauthorized access to a wireless network.

    6.  A and C   Change your password regularly. If you must write it down to help you remember it, keep it locked in a drawer.

    7.  A   A DoS attack uses a single infected computer (zombie), whereas a DDoS attack uses multiple infected computers (botnet) to attack a single system.

    8.  A   A honeypot acts as a fake network, diverting would-be hackers away from your real network.

    9.  D   This is likely a phishing scam. Call the number listed on the back of your physical card to verify.

    10.  D   Kerberos is the time-sensitive authentication protocol used on Windows domains.

The Complete Network

  ITINERARY  

      Objective 10.01   Designing and Implementing a SOHO Network

      Objective 10.02   Implementing a Wireless Network

      Objective 10.03   Specialized Network Devices

      Objective 10.04   Network Configuration Management

This chapter begins by discussing the features of the mainstream network operating systems and clients, and then discusses the administrative side of networking, including one essential job that everyone hates—paperwork! Don’t ignore this stuff—it’s important information for the CompTIA Network+ exam and may help you back at the office, too!

Designing and Implementing a SOHO Network

The CompTIA Network+ exam doesn’t define a list titled “The x Steps to Design and Build a Network.” As you’ve read this book, however, you’ve probably discovered what needs to happen. For this objective, I’ll use the following list because I’ve built hundreds of networks using these steps.

    1. List of requirements   Define the network’s needs. Why are you installing this network? What primary features do you need?

    2. Network design   What equipment do you need to build this network? How should you organize the network?

    3. Compatibility issues   Are you using existing equipment, applications, or cabling that has compatibility issues?

    4. Internal connections   What type and length of structured cabling do you need? Does this network need wireless?

    5. External connections   How do you connect to the Internet?

    6. Peripherals   How will peripherals come into play? Are you connecting any printers, fax machines, or scanners?

    7. Security   How will you deal with computer, data, and network security?

Although I’ve numbered them here, these steps might come in any order. Even though network security is in the seventh position, for example, you might make a decision concerning the firewall as early as Step 2. Don’t be afraid to jump around a bit as needed to construct the network. Let’s start building a network using this list. For each point on the list, I’ll use a scenario or two to consider some of the pitfalls and issues that might pop up.

Designing a SOHO network isn’t too terribly challenging. There simply aren’t enough computers, switches, routers, printers, or servers to overwhelm the design process. The challenge comes in the actual implementation of the network. Here, the “gotchas” come hot and heavy, no matter how well you think you’ve planned ahead. The secret is to stick with your checklist and, above all, be patient!

Define the Network Needs

This step works just how it sounds like it should. First, you think about what you want your network to do. Do you need to run a small office? Do you want to be able to share your media among your household computers? How many devices will be accessing your network? Do you want the network to be wireless or wired? Write down the answers to these questions, since they will guide the rest of your network setup.

Once you know what your network will do, think about all the things your network will need—routers, software, cables, workstations, etc. It’s also a good idea at this point to run a wireless site survey if you want to set up a wireless network—some office environments aren’t very friendly to wireless signals, and you’ll need to be aware of that. Don’t get too carried away with this step—you don’t need to know the precise model of router you need yet, but you should have a general idea of what you should be looking for.

Defining network needs never actually ends. All networks are highly evolving entities and new ideas, applications, and equipment appear on an ongoing basis.

Network Design

Now you need to work on the finer details. This is the shopping list step. Network design quantifies the equipment, operating systems, and applications used by the network. This step ties closely with Step 3, compatibility issues.

You need to address the following equipment:

    • Workstations

          • Decide the exact type of workstation you need. Do you want machines running Windows 7 or Linux? What kind of processor do you want? How much hard drive space do you need? What applications will you need to use?

    • Servers

          • Just like with workstations, you need to determine the type of servers, if any, you’ll need for your office.

    • Equipment room

          • Decide the size and location of your equipment room. Do you need racks for your servers? Remember not to put the equipment room too close to, for example, a bathroom or other area where water damage might occur. Also determine how you’ll cool the equipment room. It can get hot in there!

    • Peripherals

          • Figure out what type of printer or scanner your network will need. You might not need a lot of peripherals, but most offices have at least one networked printer.

    • Cabling

          • Get some measurements of your office to determine the length of each run of cable you’ll install. Also decide on the type of cable you want to install for your needs. Lower-grade cable might cost you less, but it will limit the transfer speeds of your network, so you may want to spring for the good stuff.

Compatibility Issues

If you are building a new home network from scratch, which of your existing parts could work in the new network? Do you have older equipment that might have compatibility issues, like an old 100BaseT switch or router?

If you needed to use all of your old equipment, visualize your new network connecting to it and how you might get around some of these issues. Does your old printer have a way to connect to the network directly? Where would you connect your Xbox 360? What if you have older TVs? Will they work with a powerful, HDMI-equipped video card?

Create an inventory of your old equipment and jot down any compatibility issues you might imagine taking place.

Internal Connections

Now that you have an idea of your equipment and what you want to do with it, you need to get everything properly connected using structured cabling. Once you connect all your equipment, configure any internal VLANs, IP addressing schemes, DHCP/DNS servers, gateways, and so on.

External Connections

No network is an island anymore. At the very least, you need an ISP so you can Google and update your Facebook page—err, I mean, get work done online. In a SOHO network, you don’t have to deal with many of the issues you’d see in larger networks. A typical home-type ISP (DSL or cable) should be more than enough for them in terms of bandwidth. On the other hand, you will probably need to be connected to the Internet all the time (or pay the price in lost business), so you may want to consider a second ISP as a fallback plan in case the primary ISP fails.

Peripherals

Since you already know what kinds of peripherals you’ll need, all you have to do is buy and install them. It’s always a good idea to test a network printer from every workstation in the office, just in case.

Security

Thinking about network security is like thinking about network electricity: security is not really a single step but an integral part of all the steps. When you set up your wireless network, make sure to set up encryption of some sort. When you install your equipment room, make sure the door locks. Make sure all the users of your network have appropriate permissions and strong passwords. Good security will not only offer you peace of mind, but it could save your business, too.

Implementing a Wireless Network

In Chapter 2, you learned about wireless concepts and theories, such as the different wireless standards and the frequencies assigned to different channels. Be sure to refer to the sections in Chapter 2 where we discussed each wireless setting. This section will tell you how to change these settings.

Installing the Access Point

When you purchase a wireless access point (WAP), you simply need to plug the power in and then connect the cable from your Internet service provider (ISP) to the WAN port (see Figure 10.1) on the WAP. This will typically leave four more ports available, which are the local ports for the network switch.

FIGURE 10.1   Looking at the physical ports on a wireless router

Once you have connected the Internet to the WAN port, you are up and running. By default, the wireless functions of the wireless router are preconfigured and enable anyone to connect to the wireless network and surf the Internet! But that is not really a good thing, security-wise, so you need to make sure that you take some basic steps to secure your wireless network.

Local Lingo

Power over Ethernet   Wireless access points need electrical power, but they’re invariably placed in strange locations (like ceilings or high up on walls) where providing electrical power is not convenient. Better WAPs support a standard called Power over Ethernet (PoE) that enables them to receive their power from the same Ethernet cables that transfer their data. The switch that connects the WAPs must support PoE, but as long as both the WAP and the switch support PoE, you don’t have to do anything other than just plug in Ethernet cables. As you might imagine, it costs extra to get WAPs and switches that support PoE, but the convenience of PoE for wireless networks makes it a popular option.

Set the Admin Password

Your first task is to change the administrator password so that no one else can administer your router. To change this password on your wireless router, you go to a web browser and type the address 192.168.0.1 or 192.168.1.1 (depending on the manufacturer and software) into the address/URL bar. Then check the router’s manual for the user name and password to log in as an administrator. Once you’ve logged in, you will need to find the page that enables you to set the admin password. For example, on my D-Link DIR-615 Wireless N router, I chose the Tools link (at the top) and then the Admin link on the left (shown in Figure 10.2).

FIGURE 10.2   Changing the admin password on a D-Link router

Change Wireless Settings

After you change the admin password, you need to change the SSID (network name) of the wireless router. You’ll remember from Chapter 2 that for clients to connect to the wireless network, they need to know the SSID. Figure 10.3 shows how to change the network name (the SSID).

FIGURE 10.3   Changing the wireless network settings such as the SSID channel and visibility (SSID broadcasting)

Notice in Figure 10.3 that you can disable wireless entirely by unchecking the Enable Wireless option. You can also perform the following functions to control your wireless network environment:

    • Wireless Mode   On this router, you can set the wireless mode to determine the compatibility with different wireless standards. As you can see in Figure 10.3, my router is set to support 802.11n, 802.11g, and 802.11b clients.

    • Wireless Channel   In Figure 10.3, the router is configured to auto-select a channel. In this case, it’s using channel 6—the default channel used by wireless networks. If you find that devices such as cordless phones interfere with your wireless network, you can try changing the channel of the router to something different by turning off Auto Channel Scan and then choosing the channel from the drop-down list.

    • Visibility Status  On most routers, this setting is typically known as “SSID Broadcasting.” SSID broadcasting advertises the router’s name to clients so that they can connect. On this router, you disable SSID broadcasting by setting the Visibility Status to Invisible. Clients will not see the wireless network unless they have been configured manually to do so.

Implement MAC Filtering

Once you have set the basic wireless settings, you will configure MAC filtering, which is used to permit or deny MAC addresses that can connect to your wireless network. To configure MAC filtering on the D-Link router, you’d go to the Advanced link at the top and then choose Network Filter on the left, as shown in Figure 10.4.

FIGURE 10.4   Filtering which system can connect to the wireless network with MAC filtering

On this router, you would choose to Turn MAC Filtering On from the drop-down list and then specify the MAC addresses by typing them in or choosing them from a list of DHCP clients in the drop-down list.

Implement Encryption

To provide real security for your wireless network, you must encrypt your data. Turning off the SSID broadcast and creating MAC address reservations will not stop a truly determined intruder. With encryption, data packets are digitally encoded (using an encryption key) before being transmitted onto the wireless network. The receiving network device has to possess the encryption key to unscramble the packet and process the data. Therefore, any data packets surreptitiously grabbed by an intruder out of the air are useless without the encryption key. A number of encryption protocols can be used to secure your wireless network; you can use Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), or Wi-Fi Protected Access 2 (WPA2).

    • WEP   Encrypts using a 64-bit or 128-bit encryption key to scramble data packets. WEP is a flawed standard that can be cracked using well-known hacker tools such as AirSnort. If your WAPs and NICs provide no other option, WEP does increase the security of your network by keeping out casual intruders, but a hacker can crack WEP with relative ease. You need something better to protect yourself from a motivated intruder.

    • WPA   Provides a better, less crackable encryption standard that addresses the weaknesses of WEP by using 128-bit encryption and TKIP, a protocol that changes the keys used for encryption for every packet that is sent. WPA offers security enhancements such as an encryption key integrity-checking feature, user authentication through the industry-standard Extensible Authentication Protocol (EAP), and other advanced features that WEP lacks. WPA runs in one of two modes:

    • WPA-Personal   Also known as WPA-PSK, this uses a preshared key as its method to encrypt traffic. With WPA-Personal you will configure the access point with a starting key value, known as the preshared key, which is then used to encrypt the traffic. This mode is used most by home users and small businesses due to its simple setup.

    • WPA-Enterprise   Also known as WPA-802.1X, this is a WPA implementation that uses a central authentication server such as a RADIUS server for authentication, authorization, and accounting features. WPA-Enterprise is used by larger companies so that they can use their existing authentication server to control who has access to the wireless network and to log network access.

    • WPA2   Improves upon the security of WPA and should be used instead of WPA if you have the choice. WPA2 uses the Advanced Encryption Standard (AES) protocol instead of TKIP and also supports a number of additional features such as added protection for ad hoc networks and key caching. Because WPA2 uses AES as its encryption protocol, it supports 128-bit, 192-bit, and 256-bit encryption.

Upgrade the Antenna

Depending on the placement of your WAP and the distance to your client machines, you may want to install a better antenna on your WAP. This will increase your WAP’s signal strength, enabling you to get faster connections at a longer distance. You have several choices for the type of antenna you use, depending on your requirements.

For a typical network, you want blanket coverage and would place a WAP with an omnidirectional antenna in the center of the area (Figure 10.5). With an omnidirectional antenna, the radio wave flows outward from the WAP. Most wireless networks use this combination, especially in the consumer space. The standard straight-wire antennas that provide the most omnidirectional function are called dipole antennas.

FIGURE 10.5   Room layout with WAP in the center

When you don’t necessarily want to broadcast to the world, you can use one or more directional antennas to create a nicely focused network. A directional antenna, as the name implies, focuses a radio wave into a beam of sorts. Directional antennas come in a variety of flavors, such as parabolic, dish, and Yagi, to name just a few. A parabolic antenna looks like a satellite dish. A Yagi antenna (named for one of its Japanese inventors) is often called a beam antenna and can enable a focused radio wave to travel a long way, even miles!

Security Concerns with Signaling

The placement and signal strength of your WAP can have an effect on the security of the wireless network overall. Try to get the proper antennas and signal strength that match your space and needs. If you’re installing in a typical small office, for example, try not to let the signal bleed into adjacent offices. Why present a tempting target to the person next door who wants to perfect his hacking skills?

Installing the Client

After you have configured the router, you’ll need to connect the clients to the wireless network. To do this, you can view a list of wireless clients by right-clicking the wireless network icon in the taskbar and then choosing View Available Wireless Networks.

From the list of wireless networks, choose which wireless network you want to connect to, as shown in Figure 10.6.

FIGURE 10.6   Viewing a list of available wireless networks

If SSID broadcasting has been disabled, you will not see the wireless network in the list of available wireless networks, so you will need to configure the connection manually through the Change Advanced Settings option, shown in Figure 10.6.

When you choose to specify a manual setting, you will need to type the name of the SSID you want to connect to and then specify the data encryption mode, as shown in Figure 10.7.

FIGURE 10.7   Adding a wireless network manually

Troubleshooting Wireless Networking

When working with wireless networks, you may not be able to connect to the network for a number of reasons, such as the following:

    • Interference   You may have trouble keeping a connection with your wireless network because of interference with other electronic equipment, such as cordless phones or microwaves. Try changing the channel on your wireless network. Wireless signals also have a tendency to “bounce” off of solid objects, so sometimes making small adjustments to furniture placement can help.

    • Incorrect encryption   You may be trying to use the wrong encryption method or specifying the wrong encryption key. You will need to verify these settings before trying to connect.

    • Incorrect channel or incorrect frequency   Your wireless client may be trying to use a channel that differs from the channel the wireless router is using. Changing the channel will change the frequency used by the wireless network. In addition, 802.11n routers are able to transmit on both the 2.4 GHz and 5 GHz frequencies. The 5 GHz range is much less crowded than the 2.4 GHz range, reducing the chance of interference from devices such as telephones and microwave ovens. Too much signal interference can increase latency, making the network sluggish and slow to respond. Running in the 5 GHz range greatly reduces this problem.

    • SSID mismatch   Another problem can occur when you have overlapping WAP signals sent by WAPs that aren’t broadcasting their SSIDs. If you have one of these wireless networks saved in your system, your computer could attempt to log into the other WAP, resulting in an SSID mismatch error. One fix for interference caused by other wireless devices is to change the channel your network uses. Another is to change the channel the offending device uses, if possible. If you can’t change channels, try moving the interfering device to another area or replacing it with a different device.

    • Standards mismatch   A standards mismatch means that your computer is configured for 802.11n when you are actually trying to connect to an old 802.11a wireless network. Be sure that the cards are compatible with the standard used by the wireless router.

    • Distance   Wireless networks are typically limited to 120 feet inside and 300 feet outside. Your system may experience shorter networking distances due to interference. You can use a wireless repeater or build a long-range antenna to extend the range of your wireless network.

    • Incorrect WAP placement   Wireless routers use a vertical antenna that sends a signal in all directions. This creates a signal “hole” in the middle, so if wireless clients are trying to connect to the wireless network and are below the antenna (potentially in the hole of the circle area), you may need to move the client or move the antenna.

Exam Tip

The CompTIA Network+ exam might use the phrase “incorrect switch placement” even though, technically, the WAP function in a typical Wi-Fi box is not a switch.

Specialized Network Devices

For the CompTIA Network+ exam, you need to be familiar with the networking devices discussed earlier in the book such as switches, routers, and fire-walls. You need to be familiar with the following terms:

    • Multilayer switch   A switch that runs at different layers of the OSI model. For example, you can have a single switch that can perform layer-2 functions such as MAC filtering, virtual LANs, and spanning tree, in addition to layer-3 functions, acting as a router that supports routing protocols such as Routing Information Protocol (RIP) and Enhanced Interior Gateway Routing Protocol (EIGRP).

    • Content switch   A switch that can implement performance features on different types of traffic. Examples of the performance features may be data caching or load-balancing services.

    • Intrusion detection system (IDS)   An application (often running on a dedicated IDS box) that inspects incoming packets, looking for active intrusions. A good IDS knows how to find attacks that no firewall can find, such as viruses, illegal logon attempts, and other well-known attacks. An IDS always has some way to let the network administrators know if an attack is taking place: at the very least the attack is logged, but some IDSs offer a pop-up message, an e-mail, or even a text message to your phone. Third-party IDS tools, on the other hand, tend to act in a much more complex and powerful way. You have two choices with a real IDS: network based or host based.

          • Network-based IDS (NIDS)   Consists of multiple sensors placed around the network, often on one or both sides of the gateway router. These sensors report to a central application that, in turn, reads a signature file to detect anything out of the ordinary (Figure 10.8).

          • host-based IDS (HIDS)   Software running on individual systems that monitors for events such as system file modification or registry changes (Figure 10.9). More expensive third-party system IDSs do all this and add the ability to provide a single reporting source—very handy when one person is in charge of anything that goes on throughout a network.

A well-protected network uses both a NIDS and a HIDS. A NIDS monitors the incoming and outgoing traffic from the Internet, whereas the HIDS monitors the individual computers.

Exam Tip

The CompTIA Network+ exam can refer to an IDS system by either its location on the network—thus NIDS or HIDS—or by what the IDS system does in each location. The network-based IDS scans using signature files, thus it is a signature-based IDS. A host-based IDS watches for suspicious behavior on systems, thus it is a behavior-based IDS.

    • Intrusion prevention system (IPS)   Very similar to an IDS, but an IPS adds the capability to react to an attack. Depending on what IPS product you choose, an IPS can block incoming packets on the fly based on IP address, port number, or application type. An IPS might go even further, literally fixing certain packets on the fly. As you might suspect, you can roll out an IPS on a network and it gets a new name: a network intrusion prevention system (NIPS).

Exam Tip

The CompTIA Network+ exam refers to intrusion detection and prevention systems collectively by their initials, IDS/IPS.

Local Lingo

Port mirroring   IDS/IPS often takes advantage of something called port mirroring. Many advanced switches have the capability to mirror data from any or all physical ports on a switch to a single physical port. It’s as though you make a customized, fully configurable promiscuous port. Port mirroring is incredibly useful for any type of situation where an administrator needs to inspect packets coming to or from certain computers. You implement port mirroring in the managed switch’s configuration screens.

    • Load balancer   Hardware or software that provides load-balancing services and is designed to divide the network activity between multiple hosts. Load balancers offer a number of other features such as data caching.

    • Multifunction network device   A device that has features of many different devices built in. A great example would be the typical home router that you purchased for your network—this device is a firewall, NAT, DHCP server, DNS server, switch, and wireless access point.

    • DNS server   A server on the network that converts the FQDN to an IP address.

    • Bandwidth shaper   Performs bandwidth shaping, also known as traffic shaping, where traffic is purposely held back, or delayed, based on its type. Traffic shaping conserves bandwidth at different times for specific applications.

    • Proxy server   A device that requests resources, such as webpages, for the client system and then returns the page to the client system instead of the client system retrieving the content itself.

    • CSU/DSU   The channel service unit/data service unit is the device that connects to your router, which connects your network to the digital link, such as a T1 or T3 link.

    • VPN concentrator   A specific device designed to offer a highly secure VPN solution to an organization using the highest level of security technologies such as encryption and authentication services.

FIGURE 10.8   Diagram of network-based IDS

FIGURE 10.9   OSSEC HIDS

Network Configuration Management

The more complicated a network becomes, the more vulnerable it becomes in terms of security, efficiency, duplication or unnecessary redundancy, and unnecessary cost. Chapter 9 covered many of the security issues, but left a major component for coverage here, configuration management. Configuration management is a set of documents, policies, and procedures designed to help you maintain and update your network in a logical, orderly fashion so you may lessen the risks of these vulnerabilities. Your network should standardize on types of NICs, cabling, network operating systems, and network applications to make certain that when upgrades need to happen, they do so with the utmost efficiency.

Local Lingo

Asset management   Managing each aspect of a network, from documentation to performance to hardware, falls into a broad category called asset management.

If you want to upgrade your users from Windows XP to Windows 7, for example, you neither want to create a huge security risk for your network, nor waste a lot of money, time, and effort by realizing after the fact that an important application wasn’t compatible with the new OS. That’s not the way to do it in the real world!

Configuration Management Documentation

The configuration management documentation enables you to see many things about your network quickly. Good documentation helps you to troubleshoot a network efficiently. You can also determine as quickly as possible both how to upgrade components of that network and what effects such an upgrade might have. Configuration management documentation covers everything, from the wires used to how the people using the network should be trained. You can think about the configuration management documentation in four broad categories:

    • Network connectivity

    • Baselines

    • Policies, procedures, and configurations

    • Regulations

Network Connectivity

Documentation on network connectivity describes the many details about both the machines on the network and how they connect. The documentation can be hard copy or electronic and falls into three categories:

    • Wiring schemes

    • Network diagrams

    • Network maps

Wiring Schemes   A wiring scheme describes the cabling and connectors used in the network. In this documentation you find the specific types of UTP used, such as CAT 5e or CAT 6, and the TIA/EIA standard used in the RJ-45 crimps (Figure 10.10). You’ll discover multimode or single-mode fiber (or both, depending on the run) and which connectors plug into the PCs, switches, and routers. CompTIA shortens the category name for this type of documentation to wire schemes.

FIGURE 10.10   Wiring scheme detail on the TIA/EIA standard used throughout the network

Exam Tip

CompTIA Network+ refers to a wiring scheme as a wire scheme in the current exam objectives and the wiring schematics in the previous objectives. Expect to see any of the three terms on the exam.

Network Diagrams   A network diagram shows devices on the network and how they connect. It shows the physical runs and defines the type of connection, such as Gigabit Ethernet, T1, and so on. A network diagram includes every router, switch, server, CSU/DSU, cable modem, and wireless access point, including the make and model and firmware upgrade. Figure 10.11 shows a typical network diagram.

FIGURE 10.11   Network diagram

The network administrator creates the network diagram. Lucky for you, two critical tools make your job easier. First are standardized icons. As you look at Figure 10.11, you might notice the icons are somewhat cryptic. That’s because many years ago Cisco developed this shorthand to represent any type of networking device you might imagine.

Cisco generally calls these “network topology icons,” and they are the accepted standard to use whenever you’re drawing a network. Figure 10.12 shows some examples of the more common topology icons.

FIGURE 10.12   Sample network topology icons

Travel Assistance

New network devices show up all the time, so there’s no single place to see every network topology icon available. That said, Cisco keeps a fairly complete list here: www.cisco.com/web/about/ac50/ac47/2.html.

Your second tool is one of the many drawing programs that support network topology icons. You can use a presentation tool like Microsoft PowerPoint, but Microsoft Visio is the most famous tool for drawing any type of network diagram. Visio adds a number of extras that make putting together any type of diagram a snap. Figure 10.13 shows how I made Figures 10.11 and 10.14: with Visio!

FIGURE 10.13   Visio in action

FIGURE 10.14   Network map

Exam Tip

Having cabling runs and devices properly documented is all part of a broader category called cable management. Good documentation helps you troubleshoot and fix problems quickly.

Network Maps   A network map goes deeper into the individual components of the network, documenting IP addresses, ports, protocols, and more. You can create a network map manually using tools like Visio. Figure 10.14 shows such a network map.

Exam Tip

Most techs and companies use the terms network diagram and network map interchangeably or have strict definitions that reverse what you read here. Don’t sweat the differences for the exam. Just know that part of your configuration management documentation involves mapping out the nodes and including IP address, connection speed, and so forth.

Alternatively, you can create a network map with powerful programs such as Nmap. You know about Nmap from Chapter 9, where you saw it scanning for unusual open ports. It offers many configuration features, including telling you whether an open port is using TCP or UDP, for example. Plus this sort of application can create stunning graphical representations of your network.

Figure 10.15 shows a graphic of my office network. Figure 10.16 has zeroed in on a single router, examining open protocols and TCP/IP applications in use. Both screens are from Zenmap, a graphical interface for Nmap.

FIGURE 10.15   My network in pictures

FIGURE 10.16   Router close up

Exam Tip

Make updating your network documentation the last step of any changes you make to the network.

Baselines

The best way to know when a problem is brewing is to know how things perform when all’s well with the system. Part of any proper configuration management documentation is a baseline: a log of performance indicators such as CPU usage, network utilization, and other values to give you a picture of your network and servers when they are working correctly. A major change in these values can point to problems on a server or the network as a whole.

All operating systems come with some form of baseline tools. A common tool used to create a baseline on Windows systems is the Performance Monitor utility that comes with all versions of Windows. You’ll see Performance Monitor at work in Chapter 12.

Policies, Procedures, and Configurations

Network security, costs, time, and employee and management frustration—all of these things matter when managing a complex network. As part of any good documentation, therefore, you’ll find policies about what people can and cannot do with network hardware and software. You’ll see procedures outlined for what to do when upgrading components or adding new user accounts. You’ll also get down-to-the-user-interface-level information about how software and hardware should be configured.

Much of this should be familiar from a CompTIA A+ certification level. For example, what’s a great way to keep a Windows PC from becoming vulnerable to a new piece of malware floating around the Internet? C’mon, one guess! Keep it patched and up to date with Windows Update, right? Exactly.

Properly created configuration management documentation will inform network folks what to do with user training. Who gets it? Which departments? What level of access should you give new employees versus seasoned and trusted veterans?

Many of the policies and procedures help protect your network from harm. In CompTIA terms, they mitigate security risks like those outlined in gory detail in Chapter 9! Two policies affect most users: acceptable use and security. After explaining these polices, I’ll also give you a configuration example.

Acceptable Use Policy   An acceptable use policy defines exactly what you can and cannot do with your computers and network. Some classic areas defined by an acceptable use policy include personal computer use and adding personal software. Can a user access Facebook on a work computer, for example, or install a game?

Security Policy   An organization’s security policy defines procedures employees should perform to protect the network’s security. Security policies cover a wide gamut. They define password complexity, explain to users how to deal with social engineering, and clarify how to deal with virus attacks. Security policies almost always define action plans to deal with serious events that might threaten your network.

Configuration   Configurations are the results of the procedures. Documenting configurations for critical systems is important. Imagine if a carefully configured gateway router suddenly lost all of its settings and no one had made a backup! Every configurable device in today’s networking world comes with some tool to document its configuration. Figure 10.17 shows a part of one of the most common of all network configuration files, Cisco’s IOS startup configuration. It can be displayed by running show startup-config on all of Cisco’s IOS-based routers and switches.

FIGURE 10.17   Section of show startup-config

Regulations

Very few people profess to like regulations, the rules that govern behavior in the workplace. Nevertheless, regulations help keep networks and people safe and productive. Every decent configuration management documentation talks about regulations, such as what to do when you have a safety violation or some sort of potentially bad accident.

Change Management Documentation

Although CompTIA seems to separate the detailed overview of the network from how to upgrade it, most networking professionals use the term change management documentation to describe this single body of knowledge. An example will make this clear. Let’s say you want to change your network by adding a demilitarized zone (DMZ) because you want to add a server that people outside the network can access easily.

The change management documentation shows you network diagrams so you can verify where to place the DMZ and what other machines are potentially affected by the change. Plus, it gives you the detailed information on what to do to get approval from supervisors, get through the budgeting office, and so on.

Change management documentation details the procedures and policies to update the documentation so after each network change, your master documents are accurate. This information is extremely important! Failure to update the correct document will eventually result in you looking really bad when an otherwise minor troubleshoot turns into a nightmare.

 Objective 10.01: Designing and Implementing a SOHO Network   Every good tech should be comfortable designing a small network. Start out by defining your network’s needs, which will make the rest of the process much simpler. After that, design your network, fix any compatibility issues, set up your internal and external connections, install your peripherals, and make sure your network is secure.

 Objective 10.02: Implementing a Wireless Network   You will need to be very familiar with wireless networking for the CompTIA Network+ exam, so be sure to read over the theory that was presented in Chapter 2 and also know the basic steps to implement and troubleshoot a wireless network. Know that different wireless standards such as 802.11b, 802.11g, and 802.11n use a number of methods to help secure the wireless network, such as MAC filtering and data encryption, via WPA or WPA2.

 Objective 10.03: Specialized Network Devices   For the exam, you need to be familiar with a wealth of different types of devices starting with switches, routers, and NAT devices. Also be familiar with multifunctioning devices such as wireless routers and proxy servers.

 Objective 10.04: Network Configuration Management   The more complicated a network is, the more vulnerable it is in terms of security, efficiency, and other aspects. Configuration management helps you maintain and update your network in a logical and orderly fashion to lessen these vulnerabilities. Networks should be standardized on the types of NICs, cabling, network operating systems, and network applications to make upgrades to the network as efficient as possible. Configuration management documentation includes network connectivity, baselines, policies, procedures, configurations, and regulations.

REVIEW QUESTIONS

    1.  The first step in designing a new SOHO network is to

          A.  Define a list of requirements.

          B.  Determine the type of ISP you will use.

          C.  Check the existing cable.

          D.  Determine what security you need.

    2.  With what technology can you avoid finding an AC outlet for a WAP?

          A.  AES

          B.  PoE

          C.  Powered Wi-Fi

          D.  TKIP

    3.  What should you use when you want to limit access to your wireless network based on the physical, hard-coded address of each wireless network device?

          A.  Bus scheduling

          B.  Encoding

          C.  Encryption

          D.  MAC address filtering

    4.  Which of the following is the wireless network encryption method that is most secure?

          A.  MAC address filtering

          B.  WEP

          C.  WPA

          D.  WPA2

    5.  Where should you place a WAP to get optimal coverage of a room?

          A.  In the center of the room.

          B.  On the north wall, halfway up.

          C.  On the wall opposite any potential interference devices.

          D.  It doesn’t matter. Replace the default antenna with a more powerful one.

    6.  What is true of a multilayer switch?

          A.  It can work at multiple OSI layers at the same time.

          B.  It can work with one of several OSI layers at a time, depending on its configuration mode. Working at a different layer requires making a configuration change and resetting the switch.

          C.  It can communicate with other switches that work at different OSI layers.

          D.  It has twice the ports of a standard switch because it contains two regular switches, one stacked on top of the other.

    7.  How does an IPS compare to an IDS?

          A.  An IPS is more secure because it uses IPsec.

          B.  An IDS is more secure because it uses L2TP.

          C.  An IPS is more robust because it can react to attacks.

          D.  An IDS is more robust because it can react to attacks.

    8.  Which feature of advanced switches enables an administrator to inspect packets coming to or from specific computers?

          A.  Bandwidth shaping

          B.  Load balancing

          C.  IPS

          D.  Port mirroring

    9.  Your boss asks you for a diagram showing every server on the network. What do you provide to her?

          A.  Logical RAID

          B.  Network diagram

          C.  Wiring scheme

          D.  Baseline

    10.  What is defined in a security policy? (Select two.)

          A.  What users can and cannot do with their computers

          B.  How complex user passwords should be

          C.  How to deal with social engineering hacking attempts

          D.  How users should install their own software

REVIEW ANSWERS

    1.  A   Defining requirements is the first step in designing a SOHO network.

    2.  B   Power over Ethernet (PoE) provides power through the network cable, thus eliminating the need to plug a WAP into an AC outlet.

    3.  D   MAC address filtering should be used when you want to limit access to your wireless network based on the hard-wired address of each wireless network device.

    4.  D   WPA2 is a wireless encryption method that improves on the security features of WPA. MAC address filtering can be easily spoofed and bypassed. Wired Equivalent Privacy (WEP) is not secure anymore.

    5.  A   Placing the WAP in the center of the room will give the most coverage.

    6.  A   A multilayer switch can work at multiple OSI layers at the same time.

    7.  C   An IPS is more robust because it can react to attacks.

    8.  D   Port mirroring enables an administrator to inspect packets coming to or from certain computers.

    9.  B   A network diagram shows every router, switch, server, CSU/DSU, cable modem, and wireless access point on the network.

    10.  B and C   A security policy describes how to deal with hacking attempts and password complexity. What users can and cannot do with their computers and what software they can install is covered under the acceptable use policy.

Troubleshooting Networks

  ITINERARY  

      Objective 11.01   The Troubleshooting Process

      Objective 11.02   Troubleshooting Network Hardware

      Objective 11.03   Testing Equipment

Did you ever watch the television show ER? It was a medical drama centering on a group of attractive doctors and nurses working in an emergency room. They spent much of their time casually checking up on patients and having witty conversations. But, at some point during every episode, something terrible happens and the ambulances pull up. People come crashing through the doors with a patient. Everyone starts shouting and the music gets very dramatic. It’s an actual emergency and there is a life that needs saving!

A network tech is a little bit like an ER doctor, except you’ll probably be fixing things by yourself and all that shouting will be in your head. You won’t always have a lot to do to keep a network running, but when something goes wrong and you see the server being wheeled through the doors on a gurney (if you happen to have a gurney, of course), you need to know how to troubleshoot a network. You’ll also need to know the symptoms of hardware malfunctions and which tools to use to fix them. The dramatic music is optional.

The Troubleshooting Process

Troubleshooting is a dynamic, fluid process that requires you to make snap judgments and act on them to try and make the network go. Any attempt to cover every possible scenario would be futile and probably not in your best interest, because any reference that tried to list every troubleshooting problem would be obsolete the moment it was created. If an exhaustive listing of all network problems is impossible, then how do you decide what to do and in what order?

Before you touch a single console or cable, you should remember two basic rules: To paraphrase the Hippocratic Oath, “First, do no harm.” If at all possible, don’t make a network problem bigger than it was originally. This is a rule I’ve broken thousands of times, and you will too. But if I change the good doctor’s phrase a bit, it’s possible to formulate a rule you can actually live with: “First, do not trash the data!” My gosh, if I had a dollar for every megabyte of irreplaceable data I’ve destroyed, I’d be rich! I’ve learned my lesson, and you should learn from my mistakes. The second rule is: Always make good backups! Computers can be replaced; data that is not backed up is, at best, expensive to recover and, at worst, gone forever.

No matter how complex and fancy, any troubleshooting process can be broken down into simple steps. Having a sequence of steps to follow makes the entire troubleshooting process simpler and easier, because you have a clear set of goals to achieve in a specific sequence.

The CompTIA Network+ objectives contain a detailed troubleshooting methodology that provides a good starting point for our discussion. Here are the basic steps in the troubleshooting process:

    1.  Identify the problem.

          a.  Gather information.

          b.  Identify symptoms.

          c.  Question users.

          d.  Determine if anything has changed.

    2.  Establish a theory of probable cause.

          a.  Question the obvious.

    3.  Test the theory to determine cause.

          a.  Once theory is confirmed, determine next steps to resolve the problem.

          b.  If theory is not confirmed, reestablish new theory or escalate.

    4.  Establish a plan of action to resolve the problem and identify potential effects.

    5.  Implement and test the solution or escalate as necessary.

    6.  Verify full system functionality and, if applicable, implement preventative measures.

    7.  Document findings, actions, and outcomes.

Identify the Problem

First, identify the problem. That means grasping the true problem, rather than what someone tells you. A user might call in and complain that he can’t access the Internet from his workstation, for example, which could be the only problem. But the problem could also be that the entire wing of the office just went down and you’ve got a much bigger problem on your hands. You need to gather information, identify symptoms, question users, and determine if anything has changed on the network. Doing this will help you get to the root of the problem.

Gather Information, Identify Symptoms, and Question Users

If you are working directly on the affected system and not relying on somebody on the other end of a telephone to guide you, you will establish the symptoms through your observation of what is (or isn’t) happening. If you’re troubleshooting over the telephone (always a joy, in my experience), you will need to ask questions based on what the user is telling you. These questions can be close-ended, which is to say there can only be a yes-or-no-type answer, such as, “Can you load a webpage?” You can also ask open-ended questions, such as, “Tell me what you see on the screen.”

The type of question you use at any given moment depends on what information you need and on the user’s knowledge level. If, for example, the user seems to be technically oriented, you will probably be able to ask more close-ended questions because they will know what you are talking about. If, on the other hand, the user seems to be confused about what’s happening, open-ended questions will allow him or her to explain in his or her own words what is going on.

One of the first steps in trying to determine the cause of a problem is to understand the extent of the problem—is it specific to one user or is it network-wide? Sometimes this entails trying the task yourself, both from the user’s machine and from your own or another machine.

For example, if a user is experiencing problems logging into the network, you might need to go to that user’s machine and try to use his or her user name to log in. Doing this tells you whether the problem is a user error of some kind, as well as enables you to see the symptoms of the problem yourself. Next, you probably want to try logging in with your own user name from that machine, or have the user try to log in from another machine. In some cases, you can ask other users in the area if they are experiencing the same problem to see if the issue is affecting more than one user. Depending on the size of your network, you should find out whether the problem is occurring in only one part of your company or across the entire network.

What does all of this tell you? Essentially, it tells you how big the problem is. If nobody in an entire remote office can log in, you may be able to assume that the problem is the network link or router connecting that office to the server. If nobody in any office can log in, you may be able to assume the server is down or not accepting logins. If only that one user in that one location can’t log in, the problem may be with that user, that machine, or that user’s account.

Exam Tip

Eliminating variables is one of the first tools in your arsenal of diagnostic techniques.

Determine If Anything Has Changed

The goal of this step is to identify if anything has changed that might have caused the problem. You may not have to ask many questions before the person using the problem system can tell you what has changed, but, in some cases, establishing if anything has changed can take quite a bit of time and involve further work behind the scenes. Here are some examples of questions to ask:

    • “Tell me exactly what was happening when the problem occurred.”

    • “Has anything been changed on the system recently?”

    • “Has the system been moved recently?”

Notice the way I’ve tactfully avoided the word you, as in “Have you changed anything on the system recently?” This is a deliberate tactic to avoid any implied blame on the part of the user. Being nice never hurts, and it makes the whole troubleshooting process more friendly.

You should also internally ask yourself some isolating questions, such as, “Was that machine involved in the software push last night?” or “Didn’t a tech visit that machine this morning?” Note you will only be able to answer these questions if your documentation is up to date. Sometimes, isolating a problem may require you to check system and hardware logs (such as those stored by some routers and other network devices), so make sure you know how to do this.

Travel Advisory

Avoid aggressive or accusatory questions.

Establish a Theory of Probable Cause

This step comes down to experience—or good use of the support tools at your disposal, such as your knowledge base. You need to select the most probable cause from all the possible causes, so the solution you choose fixes the problem the first time. This may not always happen, but whenever possible, you want to avoid spending a whole day stabbing in the dark while the problem snores softly to itself in some cozy, neglected corner of your network.

Don’t forget to question the obvious. If Bob can’t print to the networked printer, check to see that the printer is plugged in and turned on, for example.

Test the Theory to Determine Cause

With the third step, you need to test the theory, but do so without changing anything or risking any repercussions. If you have determined that the probable cause for Bob not being able to print is that the printer is turned off, go look. If that’s the case, then you should plan out your next step to resolve the problem. Do not act yet! That comes next.

If the probable cause doesn’t pan out, you need to go back to step 2 and determine a new probable cause. Once you have another idea, test it.

The reason you should hesitate to act at this third step is that you might not have permission to make the fix or the fix might cause repercussions you don’t fully understand yet. For example, if you walk over to the print server room to see if the printer is powered up and online and find the door padlocked, that’s a whole different level of problem. Sure, the printer is turned off, but management has done it for a reason. In this sort of situation, you need to escalate the problem.

To escalate has two meanings: either to inform other parties about a problem for guidance or to pass the job off to another authority who has control over the device/issue that’s most probably causing the problem. Let’s say you have a server with a bad NIC. This server is used heavily by the accounting department, and taking it down may cause problems you don’t even know about. You need to inform the accounting manager to consult with them. Alternatively, you’ll come across problems over which you have no control or authority. A badly acting server across the country (hopefully) has another person in charge to whom you need to hand over the job.

Establish a Plan of Action and Identify Potential Effects

By this point, you should have some ideas as to what the problem might be. It’s time to “look before you leap.” An action plan defines how you are going to fix this problem. Most problems are simple, but if the problem is complex, you need to write down the steps. As you do this, think about what else might happen as you go about the repair. If you take out a switch without a replacement switch at hand, the users might experience excessive downtime while you hunt for a new switch and move them over. If you replace a router, can you restore all the old router’s settings to the new one or will you have to rebuild from scratch?

Implement and Test the Solution or Escalate as Necessary

Once you think you have isolated the cause of the problem, you should decide what you think is the best way to fix it and then try your solution, whether that’s giving advice over the phone to a user, installing a replacement part, or adding a software patch. All the way through this step, try only one likely solution at a time.

As you try each possibility, always document what you do and what results you get. This isn’t just for a future problem either—during a lengthy troubleshooting process, it’s easy to forget exactly what you tried two hours before or which thing you tried produced a particular result. Although being methodical may take longer, it will save time the next time—and it may enable you to pinpoint what needs to be done to stop the problem from recurring at all, thereby reducing future call volume to your support team—and as any support person will tell you, that’s definitely worth the effort!

Then you need to test the solution. This is the part everybody hates. Once you think you’ve fixed a problem, you should try to make it happen again. If you can’t, great! But sometimes you will be able to re-create the problem, and then you know you haven’t finished the job at hand. Many techs want to slide away quietly as soon as everything seems to be fine, but trust me on this, it won’t impress your customer when her problem flares up again 30 seconds after you’ve left the building—not to mention that you get the joy of another two-hour car trip the next day to fix the same problem, for an even more unhappy client! In the scenario where you are providing support to someone else rather than working directly on the problem, you should make her try to re-create the problem. This tells you whether she understands what you have been telling her and educates her at the same time, lessening the chance that she’ll call you back later and ask, “Can we just go through that one more time?”

Exam Tip

Always test a solution before you walk away from the job!

Verify Full System Functionality and Implement Preventative Measures

Okay, now that you have changed something on the system in the process of solving one problem, you must think about the wider repercussions of what you have done. If you’ve replaced a faulty NIC in a server, for instance, will the fact that the MAC address has changed (remember, it’s built into the NIC) affect anything else, such as the login security controls or your network management and inventory software? If you’ve installed a patch on a client PC, will this change the default protocol or any other default settings that may affect other functionality? If you’ve changed a user’s security settings, will this affect his or her ability to access other network resources? This is part of testing your solution to make sure it works properly, but it also makes you think about the impact of your work on the system as a whole.

Make sure you test the full system so you don’t have to have a second tech call to resolve an outstanding issue. This saves time and money and helps your customer do his or her job better. Everybody wins.

Also at this time, if applicable, implement measures to avoid a repeat of the problem. If that means you need to educate the user to do or not do something, teach him or her tactfully. If you need to install software or patch a system, do it now.

Document Findings, Actions, and Outcomes

It is vital that you document the problem, symptoms, and solutions of all support calls, for two reasons: First, you’re creating a support database to serve as a knowledge base for future reference, enabling everyone on the support team to identify new problems as they arise and know how to deal with them quickly, without having to duplicate someone else’s research efforts. Second, documentation enables you to track problem trends and anticipate future workloads, or even to identify a particular brand or model of an item, such as a printer or a NIC, that seems to be less reliable or that creates more work for you than others. Don’t skip this step—it really is essential!

Exam Tip

Memorize these problem analysis steps:

    1.  Identify the problem.

          a.  Gather information.

          b.  Identify symptoms.

          c.  Question users.

          d.  Determine if anything has changed.

    2. Establish a theory of probable cause.

          a.  Question the obvious.

    3. Test the theory to determine cause.

          a.  Once theory is confirmed, determine next steps to resolve problem.

          b.  If theory is not confirmed, reestablish new theory or escalate.

    4.  Establish a plan of action to resolve the problem and identify potential effects.

    5.  Implement and test the solution or escalate as necessary.

    6.  Verify full system functionality and, if applicable, implement preventative measures.

    7.  Document findings, actions, and outcomes.

Troubleshooting Network Hardware

Once you know the troubleshooting process, you can start searching for signs of trouble on your network. Because there are so many places for a network to act up or outright fail, I’ll cover the top network hardware faults first. I’ll discuss logical network issues in Chapter 12.

Power Issues

Power issues generally fall into two categories: complete loss of power and dying power supplies. Power failure stops computing devices cold, and the symptoms are pretty obvious—no sound, no lights, and not working. If a single device is affected but the rest of the network is not, then try switching out for a known good component. If network power is off, check circuit breakers.

A dying power supply can create all kinds of havoc with components, ranging from “kind of working” to “the lights come on but nobody’s home” sorts of scenarios. Often the most telling symptom is a series of seemingly random errors that don’t point to any one thing. Test by swapping with a known good power supply or by using a multimeter (see the section “Multimeters” later in this chapter).

Finally, every network should have an uninterruptible power supply (UPS) as a backup for each server or rack of servers. The batteries in UPSs go out, so be certain to check them periodically and replace as necessary.

Network Media

Symptoms of network media faults can range from the inability of a single client to connect to the network to the failure of an entire system. The topology of your network determines the extent of a problem caused by a single failure and how you troubleshoot media-related problems. On a bus-based network, for example, a single cable break will shut down the entire segment, but with a UTP-based star-bus topology, a cable fault may affect only one client, unless it’s the cable between two switches or a switch and a server. Also, with a star topology, you may have a single point of failure if the switch breaks down.

Media faults can generally be categorized as follows:

    • Cable breaks

    • Cable shorts

    • Incorrect wiring to connectors

    • Badly fitted or damaged connectors

    • Incorrect or overlong cables or segments

    • Cables located near sources of interference

    • Environmental effects (heat, cold, water, and so on)

Most network cable installers carry an arsenal of tools to help them install and test new structured cabling systems. These tools range from inexpensive crimpers (the tools that put the connectors on the ends of the cables) and punch-down tools (the tools that push UTP wiring into the connectors on wall plates or into punch-down connectors on patch panels like those shown in Figure 11.1) to multi-thousand-dollar cable testers that plug into two ends of a cable (which I’ll discuss further later in the chapter). The higher-end testers provide acres of detailed information to ensure that the electrical properties of a cable pass a battery of TIA/EIA standards. These tools are indispensable to the folks who install cable, and most of them require that techs undergo significant training before they can use and understand them.

FIGURE 11.1   Punch-down connectors on the back of a patch panel

Visual Indications of Problems

Apart from the obvious—a completely severed cable, for instance—look for help from link lights on NICs and switches. Broken UTP cables tend to cause link lights on NICs and switches to turn off. Using these visual indicators is important; inspecting connectors on cables for signs of damage is not always easy because the fault may be internal to the connector, and testing by substitution is an easier option.

Travel Advisory

Some network techs tie a knot at one end of a known faulty cable as close to the connector as possible. This ensures that the cable doesn’t get placed back with good cable stock. Even if it does, it will be easy to see that the cable shouldn’t be used.

Check the NIC

A bad NIC can also cause problems. Use the utility provided by your OS to verify that the NIC works. If you’ve got an NIC with diagnostic software, run it—this software will check the NIC’s circuitry. The NIC’s female connector is a common failure point, so NICs that come with diagnostic software often include a special test called a loopback test. A loopback test sends data out of the NIC and checks to see if it comes back. Some NICs perform only an internal loopback, which tests the circuitry that sends and receives, but not the actual connecting pins. A true external loopback requires a loopback plug inserted into the NIC’s port. If an NIC is bad, replace it.

Bad Modules

Most good routers and switches come with interchangeable components, enabling manufacturers to make a base model device and then offer components to address each customer’s individual needs. These components come in a number of different shapes and sizes, such as the gigabit interface converter (GBIC) that gives customers the ability to match their router and switch connections to whatever type of fiber already exists in their location. You’ll recall from Chapter 2 the small form-factor pluggable (SFP) connector used in many Cisco and other brand switches.

You can easily install these modules. Turn off the router or switch, remove a protective plate (if one exists), plug in the module, and turn the switch/router back on.

If you install a module that doesn’t work, use the same tests that you’d perform on any port on a switch or router. The fact that these are modules doesn’t change the troubleshooting tools you’ve learned about in this book.

Troubleshooting Other Physical Network Issues

A number of different network communication issues could arise when you’re troubleshooting network issues; as a result, the Network+ exam is heavy on troubleshooting. Following are popular issues that deal with the physical network:

    • Crosstalk (near end and far end)   This term refers to interference from adjacent wires. If you experience a lot of signal degradation, it could be due to crosstalk. To fix the problem, try using another cable type that has more shielding.

    • Attenuation   This refers to the degradation of the signal as it travels great distances. If you cannot communicate with a system that is too far away, you might have exceeded the maximum cable length for that type of cable. To fix the problem, you add a repeater to the middle of the connection to boost the signal or use a different cable type.

    • Shorts   A short in the network cable could cause network downtime. When experiencing connectivity issues, use a cable analyzer or try a replacement cable to identify whether there is a short in the cable.

    • Open impedance   High impedance can cause signal bounce, which can cause communication issues. This signal bounce could be due to an incorrectly wired cable or an incorrect connector. You can use a cable tester or analyzer to determine whether connectivity exists between the two ends of the cable. If it doesn’t, you will need to recrimp the cable.

Exam Tip

The CompTIA Network+ objectives use the term open short at the time of this writing. There should be a comma after “open,” however, so you know you’re looking at two different types of broken cable issues.

    • TX/RX reversed   When making your own cables, make sure you insert the wires according to the same standard (TIA/EIA 568A or TIA/ EIA 568B) on both ends of the cable. If you don’t, you might end up swapping the sending and receiving wires (known as TX/RX reversed) and inadvertently creating a crossover cable.

    • Interference   You may receive radio or electromagnetic interference (EMI) from external components. Be sure to route network cables away from power cables and other interference sources. Cable placement is very important!

    • Temperature   The temperature in the telecommunications room should be maintained and monitored properly. If you lose the air conditioning, for example, and leave systems running, the equipment will overheat and shut down—sometimes with serious damage. To prevent this, all serious telecommunications rooms should have temperature monitors.

    • Environment   Likewise, you need to control the level of humidity in a telecommunications room. You can install environmental monitors that keep a constant watch on humidity, temperature, and more, for just a few hundred dollars. The devices cost little in comparison to the equipment in the telecommunications room that you’re protecting.

Issues That Need To Be Escalated

Loops on the network can cause problems with communication. Loops created between your switches can cause the network to go down due to confusion in the MAC address table, or routing loops can occur where each router is sending the data back to the other router:

    • Switching loops   Loops on the network will typically bring the network down. This is why Cisco switches use Spanning Tree Protocol (STP). It prevents loops by placing one of the ports in the loop in a blocking state. If you have intermittent problems with the network where systems seem to lose connections randomly, it could be a loop issue. Check how you have everything wired and remove the cable that creates a loop.

    • Routing problems   If all clients on the network cannot communicate with systems on another network, you most likely have a routing problem. Check the routing table on the router and ensure that a route exists to the network you are trying to reach. Verify the routes on each router on the network to ensure that the routers are not simply sending the data back and forth.

Testing Equipment

Network techs use various tools to test for faults, such as wiring that’s out of spec. These types of faults do not generate any physical symptoms, and they can be found only by performing a range of tests. The most common types of test equipment are described here.

Multimeters

A multimeter, shown in Figure 11.2, can be used to test a cable or bus segment for open or short circuits by testing an electrical characteristic called resistance, which is measured in ohms. A good cable will have close to zero resistance (0 ohms) between its ends (pin 1 to pin 1 on a UTP cable). A faulty or broken cable will show a higher-than-normal resistance—anything above a few ohms to infinity.

FIGURE 11.2   A simple multimeter

Exam Tip

A multimeter and a voltage event recorder can measure voltage.

Tone Locators and Toner Probes

Even in the best of networks, labels fall off ports and outlets, mystery cables disappear behind walls, and new cable runs are added without documentation. To help you figure out which end belongs to a cable when you are working with a stack of cables, you can use tone locators. A toner is a generic term for two separate devices that are used together: a tone generator and a tone probe. These two devices are often referred to as Fox and Hound, the brand name of a popular toner made by Triplett Corporation. The tone generator connects to a cable with alligator clips, tiny hooks, or a network jack, and it sends an electrical signal along the wire at a certain frequency. A tone probe emits a sound if it comes close to the cable to which the tone generator is connected (see Figure 11.3).

FIGURE 11.3   A tone locator in use

To trace a cable, you connect the tone generator to the cable, and then move the tone probe next to all the possible cables. The tone probe makes a sound when it is next to the right cable. More advanced toners include phone jacks, enabling the person manipulating the tone generator to communicate with the person manipulating the tone probe: “Jim, move the tone generator to the next port!” Some toners have one probe working with multiple generators. Each generator emits a different frequency, and the probe emits a different sound for each frequency. Good toners cost around US$75. Bad toners can cost less than US$25, but usually don’t work very well. If you want to support a network, you’ll need to own a toner.

Together, a good, medium-priced cable tester and a good toner are the most important tools used by folks who support, but don’t install, networks. Be sure to add a few extra batteries—avoid the frustration of sitting on the top of a ladder holding a cable tester or toner that has just run out of juice!

Cable Testers

As the name implies, cable testers test cables. But before we can talk about cable testers, we have to determine what makes a cable bad. When troubleshooting cables, ask the following questions:

    • How long is this cable?

    • Is it over its rated length?

    • Are any of the wires broken?

    • If there is a break, where is it?

    • Are any of the wires shorted together?

    • Are any of the wires not in the correct order?

    • Is there too much electrical or radio interference from external components?

Cable testers are designed to answer some or all of these questions, depending on the amount of money you are willing to pay. The low end of the cable-tester market consists of devices that test only for broken wires; these testers are often called continuity testers. Some cheap testers will also test for improperly wired cables, such as having the wires in a different order at either end, or they may test for shorts in the cable (see Figure 11.4).

FIGURE 11.4   A simple cable tester

Exam Tip

A certifier is a normal cable tester that will also report on characteristics such as speed and duplex settings. You might see this on the CompTIA Network+ exam as a cable certifier.

These cheap testers usually require you to insert both ends of the cable into the tester. That can be a little bit tough if the cable is already installed in the wall! A number of testers come in two parts so that you can connect the tester to a cable in the wiring room while taking the other part of the tester to the wall jack (located elsewhere) for that cable.

Medium-priced testers add the ability to tell you the length of the cables by switching the mode of the tester to what is usually known as the “length” mode. They also tell you where a break or short is located in a cable. These are generically called Time-Domain Reflectometers, or TDRs (see Figure 11.5). Optical Time-Domain Reflectors (OTDRs) serve the same purpose as TDRs, but are used for fiber-optic cabling.

FIGURE 11.5   Time-Domain Reflectometer

The medium-priced testers have a small loopback device that gets inserted into the far end of the cable, enabling the tester to work with installed cables. This is the type of tester that you want. With a basic unit, you can plug in both ends of a patch lead, and the tester will check for correct wiring and open or short circuits. If you are testing a wall port, you generally fit a loopback plug into the socket at the other end to complete the circuit and enable testing.

A combination of troubleshooting methodology and test equipment will enable you to determine whether a particular cable is bad. In most troubleshooting situations, you will use other clues to determine whether you have a hardware or software problem. In the “I can’t log in” scenario, for example, if you have determined that everyone else in the area can log in and that this user can log on from another location, you have narrowed the problem either to a configuration or hardware issue. If all network activity is broken (that is, if nothing is available on the network, or you can’t ping the default gateway), you may choose to test cables by connecting the PC to the server. This is not the only option, but it is one variable that can be tested and eliminated.

Travel Advisory

When troubleshooting network problems, don’t forget to check the simple stuff first—you can save yourself a lot of time. For example, make sure that cables are physically connected, or verify that the printer is online before trying more complicated solutions.

Exam Tip

Here are a few more tools you should be familiar with for the Network+ exam:

Butt set   Used to test telephone lines.

Cable stripper   Used to strip the covering off the cable. These are popular functions of cable crimpers that are used to cut and seal the connector on the end of the cable.

 Objective 11.01: The Troubleshooting Process   Follow the troubleshooting process to find solutions for your network’s issues. Begin by identifying the problem. Establish a theory of probable cause, and then test that theory to determine if you were right. Once you’ve found the cause, establish a plan of action and identify potential effects. Test your solution or escalate the issue to someone else, if needed. Before leaving your client, verify full system functionality, implement preventative measures, and document the outcome.

 Objective 11.02: Troubleshooting Network Hardware   Look for symptoms in your network hardware to track down potential issues. Watch out for cable issues, such as breaks, shorts, and incorrect cable wiring. Check the link lights on each piece of network hardware. Also look for crosstalk, high temperatures, interference, and other physical network issues.

 Objective 11.03: Testing Equipment   Use the proper tools and equipment to test your network hardware. A multimeter checks for short circuits by measuring the resistance on the wires. A tone locator and toner probe, or Fox and Hound, helps you track down both ends of a network cable. A cable tester can tell you a lot about what is happening with your cables.

REVIEW QUESTIONS

    1.  Which of the following is the final step of the troubleshooting model?

          A.  Establish a theory of probable cause.

          B.  Test the solution.

          C.  Document your findings.

          D.  Establish a plan of action.

    2.  Susan cannot log in to the network. Which of the following would be the best question to ask first?

          A.  “Tell me exactly what happens when you try to log in.”

          B.  “What did you do?”

          C.  “What protocols are installed?”

          D.  “Which operating system are you using?”

    3.  Which of the following are open-ended questions? (Select all that apply.)

          A.  “Has anything been changed on the system recently?”

          B.  “Can you see a power light on the monitor?”

          C.  “What lights can you see on the monitor?”

          D.  “Tell me what happens when you move the mouse.”

    4.  Which of the following are physical network issues associated with network media? (Select all that apply.)

          A.  Attenuation

          B.  Crosstalk

          C.  Wrong subnet mask

          D.  Shorts

    5.  Which of the following steps should be first in a troubleshooting model?

          A.  Document your findings.

          B.  Test your theory.

          C.  Identify the problem.

          D.  Implement the solution.

    6.  Which of the following tools can identify a cabling fault due to an overlong segment?

          A.  Multimeter

          B.  TDR

          C.  Tone locator

          D.  Punch-down tool

    7.  Isabel suspects that electrical interference is affecting a segment of network cabling. What is one of the first things she should do to test her diagnosis?

          A.  Use a TDR.

          B.  Use a protocol analyzer.

          C.  Install a length of optical fiber.

          D.  Move the media.

    8.  Which of the following is used to test fiber-optic cabling?

          A.  Multimeter

          B.  Butt set

          C.  OTDR

          D.  TDR

    9.  Stella complains that her computer can’t connect to the network. You theorize that her NIC might be faulty. What step should you follow next?

          A.  Try replacing the NIC.

          B.  Ask Stella what is wrong.

          C.  Replace the cable with CAT 6.

          D.  Verify her system works.

    10.  Abigail receives several reports that users are experiencing server connection issues. She walks to the server closet to investigate the issue and finds that it is incredibly humid inside. What should she have installed to avoid this problem?

          A.  Cable tester

          B.  Environmental monitor

          C.  Temperature monitor

          D.  Fox and Hound

REVIEW ANSWERS

    1.  C   Once you have solved the problem, always document your findings so that you or someone else may more quickly come to a solution next time.

    2.  A   Identify the problem by asking the user what happens when she attempts to log in.

    3.  C, D   Any question that cannot be answered with a “yes” or “no” is an open-ended question.

    4.  A, B, D   Using the wrong subnet mask would be a logical network issue, not a network media issue.

    5.  C   The troubleshooting theory begins by identifying the problem.

    6.  B   A TDR can accurately measure segment length. A multimeter cannot.?

    7.  D   Try moving the affected media first before moving on to more complicated solutions.

    8.  D   An Optical Time Domain Reflectometer (OTDR) tests fiber-optic cabling.

    9.  A   Test your theory by replacing the NIC. If it works, verify full system functionality and document your findings.

    10. B   An environmental monitor can track humidity; a temperature monitor does not.

Network Utilities and Optimization

  ITINERARY  

      Objective 12.01   TCP/IP Utilities

      Objective 12.02   Troubleshooting Network Performance

      Objective 12.03   Monitoring Networks

You’ve seen the numerous problems that can crop up in network hardware and learned how to combat them. But how do you fix problems you can’t see? In most cases, you’ll have to do some extra digging to track down logical network problems. Many software tools can help you diagnose and repair network errors. You can also use many of these tools to increase and optimize a network’s performance. A third category of tools helps you monitor a network’s performance. This chapter provides an in-depth discussion of all of these tools.

TCP/IP Utilities

TCP/IP offers powerful troubleshooting utilities that all network techs should know. The CompTIA Network+ certification exam tests your knowledge of when to use each of the utilities discussed in this section, so be sure that you are familiar with these commands!

Travel Advisory

Case matters   With command-line commands such as the ones you’re about to study, make note of the case for each command. With few exceptions, learn all commands in lowercase. Windows doesn’t care that much, but every other operating system cares a lot, and running a command with the improper case will result in a failed command.

ipconfig and ifconfig

When troubleshooting a system connected to the network, the first thing you will most likely want to find out is whether the system has an IP address. The following commands can be used to determine the IP settings on the system.

ipconfig

The ipconfig command is used in Windows to display the IP address information of the system. The following is a list of popular ipconfig commands:

    • ipconfig   Displays the IP address, subnet mask, and default gateway

    • ipconfig /all   Displays all TCP/IP settings and the MAC address

    • ipconfig /displaydns   Displays the DNS resolver cache

    • ipconfig /flushdns   Clears out the DNS resolver cache

    • ipconfig /registerdns   Renews client DNS registration information

ifconfig

The ifconfig command displays or sets settings on a network card on a UNIX/Linux/OS X system. The following is a list of popular ifconfig commands:

    • ifconfig   Displays the network card and IP settings

    • ifconfig eth0 up   Enables the first Ethernet card

    • ifconfig eth0 down   Disables the Ethernet card

The ping utility (all operating systems) tests connections between two nodes. To test the connection between two nodes, sit at one of the systems and type in ping followed by the hostname or IP address of the other node. Ping uses the Internet Control Message Protocol (ICMP) to send an ICMP Echo Request to determine whether the other machine can receive the test packet and reply to it. A node that can be reached will respond, and the ping command will report success. Ping can also test for the availability of Internet-based services using fully qualified domain names (FQDNs), but note that some sites block ICMP Echo Requests to dissuade their sites from being used for testing—and some corporate Internet security systems also block ICMP Echo Requests to external sites. The output of the ping command looks like this:

You should read the messages ping reports back when it cannot reach another machine. They can contain important clues about the source of the problem.

If ping cannot turn a name into an IP address, for example, it will report back, “Unknown host” or some similar message. (The exact message returned by the ping command varies depending on the operating system.) If ping resolves an IP address but cannot reach the specified address, ping will display a different message, such as “Destination host unreachable.” Keep the following points in mind when you receive such a message:

    • Unknown host   This message means, “I don’t know the IP address!” You probably specified an invalid/unused DNS name.

    • Destination host unreachable   This message means, “I can’t get to that IP address.” In this case, you should check for possible routing problems—for example, have you specified a default gateway?

If a seemingly valid host is specified but that host doesn’t appear to be responding, you will see a sequence similar to the following:

tracert

The tracert (or traceroute on UNIX/Linux/OS X systems) command traces the route between two hosts. The tracert command will send back a response with each router it hits. This enables you to determine if communication is slow because a link has gone down between your computer and the destination. If you know that three routers are normally between you and the destination, and the tracert returns six responses, you know that your packets are taking an indirect pathway (due to a link being down). The following listing shows a trace to the Total Seminars’ web server from a machine in the UK (the –d switch tells tracert to display IP addresses without the corresponding domain names):

Exam Tip

The ping and traceroute commands are excellent examples of connectivity software, utilities that enable you to determine if a connection can be made between two computers.

arp

The arp utility (Windows) helps diagnose problems associated with the Address Resolution Protocol (ARP). TCP/IP hosts use arp to determine the physical (MAC) address that corresponds with a specific logical (IP) address. The arp utility, when used with the –a option, displays any IP addresses that have been resolved to MAC addresses recently. Here’s an example:

netstat

The netstat command (all operating systems) enables a network tech to examine network statistics about a system. These statistics include information such as the ports listening on the system and any connections that have been established. The following is some output from the netstat command:

The netstat command can provide a wide range of information depending on the command-line switches used. Type netstat /? at a command prompt to list the optional command-line switches:

nbtstat

For backward compatibility with some truly ancient local area networking (LAN) applications, Microsoft implements the NetBIOS over TCP (NBT) protocol in Windows. This manifests in a couple of ways. First, every Windows PC has a distinct NetBIOS name. My computer’s name, for example, is Mike7. Second, you can use a specific utility to interact with other Windows computers on a LAN.

The nbtstat (NetBIOS over TCP/IP statistics) command enables a network tech to check information about the NetBIOS names. This includes viewing the names that have been registered by the local system (nbtstat –n), viewing the names registered by a remote system (nbtstat –A), and viewing the NetBIOS name cache (nbtstat –c), which shows the NetBIOS names and corresponding IP addresses that have been resolved by a particular host. Here’s some sample output:

When properly used, nbtstat helps network techs diagnose and troubleshoot NetBIOS problems, especially those related to NetBIOS name resolution.

Like netstat, nbtstat can provide a wealth of information using different switches. Here are some of the popular switches:

Exam Tip

Note that nbtstat enables you to purge and reload the NetBIOS name cache with the command nbtstat –R. Remember that, unlike most Windows command-line utilities, nbtstat is case-sensitive when it comes to its switches. Therefore, nbtstat –R and nbtstat –r are not the same command.

nslookup

The nslookup command provides a command-line utility for diagnosing DNS problems. All operating systems support this tool. Its most basic function returns the IP address, as shown here:

The nslookup command also offers an interactive mode that enables you to specify a wide range of options as you diagnose and troubleshoot DNS issues. To see the full range of options, type ? at the nslookup prompt in Windows:

In UNIX/Linux/OS X you get the detailed nslookup options by typing man nslookup from the terminal prompt.

Using command-line utilities such as ping, tracert, arp, netstat, nbtstat, and nslookup, an experienced network tech can diagnose most TCP/IP problems quickly and begin working on solutions. If two hosts can ping each other by IP address but not by name, for example, the wise network tech knows to leave the routers alone and concentrate on name resolution issues instead.

To function effectively as a network tech, you need to learn TCP/IP. Supported by all operating systems, the TCP/IP suite provides excellent tools for integrating multiple operating systems within the same network. Its importance will continue to grow as the Internet continues to increase its importance in both business and everyday life.

arping

The arping utility is a popular UNIX/Linux/OS X command that combines the ping and arp commands together. When you use arping and specify the IP address to ping, it will return replies (like ping) if the system is up, but it will return the MAC address to you in the reply. Here is sample arping output:

dig

In addition to nslookup, UNIX/Linux/OS X systems offer another DNS diagnostic utility called dig. The dig command has a number of useful switches, and the most popular uses of dig are listed here:

The dig example shows the output of this command:

This command says, “Show me all the MX records for the totalsem.com domain.”

Here’s the output for that dig command:

mtr

The mtr command (UNIX/Linux/OS X) is a network diagnostics utility that combines the features of tracert and ping together. When you use mtr, it will send ping messages to each router along the route and report back to you diagnostics information, such as how long it took, how many packets were sent and received, and the percent of lost packets. Here’s a sample of mtr output:

route

The route command is a Windows command used to manage the local routing table of a system. For example, to view the Windows routing table, you can use the route print command, and to add a route to your Windows routing table, you can use the route add command. Here’s a sample of route print output:

Troubleshooting Network Performance

A number of logical network issues can arise when you’re troubleshooting the network. Logical issues range from configuring a system with the wrong IP address or subnet masks to placing the system in the wrong VLAN. Here are some examples:

    • Port speed and duplex mismatch   If a system can’t connect to the network, double-check that the speed and duplex settings of the card are set correctly.

    • Incorrect VLAN   Miscommunication can occur if you place a system on the wrong VLAN. Remember that a system on one VLAN cannot normally talk to a system on another VLAN unless you are routing between VLANs.

    • Incorrect or duplicate IP address   You may have mistyped the IP address of a system and thus the address you’re trying to use won’t work. A duplicated IP address won’t let the duplicate node communicate, but always tells you that it’s a duplicate address.

    • Wrong gateway   If you have trouble communicating off the network, it’s typically a routing issue. Check the default gateway settings on all the systems to verify that they are pointing to the IP address of the router interface on your network.

    • Wrong DNS   If you can communicate by the IP address but not by the DNS name of a system, you most likely have a name resolution problem. Check the IP address you have configured on the system as the DNS server entry.

    • Wrong subnet mask   If you have the wrong subnet mask typed into the TCP/IP properties, this will cause miscommunication. When you check the IP address of a system, also verify that you are using the correct subnet mask.

    • Bad/missing routes   Even with dynamic routing protocols enabling routers to update routes without human intervention, human intervention happens at some stage of the process. An erroneous forwarding entry statically entered, for example, might become invalid later on. If the routers can’t synchronize, they might report a missing route.

Protocol Analyzers

Things are getting a bit heavy when you reach for a protocol analyzer, because this means that you’re checking out your network at a very fundamental level by analyzing individual data packets on the network. Software-based protocol or network analyzers (also called packet sniffers) include applications such as the Network Monitor (NetMon) provided with Windows Servers.

Exam Tip

The CompTIA Network+ exam calls both protocol and network analyzing tools network sniffers.

Use these tools when unexplained slowdowns occur on your network to help you determine which machines are possibly sending rogue or malformed packets. A protocol analyzer enables you to determine whether a broadcast storm (or just too much broadcasting in general) is occurring or whether a faulty NIC is installed in a machine that is flooding the network with malformed packets.

Travel Assistance

Wireshark   The protocol analyzer tool that every tech uses is called Wireshark. It performs beautifully and can analyze packets thoroughly. You can find it here: www.wireshark.org.

Protocol analyzers can serve many purposes: In addition to identifying faulty hardware, they can help determine whether any faulty software is on the network that might be sending out dodgy data, and sometimes they can even help trace intermittent faults, such as cabling problems (though other, simpler diagnostic steps can usually be taken first, employing some of the troubleshooting methods and tools discussed earlier).

Throughput Testers

Throughput testers enable you to measure the data flow in a network. Which tool is appropriate depends on the type of network throughput you want to test. Most techs use one of several speed-testing websites for checking an Internet connection’s throughput, such as Speed Test at Speakeasy (Figure 12.1): www.speakeasy.net/speedtest.

FIGURE 12.1   Speed Test results from Speakeasy

Network Performance Optimization

A number of applications, such as VoIP or video-streaming applications, require a lot of bandwidth. And some applications, such as web servers and e-mail servers, can have performance optimized through caching features or through load balancing and high-availability solutions. The following features can be used to optimize performance of networking applications.

Caching

Caching is the process of storing data that someone asks for in the hope that someone else will ask for it again. Generally, odds are incredibly good that anytime anyone asks for anything on the Internet, either they or other folks on your LAN will ask for the same thing again—and that’s why caching works so well in so many different ways. Caching reduces network workload by eliminating the processes required to reacquire data. Caching reduces network traffic and server workloads.

You can also employ dedicated cache servers on your network. These network appliances—CompTIA calls them caching engines—can work at just about any level, such as LAN or WAN, and reduce overall network traffic dramatically. One example is EngageIP Cache Server. Cisco has also produced these appliances, though now the caching is part of boxes with more integrated functions.

More commonly today, you’ll find caching server functions as part of software services. Squid, for example, is a proxy and caching server that handles HTTP, DNS, FTP, and more. You can deploy Squid on multiple servers and use the Cache Array Routing Protocol (CARP) to load balance among them all, optimizing network performance (at least for HTTP).

Controlling Data Throughput

Former U.S. Senator Ted Stevens got a lot of teasing a few years ago by describing the Internet as “a series of tubes,” but there’s actually a strong argument for the idea of tubes when discussing the amount of data per second any given Internet connection may need. Unless your budget allows you to buy a “big tube” connection to the Internet, every network suffers from a limited amount of bandwidth that’s rarely truly sufficient for everything your users need. Even if you’re lucky enough to have good bandwidth today, ongoing network growth guarantees you’ll eventually run into network slowdowns as demand grows.

There’s no magic point at which a network goes from working well to working slowly. Most people are used to having to wait a bit for a webpage or a file transfer. Certain applications, called latency-sensitive applications, do not perform well when they lack adequate bandwidth. Some latency-sensitive applications require high bandwidth. Streaming video is a great example. Have you ever watched a video on YouTube that constantly stops and starts? At least YouTube enables you to pause the video so it can load more before you continue watching (Figure 12.2).

FIGURE 12.2   Pausing a video on YouTube

Try watching a video on Hulu.com (Figure 12.3) over an overly busy or slow connection. Hulu, unlike YouTube but like most other video sites, only caches a few seconds (to prevent people from stealing the video) and is all but unwatchable if there are constant stops and starts. Voice over IP (VoIP) applications are another great example. If every conversation is clipped...and...chopped...the beauty of VoIP falls apart.

FIGURE 12.3   Hulu.com (I love this site!)

Latency sensitivity takes on a whole new level of importance when you get into unified communications (UC), where you roll all kinds of these services into one box: VoIP, instant messaging (IM), telephone service, video conferencing, and more. If you can’t control the bandwidth, your network won’t function properly.

When the size of your Internet pipe is limited, you need some method to throttle bandwidth so that in high-demand times, latency-sensitive applications get more bandwidth at the cost of reducing bandwidth to those applications that don’t mind the wait. The CompTIA Network+ exam mentions two of the most common: Quality of Service (QoS) and traffic shaping, but I’ll tell you about a few other solutions, as well.

Quality of Service   Quality of Service (QoS) is a procedure used almost exclusively on gateway devices to give certain applications priority when a connection reaches a certain amount of utilization. QoS works at layer 2 and layer 3 of the OSI model and works with 802.1Q trunks to prioritize traffic. QoS applies a Class of Service (CoS) priority (0 to 7) to a certain port. As traffic from that port goes through a trunk line, its priority defines how much bandwidth is allocated. The higher the priority of traffic, the more bandwidth it gets. This form of QoS is specialized when you have a high-priority file server or VoIP server systems connected to your network.

Exam Tip

QoS can also reduce jitter on VoIP connections.

Traffic Shaping   Traffic shaping (also called bandwidth shaping) prioritizes traffic in various ways, such as by analyzing TCP/UDP port numbers or by examining the Application-layer information in packets. Traffic shaping works in one of two ways: by giving certain packets a priority or by directly assigning a fixed amount of bandwidth (in bits/sec) to packets from a particular application based on port number.

Local Lingo

When ISPs limit traffic based on applications to customers, it is called bandwidth throttling.

A typical setup of traffic shaping first requires you to tell the router the total upstream and downstream bandwidth of your connection. From there, you assign bandwidth to a particular application, as shown in Figure 12.4.

FIGURE 12.4   Traffic shaping on a SOHO router

QoS and traffic shaping give you a number of tools to control traffic. You can control or prioritize traffic based on port/MAC address (QoS), IP address, or application. The choice depends on the equipment you choose and the needs of your networks.

Load Balancing   Load balancing is used most by web servers. The administrator loads the website on multiple web servers and then uses load-balancing software to split the requests sent to that website between two (or more) systems.

DNS is an easy way to load-balance, but it still relies on multiple DNS servers, each with its own IP address. As web clients access one DNS server or another, they cache that DNS server’s IP address. The next time they access the server, they go directly to the cached DNS server and skip the round robin, reducing its effectiveness.

To hide all of your web servers behind a single IP, you have two popular choices. First is to use a special multilayer switch that works at layers 3 and 4. This switch is really just a router that performs NAT and port forwarding, but also has the capability to query the hidden web servers continually and send HTTP requests to a server that has a lighter workload than the other servers.

The second option is to use a content switch. Content switches always work at layer 7 (Application layer). Content switches designed to work with web servers, therefore, are able to read the incoming HTTP and HTTPS requests. With this, you can perform very advanced actions, such as handling SSL certificates and cookies on the content switch, removing the workload from the web servers. Not only can these devices load-balance in the ways previously described, but their HTTP savvy can actually pass a cookie to HTTP requesters—web browsers—so the next time that client returns, it is sent to the same server (Figure 12.5).

FIGURE 12.5   Layer-7 content switch

Exam Tip

The CompTIA Network+ exam refers to a content switch as a content filter network appliance.

High Availability   High availability is a popular solution for e-mail and database servers. High availability means a spare server is ready to kick in when the primary server fails. This process is automatic and handled by the high-availability software, such as Windows Clustering and server farms.

Fault Tolerance   Fault tolerance ensures that the data is duplicated across multiple drives so that the data can still be retrieved if a drive fails. Most servers implement fault-tolerant solutions such as mirrored volumes or RAID 5 volumes.

ISPs and MTUs

I discussed the maximum transmission unit (MTU) in Chapter 6. Back in the dark ages (before Windows Vista), Microsoft users often found themselves with terrible connection problems due to the fact that IP packets were too big to fit into certain network protocols. The largest Ethernet packet is 1500 bytes, so some earlier versions of Windows set their MTU size to a value less than 1500 to minimize the fragmentation of packets. The problem cropped up when you tried to connect to a technology other than Ethernet, such as DSL. Some DSL carriers couldn’t handle an MTU size greater than 1400. When your network’s packets are so large that they must be fragmented to fit into your Internet service provider’s packets, we call it an MTU mismatch.

As a result, techs would tweak their MTU settings to improve throughput by matching up the MTU sizes between the ISP and their own network. This usually required a manual registry setting adjustment, although some older versions of Windows used third-party programs like Dr. TCP (Figure 12.6). This process is called “matching up” mismatched MTU settings.

FIGURE 12.6   Adjusting the MTU settings in Dr. TCP

Travel Advisory

Dr. TCP is an old program and does not work on Windows Vista or 7. Don’t use it anymore; you don’t have to, either, because of Path MTU Discovery.

Around 2007, Path MTU Discovery (PMTU), a new method to determine the best MTU setting automatically, was created. PMTU works by adding a new feature called the “Don’t Fragment (DF) flag” to the IP packet. A PMTU-aware operating system can automatically send a series of fixed-size ICMP packets (basically just pings) with the DF flag set to another device to see if it works. If it doesn’t work, the system lowers the MTU size and tries again until the ping is successful.

You can imitate this feature by running a ping yourself. Open a command prompt and run the following command:

You should get results similar to the following:

Try running the ping command again, this time setting the MTU size smaller:

Imagine the hassle of incrementing the MTU size manually. That’s the beauty of PMTU—you can automatically set your MTU size to the perfect amount.

Unfortunately, PMTU runs under ICMP; most routers have firewall features that, by default, are configured to block ICMP requests, making PMTU worthless. This is called a PMTU or MTU black hole. If you’re having terrible connection problems and you’ve checked everything else, you need to consider this issue. In many cases, going into the router and turning off ICMP blocking in the firewall is all you need to do to fix the problem.

Exam Tip

The CompTIA Network+ objectives use the term MUT/MTU black holes. There’s no such thing as “MUT” so, hopefully, CompTIA will have fixed this by the time you’re reading this book.

Monitoring Networks

Networking technicians need to know how to use the tools that are available to monitor network performance and connectivity. A network administrator sets up the tools you use, but a tech needs to know how to use those tools to create baselines, monitoring utilities, and logs of various sorts.

Establishing a Baseline

The best way to know when a problem is brewing is to know how things perform when all’s well with the system. Part of any proper configuration management documentation is a baseline: a log of performance indicators such as CPU usage, network utilization, and other values to give you a picture of your network and servers when they are working correctly. A major change in these values can point to problems on a server or the network as a whole.

All operating systems come with some form of baseline tools. A common tool used to create a baseline on Windows systems is the Performance Monitor utility that comes with all versions of Windows.

Performance Monitor

Administrators use Performance Monitor (also called PerfMon) to view the behavior of hardware and other resources on Windows machines, either locally or remotely. Performance Monitor can both monitor real-time performance and display historical data about the performance of your systems. Figure 12.7 shows the default Performance Monitor in Windows 7.

FIGURE 12.7   The real-time monitoring tool in Performance Monitor in Windows 7

Exam Tip

The CompTIA Network+ exam is not going to test you on using Performance Monitor or any other baselining tool. Just make sure you understand what a baseline does for you.

Windows 2000/XP calls the real-time monitoring section of Performance Monitor the System Monitor. Windows Vista/7 calls it Performance Monitor. Regardless of the name, this is the tool that enables you to view network performance.

Unfortunately, you can’t just turn on Performance Monitor and instantly collect data. You’ll need to choose what device or connection to monitor, how to monitor it, and how to display the data. If you want to record data for later use, you can configure Performance Monitor to log the data, too.

Network Monitor

The Network Monitor (another Microsoft tool) enables you to monitor network traffic.

Network Monitor is an example of a packet analyzer (see Figure 12.8), also known as a packet sniffer or LAN analyzer, that helps diagnose problems with communication over the network.

FIGURE 12.8   Looking at Network Monitor

Exam Tip

A packet analyzer, also known as a packet sniffer, is used to monitor network traffic and view the packets that pass through the network. Microsoft’s Network Monitor and a free program called Wireshark (www.wireshark.org) are examples of packet sniffers.

For example, let’s say that you are responsible for installing a new sales application on each computer found in the sales department. This application, after installed, will connect to a special application server in the back room running the server part of the sales application. You install the server and client parts without a hitch! You start up the client application on Sean’s computer, but it is having trouble connecting to the server portion of the application.

You know nothing about this application, and you have followed the installation instructions—what can you do? One of the first things you can do is run Network Monitor and see what port on the server the client is trying to connect to—maybe the server port is configured incorrectly. This is the type of thing that Network Monitor is good at doing—monitoring traffic and displaying the contents of a discussion between two systems.

You can install Network Monitor on a Windows server through Add/Remove Programs. When in Add/Remove Programs, go to Add/Remove Windows Components and select Management and Monitoring Tools; then click the Details button. In the Details screen, select Network Monitor Tools.

Travel Advisory

The version of Network Monitor that comes with the Server versions of Windows enables you to capture data being sent only through the network card of the system doing the monitoring. For a free full-blown packet analyzer, check out Wireshark, which is similar to Network Monitor but can be installed on Windows clients, servers, and Linux systems.

Once you have the program installed, start it from the Administrative Tools menu. After the program has loaded, click the Start Capture button on the toolbar to start recording network traffic. While recording, generate the type of traffic that you want to analyze, and then stop recording by clicking the Stop and View Capture button. Now you can start analyzing your network traffic!

Exam Tip

Be aware that Network Monitor and Wireshark are also examples of network traffic analyzers.

Checking System Logs

Most network operating systems and modern client systems maintain their own log files, and it is important that you check these logs on a regular basis—once a day is a good idea, especially for servers. Checking the logs achieves two things:

It can tell you why a certain problem has occurred, and it can alert you to a problem that may get worse if not treated—for example, a log file can alert you to “timeout errors” from a hard disk that’s having problems reading or writing data—before it dies!

Especially with a fault-tolerant server, examining the system logs regularly is vital because some component failures will be logged, but because the system has redundant items, the server may still run as if nothing bad has happened. It’s both good and bad to discover that one of your mirrored drives actually failed several weeks ago without anyone noticing—good that the system kept running, but bad that no one realized that a disk replacement was needed to maintain full fault tolerance.

Logs and Network Traffic

Every operating system, and many applications, generate log files automatically that record events, actions, errors, and more. You can also use programs to generate custom logs. A skilled network administrator or technician can use various tools on log files to, among other things, analyze network traffic to determine problem areas.

Exam Tip

Most UNIX/Linux distributions and many Windows applications use syslog as the basic building block for logging messages and doing custom logs. Eric Allman developed Syslog in the 1980s as a logging program for e-mail, but it has grown into a general logging tool today.

Logs fall into several categories, such as general, system, and history. You see general logs in tools like Windows Event Viewer. These record updates to applications, for example, and aren’t terribly interesting from a networking standpoint. Linux systems tend to have lots of logs, but most versions have a directory called /var/log where all of your logs (usually) reside. Mac OS X has roughly the same logs as Linux.

System logs display events such as login attempts, reboots needed for changes to OS files, and similar things (Figure 12.9). System logs (and security logs in Windows) can be important for finding security problems, but like general logs, they don’t do much for network optimization.

FIGURE 12.9   Event Viewer in Windows 7

History logs track the history of how a user or users access network resources, or how network resources are accessed throughout the network. Generically, you can use traffic analysis tools to chart HTTP use, for example, or discover when your network gets a spike in BitTorrent traffic.

SNMP

Most of this “logging” happens in a relationship between a router and a management server. Simple Network Management Protocol (SNMP) is a very popular method for querying the state of SNMP-capable devices. SNMP can tell you a number of settings like CPU usage, network utilization, and detailed firewall hits. SNMP uses agents (special client programs) to collect network information from a Management Information Base (MIB), SNMP’s version of a server. To use SNMP, you need SNMP-capable devices and some tool to query them. One tool is Cacti (www.cacti.net), shown in Figure 12.10. Cacti, like most good SNMP tools, enables you to query an SNMP-capable device for hundreds of different types of information.

FIGURE 12.10   Cacti at work

SNMP is a useful tool for network administrators, but the first version, SNMPv1, sent all data, including the passwords, unencrypted over the network. SNMPv2 had good encryption but was rather challenging to use. SNMPv3 is the standard version used today and combines solid, fairly easy-to-use authentication and encryption.

 Objective 12.01: TCP/IP Utilities   The simplest, and often the most effective, software tools are the ones that come with your operating system. You can do a lot with ping, tracert, and the rest to diagnose network problems. Many common faults are protocol related; if you don’t have the right protocols installed, or if they are misconfigured, you are not going to see all systems (or maybe anything) on your network.

 Objective 12.02: Troubleshooting Network Performance   When your network feels a little under the weather, it’s time for a tune-up. Protocol analyzers let you look inside packets to learn more about your network difficulties. You can optimize your network with features like caching, QoS, traffic shaping, load balancing, high availability, and fault tolerance.

 Objective 12.03: Monitoring Networks   Don’t forget that a server can tell you a lot about what’s going on (or going wrong) if you take a look at its logs. The logs can also be used to preempt some problems and stop them from becoming reality. As well as being troubleshooting tools, the logs help you manage the health of your server before something nasty happens, so checking them should be a standard operating procedure.

REVIEW QUESTIONS

    1.  Which of the following commands will display the TCP/IP configuration of a system running UNIX/Linux/OS X?

          A.  ipconfig

          B.  ping 127.0.0.1

          C.  ifconfig

          D.  ipstat

    2.  Which of the following can be used to optimize performance of networking applications? (Select three.)

          A.  QoS

          B.  Switching loops

          C.  Traffic shaping

          D.  Load balancing

    3.  Which of the following programs can be used to view the error logs on a Windows server?

          A.  Event Viewer

          B.  PerfMon

          C.  applog

          D.  monitor.nlm

    4.  You notice that your system is running slowly, and you suspect that someone has planted a program on your system and is using that program to get unauthorized access. What command and switch could you use to troubleshoot this?

          A.  ipconfig /all

          B.  netstat –r

          C.  nbtstat –A

          D.  netstat –a

    5.  You are looking at your web server log files and you notice that a machine on your network with the IP address 192.168.3.2 has been sending a number of invalid requests to the web server. You would like to track down whose computer this is on your network. What command would you use?

          A.  ping 192.168.3.2

          B.  netstat –r

          C.  nbtstat –A 192.168.3.2

          D.  netstat –a 192.168.3.2

    6.  Which command shows you detailed IP information, including DNS server addresses and MAC addresses?

          A.  ipconfig

          B.  ipconfig -a

          C.  ipconfig /all

          D.  ipconfig /dns

    7.  Which tool uses ICMP packets to test connectivity between two systems?

          A.  ARP

          B.  arping

          C.  netstat

          D.  ping

    8.  If you want to see which other computers on your network are currently connected to you, what command should you use?

          A.  ping

          B.  nbtstat

          C.  netstat

          D.  tracert

    9.  Which Windows command displays the local system’s routing table?

          A.  route print

          B.  print route

          C.  tracert /print

          D.  tracert /p

    10.  Which tools should you use to diagnose problems with DNS?

          A.  Nmap or Wireshark

          B.  nslookup or dig

          C.  ping or arping

          D.  tracert or arping

REVIEW ANSWERS

    1.  C  Run the ifconfig command to display TCP/IP configuration information on a UNIX/Linux system.

    2.  A, C, D   Switching loops are not used to optimize performance of networking applications and will typically bring the network down. All other choices are used to optimize performance of networking applications.

    3.  A  Event Viewer is used to view the logs on any Windows server–based operating system.

    4.  A  Using netstat –a, you can view the TCP and UDP connections and listening ports on your system.

    5.  C  The nbtstat command with the –A switch is used to view the remote name table on a computer when you supply the command with an IP address.

    6.  C  Running ipconfig /all displays detailed IP configuration information.

    7.  D  Only ping uses ICMP packets.

    8.  C  The netstat command shows your current sessions.

    9.  A  The route print command enables you to view and edit your local routing table.

    10.  B  The nslookup tool and the more powerful dig tool are used to diagnose DNS problems.

Career Flight Path

CompTIA Network+ certification generally serves as the follow-up to the immensely popular CompTIA A+ certification and is an important cornerstone for any number of career flight paths. Many IT companies see CompTIA Network+ certification as the foundation for networking expertise. After CompTIA Network+, you have a number of certification options, depending on the types or specific brands of network hardware you choose to support. Look at these four in particular:

    • CompTIA Server+ Certification

    • CompTIA Security+ Certification

    • Microsoft Certified Technology Specialist Certifications

    • Cisco Certifications

CompTIA Server+ Certification

CompTIA Server+ certification offers a more in-depth testing of your knowledge of PC and server-specific hardware and operating systems. If you plan to follow the path of the high-end hardware tech, CompTIA Server+ is a good next step—plus CompTIA Server+ is a natural lead-in to Cisco certifications. (See “Cisco Certifications.”)

CompTIA Security+ Certification

CompTIA Security+ is a great starting point to learn about network security. CompTIA Security+ certification covers a wide range of security topics and technologies and is a great next step after you obtain your CompTIA Network+ certification. The CompTIA Security+ certification is also a great starting point to move on to other security certifications, such as the CISSP or the Security Certified Professional (SCP) certification.

Microsoft Certified Technology Specialist (MCTS) Certifications

Microsoft operating systems and server products control a huge portion of all installed networks, and those networks need qualified support people to make them run. Microsoft offers a series of certifications for networking professionals that naturally follow the CompTIA certifications. You can take a whole slew of certification tracks and exams, but I would suggest following Microsoft’s recommended IT Pro track for networking professionals:

    1.  MTA Networking Fundamentals

    2.  MTA Security Fundamentals

    3.  MTA Windows Server Admin Fundamentals

    4.  MCTS Windows Server 2008, Network Infrastructure

    5.  MCTS Windows Server 2008, Active Directory

Once you’ve completed this MCTS track, you can continue on the Microsoft certification path and earn the more advanced Microsoft Certified IT Professional (MCITP) certification by passing the related exams in your product path. Check out Microsoft’s Learning and Certification website for details on the different Microsoft certifications: www.microsoft.com/learning/certification

Cisco Certifications

Let’s face it: Cisco routers pretty much run the Internet, not to mention most of the world’s intranets. Cisco provides four levels of certification for folks who want to show their skills at handling Cisco products. Nearly everyone interested in Cisco certification starts with the Cisco Certified Entry Networking Technician (CCENT) exam. The CCENT exam is a darn easy way to slap the word Cisco on your resume! After the CCENT, you should decide on your desired specialty (Cisco offers tracks in a range of networking specialties, from routing and switching to storage networking) and follow that track. See the Cisco certification website at www.cisco.com/web/learning/index.html.

About the Download

This e-book comes with free downloads, including a sample of the Total Tester practice exam software; an introduction video from the author, Mike Meyers; and a collection of Mike’s current favorite tools and utilities for network management. The Total Tester software can be installed on any Windows 98/ NT/2000/XP/Vista/7 computer and must be installed to access the Total Tester practice exams. The download also includes a demonstration version of the Boson NetSim Network Simulator with a free lab. See the Boson NetSim Network Simulator section below for the system requirements for the Boson NetSim.

To download the Total Tester, simply click the link below and follow the directions for free online registration.

http://www.totalsem.com/0071789065.php

To access the other available downloads, visit McGraw-Hill Professional’s Media Center by clicking the link below and entering this e-book’s ISBN and your e-mail address. You will then receive an e-mail message with a download link to the additional content.

http://mhprofessional.com/mediacenter/

This e-book’s ISBN is 978-0-07-178906-6.

System Requirements

The Total Tester software requires Windows 98 or higher, Internet Explorer 5.5 or higher, or Firefox with Flash Player, and 30 MB of hard disk space for full installation.

Installing and Running Total Tester

Once you’ve downloaded the Total Tester software, double-click the Launch.exe icon.

From the splash screen, you can install Total Tester by clicking the Install Practice Exams button. This will begin the installation process, create a program group named Total Seminars, and put an icon on your desktop. To run Total Tester, go to Start | Programs | Total Seminars or double-click the icon on your desktop.

To uninstall the Total Tester software, go to Start | Settings | Control Panel | Add/Remove Programs and select the Total Tester program you want to remove. Select Remove, and Windows will completely uninstall the software.

About Total Tester

The Total Tester practice exam software helps you test your knowledge as you study. Total Tester provides you with a simulation of the actual exam. Exams can be taken in either practice or final mode. Practice mode provides an assistance window with hints, references to the book, an explanation of the answers, and the ability to check your answers as you take the test. Both practice and final modes provide an overall grade and a grade broken down by certification objective. To launch a test, select Suites from the menu at the top, select an exam, and choose from the list of available practice exams.

Playing Mike’s Intro Video

Once you’ve received the e-mail message from McGraw-Hill Professional’s Media Center, click the link included to download a zip file containing the downloads for this e-book. Extract all of the files from the zip file and save them to your computer.

To view Mike Meyers’ introduction video, launch the Intro.wmv file. The file will play using your system’s default video player.

Mike’s Cool Tools

Mike loves freeware and open source networking tools! Most of the utilities mentioned in the text are available in the Mike’s Cool Tools folder as part of the download.

Please read the Cool Tools Descriptions.pdf file for a description of the utilities.

Caution

Although all of the tools are “Mike Meyers Approved,” there is no guarantee they will work for you. Read any and all documentation that comes with each utility before using that program.

Boson’s NetSim Network Simulator

This e-book’s download includes a free demonstration version of Boson’s NetSim network simulation software. Double-click the netsim8.exe file in the NSdemo_forNETplus folder to install the NetSim demo. You must register for a free online account with Boson by visiting www.boson.com before you can complete the activation process.

The Boson NetSim Network Simulator is an application that simulates Cisco Systems’ networking hardware and software and is designed to aid the user in learning the Cisco IOS command structure. The NetSim labs do not directly address the CompTIA Network+ objectives, but all the labs/features/functions/ components of NetSim enable you to view simulated networks in a practice environment. Try the demo lab for free.

NetSim uses Boson’s proprietary Network Simulator, Router Simulator, and EROUTER software technologies, along with the Boson Virtual Packet Technolog engine, to create individual packets. These packets are routed and switched through the simulated network, allowing NetSim to build an appropriate virtual routing table and simulate true networking. Other simulation products on the market do not support this level of functionality.

Boson offers a NetSim for CCENT, CCNA, and CCNP. Each supports the technologies and skills you will need for these respective certifications.

Boson NetSim provides more versatility and support than any other network simulation software on the market. NetSim software also includes a comprehensive lab menu that contains lessons and labs covering routing protocols, Cisco devices, switching, topological design, and much more.

NetSim is a Windows-based product and requires Windows XP, Windows Vista, or Windows 7 to run. System requirements and product activation instructions can be found on the Boson web site.

Technical Support

For questions regarding the Total Tester software, visit www.totalsem.com or e-mail support@totalsem.com, or e-mail customer.service@mcgraw-hill.com. For customers outside the United States, e-mail international_cs@mcgraw-hill.com.

Boson Technical Support

For technical support related to the Boson NetSim, please visit www.boson.com or e-mail supportissues@boson.com.

Glossary

6in4   One of the most popular of all the IPv6 tunneling standards, and one of only two IPv6 tunneling protocols that can go through a NAT.

6to4   The dominant IPv6 tunneling protocol because it is the only IPv6 tunnel that doesn’t require a tunnel broker. It is generally used to directly connect two routers because it normally requires a public IPv4 address.

10BaseFL   Fiber-optic implementation of Ethernet that runs at 10 megabits per second (Mbps) using baseband signaling. Maximum segment length is 2 km.

10BaseT   An Ethernet LAN designed to run on UTP cabling. Runs at 10 Mbps and uses baseband signaling. Maximum length for the cabling between the NIC and the hub (or the switch, the repeater, and so forth) is 100 m.

10GBaseER/10GBaseEW   A 10 GbE standard using 1550-nm single-mode fiber. Maximum cable length up to 40 km.

10GBaseLR/10GBaseLW   A 10 GbE standard using 1310-nm single-mode fiber. Maximum cable length up to 10 km.

10GBaseSR/10GBaseSW   A 10 GbE standard using 850-nm multimode fiber. Maximum cable length up to 300 m.

10GBaseT   A 10 GbE standard designed to run on CAT 6a UTP cabling. Maximum cable length of 100 m.

10 Gigabit Ethernet (10 GbE)   Currently (2012) the fastest Ethernet designation available, with a number of fiber-optic and copper standards.

100BaseFX   An Ethernet LAN designed to run on fiber-optic cabling. Runs at 100 Mbps and uses baseband signaling. Maximum cable length is 400 m for half-duplex and 2 km for full-duplex.

100BaseT   An Ethernet LAN designed to run on UTP cabling. Runs at 100 Mbps, uses baseband signaling, and uses two pairs of wires on CAT 5 or better cabling.

100BaseT4   An Ethernet LAN designed to run on UTP cabling. Runs at 100 Mbps and uses four-pair CAT 3 or better cabling. Made obsolete by 100BaseT.

100BaseTX   The technically accurate but little-used name for 100BaseT.

110-Punchdown Block   The most common connection used on the back of an RJ-45 jack and patch panels.

110-Punchdown Tool   See Punchdown Tool.

802 Committee   The IEEE committee responsible for all Ethernet standards.

802.1X   A port-authentication network access control mechanism for networks.

802.3 (Ethernet)   See Ethernet.

802.3ab   The IEEE standard for 1000BaseT.

802.3z   The umbrella IEEE standard for all versions of Gigabit Ethernet other than 1000BaseT.

802.11   See IEEE 802.11.

802.11a   A wireless standard that operates in the frequency range of 5 GHz and offers throughput of up to 54 Mbps.

802.11b   The first popular wireless standard, which operates in the frequency range of 2.4 GHz and offers throughput of up to 11 Mbps.

802.11g   Currently (2012) the wireless standard with the widest use, 802.11g operates on the 2.4-GHz band with a maximum throughput of 54 Mbps.

802.11i   A wireless standard that added security features.

802.11n   An updated 802.11 standard that increases transfer speeds and adds support for multiple in/multiple out (MIMO) by using multiple antennas. 802.11n can operate on either the 2.4- or 5-GHz frequency band and has a maximum throughput of 400 Mbps.

802.16   A wireless standard (also known as WiMax) with a range of up to 30 miles.

1000BaseCX   A Gigabit Ethernet standard using unique copper cabling, with a 25-m maximum cable distance.

1000BaseLX   A Gigabit Ethernet standard using single-mode fiber cabling, with a 220- to 500-m maximum cable distance.

1000BaseSX   A Gigabit Ethernet standard using multimode fiber cabling, with a 5-km maximum cable distance.

1000BaseT   A Gigabit Ethernet standard using CAT 5e/6 UTP cabling, with a 100-m maximum cable distance.

1000BaseX   An umbrella Gigabit Ethernet standard. Also known as 802.3z. Comprises all Gigabit standards with the exception of 1000BaseT, which is under the 802.3ab standard.

A Records   A list of the IP addresses and names of all the systems on a DNS server domain.

AAA (Authentication, Authorization, and Accounting)   See Authentication, Authorization, and Accounting (AAA).

Acceptable Use Policy   A document that defines what a person may and may not do on an organization’s computers and networks.

Access Control List (ACL)   A clearly defined list of permissions that specifies what actions an authenticated user may perform on a shared resource.

Active Directory   A form of directory service used in networks with Windows servers. Creates an organization of related computers that share one or more Windows domains.

Activity Light   An LED on a NIC, hub, or switch that blinks rapidly to show data transfers over the network.

Ad Hoc Mode   A wireless networking mode where each node is in direct contact with every other node in a decentralized free-for-all. Ad hoc mode is similar to the mesh topology.

Address Resolution Protocol (ARP)   A protocol in the TCP/IP suite used with the command-line utility of the same name to determine the MAC address that corresponds to a particular IP address.

ADSL (Asymmetric Digital Subscriber Line)   See Asymmetric Digital Subscriber Line (ADSL).

Advanced Encryption Standard (AES)   A block cipher created in the late 1990s that uses a 128-bit block size and a 128-, 192-, or 256-bit key size. Practically uncrackable.

Adware   A program that monitors the types of Web sites you frequent and uses that information to generate targeted advertisements, usually pop-up windows.

Aggregation   A router hierarchy in which every router underneath a higher router always uses a subnet of that router’s existing routes.

Algorithm   A set of rules for solving a problem in a given number of steps.

Anycast   A method of addressing groups of computers as though they were a single computer. Anycasting starts by giving a number of computers (or clusters of computers) the same IP address. Advanced routers then send incoming packets to the closest of the computers.

Apache HTTP Server   An open-source HTTP server program that runs on a wide variety of operating systems.

Application Layer   See Open System Interconnection (OSI) Seven-Layer Model.

Application Log   Tracks application events, such as when an application opens or closes. Different types of application logs record different events.

Archive Bit   An attribute of a file that shows whether the file has been backed up since the last change. Each time a file is opened, changed, or saved, the archive bit is turned on. Some types of backups turn off this archive bit to indicate that a good backup of the file exists on tape.

Area ID   Address assigned to routers in an OSPF network to prevent flooding beyond the routers in that particular network. See also Open Shortest Path First (OSPF).

arping   A command used to discover hosts on a network, similar to ping, but that relies on ARP rather than ICMP. The arping command won’t cross any routers, so it will only work within a broadcast domain. See also Address Resolution Protocol (ARP) and ping.

Asset Management   Managing each aspect of a network, from documentation to performance to hardware.

Asymmetric Digital Subscriber Line (ADSL)   A fully digital, dedicated connection to the telephone system that provides download speeds of up to 9 Mbps and upload speeds of up to 1 Mbps.

Asymmetric-Key Algorithm   An encryption method in which the key used to encrypt a message and the key used to decrypt it are different, or asymmetrical.

Asynchronous Transfer Mode (ATM)   A network technology that runs at speeds between 25 and 622 Mbps using fiber-optic cabling or CAT 5 or better UTP.

Attenuation   The degradation of signal over distance for a networking cable.

Authentication   A process that proves good data traffic truly came from where it says it originated by verifying the sending and receiving users and computers.

Authentication, Authorization, and Accounting (AAA)   A security philosophy wherein a computer trying to connect to a network must first present some form of credential in order to be authenticated and then must have limitable permissions within the network. The authenticating server should also record session information about the client.

Authentication Server (AS)   In Kerberos, a system that hands out Ticket-Granting Tickets to clients after comparing the client hash to its own. See also Ticket-Granting Ticket (TGT).

Authoritative DNS Servers   DNS servers that hold the IP addresses and names of systems for a particular domain or domains in special storage areas called forward lookup zones.

Authorization   A step in the AAA philosophy during which a client’s permissions are decided upon. See also Authentication, Authorization, and Accounting (AAA).

Automatic Private IP Addressing (APIPA)   A networking feature in operating systems that enables DHCP clients to self-configure an IP address and subnet mask automatically when a DHCP server isn’t available.

Autonomous System (AS)   One or more networks that are governed by a single protocol within that AS, which provides routing for the Internet backbone.

Back Up   To save important data in a secondary location as a safety precaution against the loss of the primary data.

Backup Designated Router (BDR)   A second router set to take over if the designated router fails. See also Designated Router (DR).

Backup Generator   An onsite generator that provides electricity if the power utility fails.

Bandwidth   A piece of the spectrum occupied by some form of signal, whether it is television, voice, fax data, and so forth. Signals require a certain size and location of bandwidth to be transmitted. The higher the bandwidth, the faster the signal transmission, thus allowing for a more complex signal such as audio or video. Because bandwidth is a limited space, when one user is occupying it, others must wait their turn. Bandwidth is also the capacity of a network to transmit a given amount of data during a given period.

Baseband   Digital signaling that has only one signal (a single signal) on the cable at a time. The signals must be in one of three states: one, zero, or idle.

Baseline   Static image of a system’s (or network’s) performance when all elements are known to be working properly.

Basic NAT   A simple form of NAT that translates a computer’s private or internal IP address to a global IP address on a one-to-one basis.

Basic Rate Interface (BRI)   The basic ISDN configuration, which consists of two B channels (which can carry voice or data at a rate of 64 Kbps) and one D channel (which carries setup and configuration information, as well as data, at 16 Kbps).

Basic Service Set (BSS)   In wireless networking, a single access point servicing a given area.

Basic Service Set Identifier (BSSID)   Naming scheme in wireless networks.

Baud   One analog cycle on a telephone line.

Baud Rate   The number of bauds per second. In the early days of telephone data transmission, the baud rate was often analogous to bits per second. Due to advanced modulation of baud cycles as well as data compression, this is no longer true.

Bearer Channel (B Channel)   A type of ISDN channel that carries data and voice information using standard DS0 channels at 64 Kbps.

Biometric Devices   Devices that scan fingerprints, retinas, or even the sound of the user’s voice to provide a foolproof replacement for both passwords and smart devices.

Bit Error Rate Test (BERT)   An end-to-end test that verifies a T-carrier connection.

Block Cipher   An encryption algorithm in which data is encrypted in “chunks” of a certain length at a time. Popular in wired networks.

BNC Connector   A connector used for 10Base2 coaxial cable. All BNC connectors have to be locked into place by turning the locking ring 90 degrees.

Bonding   Two or more NICs in a system working together to act as a single NIC to increase performance.

Bootstrap Protocol (BOOTP)   A component of TCP/IP that allows computers to discover and receive an IP address from a DHCP server prior to booting the OS. Other items that may be discovered during the BOOTP process are the IP address of the default gateway for the subnet and the IP addresses of any name servers.

Border Gateway Protocol (BGP-4)   An exterior gateway routing protocol that enables groups of routers to share routing information so that efficient, loop-free routes can be established.

Botnet   A group of computers under the control of one operator, used for malicious purposes.

Bps (Bits Per Second)   A measurement of how fast data is moved across a transmission medium. A Gigabit Ethernet connection moves 1,000,000,000 bps.

Bridge   A device that connects two networks and passes traffic between them based only on the node address, so that traffic between nodes on one network does not appear on the other network. For example, an Ethernet bridge only looks at the MAC address. Bridges filter and forward frames based on MAC addresses and operate at Layer 2 (Data Link layer) of the OSI seven-layer model.

Bridge Loop   A negative situation in which bridging devices (usually switches) are installed in a loop configuration, causing frames to loop continuously. Switches using Spanning Tree Protocol (STP) prevent bridge loops by automatically turning off looping ports.

Bridged Connection   An early type of DSL connection that made the DSL line function the same as if you snapped an Ethernet cable into your NIC.

Broadband   Analog signaling that sends multiple signals over the cable at the same time. The best example of broadband signaling is cable television. The zero, one, and idle states exist on multiple channels on the same cable. See also Baseband.

Broadcast   A frame or packet addressed to all machines, almost always limited to a broadcast domain.

Broadcast Address   The address a NIC attaches to a frame when it wants every other NIC on the network to read it. In TCP/IP, the general broadcast address is 255.255.255.255. In Ethernet, the broadcast MAC address is FF-FF-FF-FF-FF-FF.

Broadcast Domain   A network of computers that will hear each other’s broadcasts. The older term collision domain is the same, but it’s rarely used today.

Broadcast Storm   The result of one or more devices sending a nonstop flurry of broadcast frames on the network.

Browser   A software program specifically designed to retrieve, interpret, and display Web pages.

Building Entrance   Location where all the cables from the outside world (telephone lines, cables from other buildings, and so on) come into a building.

Bus Topology   A network topology that uses a single bus cable that connects all of the computers in line. Bus topology networks must be terminated to prevent signal reflection.

Butt Set   Device that can tap into a 66- or 110-punchdown block to see if a particular line is working.

Byte   Eight contiguous bits, the fundamental data unit of personal computers. Storing the equivalent of one character, the byte is also the basic unit of measurement for computer storage. Bytes are counted in powers of two.

CAB Files   Short for “cabinet files.” These files are compressed and most commonly used during Microsoft operating system installation to store many smaller files, such as device drivers.

Cable Certifier   A very powerful cable testing device used by professional installers to test the electrical characteristics of a cable and then generate a certification report, proving that cable runs pass TIA/EIA standards.

Cable Drop   Location where the cable comes out of the wall at the workstation location.

Cable Modem   A bridge device that interconnects the cable company’s DOCSIS service to the user’s Ethernet network. In most locations, the cable modem is the demarc.

Cable Stripper   Device that enables the creation of UTP cables.

Cable Tester   A generic name for a device that tests cables. Some common tests are continuity, electrical shorts, crossed wires, or other electrical characteristics.

Cable Tray   A device for organizing cable runs in a drop ceiling.

Cache   A special area of RAM that stores frequently accessed data. In a network there are a number of applications that take advantage of cache in some way.

Cache-Only DNS Servers (Caching-Only DNS Servers)   DNS servers that do not have any forward lookup zones. They resolve names of systems on the Internet for the network, but are not responsible for telling other DNS servers the names of any clients.

Cached Lookup   The list kept by a DNS server of IP addresses it has already resolved, so it won’t have to re-resolve an FQDN it has already checked.

Caching Engine   A server dedicated to storing cache information on your network. These servers can reduce overall network traffic dramatically.

Canonical Name (CNAME)   Less common type of DNS record that acts as a computer’s alias.

Capturing a Printer   A process by which a printer uses a local LPT port that connects to a networked printer. This is usually only done to support older programs that are not smart enough to know how to print directly to a UNC-named printer; it’s quite rare today.

Card   Generic term for anything that you can snap into an expansion slot.

Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)   See CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance).

Carrier Sense Multiple Access with Collision Detection (CSMA/CD)   See CSMA/CD (Carrier Sense Multiple Access with Collision Detection).

CAT 3   Category 3 wire, a TIA/EIA standard for UTP wiring that can operate at up to 16 Mbps.

CAT 4   Category 4 wire, a TIA/EIA standard for UTP wiring that can operate at up to 20 Mbps. This wire is not widely used, except in older Token Ring networks.

CAT 5   Category 5 wire, a TIA/EIA standard for UTP wiring that can operate at up to 100 Mbps.

CAT 5e   Category 5e wire, a TIA/EIA standard for UTP wiring with improved support for 100 Mbps using two pairs and support for 1000 Mbps using four pairs.

CAT 6   Category 6 wire, a TIA/EIA standard for UTP wiring with improved support for 1000 Mbps.

Category (CAT) Rating   A grade assigned to cable to help network installers get the right cable for the right network technology. CAT ratings are officially rated in megahertz (MHz), indicating the highest-frequency bandwidth the cable can handle.

CCITT (Comité Consultatif International Téléphonique et Télégraphique)   European standards body that established the V standards for modems.

Central Office   Building that houses local exchanges and a location where individual voice circuits come together.

Certificate   A public encryption key signed with the digital signature from a trusted third party called a certificate authority (CA). This key serves to validate the identity of its holder when that person or company sends data to other parties.

Certifier   A device that tests a cable to ensure that it can handle its rated amount of capacity.

Challenge Handshake Authentication Protocol (CHAP)   A remote access authentication protocol. It has the serving system challenge the remote client, which must provide an encrypted password.

Change Management Documentation   A set of documents that defines procedures for changes to the network.

Channel   A portion of the wireless spectrum on which a particular wireless network operates. Setting wireless networks to different channels enables separation of the networks.

Channel Bonding   Wireless technology that enables WAPs to use two channels for transmission.

Channel Service Unit/Digital Service Unit (CSU/DSU)   See CSU/DSU (Channel Service Unit/Data Service Unit).

Chat   A multiparty, real-time text conversation. The Internet’s most popular version is known as Internet Relay Chat (IRC), which many groups use to converse in real time with each other.

Checksum   A simple error-detection method that adds a numerical value to each data packet, based on the number of data bits in the packet. The receiving node applies the same formula to the data and verifies that the numerical value is the same; if not, the data has been corrupted and must be re-sent.

Cipher   A series of complex and hard-to-reverse mathematics run on a string of ones and zeroes in order to make a new set of seemingly meaningless ones and zeroes.

Ciphertext   The output when cleartext is run through a cipher algorithm using a key.

Circuit Switching   The process for connecting two phones together on one circuit.

Cisco IOS   Cisco’s proprietary operating system.

Cladding   The part of a fiber-optic cable that makes the light reflect down the fiber.

Class License   Contiguous chunk of IP addresses passed out by the Internet Assigned Numbers Authority (IANA).

Classless Inter-Domain Routing (CIDR)   Method of categorizing IP addresses in order to distribute them. See also Subnetting.

Classless Subnet   A subnet that does not fall into the common categories such as Class A, Class B, and Class C.

Cleartext   See Plaintext.

Client   A computer program that uses the services of another computer program; software that extracts information from a server. Your autodial phone is a client, and the phone company is its server. Also, a machine that accesses shared resources on a server.

Client/Server   A relationship in which client software obtains services from a server on behalf of a user.

Client/Server Application   An application that performs some or all of its processing on an application server rather than on the client. The client usually only receives the result of the processing.

Client/Server Network   A network that has dedicated server machines and client machines.

Client-to-Site   A type of VPN connection where a single computer logs into a remote network and becomes, for all intents and purposes, a member of that network.

Cloud Computing   Using the Internet to store files and run applications. For example, Google Documents is a cloud computing application that enables you to run productivity applications over the Internet from your Web browser.

Coaxial Cable   A type of cable that contains a central conductor wire surrounded by an insulating material, which in turn is surrounded by a braided metal shield. It is called coaxial because the center wire and the braided metal shield share a common axis or centerline.

Collision   The result of two nodes transmitting at the same time on a multiple access network such as Ethernet. Both frames may be lost or partial frames may result.

Collision Domain   See Broadcast Domain.

Collision Light   A light on some older NICs that flickers when a network collision is detected.

Command   A request, typed from a terminal or embedded in a file, to perform an operation or to execute a particular program.

Common Internet File System (CIFS)   The protocol that NetBIOS used to share folders and printers. Still very common, even on UNIX/Linux systems.

Compatibility Issue   When different pieces of hardware or software don’t work together correctly.

Complete Algorithm   A cipher and the methods used to implement that cipher.

Concentrator   A device that brings together at a common center connections to a particular kind of network (such as Ethernet) and implements that network internally.

Configuration Management   A set of documents, policies, and procedures designed to help you maintain and update your network in a logical, orderly fashion.

Configuration Management Documentation   Documents that define the configuration of a network. These would include wiring diagrams, network diagrams, baselines, and policy/procedure/configuration documentation.

Configurations   The settings stored in devices that define how they are to operate.

Connection   A term used to refer to communication between two computers.

Connection-Oriented Communication   A protocol that establishes a connection between two hosts before transmitting data and verifies receipt before closing the connection between the hosts. TCP is an example of a connection-oriented protocol.

Connectionless Communication   A protocol that does not establish and verify a connection between the hosts before sending data; it just sends the data and hopes for the best. This is faster than connection-oriented protocols. UDP is an example of a connectionless protocol.

Content Switch   Advanced networking device that works at least at Layer 7 (Application layer) and hides servers behind a single IP.

Continuity   The physical connection of wires in a network.

Continuity Tester   Inexpensive network tester that can only test for continuity on a line.

Convergence   Point at which the routing tables for all routers in a network are updated.

Copy Backup   A type of backup similar to Normal or Full, in that all selected files on a system are backed up. This type of backup does not change the archive bit of the files being backed up.

Core   The central glass of the fiber-optic cable that carries the light signal.

Cost   Routers can use a connection’s monetary cost when determining a route’s metric.

Counter   A predefined event that is recorded to a log file.

CRC (Cyclic Redundancy Check)   A mathematical method that is used to check for errors in long streams of transmitted data with high accuracy. Before data is sent, the main computer uses the data to calculate a CRC value from the data’s contents. If the receiver calculates a different CRC value from the received data, the data was corrupted during transmission and is re-sent. Ethernet frames have a CRC code.

Crimper   Also called a crimping tool, the tool used to secure a crimp (or an RJ-45 connector) onto the end of a cable.

Cross-Platform Support   Standards created to enable terminals (and now operating systems) from different companies to interact with one another.

Crossover Cable   A special UTP cable used to interconnect hubs/switches or to connect network cards without a hub/switch. Crossover cables reverse the sending and receiving wire pairs from one end to the other.

Crossover Port   Special port in a hub that crosses the sending and receiving wires, thus removing the need for a crossover cable to connect the hubs.

Crosstalk   Electrical signal interference between two cables that are in close proximity to each other.

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance)   Access method used mainly on wireless networks. Before hosts send out data, they send out a signal that checks to make sure the network is free of other signals. If data is detected on the wire, the hosts wait a random time period before trying again. If the wire is free, the data is sent out.

CSMA/CD (Carrier Sense Multiple Access with Collision Detection)   Access method that Ethernet systems use in LAN technologies, enabling frames of data to flow through the network and ultimately reach address locations. Known as a contention protocol, hosts on CSMA/CD networks send out data without checking to see if the wire is free first. If a collision occurs, then both hosts wait a random time period before retransmitting the data.

CSU/DSU (Channel Service Unit/Data Service Unit)   A piece of equipment that connects a T-carrier leased line from the telephone company to a customer’s equipment (such as a router). It performs line encoding and conditioning functions, and it often has a loopback function for testing.

Daily Backup   Also called a daily copy backup, makes a copy of all files that have been changed on that day without changing the archive bits of those files.

Daisy-chain   A method of connecting together several devices along a bus and managing the signals for each device.

Data Backup   The process of creating extra copies of data to be used in case the primary data source fails.

Data Encryption Standard (DES)   A symmetric-key algorithm developed by the U.S. government in the 1970s and formerly in use in a variety of TCP/IP applications. DES used a 64-bit block and a 56-bit key. Over time, the 56-bit key made DES susceptible to brute-force attacks.

Data Link Layer   See Open Systems Interconnection (OSI) Seven-Layer Model.

Data Over Cable Service Interface Specification (DOCSIS)   The unique protocol used by cable modem networks.

Datagram   A connectionless transfer unit created with User Datagram Protocol designed for quick transfers over a packet-switched network.

Decibel (dB)   A measurement of the quality of a signal.

Dedicated Circuit   A circuit that runs from a breaker box to specific outlets.

Dedicated Line   A telephone line that is an always open, or connected, circuit. Dedicated telephone lines usually do not have telephone numbers.

Dedicated Server   A machine that does not use any client functions, only server functions.

Default   A software function or operation that occurs automatically unless the user specifies something else.

Default Gateway   In a TCP/IP network, the IP address of the router that interconnects the LAN to a wider network, usually the Internet. This router’s IP address is part of the necessary TCP/IP configuration for communicating with multiple networks using IP.

Delta Channel (D Channel)   A type of ISDN line that transfers data at 16 Kbps.

Demarc   A device that marks the dividing line of responsibility for the functioning of a network between internal users and upstream service providers.

Demarc Extension   Any cabling that runs from the network interface to whatever box is used by the customer as a demarc.

Demilitarized Zone (DMZ)   A lightly protected or unprotected subnet network positioned between an outer firewall and an organization’s highly protected internal network. DMZs are used mainly to host public address servers (such as Web servers).

Denial of Service (DoS) Attack   An attack that floods a networked server with so many requests that it becomes overwhelmed and ceases functioning.

Designated Router (DR)   The main router in an OSPF network that relays information to all other routers in the area.

Destination Port   A fixed, predetermined number that defines the function or session type in a TCP/IP network.

Device Driver   A subprogram to control communications between the computer and some peripheral hardware.

Device ID   The last six digits of a MAC address, identifying the manufacturer’s unique serial number for that NIC.

DHCP Lease   Created by the DHCP server to allow a system requesting DHCP IP information to use that information for a certain amount of time.

DHCP Scope   The pool of IP addresses that a DHCP server may allocate to clients requesting IP addresses or other IP information like DNS server addresses.

Dial-up Lines   Telephone lines with telephone numbers; they must dial to make a connection, as opposed to a dedicated line.

Differential Backup   Similar to an incremental backup in that it backs up the files that have been changed since the last backup. This type of backup does not change the state of the archive bit.

DIG (Domain Information Groper)   See Domain Information Groper.

Digital Signature   A string of characters, created from a private encryption key, that verifies a sender’s identity to those who receive encrypted data or messages.

Digital Subscriber Line (DSL)   A high-speed Internet connection technology that uses a regular telephone line for connectivity. DSL comes in several varieties, including Asymmetric (ADSL) and Symmetric (SDSL), and many speeds. Typical home-user DSL connections are ADSL with a download speed of up to 9 Mbps and an upload speed of up to 1 Kbps.

Dipole Antenna   The standard straight-wire antenna that provides most omni-directional function.

Direct Current (DC)   A type of electric circuit where the flow of electrons is in a complete circle.

Direct-Sequence Spread-Spectrum (DSSS)   A spread-spectrum broadcasting method defined in the 802.11 standard that sends data out on different frequencies at the same time.

Directional Antenna   An antenna that focuses its signal into a beam of sorts.

Discretionary Access Control (DAC)   Authorization method based on the idea that there is an owner of a resource who may at his or her discretion assign access to that resource. DAC is considered much more flexible than MAC.

Disk Mirroring   Process by which data is written simultaneously to two or more disk drives. Read and write speed is decreased, but redundancy, in case of catastrophe, is increased. Also known as RAID level 1. See also Duplexing.

Disk Striping   Process by which data is spread among multiple (at least two) drives. It increases speed for both reads and writes of data, but provides no fault tolerance. Also known as RAID level 0.

Disk Striping with Parity   Process by which data is spread among multiple (at least three) drives, with parity information as well to provide fault tolerance. The most commonly implemented type is RAID 5, where the data and parity information is spread across three or more drives.

Dispersion   Diffusion over distance of light propagating down fiber cable.

Distance Vector   Set of routing protocols that calculates the total cost to get to a particular network ID and compares that cost to the total cost of all the other routes to get to that same network ID.

Distributed Coordination Function (DCF)   One of two methods of collision avoidance defined by the 802.11 standard and the only one currently implemented. DCF specifies strict rules for sending data onto the network media.

Distributed Denial of Service (DDoS) Attack   A DoS attack that uses multiple (as in hundreds or up to hundreds of thousands) of computers under the control of a single operator to conduct a devastating attack.

DLL (Dynamic Link Library)   A file of executable functions or data that can be used by a Windows application. Typically, a DLL provides one or more particular functions, and a program accesses the functions by creating links to the DLL.

DNS Domain   A specific branch of the DNS name space. First-level DNS domains include .com, .gov, and .edu.

DNS Resolver Cache   A cache used by Windows DNS clients to keep track of DNS information.

DNS Root Servers   The highest in the hierarchy of DNS servers running the Internet.

DNS Server   A system that runs a special DNS server program.

DNS Tree   A hierarchy of DNS domains and individual computer names organized into a tree-like structure, the top of which is the root.

Document   A medium and the data recorded on it for human use; for example, a report sheet or book. By extension, any record that has permanence and that can be read by a human or a machine.

Documentation   A collection of organized documents or the information recorded in documents. Also, instructional material specifying the inputs, operations, and outputs of a computer program or system.

Domain   A term used to describe a grouping of users, computers, and/or networks. In Microsoft networking, a domain is a group of computers and users that shares a common account database and a common security policy. For the Internet, a domain is a group of computers that shares a common element in their DNS hierarchical name.

Domain Controller   A Microsoft Windows Server system specifically configured to store user and server account information for its domain. Often abbreviated as “DC.” Windows domain controllers store all account and security information in the Active Directory directory service.

Domain Information Groper (DIG)   Command-line tool in non-Windows systems used to diagnose DNS problems.

Domain Name System (DNS)   A TCP/IP name resolution system that resolves host names to IP addresses.

Domain Users and Groups   Users and groups that are defined across an entire network domain.

Dotted Decimal Notation   Shorthand method for discussing and configuring binary IP addresses.

Download   The transfer of information from a remote computer system to the user’s system. Opposite of upload.

Drive Duplexing   See Duplexing.

Drive Mirroring   The process of writing identical data to two hard drives on the same controller at the same time to provide data redundancy.

DS0   The digital signal rate created by converting analog sound into 8-bit chunks 8000 times a second, with a data stream of 64 Kbps. This is the simplest data stream (and the slowest rate) of the digital part of the phone system.

DS1   The signaling method used by T1 lines, which uses a relatively simple frame consisting of 25 pieces: a framing bit and 24 channels. Each DS1 channel holds a single 8-bit DS0 data sample. The framing bit and data channels combine to make 193 bits per DS1 frame. These frames are transmitted 8000 times/ sec, making a total throughput of 1.544 Mbps.

DSL Access Multiplexer (DSLAM)   A device located in a telephone company’s central office that connects multiple customers to the Internet.

DSL Modem   A device that enables customers to connect to the Internet using a DSL connection. A DSL modem isn’t really a modem—it’s more like an ISDN terminal adapter—but the term stuck, and even the manufacturers of the devices now call them DSL modems.

DSP (Digital Signal Processor)   A specialized microprocessor-like device that processes digital signals at the expense of other capabilities, much as the floating-point unit (FPU) is optimized for math functions. DSPs are used in such specialized hardware as high-speed modems, multimedia sound cards, MIDI equipment, and real-time video capture and compression.

Duplexing   Also called disk duplexing or drive duplexing, similar to mirroring in that data is written to and read from two physical drives for fault tolerance. In addition, separate controllers are used for each drive, for both additional fault tolerance and additional speed. Considered RAID level 1. See also Disk Mirroring.

Dynamic Addressing   A way for a computer to receive IP information automatically from a server program. See also Dynamic Host Configuration Protocol (DHCP).

Dynamic DNS (DDNS)   A protocol that enables DNS servers to get automatic updates of IP addresses of computers in their forward lookup zones, mainly by talking to the local DHCP server.

Dynamic Host Configuration Protocol (DHCP)   A protocol that enables a DHCP server to set TCP/IP settings automatically for a DHCP client.

Dynamic Link Library (DLL)   See DLL (Dynamic Link Library).

Dynamic NAT   Type of NAT in which many computers can share a pool of routable IP addresses that number fewer than the computers.

Dynamic Port Numbers   Port numbers 49152–65535, recommended by the IANA to be used as ephemeral port numbers.

Dynamic Routing   Process by which routers in an internetwork automatically exchange information with other routers. Requires a dynamic routing protocol, such as OSPF or RIP.

Dynamic Routing Protocol   A protocol that supports the building of automatic routing tables, such as OSPF or RIP.

E1   The European counterpart of a T1 connection that carries 32 channels at 64 Kbps for a total of 2.048 Mbps—making it slightly faster than a T1.

E3   The European counterpart of a T3 line that carries 16 E1 lines (512 channels), for a total bandwidth of 34.368 Mbps—making it a little bit slower than an American T3.

Edge Router   Router that connects one automated system (AS) to another.

Effective Permissions   The permissions of all groups combined in any network operating system.

Electromagnetic Interference (EMI)   Interference from one device to another, resulting in poor performance in the device’s capabilities. This is similar to having static on your TV while running a hair dryer, or placing two monitors too close together and getting a “shaky” screen.

E-mail (Electronic Mail)   Messages, usually text, sent from one person to another via computer. E-mail can also be sent automatically to a large number of addresses, known as a mailing list.

E-mail Client   Program that runs on a computer and enables you to send, receive, and organize e-mail.

E-mail Server   Also known as mail server, a server that accepts incoming mail, sorts the mail for recipients into mailboxes, and sends mail to other servers using SMTP.

Emulator   Software or hardware that converts the commands to and from the host machine to an entirely different platform. For example, a program that enables you to run Nintendo games on your PC.

Encapsulation   The process of putting the packets from one protocol inside the packets of another protocol. An example of this is TCP/IP encapsulation in Ethernet, which places TCP/IP packets inside Ethernet frames.

Encryption   A method of securing messages by scrambling and encoding each packet as it is sent across an unsecured medium, such as the Internet. Each encryption level provides multiple standards and options.

Endpoint   In the TCP/IP world, the session information stored in RAM. See also Socket.

Endpoints   Correct term to use when discussing the data each computer stores about the connection between two computers’ TCP/IP applications. See also Socket Pairs.

Enhanced Interior Gateway Routing Protocol (EIGRP)   Cisco’s proprietary hybrid protocol that has elements of both distance vector and link state routing.

Environmental Monitor   Device used in telecommunications rooms that keeps track of humidity, temperature, and more.

Ephemeral Port   In TCP/IP communication, an arbitrary number generated by a sending computer that the receiving computer uses as a destination address when sending a return packet.

Ephemeral Port Numbers   See Ephemeral Port.

Equipment Rack   A metal structure used in equipment rooms to secure network hardware devices and patch panels. Most racks are 19” wide. Devices designed to fit in such a rack use a height measurement called units, or simply U.

ESD (Electro-Static Discharge)   The movement of electrons from one body to another. ESD is a real menace to PCs because it can cause permanent damage to semiconductors.

Ethernet   Name coined by Xerox for the first standard of network cabling and protocols. Ethernet is based on a bus topology. The IEEE 802.3 subcommittee defines the current Ethernet specifications.

Evil Twin   An attack that lures people into logging into a rogue access point that looks similar to a legitimate access point.

Executable Viruses   Viruses that are literally extensions of executables and that are unable to exist by themselves. Once an infected executable file is run, the virus loads into memory, adding copies of itself to other EXEs that are subsequently run.

Extended Service Set (ESS)   A single wireless access point servicing a given area that has been extended by adding more access points.

Extended Service Set ID (ESSID)   An SSID applied to an Extended Service Set as a network naming convention.

Extended Unique Identifier, 64-bit (EUI-64)   The last 64 bits of the IPv6 address, which are determined based on a device’s MAC address.

Extensible Authentication Protocol (EAP)   Authentication wrapper that EAP-compliant applications can use to accept one of many types of authentication. While EAP is a general-purpose authentication wrapper, its only substantial use is in wireless networks.

External Connections   A network’s connection to the wider Internet. Also a major concern when setting up a SOHO network.

External Data Bus (EDB)   The primary data highway of all computers. Everything in your computer is tied either directly or indirectly to the EDB.

External Network Address   A number added to the MAC address of every computer on an IPX/SPX network that defines every computer on the network; this is often referred to as a network number.

External Threats   Threats to your network through external means; examples include virus attacks and the exploitation of users, security holes in the OS, or the network hardware itself.

FAQ (Frequently Asked Questions)   Common abbreviation coined by BBS users and spread to Usenet and the Internet. This is a list of questions and answers that pertains to a particular topic, maintained so that users new to the group don’t all bombard the group with similar questions. Examples are “What is the name of the actor who plays X on this show, and was he in anything else?” or “Can anyone list all of the books by this author in the order that they were published so that I can read them in that order?” The common answer to this type of question is “Read the FAQ!”

Far-End Crosstalk (FEXT)   Crosstalk on the opposite end of a cable from the signal’s source.

Fast Ethernet   Nickname for the 100-Mbps Ethernet standards. Originally applied to 100BaseT.

Fault Tolerance   The capability of any system to continue functioning after some part of the system has failed. RAID is an example of a hardware device that provides fault tolerance for hard drives.

Federal Communications Commission (FCC)   In the United States, regulates public airwaves and rates PCs and other equipment according to the amount of radiation emitted.

Fiber-Optic Cable   A high-speed physical medium for transmitting data that uses light rather than electricity to transmit data and is made of high-purity glass fibers sealed within a flexible opaque tube. Much faster than conventional copper wire.

File Server   A computer designated to store software, courseware, administrative tools, and other data on a local or wide area network. It “serves” this information to other computers via the network when users enter their personal access codes.

File Transfer Protocol (FTP)   A set of rules that allows two computers to talk to one another as a file transfer is carried out. This is the protocol used when you transfer a file from one computer to another across the Internet.

Fire Ratings   Ratings developed by Underwriters Laboratories (UL) and the National Electrical Code (NEC) to define the risk of network cables burning and creating noxious fumes and smoke.

Firewall   A device that restricts traffic between a local network and the Internet.

FireWire   An IEEE 1394 standard to send wide-band signals over a thin connector system that plugs into TVs, VCRs, TV cameras, PCs, and so forth. This serial bus developed by Apple and Texas Instruments enables connection of 60 devices at speeds ranging from 100 to 800 Mbps.

Flat Name Space   A naming convention that gives each device only one name that must be unique. NetBIOS uses a flat name space. TCP/IP’s DNS uses a hierarchical name space.

Forward Lookup Zone   The storage area in a DNS server to store the IP addresses and names of systems for a particular domain or domains.

FQDN (Fully Qualified Domain Name)   The complete DNS name of a system, from its host name to the top-level domain name.

Fractional T1 Access   A service provided by many telephone companies wherein customers can purchase a number of individual channels in a T1 line in order to save money.

Frame   A defined series of binary data that is the basic container for a discrete amount of data moving across a network. Frames are created at Layer 2 of the OSI model.

Frame Check Sequence (FCS)   A sequence of bits placed in a frame that is used to check the primary data for errors.

Frame Relay   An extremely efficient data transmission technique used to send digital information such as voice, data, LAN, and WAN traffic quickly and cost-efficiently to many destinations from one port.

FreeRADIUS   Free RADIUS server software for UNIX/Linux systems.

Freeware   Software that is distributed for free with no license fee.

Frequency Division Multiplexing (FDM)   A process of keeping individual phone calls separate by adding a different frequency multiplier to each phone call, making it possible to separate phone calls by their unique frequency range.

Frequency-Hopping Spread-Spectrum (FHSS)   A spread-spectrum broadcasting method defined in the 802.11 standard that sends data on one frequency at a time, constantly shifting (or hopping) frequencies.

FUBAR   Fouled Up Beyond All Recognition.

Full Duplex   Any device that can send and receive data simultaneously.

Fully Meshed Topology   A mesh network where every node is directly connected to every other node.

Gain   The strengthening and focusing of radio frequency output from a wireless access point (WAP).

Gateway Router   A router that acts as a default gateway in a TCP/IP network.

General Logs   Logs that record updates to applications.

Giga-   The prefix that generally refers to the quantity 1,073,741,824. One gigabyte is 1,073,741,824 bytes. With frequencies, in contrast, giga- often refers to one billion. One gigahertz is 1,000,000,000 hertz.

Gigabit Ethernet   See 1000BaseT.

Gigabyte   1024 megabytes.

Global Unicast Address   A second IPv6 address that every system needs in order to get on the Internet.

Grandfather, Father, Son (GFS)   A tape rotation strategy used in data backups.

Group Policy   A feature of Windows Active Directory that allows an administrator to apply policy settings to network users en masse.

Group Policy Object (GPO)   Enables network administrators to define multiple rights and permissions to entire sets of users all at one time.

Groups   Collections of network users who share similar tasks and need similar permissions; defined to make administration tasks easier.

H.323   A VoIP standard that handles the initiation, setup, and delivery of VoIP sessions.

Hackers   People who break into computer systems with malicious intent.

Half Duplex   Any device that can only send or receive data at any given moment.

Hardware Tools   Tools such as cable testers, TDRs, OTDRs, certifiers, voltage event recorders, protocol analyzers, cable strippers, multimeters, tone probes/ generators, butt sets, and punchdown tools used to configure and troubleshoot a network.

Hash   A mathematical function used in cryptography that is run on a string of binary digits of any length that results in a value of some fixed length.

Hex (Hexadecimal)   Hex symbols based on a numbering system of 16 (computer shorthand for binary numbers), using 10 digits and 6 letters to condense 0s and 1 s to binary numbers. Hex is represented by digits 0 through 9 and alpha A through F, so that 09h has a value of 9, and 0Ah has a value of 10.

Hierarchical Name Space   A naming scheme where the full name of each object includes its position within the hierarchy. An example of a hierarchical name is www.totalseminars.com, which includes not only the host name, but also the domain name. DNS uses a hierarchical name space scheme for fully qualified domain names (FQDNs).

High Availability   A collection of technologies and procedures that work together to keep an application available at all times.

High-Speed WAN Internet Cards   A type of router expansion card that enables connection to two different ISPs.

History Logs   Logs that track the history of how a user or users access network resources, or how network resources are accessed throughout the network.

Home Page   Either the Web page that your browser is set to use when it starts up or the main Web page for a business, organization, or person. Also, the main page in any collection of Web pages.

Honeynet   The network created by a honeypot in order to lure in hackers.

Honeypot   An area of a network that an administrator sets up for the express purpose of attracting a computer hacker. If a hacker takes the bait, the network’s important resources are unharmed and network personnel can analyze the attack to predict and protect against future attacks, making the network more secure.

Hop   The passage of a packet through a router.

Horizontal Cabling   Cabling that connects the equipment room to the work areas.

Host   A single device (usually a computer) on a TCP/IP network that has an IP address; any device that can be the source or destination of a data packet. Also, a computer running multiple virtualized operating systems.

Host ID   The portion of an IP address that defines a specific machine in a subnet.

Host Name   An individual computer name in the DNS naming convention.

hostname   Command-line tool that returns the host name of the computer it is run on.

HOSTS File   The predecessor to DNS, a static text file that resides on a computer and is used to resolve DNS host names to IP addresses. The HOSTS file is checked before the machine sends a name resolution request to a DNS name server. The HOSTS file has no extension.

HTML (Hypertext Markup Language)   An ASCII-based script-like language for creating hypertext documents like those on the World Wide Web.

HTTP (Hypertext Transfer Protocol)   Extremely fast protocol used for network file transfers on the World Wide Web.

HTTP over SSL (HTTPS)   A secure form of HTTP, used commonly for Internet business transactions or any time where a secure connection is required. See also Hypertext Transfer Protocol (HTTP) and Secure Sockets Layer (SSL).

Hub   An electronic device that sits at the center of a star topology network, providing a common point for the connection of network devices. In a 10BaseT Ethernet network, the hub contains the electronic equivalent of a properly terminated bus cable. Hubs are rare today and have been replaced by switches.

Hybrid Topology   A mix or blend of two different topologies. A star-bus topology is a hybrid of the star and bus topologies.

Hypertext   A document that has been marked up to enable a user to select words or pictures within the document, click them, and connect to further information. The basis of the World Wide Web.

Hypervisor   An extra layer of sophisticated programming to manage the vastly more complex interactions required for virtualization.

ICF (Internet Connection Firewall)   The software firewall built into Windows XP that protects your system from unauthorized access from the Internet. Microsoft changed the name to the Windows Firewall in Windows XP Service Pack 2.

ICS (Internet Connection Sharing)   Also known simply as Internet sharing, the technique of enabling more than one computer to access the Internet simultaneously using a single Internet connection. When you use Internet sharing, you connect an entire LAN to the Internet using a single public IP address.

IEEE (Institute of Electrical and Electronics Engineers)   The leading standards-setting group in the United States.

IEEE 802.2   IEEE subcommittee that defined the standards for Logical Link Control (LLC).

IEEE 802.3   IEEE subcommittee that defined the standards for CSMA/CD (a.k.a. Ethernet).

IEEE 802.11   IEEE subcommittee that defined the standards for wireless.

IEEE 802.14   IEEE subcommittee that defined the standards for cable modems.

IEEE 1284   The IEEE standard for the now obsolete parallel communication.

IEEE 1394   IEEE standard for FireWire communication.

IETF (Internet Engineering Task Force)   The primary standards organization for the Internet.

ifconfig   A command-line utility for Linux servers and workstations that displays the current TCP/IP configuration of the machine, similar to ipconfig for Windows systems.

IMAP (Internet Message Access Protocol)   An alternative to POP3. IMAP retrieves e-mail from an e-mail server like POP3; IMAP uses TCP port 143.

Impedance   The amount of resistance to an electrical signal on a wire. It is used as a relative measure of the amount of data a cable can handle.

Incremental Backup   Backs up all files that have their archive bits turned on, meaning they have been changed since the last backup. This type of backup turns the archive bits off after the files have been backed up.

Independent Basic Service Set (IBSS)   A basic unit of organization in wireless networks formed by two or more wireless nodes communicating in ad hoc mode.

Independent Computing Architecture (ICA)   A Citrix-created standard that defines how a server and a client exchange terminal information.

Infrastructure Mode   Mode in which wireless networks use one or more wireless access points to connect the wireless network nodes centrally. This configuration is similar to the star topology of a wired network.

Inheritance   A method of assigning user permissions, in which folder permissions flow downward into subfolders.

Insulating Jacket   The external plastic covering of a fiber-optic cable.

Integrated Services Digital Network (ISDN)   See ISDN (Integrated Services Digital Network).

Interframe Gap (IFG)   A short, predefined silence used in CSMA/CA.

Interframe Space (IFS)   Short, predefined period of silence in CSMA/CA appended to the waiting time when a device detects activity on the line.

Intermediate Distribution Frame (IDF)   The room where all the horizontal runs from all the work areas on a given floor in a building come together.

Intermediate System to Intermediate System (IS-IS)   Protocol similar to, but not as popular as, OSPF, but with support for IPv6 since inception.

Internal Connections   The connections between computers in a network.

Internal Network   A private LAN, with a unique network ID, that resides behind a router.

Internal Threats   All the things that a network’s own users do to create problems on the network. Examples include accidental deletion of files, accidental damage to hardware devices or cabling, and abuse of rights and permissions.

Internet Assigned Numbers Authority (IANA)   The organization responsible for assigning public IP addresses. IANA no longer directly assigns IP addresses, having delegated this to the five Regional Internet Registries. See Regional Internet Registries.

Internet Authentication Service (IAS)   Popular RADIUS server for Microsoft environments.

Internet Connection Firewall (ICF)   See ICF (Internet Connection Firewall).

Internet Connection Sharing (ICS)   See ICS (Internet Connection Sharing).

Internet Control Message Protocol (ICMP)   Protocol in which messages consist of a single packet and are connectionless. ICMP packets determine connectivity between two hosts.

Internet Group Management Protocol (IGMP)   Protocol that routers use to communicate with hosts to determine a “group” membership in order to determine which computers want to receive a multicast.

Internet Information Services (IIS)   Microsoft’s Web server program for managing Web servers.

Internet Message Access Protocol Version 4 (IMAP4)   An alternative to POP3 for receiving e-mail from an e-mail server. Supports searching through messages stored on a server and supports using folders to organize e-mail.

Internet Protocol (IP)   The Internet standard protocol that handles the logical naming for the TCP/IP protocol using IP addresses.

Internet Protocol Version 4 (IPv4)   Protocol in which addresses consist of four sets of numbers, each number being a value between 0 and 255, using a period to separate the numbers. Often called dotted decimal format. No IPv4 address may be all 0s or all 255s. Examples include 192.168.0.1 and 64.176.19.164.

Internet Protocol Version 6 (IPv6)   Protocol in which addresses consist of eight sets of four hexadecimal numbers, each number being a value between 0000 and FFFF, using a colon to separate the numbers. No IP address may be all 0s or all FFFFs. An example is FEDC:BA98:7654:3210:0800:200C:00CF:1234.

InterNIC   The organization that maintained the DNS services, registrations, and so forth run by Network Solutions, General Atomics, and AT&T in the early days of the Internet. ICANN assumed these roles in 1998, so the only time you’ll see this organization mentioned currently is on certification exams.

InterVLAN Routing   A feature on some switches to create virtual routers.

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)   An IPv6 tunneling protocol that adds the IPv4 address to an IPv6 prefix.

Intranet   A private TCP/IP network inside a company or organization.

Intrusion Detection System (IDS)/Intrusion Prevention System (IPS)   An application (often running on a dedicated IDS box) that inspects incoming packets, looking for active intrusions. The difference between an IDS and an IPS is that an IPS can react to an attack.

IP Address   The numeric address of a computer connected to a TCP/IP network, such as the Internet. IPv4 addresses are 32-bits long, written as four octets of 8-bit binary. IPv6 addresses are 128-bits long, written as eight sets of four hexadecimal characters. IP addresses must be matched with a valid subnet mask, which identifies the part of the IP address that is the network ID and the part that is the host ID.

IP Filtering   A method of blocking packets based on IP addresses.

IP Security (IPsec)   A IP packet encryption protocol. IPsec is the only IP encryption protocol to work at Layer 3 of the OSI seven-layer model. IPsec is most commonly seen on Virtual Private Networks. See virtual private network (VPN).

ipconfig   A command-line utility for Windows that displays the current TCP/ IP configuration of the machine; similar to UNIX/Linux’s ifconfig.

IRC (Internet Relay Chat)   An online group discussion. Also called chat.

ISDN (Integrated Services Digital Network)   The CCITT (Comité Consultatif International Téléphonique et Télégraphique) standard that defines a digital method for telephone communications. Originally designed to replace the current analog telephone systems. ISDN lines have telephone numbers and support up to 128-Kbps transfer rates. ISDN also allows data and voice to share a common phone line. Never very popular, ISDN is now relegated to specialized niches.

ISP (Internet Service Provider)   An institution that provides access to the Internet in some form, usually for a fee.

IT (Information Technology)   The business of computers, electronic communications, and electronic commerce.

Java   A network-oriented programming language invented by Sun Microsystems and specifically designed for writing programs that can be safely downloaded to your computer through the Internet and immediately run without fear of viruses or other harm to your computer or files. Using small Java programs (called applets), Web pages can include functions such as animations, calculators, and other fancy tricks.

Just a Bunch of Disks (JBOD)   An array of hard drives that are simply connected with no RAID implementations.

K-   Most commonly used as the suffix for the binary quantity 1024. For instance, 640 K means 640 × 1024 or 655,360. Just to add some extra confusion to the IT industry, K is often misspoken as “kilo,” the metric value for 1,000. For example, 10 KB, spoken as “10 kilobytes,” means 10,240 bytes rather than 10,000 bytes. Finally, when discussing frequencies, K means 1,000. So,1 KHz = 1,000 kilohertz.

Kbps (Kilobits Per Second)   Data transfer rate.

Kerberos   An authentication standard designed to allow different operating systems and applications to authenticate each other.

Key Distribution Center (KDC)   System for granting authentication in Kerberos.

Key Pair   Name for the two keys generated in asymmetric-key algorithm systems.

Kilohertz (KHz)   A unit of measure that equals a frequency of 1000 cycles per second.

LAN (Local Area Network)   A group of PCs connected together via cabling, radio, or infrared that use this connectivity to share resources such as printers and mass storage.

Last Mile   The connection between a central office and individual users in a telephone system.

Latency   A measure of a signal’s delay.

Layer   A grouping of related tasks involving the transfer of information. Also, a particular level of the OSI seven-layer model, for example, Physical layer, Data Link layer, and so forth.

Layer 2 Switch   Any device that filters and forwards frames based on the MAC addresses of the sending and receiving machines. What is normally called a “switch” is actually a “Layer 2 switch.”

Layer 2 Tunneling Protocol (L2TP)   A VPN protocol developed by Cisco that can be run on almost any connection imaginable. LT2P has no authentication or encryption, but uses IPsec for all its security needs.

Layer 3 Switch   Also known as a router, filters and forwards data packets based on the IP addresses of the sending and receiving machines.

LC   A duplex type of Small Form Factor (SFF) fiber connector, designed to accept two fiber cables.

LEDs (Light Emitting Diodes)   Solid-state devices that vibrate at luminous frequencies when current is applied.

Leeching   Using another person’s wireless connection to the Internet without that person’s permission.

Light Leakage   The type of interference caused by bending a piece of fiber-optic cable past its maximum bend radius. Light bleeds through the cladding, causing signal distortion and loss.

Lights-out Management   Special “computer within a computer” features built into better servers, designed to give you access to a server even when the server itself is shut off.

Lightweight Directory Access Protocol (LDAP)   The tool that programs use to query and change a database used by the network. LDAP uses TCP port 389 by default.Lightweight Extensible Authentication Protocol (LEAP)

A proprietary EAP authentication used almost exclusively by Cisco wireless products. LEAP is an interesting combination of MS-CHAP authentication between a wireless client and a RADIUS server.

Link Light   An LED on NICs, hubs, and switches that lights up to show good connection between the devices.

Link-Local Address   The address that a computer running IPv6 gives itself after first booting. The first 64 bits of a link-local address are always FE80::/64.

Link Segments   Segments that link other segments together but are unpopulated or have no computers directly attached to them.

Link State   Type of dynamic routing protocol that announces only changes to routing tables, as opposed to entire routing tables. Compare to distance vector routing protocols. See also Distance Vector.

Linux   The popular open source UNIX-clone operating system.

List of Requirements   A list of all the things you’ll need to do to set up your SOHO network, as well as the desired capabilities of the network.

Listening Port   A socket that is prepared to respond to any IP packets destined for that socket’s port number.

LMHOSTS File   A static text file that resides on a computer and is used to resolve NetBIOS names to IP addresses. The LMHOSTS file is checked before the machine sends a name resolution request to a WINS name server. The LMHOSTS file has no extension.

Load Balancing   The process of taking several servers and making them look like a single server.

Local   Refers to the computer(s), server(s), and/or LAN that a user is physically using or that is in the same room or building.

Local Connector (LC)   One popular type of Small Form Factor (SFF) connector, considered by many to be the predominant fiber connector.

Local User Accounts   The accounts unique to a single Windows system. Stored in the local system’s registry.

Localhost   The HOSTS file alias for the loopback address of 127.0.0.1, referring to the current machine.

Logical Address   A programmable network address, unlike a physical address that is burned into ROM.

Logical Link Control (LLC)   The aspect of the NIC that talks to the operating system, places data coming from the software into frames, and creates the FCS on each frame. The LLC also deals with incoming frames—processing those that are addressed to this NIC and erasing frames addressed to other machines on the network.

Logical Network Diagram   A document that shows the broadcast domains and individual IP addresses for all devices on the network. Only critical switches and routers are shown.

Logical Topology   A network topology defined by signal paths as opposed to the physical layout of the cables. See also Physical Topology.

Loopback Address   Sometimes called the localhost, a reserved IP address used for internal testing: 127.0.0.1.

Loopback Plug   Network connector that connects back into itself, used to connect loopback tests.

Loopback Test   A special test often included in diagnostic software that sends data out of the NIC and checks to see if it comes back.

MAC (Media Access Control) Address   Unique 48-bit address assigned to each network card. IEEE assigns blocks of possible addresses to various NIC manufacturers to help ensure that each address is unique. The Data Link layer of the OSI seven-layer model uses MAC addresses for locating machines.

MAC Address Filtering   A method of limiting access to a wireless network based on the physical addresses of wireless NICs.

MAC Filtering   See MAC Address Filtering.

Macro   A specially written application macro (collection of commands) that performs the same functions as a virus. These macros normally autostart when the application is run and then make copies of themselves, often propagating across networks.

Mailbox   Special holding area on an e-mail server that separates out e-mail for each user.

Main Distribution Frame (MDF)   The room in a building that stores the demarc, telephone cross-connects, and LAN cross-connects.

Malware   Any program or code (macro, script, and so on) that’s designed to do something on a system or network that you don’t want to have happen.

Man in the Middle   A hacking attack where a person inserts him- or herself into a conversation between two others, covertly intercepting traffic thought to be only between those other people.

Managed Device   Networking devices, such as routers and advanced switches, that must be configured to use.

Managed Switch   See Managed Device.

Management Information Base (MIB)   SNMP’s version of a server. See Simple Network Management Protocol (SNMP).

Mandatory Access Control (MAC)   A security model in which every resource is assigned a label that defines its security level. If the user lacks that security level, they do not get access.

Maximum Transfer Unit (MTU)   Specifies the largest size of a data unit in a communications protocol, such as Ethernet.

MB (Megabyte)   1,048,576 bytes.

MD5 (Message-Digest Algorithm Version 5)   Arguably the most popular hashing function.

Mechanical Transfer Registered Jack (MT-RJ)   The first type of Small Form Factor (SFF) fiber connector, still in common use.

Media Access Control (MAC)   The part of a NIC that remembers the NIC’s own MAC address and attaches that address to outgoing frames.

Media Converter   A device that lets you interconnect different types of Ethernet cable.

Mega-   A prefix that usually stands for the binary quantity 1,048,576. One megabyte is 1,048,576 bytes. One megahertz, however, is 1,000,000 hertz. Sometimes shortened to meg, as in “a 286 has an address space of 16 megs.”

Mesh Topology   Topology in which each computer has a direct or indirect connection to every other computer in a network. Any node on the network can forward traffic to other nodes. Popular in cellular and many wireless networks.

Metric   Relative value that defines the “cost” of using a particular route.

Metropolitan Area Network (MAN)   Multiple computers connected via cabling, radio, leased phone lines, or infrared that are within the same city. A typical example of a MAN is a college campus. No firm dividing lines dictate what is considered a WAN, MAN, or LAN.

MHz (Megahertz)   A unit of measure that equals a frequency of 1 million cycles per second.

MIME (Multipurpose Internet Mail Extensions)   A standard for attaching binary files, such as executables and images, to the Internet’s text-based mail (24-Kbps packet size).

Mirroring   Also called drive mirroring, reading and writing data at the same time to two drives for fault-tolerance purposes. Considered RAID level 1.

Modal Distortion   A light distortion problem unique to multimode fiber-optic cable.

Modem (Modulator-Demodulator)   A device that converts both digital bit streams into analog signals (modulation) and incoming analog signals back into digital signals (demodulation). Most commonly used to interconnect telephone lines to computers.

Mounting Bracket   Bracket that acts as a holder for a faceplate in cable installations.

MS-CHAP   Microsoft’s dominant variation of the CHAP protocol, uses a slightly more advanced encryption protocol.

MTU (Maximum Transfer Unit)   See Maximum Transfer Unit (MTU).

MTU Black Hole   When a router’s firewall features block ICMP requests, making MTU worthless.

MTU Mismatch   The situation when your network’s packets are so large that they must be fragmented to fit into your ISP’s packets.

Multicast   Method of sending a packet in which the sending computer sends it to a group of interested computers.

Multicast Addresses   In IPv6, a set of reserved addresses designed to go only to certain systems.

Multifactor Authentication   A form of authentication where a user must use two or more factors to prove his or her identity.

Multilayer Switch   A switch that has functions that operate at multiple layers of the OSI seven-layer model.

Multimeter   A tool for testing voltage (AC and DC), resistance, and continuity.

Multimode Fiber (MMF)   Type of fiber-optic cable that uses LEDs.

Multiple In/Multiple Out (MIMO)   A feature in 802.11 WAPs that enables them to make multiple simultaneous connections.

Multiplexer   A device that merges information from multiple input channels to a single output channel.

Multiprotocol Label Switching (MPLS)   A router feature that labels certain data to use a desired connection. It works with any type of packet switching (even Ethernet) to force certain types of data to use a certain path.

Multisource Agreement (MSA)   Interchangeable modular transceivers used in 10 GbE networking devices.

Multispeed Hub   Any hub that supports more than one network speed for otherwise similar cabling systems. Multispeed hubs come in two flavors: one has mostly dedicated slower ports, with a few dedicated faster ports, whereas the other has only special auto-sensing ports that automatically run at either the faster or the slower speed.

MX Records   Records used by SMTP servers to determine where to send mail.

My Traceroute (mtr)   Terminal command in Linux that dynamically displays the route a packet is taking. Similar to traceroute.

Name Resolution   A method that enables one computer on the network to locate another to establish a session. All network protocols perform name resolution in one of two ways: either via broadcast or by providing some form of name server.

Name Server   A computer whose job is to know the name of every other computer on the network.

NAT Translation Table   Special database in a NAT router that stores destination IP addresses and ephemeral source ports from outgoing packets and compares them against returning packets.

nbtstat   A command-line utility used to check the current NetBIOS name cache on a particular machine. The utility compares NetBIOS names to their corresponding IP addresses.

Near-End Crosstalk (NEXT)   Crosstalk at the same end of a cable from which the signal is being generated.

NetBEUI (NetBIOS Extended User Interface)   Microsoft’s first networking protocol, designed to work with NetBIOS. NetBEUI is long obsolesced by TCP/IP. NetBEUI did not support routing.

NetBIOS (Network Basic Input/Output System)   A protocol that operates at the Session layer of the OSI seven-layer model. This protocol creates and manages connections based on the names of the computers involved.

NetBIOS Name   A computer name that identifies both the specific machine and the functions that machine performs. A NetBIOS name consists of 16 characters: the first 15 are an alphanumeric name, and the 16th is a special suffix that identifies the role the machine plays.

netstat   A universal command-line utility used to examine the TCP/IP connections open on a given host.

Network   A collection of two or more computers interconnected by telephone lines, coaxial cables, satellite links, radio, and/or some other communication technique. A computer network is a group of computers that are connected together and communicate with one another for a common purpose. Computer networks support “people and organization” networks, users who also share a common purpose for communicating.

Network Access Control (NAC)   Control over information, people, access, machines, and everything in between.

Network Access Server (NAS)   Systems that control the modems in a RADIUS network.

Network Address Translation (NAT)   A means of translating a system’s IP address into another IP address before sending it out to a larger network. NAT manifests itself by a NAT program that runs on a system or a router. A network using NAT provides the systems on the network with private IP addresses. The system running the NAT software has two interfaces: one connected to the network and the other connected to the larger network.

The NAT program takes packets from the client systems bound for the larger network and translates their internal private IP addresses to its own public IP address, enabling many systems to share a single IP address.

Network as a Service (NaaS)   The act of renting virtual server space over the Internet. See Cloud Computing.

Network Design   The process of gathering together and planning the layout for the equipment needed to create a network.

Network Diagram   An illustration that shows devices on a network and how they connect.

Network ID   A number used in IP networks to identify the network on which a device or machine exists.

Network Interface   A device by which a system accesses a network. In most cases, this is a NIC or a modem.

Network Interface Card (NIC)   Traditionally, an expansion card that enables a PC to link physically to a network. Modern computers now use built-in NICs, no longer requiring physical cards, but the term “NIC” is still very common.

Network Interface Unit (NIU)   Another name for a demarc. See Demarc.

Network Layer   Layer 3 of the OSI seven-layer model. See Open Systems Interconnection (OSI) Seven-Layer Model.

Network Management Software (NMS)   Tools that enable you to describe, visualize, and configure an entire network.

Network Map   A highly detailed illustration of a network, down to the individual computers. A network map will show IP addresses, ports, protocols, and more.

Network Name   Another name for the SSID.

Network Protocol   Special software that exists in every network-capable operating system that acts to create unique identifiers for each system. It also creates a set of communication rules for issues like how to handle data chopped up into multiple packets and how to deal with routers. TCP/IP is the dominant network protocol today.

Network Share   A shared resource on a network.

Network Threat   Any number of things that share one essential feature: the potential to damage network data, machines, or users.

Network Time Protocol (NTP)   Protocol that gives the current time.

Network Topology   Refers to the way that cables and other pieces of hardware connect to one another.

Newsgroup   The name for a discussion group on Usenet.

Next Hop   The next router a packet should go to at any given point.

NFS (Network File System)   A TCP/IP file system–sharing protocol that enables systems to treat files on a remote machine as though they were local files. NFS uses TCP port 2049, but many users choose alternative port numbers. Though still somewhat popular and heavily supported, NFS has been largely replaced by Samba/CIFS. See also Samba and Common Internet File System (CIFS).

Nmap   A network utility designed to scan a network and create a map. Frequently used as a vulnerability scanner.

Node   A member of a network or a point where one or more functional units interconnect transmission lines.

Noise   Undesirable signals bearing no desired information and frequently capable of introducing errors into the communication process.

Non-Discovery Mode   A setting for Bluetooth devices that effectively hides them from other Bluetooth devices.

Nonrepudiation   The process that guarantees the data is as originally sent and that it came from the source you think it should have come from.

Normal Backup   A full backup of every selected file on a system. This type of backup turns off the archive bit after the backup.

Novell NetWare   A powerful, unique, and once dominant network operating system that operated on a client/server model.

Ns (Nanosecond)   A billionth of a second. Light travels a little over 11 inches in 1 ns.

NS Records   Records that list the DNS servers for a Web site.

nslookup   A once handy tool that advanced techs used to query the functions of DNS servers. Most DNS servers now ignore all but the most basic nslookup queries.

NTFS (NT File System)   A file system for hard drives that enables object-level security, long filename support, compression, and encryption. NTFS 4.0 debuted with Windows NT 4.0. Windows 2000 offered NTFS 5.0; Windows XP saw the debut of NTFS 5.1. Later Windows versions continued the updates, so Windows Vista uses NTFS 6.0 and Windows 7 uses NTFS 6.1.

NTFS Permissions   Groupings of what Microsoft calls special permissions that have names like Execute, Read, and Write, and that allow or disallow users certain access to files.

NTLDR   A Windows NT/2000/XP/2003 boot file. Launched by the MBR or MFT, NTLDR looks at the BOOT.INI configuration file for any installed operating systems.

Object   A group of related counters used in Windows logging utilities.

OEM (Original Equipment Manufacturer)   Contrary to the name, does not create original hardware, but rather purchases components from manufacturers and puts them together in systems under its own brand name. Dell, Inc. and Gateway, Inc., for example, are for the most part OEMs. Apple, Inc., which manufactures most of the components for its own Macintosh-branded machines, is not an OEM. Also known as VARs (value-added resellers).

Offsite   The term for a virtual computer accessed and stored remotely.

Ohm Rating   Electronic measurement of a cable’s or an electronic component’s impedance.

Onsite   The term for a virtual computer stored at your location.

Open Port   See Listening Port.

Open Shortest Path First (OSPF)   An interior gateway routing protocol developed for IP networks based on the shortest path first or link-state algorithm.

Open Source   Applications and operating systems that offer access to their source code; this enables developers to modify applications and operating systems easily to meet their specific needs.

Open Systems Interconnection (OSI)   An international standard suite of protocols defined by the International Organization for Standardization (ISO) that implements the OSI seven-layer model for network communications between computers.

Open Systems Interconnection (OSI) Seven-Layer Model   An architecture model based on the OSI protocol suite, which defines and standardizes the flow of data between computers. The following lists the seven layers:

    • Layer 1   The Physical layer defines hardware connections and turns binary into physical pulses (electrical or light). Repeaters and hubs operate at the Physical layer.

    • Layer 2   The Data Link layer identifies devices on the Physical layer. MAC addresses are part of the Data Link layer. Bridges operate at the Data Link layer.

    • Layer 3   The Network layer moves packets between computers on different networks. Routers operate at the Network layer. IP and IPX operate at the Network layer.

    • Layer 4   The Transport layer breaks data down into manageable chunks. TCP, UDP, SPX, and NetBEUI operate at the Transport layer.

    • Layer 5   The Session layer manages connections between machines. NetBIOS and Sockets operate at the Session layer.

    • Layer 6   The Presentation layer, which can also manage data encryption, hides the differences among various types of computer systems.

    • Layer 7   The Application layer provides tools for programs to use to access the network (and the lower layers). HTTP, FTP, SMTP, and POP3 are all examples of protocols that operate at the Application layer.

OpenSSH   A series of secure programs developed by the OpenBSD organization to fix SSH’s limitation of only being able to handle one session per tunnel.

Operating System (OS)   The set of programming that enables a program to interact with the computer and provides an interface between the PC and the user. Examples are Microsoft Windows 7, Apple Macintosh OS X, and SUSE Linux.

Optical Carrier (OC)   Specification used to denote the optical data carrying capacity (in Mbps) of fiber-optic cables in networks conforming to the SONET standard. The OC standard is an escalating series of speeds, designed to meet the needs of medium-to-large corporations. SONET establishes OCs from 51.8 Mbps (OC-1) to 39.8 Gbps (OC-768).

Optical Time Domain Reflectometer (OTDR)   Tester for fiber-optic cable that determines continuity and reports the location of cable breaks.

Organizationally Unique Identifier (OUI)   The first 24 bits of a MAC address, assigned to the NIC manufacturer by the IEEE.

Orthogonal Frequency-Division Multiplexing (OFDM)   A spread-spectrum broadcasting method that combines the multiple frequencies of DSSS with FHSS’s hopping capability.

OS (Operating System)   See Operating System (OS).

Oscilloscope   A device that gives a graphical/visual representation of signal levels over a period of time.

Packet   Basic component of communication over a network. A group of bits of fixed maximum size and well-defined format that is switched and transmitted as a complete whole through a network. It contains source and destination address, data, and control information. See also Frame.

Packet Filtering   A mechanism that blocks any incoming or outgoing packet from a particular IP address or range of IP addresses. Also known as IP filtering.

Packet Sniffer   A tool that intercepts and logs network packets.

Pad   Extra data added to an Ethernet frame to bring the data up to the minimum required size of 64 bytes.

Path MTU Discovery (PMTU)   A method for determining the best MTU setting that works by adding a new feature called the “Don’t Fragment (DF) flag” to the IP packet.

Partially Meshed Topology   A mesh topology in which not all of the nodes are directly connected.

Passive Optical Network (PON)   A fiber architecture that uses a single fiber to the neighborhood switch and then individual fiber runs to each final destination.

Password   A series of characters that enables a user to gain access to a file, a folder, a PC, or a program.

Password Authentication Protocol (PAP)   The oldest and most basic form of authentication and also the least safe because it sends all passwords in cleartext.

Patch Cables   Short (2 to 5 foot) UTP cables that connect patch panels to the hubs.

Patch Panel   A panel containing a row of female connectors (ports) that terminate the horizontal cabling in the equipment room. Patch panels facilitate cabling organization and provide protection to horizontal cabling.

PBX (Private Branch Exchange)   A private phone system used within an organization.

PDA (Personal Digital Assistant)   A hand-held computer that blurs the line between the calculator and computer. Earlier PDAs were calculators that enabled the user to program in such information as addresses and appointments. Newer machines, such as the Palm Pilot, are fully programmable computers. Most PDAs use a pen/stylus for input rather than a keyboard. A few of the larger PDAs have a tiny keyboard in addition to the stylus.

Peer-to-Peer   A network in which each machine can act as either a client or a server.

Peer-to-Peer Mode   See Ad Hoc Mode.

Performance Monitor (PerfMon)   The Windows XP logging utility.

Peripherals   Noncomputer devices on a network, for example, fax machines, printers, or scanners.

Permissions   Sets of attributes that network administrators assign to users and groups that define what they can do to resources.

Persistent Connection   A connection to a shared folder or drive that the computer immediately reconnects to at logon.

Personal Area Network (PAN)   The network created among Bluetooth devices such as smartphones, tablets, printers, keyboards, mice, and so on.

Phishing   A social engineering technique where the attacker poses as a trusted source in order to obtain sensitive information.

Physical Address   An address burned into a ROM chip on a NIC. A MAC address is an example of a physical address.

Physical Layer   See Open Systems Interconnection (OSI) Seven-Layer Model.

Physical Network Diagram   A document that shows all of the physical connections on a network. Cabling type, protocol, and speed are also listed for each connection.

Physical Topology   The manner in which the physical components of a network are arranged.

PING (Packet Internet Groper)   A small network message sent by a computer to check for the presence and response of another system. A ping uses ICMP packets. See Internet Control Message Protocol (ICMP).

Plain Old Telephone Service (POTS)   See Public Switched Telephone Network (PSTN).

Plaintext   Data that is in an easily read or viewed industry-wide standard format.

Platform   Hardware environment that supports the running of a computer system.

Plenum   Usually a space between a building’s false ceiling and the floor above it. Most of the wiring for networks is located in this space. Plenum is also a fire rating for network cabling.

Point Coordination Function (PCF)   A method of collision avoidance defined by the 802.11 standard, which has yet to be implemented.

Point-to-Multipoint   Topology in which one device communicates with more than one other device on a network.

Point-to-Point Protocol (PPP)   A protocol that enables a computer to connect to the Internet through a dial-in connection and to enjoy most of the benefits of a direct connection. PPP is considered to be superior to SLIP because of its error detection and data compression features, which SLIP lacks, and the capability to use dynamic IP addresses.

Point-to-Point Protocol over Ethernet (PPPoE)   A protocol that was originally designed to encapsulate PPP frames into Ethernet frames. Used by DSL providers to force customers to log into their DSL connections instead of simply connecting automatically.

Point-to-Point Topology   A network of two single devices communicating with each other.

Point-to-Point Tunneling Protocol (PPTP)   A protocol that works with PPP to provide a secure data link between computers using encryption.

Pointer Record (PTR)   A record that points to canonical names. See also Reverse Lookup Zone.

Polyvinyl Chloride (PVC)   A material used for the outside insulation and jacketing of most cables. Also a fire rating for a type of cable that has no significant fire protection.

Port   That portion of a computer through which a peripheral device may communicate. Often identified with the various plug-in jacks on the back of your computer. On a network hub, it is the connector that receives the wire link from a node. In TCP/IP, ports are 16-bit numbers between 0 and 65535 assigned to a particular TCP/IP session.

Port Address Translation (PAT)   The most commonly used form of Network Address Translation, where the NAT uses port numbers to map traffic from specific machines in the network. See Network Address Translation.

Port Authentication   Function of many advanced networking devices that authenticates a connecting device at the point of connection.

Port Blocking   Preventing the passage of any TCP or UDP segments or datagrams through any ports other than the ones prescribed by the system administrator.

Port Filtering   See Port Blocking.

Port Forwarding   Preventing the passage of any IP packets through any ports other than the ones prescribed by the system administrator.

Port Mirroring   The capability of many advanced switches to mirror data from any or all physical ports on a switch to a single physical port. Useful for any type of situation where an administrator needs to inspect packets coming to or from certain computers.

Port Number   Number used to identify the requested service (such as SMTP or FTP) when connecting to a TCP/IP host. Some example port numbers include 80 (HTTP), 20 (FTP), 69 (TFTP), 25 (SMTP), and 110 (POP3).

Post Office Protocol Version 3 (POP3)   One of the two protocols that receive e-mail from SMTP servers. POP3 uses TCP port 110. Most e-mail clients use this protocol, although some use IMAP4.

PostScript   A language defined by Adobe Systems, Inc., for describing how to create an image on a page. The description is independent of the resolution of the device that will create the image. It includes a technology for defining the shape of a font and creating a raster image at many different resolutions and sizes.

Power over Ethernet (PoE)   A standard that enables WAPs to receive their power from the same Ethernet cables that transfer their data.

Power Users   A user account that has the capability to do many, but not all, of the basic administrator functions.

PPPoE (PPP over Ethernet)   See Point-to-Point Protocol over Ethernet (PPPoE).

Preamble   A 64-bit series of alternating 1s and 0s, ending with 11, that begins every Ethernet frame. The preamble gives a receiving NIC time to realize a frame is coming and to know exactly where the frame starts.

Presentation Layer   See Open Systems Interconnection (OSI) Seven-Layer Model.

Primary Lookup Zone   A forward lookup zone stored in a text file. See Forward Lookup Zone.

Primary Rate Interface (PRI)   A type of ISDN that is actually just a full T1 line carrying 23 B channels.

Private Port Numbers   See Dynamic Port Numbers.

Program   A set of actions or instructions that a machine is capable of interpreting and executing. Used as a verb, it means to design, write, and test such instructions.

Promiscuous Mode   A mode of operation for a NIC in which the NIC processes all frames that it sees on the cable.

Prompt   A character or message provided by an operating system or program to indicate that it is ready to accept input.

Proprietary   Term used to describe technology that is unique to, and owned by, a particular vendor.

Protected Extensible Authentication Protocol (PEAP)   An authentication protocol that uses a password function based on MS-CHAPv2 with the addition of an encrypted TLS tunnel similar to EAP-TLS.

Protocol   An agreement that governs the procedures used to exchange information between cooperating entities; usually includes how much information is to be sent, how often it is sent, how to recover from transmission errors, and who is to receive the information.

Protocol Analyzer   A tool that monitors the different protocols running at different layers on the network and that can give Application, Session, Network, and Data Link layer information on every frame going through a network.

Protocol Stack   The actual software that implements the protocol suite on a particular operating system.

Protocol Suite   A set of protocols that are commonly used together and operate at different levels of the OSI seven-layer model.

Proxy ARP   The process of making remotely connected computers act as though they are on the same LAN as local computers.

Proxy Server   A device that fetches Internet resources for a client without exposing that client directly to the Internet. Most proxy servers accept requests for HTTP, FTP, POP3, and SMTP resources. The proxy server often caches, or stores, a copy of the requested resource for later use.

PSTN (Public Switched Telephone Network)   See Public Switched Telephone Network (PSTN).

Public-Key Cryptography   A method for exchanging digital keys securely.

Public-Key Infrastructure (PKI)   The system for creating and distributing digital certificates using sites like VeriSign, Thawte, or GoDaddy.

Public Switched Telephone Network (PSTN)   Also known as Plain Old Telephone Service (POTS). The most common type of phone connection, which takes your sounds, translated into an analog waveform by the microphone, and transmits them to another phone.

Punchdown Tool   A specialized tool for connecting UTP wires to a 110-block.

Quality of Service (QoS)   Policies that control how much bandwidth a protocol, PC, user, VLAN, or IP address may use.

Raceway   Cable organizing device that adheres to walls, making for a much simpler, though less neat, installation than running cables in the walls.

Radio Frequency Interference (RFI)   The phenomenon where a Wi-Fi signal is disrupted by a radio signal from another device.

Radio Grade (RG) Ratings   Ratings developed by the U.S. military to provide a quick reference for the different types of coaxial cables.

RADIUS Server   A system that enables remote users to connect to a network service.

Real-Time Processing   The processing of transactions as they occur, rather than batching them. Pertaining to an application, processing in which response to input is fast enough to affect subsequent inputs and guide the process, and in which records are updated immediately. The lag from input time to output time must be sufficiently small for acceptable timeliness. Timeliness is a function of the total system: missile guidance requires output within a few milliseconds of input, whereas scheduling of steamships requires a response time in days. Real-time systems are those with a response time of milliseconds; interactive systems respond in seconds; and batch systems may respond in hours or days.

Real-Time Transport Protocol (RTP)   Protocol that defines the type of packets used on the Internet to move voice or data from a server to clients. The vast majority of VoIP solutions available today use RTP.

Redundant Array of Independent [or Inexpensive] Devices [or Disks] (RAID)   A way to create a fault-tolerant storage system. RAID has six levels. Level 0 uses byte-level striping and provides no fault tolerance. Level 1 uses mirroring or duplexing. Level 2 uses bit-level striping. Level 3 stores error-correcting information (such as parity) on a separate disk and data striping on the remaining drives. Level 4 is level 3 with block-level striping. Level 5 uses block-level and parity data striping.

REGEDIT.EXE   A program used to edit the Windows registry.

Regional Internet Registries (RIRs)   Entities under the oversight of the Internet Assigned Numbers Authority (IANA), which parcels out IP addresses.

Registered Ports   Port numbers from 1024 to 49151. Anyone can use these port numbers for their servers or for ephemeral numbers on clients.

Regulations   Rules of law or policy that govern behavior in the workplace, such as what to do when a particular event occurs.

Remote   Refers to the computer(s), server(s), and/or LAN that cannot be physically used due to its distance from the user.

Remote Access   The capability to access a computer from outside a building in which it is housed. Remote access requires communications hardware, software, and actual physical links.

Remote Access Server (RAS)   Refers to both the hardware component (servers built to handle the unique stresses of a large number of clients calling in) and the software component (programs that work with the operating system to allow remote access to the network) of a remote access solution.

Remote Authentication Dial-In User Service (RADIUS)   An AAA standard created to support ISPs with hundreds if not thousands of modems in hundreds of computers to connect to a single central database. RADIUS consists of three devices: the RADIUS server that has access to a database of user names and passwords, a number of network access servers (NASs) that control the modems, and a group of systems that dial into the network.

Remote Copy Protocol (RCP)   Provides the capability to copy files to and from the remote server without the need to resort to FTP or Network File System (NFS, a UNIX form of folder sharing). RCP can also be used in scripts and shares TCP port 514 with RSH.

Remote Desktop Protocol (RDP)   A Microsoft-created remote terminal protocol.

Remote Installation Services (RIS)   A tool introduced with Windows 2000 that can be used to initiate either a scripted installation or an installation of an image of an operating system onto a PC.

Remote Login (rlogin)   Program in UNIX that enables you to log into a server remotely. Unlike Telnet, rlogin can be configured to log in automatically.

Remote Shell (RSH)   Allows you to send single commands to the remote server. Whereas rlogin is designed to be used interactively, RSH can be easily integrated into a script.

Remote Terminal   A connection on a faraway computer that enables you to control that computer as if you were sitting in front of it and logged in. Remote terminal programs all require a server and a client. The server is the computer to be controlled. The client is the computer from which you do the controlling.

Repeater   A device that takes all of the frames it receives on one Ethernet segment and re-creates them on another Ethernet segment. This allows for longer cables or more computers on a segment. Repeaters operate at Layer 1 (Physical) of the OSI seven-layer model.

Replication   A process where multiple computers might share complete copies of a database and constantly update each other.

Resistance   The tendency for a physical medium to impede electron flow. It is classically measured in a unit called ohms. See also Impedance.

Resource   Anything that exists on another computer that a person wants to use without going to that computer. Also an online information set or an online interactive option. An online library catalog and the local school lunch menu are examples of information sets. Online menus or graphical user interfaces, Internet e-mail, online conferences, Telnet, FTP, and Gopher are examples of interactive options.

Reverse Lookup Zone   A DNS setting that resolves IP addresses to FQDNs. In other words, it does exactly the reverse of what DNS normally accomplishes using forward lookup zones.

Ring Topology   A network topology in which all the computers on the network attach to a central ring of cable.

RIPv1   The first version of RIP, which had several shortcomings, such as a maximum hop count of 15 and a routing table update interval of 30 seconds, which was a problem because every router on a network would send out its table at the same time.

RIPv2   The current version of RIP. Fixed many problems of RIPv1, but the maximum hop count of 15 still applies.

Riser   Fire rating that designates the proper cabling to use for vertical runs between floors of a building.

Rivest Cipher 4 (RC4)   A popular streaming symmetric-key algorithm.

Rivest Shamir Adleman (RSA)   An improved public-key cryptography algorithm that enables secure digital signatures.

RJ (Registered Jack)   Connectors used for UTP cable on both telephone and network connections.

RJ-11   Type of connector with four-wire UTP connections; usually found in telephone connections.

RJ-45   Type of connector with eight-wire UTP connections; usually found in network connections and used for 10/100/1000BaseT networking.

Rogue Access Point   An unauthorized wireless access point (WAP) installed in a computer network.

Role-Based Access Control (RBAC)   The most popular authentication model used in file sharing, defines a user’s access to a resource based on the roles the user plays in the network environment. This leads to the idea of creation of groups. A group in most networks is nothing more than a name that has clearly defined accesses to different resources. User accounts are placed into various groups.

ROM (Read-Only Memory)   The generic term for nonvolatile memory that can be read from but not written to. This means that code and data stored in ROM cannot be corrupted by accidental erasure. Additionally, ROM retains its data when power is removed, which makes it the perfect medium for storing BIOS data or information such as scientific constants.

Root Directory   The directory that contains all other directories.

Rootkit   A Trojan that takes advantage of very low-level operating system functions to hide itself from all but the most aggressive of anti-malware tools.

route   A command that enables a user to display and edit the local system’s routing table.

Router   A device that connects separate networks and forwards a packet from one network to another based only on the network address for the protocol being used. For example, an IP router looks only at the IP network number. Routers operate at Layer 3 (Network) of the OSI seven-layer model.

Routing and Remote Access Service (RRAS)   A special remote access server program, originally only available on Windows Server, on which a PPTP endpoint is placed in Microsoft networks.

Routing Information Protocol (RIP)   Distance vector routing protocol that dates from the 1980s.

Routing Loop   A situation where interconnected routers loop traffic, causing the routers to respond slowly or not respond at all.

Routing Table   A list of paths to various networks required by routers. This table can be built either manually or automatically.

RS-232   The recommended standard (RS) upon which all serial communication takes place on a PC.

Run   A single piece of installed horizontal cabling.

Samba   An application that enables UNIX systems to communicate using Server Message Blocks (SMBs). This, in turn, enables them to act as Microsoft clients and servers on the network.

SC Connector   One of two special types of fiber-optic cable used in 10BaseFL networks.

Scalability   The capability to support network growth.

Scanner   A device that senses alterations of light and dark. It enables the user to import photographs, other physical images, and text into the computer in digital form.

Secondary Lookup Zone   A backup lookup zone stored on another DNS server. See also Forward Lookup Zone.

Secure Copy Protocol (SCP)   One of the first SSH-enabled programs to appear after the introduction of SSH. SCP was one of the first protocols used to transfer data securely between two hosts and thus might have replaced FTP. SCP works well but lacks features such as a directory listing.

Secure FTP (SFTP)   Designed as a replacement for FTP after many of the inadequacies of SCP (such as the inability to see the files on the other computer) were discovered.

Secure Hash Algorithm (SHA)   A popular cryptographic hash.

Secure Shell (SSH)   A terminal emulation program that looks exactly like Telnet but encrypts the data. SSH has replaced Telnet on the Internet.

Secure Sockets Layer (SSL)   A protocol developed by Netscape for transmitting private documents over the Internet. SSL works by using a public key to encrypt sensitive data. This encrypted data is sent over an SSL connection and then decrypted at the receiving end using a private key.

Security   A network’s resilience against unwanted access or attack.

Security Log   A log that tracks anything that affects security, such as successful and failed logons and logoffs.

Security Policy   A set of procedures defining actions employees should perform to protect the network’s security.

Segment   The bus cable to which the computers on an Ethernet network connect.

Sendmail   A popular e-mail server program.

Sequential   A method of storing and retrieving information that requires data to be written and read sequentially. Accessing any portion of the data requires reading all the preceding data.

Server   A computer that shares its resources, such as printers and files, with other computers on the network. An example of this is a Network File System Server that shares its disk space with a workstation that has no disk drive of its own.

Server-Based Network   A network in which one or more systems function as dedicated file, print, or application servers, but do not function as clients.

Service Set Identification (SSID)   A 32-bit identification string, sometimes called a network name, that’s inserted into the header of each data packet processed by a wireless access point.

Session   A networking term used to refer to the logical stream of data flowing between two programs and being communicated over a network. Many different sessions may be emanating from any one node on a network.

Session Initiation Protocol (SIP)   A signaling protocol for controlling voice and video calls over IP. SIP competes with H.323 for VoIP dominance.

Session Layer   See Open Systems Interconnection (OSI) Seven-Layer Model.

Session Software   Handles the process of differentiating among various types of connections on a PC.

Share Level Security   A security system in which each resource has a password assigned to it; access to the resource is based on knowing the password.

Share Permissions   Permissions that only control the access of other users on the network with whom you share your resource. They have no impact on you (or anyone else) sitting at the computer whose resource is being shared.

Shareware   Software that is protected by copyright, but the copyright holder allows (encourages!) you to make and distribute copies, under the condition that those who adopt the software after preview pay a fee. Derivative works are not allowed, and you may make an archival copy.

Shell   Generally refers to the user interface of an operating system. A shell is the command processor that is the actual interface between the kernel and the user.

Shielded Twisted Pair (STP)   A cabling for networks composed of pairs of wires twisted around each other at specific intervals. The twists serve to reduce interference (also called crosstalk). The more twists, the less interference. The cable has metallic shielding to protect the wires from external interference. See also Unshielded Twisted Pair (UTP) for the more commonly used cable type in modern networks.

Short Circuit   Allows electricity to pass between two conductive elements that weren’t designed to interact together. Also called a short.

Shortest Path First   Networking algorithm for directing router traffic. See also Open Shortest Path First (OSPF).

Signal Strength   A measurement of how well your wireless device is connecting to other devices.

Signaling Topology   Another name for logical topology. See Logical Topology.

Simple Mail Transfer Protocol (SMTP)   The main protocol used to send electronic mail on the Internet.

Simple Network Management Protocol (SNMP)   A set of standards for communication with devices connected to a TCP/IP network. Examples of these devices include routers, hubs, and switches.

Single-Mode Fiber (SMF)   Fiber-optic cables that use lasers.

Site Survey   A process that enables you to determine any obstacles to creating the wireless network you want.

Site-to-Site   A type of VPN connection using two Cisco VPN concentrators to connect two separate LANs permanently.

Small Form Factor (SFF)   A description of later-generation, fiber-optic connectors designed to be much smaller than the first iterations of connectors. See also LC and Mechanical Transfer Registered Jack (MT-RJ).

Small Form Factor Pluggable (SFP)   A Cisco module that enables you to add additional features to its routers.

Smart Device   Devices (such as credit cards, USB keys, etc.) that you insert into your PC in lieu of entering a password.

Smart Jack   Type of NIU that enables ISPs or telephone companies to test for faults in a network, such as disconnections and loopbacks.

SMB (Server Message Block)   Protocol used by Microsoft clients and servers to share file and print resources.

Smurf   A type of hacking attack in which an attacker floods a network with ping packets sent to the broadcast address. The trick that makes this attack special is that the return address of the pings is spoofed to that of the intended victim. When all the computers on the network respond to the initial ping, they send their response to the intended victim.

Snap-Ins   Small utilities that can be used with the Microsoft Management Console.

Snapshot   A tool that enables you to save an extra copy of a virtual machine as it is exactly at the moment the snapshot is taken.

Sneakernet   Saving a file on a portable medium and walking it over to another computer.

Sniffer   Diagnostic program that can order a NIC to run in promiscuous mode. See Promiscuous Mode.

Snip   See Cable Stripper.

Social Engineering   The process of using or manipulating people inside the networking environment to gain access to that network from the outside.

Socket   A combination of a port number and an IP address that uniquely identifies a connection.

Socket Pairs   See Endpoints.

Software   Programming instructions or data stored on some type of binary storage device.

Solid Core   A cable that uses a single solid wire to transmit signals.

SONET (Synchronous Optical Network)   A standard for connecting fiber-optic transmission systems. SONET was proposed in the mid-1980s and is now an ANSI standard. SONET defines interface standards at the Physical layer of the OSI seven-layer model.

Source Address Table (SAT)   An electronic table of the MAC addresses of each computer connected to a switch.

Spanning Tree Protocol (STP)   A protocol that enables switches to detect and repair bridge loops automatically.

Spyware   Any program that sends information about your system or your actions over the Internet.

SQL (Structured Query Language)   A language created by IBM that relies on simple English statements to perform database queries. SQL enables databases from different manufacturers to be queried using a standard syntax.

SSL (Secure Sockets Layer)   See Secure Sockets Layer (SSL).

SSL VPN   A type of VPN that uses SSL encryption. Clients connect to the VPN server using a standard Web browser, with the traffic secured using SSL. The two most common types of SSL VPNs are SSL portal VPNs and SSL tunnel VPNs.

ST Connector   One of two special types of fiber-optic cable used in 10BaseFL networks.

Star Topology   A network topology in which all computers in the network connect to a central wiring point.

Star-Bus Topology   A hybrid of the star and bus topologies that uses a physical star, where all nodes connect to a single wiring point such as a hub and a logical bus that maintains the Ethernet standards. One benefit of a star-bus topology is fault tolerance.

Star-Ring Topology   A hybrid of the Token Ring topology and the physical star.

Stateful   Describes a DHCPv6 server that works very similarly to an IPv4 DHCP server, passing out IPv6 addresses, subnet masks, and default gateways as well as optional items like DNS server addresses.

Stateful Filtering/Stateful Inspection   A method of filtering in which all packets are examined as a stream. Stateful devices can do more than allow or block; they can track when a stream is disrupted or packets get corrupted and act accordingly.

Stateless   Describes a DHCPv6 server that only passes out optional information.

Stateless Filtering   A method of filtering where the device that does the filtering just checks the packet for IP addresses and port numbers and blocks or allows accordingly.

Static Addressing   The process of assigning IP addresses by manually typing them into client computers.

Static NAT (SNAT)   A type of NAT that maps a single routable IP address to a single machine, allowing you to access that machine from outside the network.

Static Routing   A process by which routers in an internetwork obtain information about paths to other routers. This information must be supplied manually.

Storage   A device or medium that can retain data for subsequent retrieval.

STP (Spanning Tree Protocol)   See Spanning Tree Protocol (STP).

Straight-through Cable   A cable that enables you to connect the uplink ports of two hubs together.

Stranded Core   A cable that uses a bundle of tiny wire strands to transmit signals. Stranded core is not quite as good a conductor as solid core, but it will stand up to substantial handling without breaking.

Stream Cipher   An encryption method that encrypts a single bit at a time. Popular when data comes in long streams (such as with older wireless networks or cell phones).

Stripe Set   Two or more drives in a group that are used for a striped volume.

Structured Cabling   Standards defined by the Telecommunications Industry Association/Electronic Industries Alliance (TIA/EIA) that define methods of organizing the cables in a network for ease of repair and replacement.

STS Overhead   Carries the signaling and protocol information in Synchronous Transport Signal (STS).

STS Payload   Carries data in STS.

Subnet   Each independent network in a TCP/IP internetwork.

Subnet Mask   The value used in TCP/IP settings to divide the IP address of a host into its component parts: network ID and host ID.

Subnetting   Taking a single class of IP addresses and chopping it into multiple smaller groups.

Supplicant   A client computer in a RADIUS network.

Switch   A device that filters and forwards traffic based on some criteria. A bridge and a router are both examples of switches.

Switching Loop   When you connect multiple switches together to cause a loop to appear.

Symmetric DSL (SDSL)   Type of DSL connection that provides equal upload and download speed and, in theory, provides speeds up to 15 Mbps, although the vast majority of ISPs provide packages ranging from 192 Kbps to 9 Mbps.

Symmetric-Key Algorithm   Any encryption method that uses the same key for both encryption and decryption.

Synchronous   Describes a connection between two electronic devices where neither must acknowledge (ACK) when receiving data.

Synchronous Digital Hierarchy (SDH)   European fiber carrier standard equivalent to SONET.

Synchronous Optical Network (SONET)   American fiber carrier standard. See also SONET (Synchronous Optical Network).

Synchronous Transport Signal (STS)   Signal method used by SONET. It consists of the STS payload and the STS overhead. A number is appended to the end of STS to designate signal speed.

System Log   A log file that records issues dealing with the overall system, such as system services, device drivers, or configuration changes.

System Restore   A Windows utility that enables you to return your PC to a recent working configuration when something goes wrong. System Restore returns your computer’s system settings to the way they were the last time you remember your system working correctly—all without affecting your personal files or e-mail.

T1   A leased-line connection capable of carrying data at 1,544,000 bps.

T1 Line   The specific, shielded, two-pair cabling that connects the two ends of a T1 connection.

T3 Line   A leased-line connection capable of carrying data at 44,736,000 bps.

TCP Segment   The connection-oriented payload of an IP packet. A TCP segment works on the Transport layer.

TCP/IP Model   An architecture model based on the TCP/IP protocol suite, which defines and standardizes the flow of data between computers. The following lists the four layers:

    • Layer 1   The Link layer (Network Interface layer) is similar to OSI’s Data Link and Physical layers. The Link layer consists of any part of the network that deals with frames.

    • Layer 2   The Internet layer is the same as OSI’s Network layer. Any part of the network that deals with pure IP packets—getting a packet to its destination—is on the Internet layer.

    • Layer 3   The Transport layer combines the features of OSI’s Transport and Session layers. It is concerned with the assembly and disassembly of data, as well as connection-oriented and connectionless communication.

    • Layer 4   The Application layer combines the features of the top three layers of the OSI model. It consists of the processes that applications use to initiate, control, and disconnect from a remote system.

Telecommunications Room   A central location for computer or telephone equipment and, most importantly, centralized cabling. All cables usually run to the telecommunications room from the rest of the installation.

Telephony   The science of converting sound into electrical signals, moving those signals from one location to another, and then converting those signals back into sounds. This includes modems, telephone lines, the telephone system, and any products used to create a remote access link between a remote access client and server.

Telnet   A program that enables users on the Internet to log onto remote systems from their own host systems.

Temperature Monitor   Device for keeping a telecommunications room at an optimal temperature.

Temporal Key Integrity Protocol (TKIP)   The extra layer of security that WPA adds on top of WEP.

Teredo   A NAT-traversal IPv6 tunneling protocol, built into Microsoft Windows.

Terminal Access Controller Access Control System Plus (TACACS+)   A proprietary protocol developed by Cisco to support AAA in a network with many routers and switches. It is similar to RADIUS in function, but uses TCP port 49 by default and separates authorization, authentication, and accounting into different parts.

Terminal Adapter (TA)   The most common interface used to connect a computer to an ISDN line.

Terminal Emulation   Software that enables a PC to communicate with another computer or network as if it were a specific type of hardware terminal.

TIA/EIA (Telecommunications Industry Association/ Electronics Industry Association)   The standards body that defines most of the standards for computer network cabling. Many of these standards are defined under the TIA/EIA 568 standard.

TIA/EIA 568A   One of two four-pair UTP crimping standards for 10/100/ 1000BaseT networks. Often shortened to T568A. The other standard is TIA/EIA 568B.

TIA/EIA 568B   One of two four-pair UTP crimping standards for 10/100/ 1000BaseT networks. Often shortened to T568B. The other standard is TIA/EIA 568A.

TIA/EIA 606   Official methodology for labeling patch panels.

Ticket-Granting Ticket (TGT)   Sent by an Authentication Server in a Kerberos setup if a client’s hash matches its own, signaling that the client is authenticated but not yet authorized.

Time Division Multiplexing (TDM)   The process of having frames that carry a bit of every channel in every frame sent at a regular interval in a T1 connection.

Time Domain Reflectometer (TDR)   Advanced cable tester that tests the length of cables and their continuity or discontinuity, and identifies the location of any discontinuity due to a bend, break, unwanted crimp, and so on.

Tone Generator   See Toners.

Tone Probe   See Toners.

Toners   Generic term for two devices used together—a tone generator and a tone locator (probe)—to trace cables by sending an electrical signal along a wire at a particular frequency. The tone locator then emits a sound when it distinguishes that frequency. Also referred to as Fox and Hound.

Top-Level Domain Servers   A set of DNS servers—just below the root servers—that handle the top-level domain names, such as .com, .org, .net, and so on.

Topology   The pattern of interconnections in a communications system among devices, nodes, and associated input and output stations. Also describes how computers connect to each other without regard to how they actually communicate.

tracert (also traceroute)   A command-line utility used to follow the path a packet takes between two hosts.

Traffic Analysis   Tools that chart a network’s traffic usage.

Traffic Shaping   Controlling the flow of packets into or out of the network according to the type of packet or other rules.

Transceiver   The device that transmits and receives signals on a cable.

Transmission Control Protocol (TCP)   Part of the TCP/ IP protocol suite, operates at Layer 4 (Transport) of the OSI seven-layer model. TCP is a connection-oriented protocol.

Transmission Control Protocol/Internet Protocol (TCP/IP)   A set of communication protocols developed by the U.S. Department of Defense that enables dissimilar computers to share information over a network.

Transmit Beamforming   A multiple-antenna technology in 802.11n WAPs that helps get rid of dead spots.

Transport Layer   See Open System Interconnection (OSI) Seven-Layer Model.

Transport Layer Security (TLS)   A robust update to SSL that works with almost any TCP application.

Trivial File Transfer Protocol (TFTP)   A protocol that transfers files between servers and clients. Unlike FTP, TFTP requires no user login. Devices that need an operating system, but have no local hard disk (for example, diskless workstations and routers), often use TFTP to download their operating systems.

Trojan   A virus that masquerades as a file with a legitimate purpose, so that a user will run it intentionally. The classic example is a file that runs a game, but also causes some type of damage to the player’s system.

Trunk Port   A port on a switch configured to carry all data, regardless of VLAN number, between all switches in a LAN.

Trunking   The process of transferring VLAN data between two or more switches.

Tunnel   An encrypted link between two programs on two separate computers.

Tunnel Broker   In IPv6, a service that creates the actual tunnel and (usually) offers a custom-made endpoint client for you to use, although more advanced users can often make a manual connection.

Tunnel Information and Control Protocol (TIC)   One of the protocols that set up IPv6 tunnels and handle configuration as well as login.

Tunnel Setup Protocol (TSP)   One of the protocols that set up IPv6 tunnels and handle configuration as well as login.

Twisted Pair   Twisted pairs of cables, the most overwhelmingly common type of cabling used in networks. The two types of twisted pair cabling are UTP (unshielded twisted pair) and STP (shielded twisted pair). The twists serve to reduce interference, called crosstalk; the more twists, the less crosstalk.

Two-Factor Authentication   A method of security authentication that requires two separate means of authentication, for example, some sort of physical token that, when inserted, prompts for a password.

U (Units)   The unique height measurement used with equipment racks; 1 U equals 1.75 inches.

UART (Universal Asynchronous Receiver/Transmitter)   A device that turns serial data into parallel data. The cornerstone of serial ports and modems.

UDP (User Datagram Protocol)   Part of the TCP/IP protocol suite, a connectionless protocol that is an alternative to TCP.

UDP Datagram   A connectionless networking container used in UDP communication.

UNC (Universal Naming Convention)   Describes any shared resource in a network using the convention \\<server name>\<name of shared resource>.

Unicast   A message sent from one computer to one other computer.

Unicast Address   A unique IPv6 address that is exclusive to a system. Link-local addresses are unicast addresses.

Unified Communication (UC)   A system that rolls many different network services into one, for example, instant messaging (IM), telephone service, video conferencing, and more.

Uninterruptible Power Supply (UPS)   A device that supplies continuous clean power to a computer system the whole time the computer is on. Protects against power outages and sags. The term UPS is often used mistakenly when people mean stand-by power supply or system (SPS).

Universal Asynchronous Receiver/Transmitter (UART)   A device inside a modem that takes the 8-bit-wide digital data and converts it into 1-bit-wide digital data and hands it to the modem for conversion to analog data. The process is reversed for incoming data.

UNIX   A popular computer software operating system used on many Internet host systems.

Unshielded Twisted Pair (UTP)   A popular cabling for telephone and networks composed of pairs of wires twisted around each other at specific intervals. The twists serve to reduce interference (also called crosstalk). The more twists, the less interference. The cable has no metallic shielding to protect the wires from external interference, unlike its cousin, STP. 10BaseT uses UTP, as do many other networking technologies. UTP is available in a variety of grades, called categories, as defined in the following:

    • Category 1 UTP   Regular analog phone lines, not used for data communications

    • Category 2 UTP   Supports speeds up to 4 Mbps

    • Category 3 UTP   Supports speeds up to 16 Mbps

    • Category 4 UTP   Supports speeds up to 20 Mbps

    • Category 5 UTP   Supports speeds up to 100 Mbps

    • Category 5e UTP   Supports speeds up to 100 Mbps with two pairs and up to 1000 Mbps with four pairs

    • Category 6 UTP   Improved support for speeds up to 10 Gbps

    • Category 6a UTP   Extends the length of 10-Gbps communication to the full 100 meters commonly associated with UTP cabling.

Uplink Port   Port on a hub that enables you to connect two hubs together using a straight-through cable.

Upload   The transfer of information from a user’s system to a remote computer system. Opposite of download. See also Download.

URL (Uniform Resource Locator)   An address that defines the type and the location of a resource on the Internet. URLs are used in almost every TCP/IP application. A typical HTTP URL is http://www.totalsem.com.

Usenet   The network of UNIX users, generally perceived as informal and made up of loosely coupled nodes, that exchanges mail and messages. Started by Duke University and UNC-Chapel Hill. An information cooperative linking around 16,000 computer sites and millions of people. Usenet provides a series of “news groups” analogous to online conferences.

User   Anyone who uses a computer. You.

User Account   A container that identifies a user to the application, operating system, or network, including name, password, user name, groups to which the user belongs, and other information based on the user and the OS or NOS being used. Usually defines the rights and roles a user plays on a system.

User Datagram Protocol (UDP)   A protocol used by some older applications, most prominently TFTP (Trivial FTP), to transfer files. UDP datagrams are both simpler and smaller than TCP segments, and they do most of the behind-the-scenes work in a TCP/IP network.

User-Level Security   A security system in which each user has an account, and access to resources is based on user identity.

User Profiles   A collection of settings that corresponds to a specific user account and may follow the user, regardless of the computer at which he or she logs on. These settings enable the user to have customized environment and security settings.

V Standards   Standards established by CCITT for modem manufacturers to follow (voluntarily) to ensure compatible speeds, compression, and error correction.

V.92 Standard   The current modem standard, which has a download speed of 57,600 bps and an upload speed of 48 Kbps. V.92 modems have several interesting features, such as Quick Connect and Modem on Hold.

Vertical Cross-Connect   Main patch panel in a telecommunications room. See also Patch Panel.

Very High Bitrate DSL (VDSL)   The latest form of DSL with download and upload speeds of up to 100 Mbps. VDSL was designed to run on copper phone lines, but many VDSL suppliers use fiber-optic cabling to increase effective distances.

View   The different displays found in Performance Monitor.

Virtual Local Area Network (VLAN)   A LAN that, using VLAN-capable switches, places some (or any on the more expensive VLANs) systems on virtual broadcast domains.

Virtual Machine (VM)   A virtual computer accessed through a class of program called a hypervisor or virtual machine manager. A virtual machine runs inside your actual operating system, essentially enabling you to run two or more operating systems at once.

Virtual Machine Manager (VMM)   See Hypervisor.

Virtual PBX   Software that functionally replaces a physical PBX telephone system.

Virtual Private Network (VPN)   A network configuration that enables a remote user to access a private network via the Internet. VPNs employ an encryption methodology called tunneling, which protects the data from interception.

Virtual Switch   Special software that enables VMs to communicate with each other without going outside of the host system.

Virtual Trunk Protocol (VTP)   A proprietary Cisco protocol to automate the updating of multiple VLAN switches.

Virus   A program that can make a copy of itself without you necessarily being aware of it. Some viruses can destroy or damage files, and generally the best protection is always to maintain backups of your files.

Virus Definition or Data Files   Enables the virus protection software to recognize the viruses on your system and clean them. These files should be updated often. Also called signature files, depending on the virus protection software in use.

Voice over IP (VoIP)   Using an IP network to transfer voice calls.

Voltage   The pressure of the electrons passing through a wire.

Voltage Event Recorder   Tracks voltage over time by plugging into a power outlet.

Volts (V)   Units of measurement for voltage.

VPN Concentrator   The new endpoint of the local LAN in L2TP.

Vulnerability Scanner   A tool that scans a network for potential attack vectors.

WAN (Wide Area Network)   A geographically dispersed network created by linking various computers and LANs over long distances, generally using leased phone lines. There is no firm dividing line between a WAN and a LAN.

Warm Boot   A system restart performed after the system has been powered and operating. This clears and resets the memory, but does not stop and start the hard drive.

Wattage (Watts or W)   The amount of amps and volts needed by a particular device to function.

Web Server   A server that enables access to HTML documents by remote users.

Well-Known Port Numbers   Port numbers from 0 to 1204 that are used primarily by client applications to talk to server applications in TCP/IP networks.

Wi-Fi   The most widely adopted wireless networking type in use today. Technically, only wireless devices that conform to the extended versions of the 802.11 standard—802.11a, 802.11b, and 802.11g—are Wi-Fi certified.

Wi-Fi Protected Access (WPA)   A wireless security protocol that addresses the weaknesses and acts as a sort of upgrade to WEP. WPA offers security enhancements such as dynamic encryption key generation (keys are issued on a per-user and per-session basis), an encryption key integrity-checking feature, user authentication through the industry-standard Extensible Authentication Protocol (EAP), and other advanced features that WEP lacks.

Wi-Fi Protected Access 2 (WPA2)   An update to the WPA protocol that uses the Advanced Encryption Standard algorithm, making it much harder to crack.

WiMax   See 802.16.

Windows Domain   A group of computers controlled by a computer running Windows Server, which is configured as a domain controller.

Windows Firewall   The firewall that has been included in Windows operating systems since Windows XP; originally named Internet Connection Firewall (ICF) but renamed in XP Service Pack 2.

Windows Internet Name Service (WINS)   A name resolution service that resolves NetBIOS names to IP addresses.

winipcfg   A graphical program used on Windows 95, Windows 98, and Windows Me machines to display the current TCP/IP configuration of the machine; similar to more modern Windows’s ipconfig and UNIX/ Linux’s ifconfig.

WINS Proxy Agent   A WINS relay agent that forwards WINS broadcasts to a WINS server on the other side of a router to keep older systems from broadcasting in place of registering with the server.

Wire Scheme   See Wiring Diagram.

Wired Equivalent Privacy (WEP)   A wireless security protocol that uses a 64-bit encryption algorithm to scramble data packets.

Wireless Access Point (WAP)   Connects wireless network nodes to wireless or wired networks. Many WAPs are combination devices that act as high-speed hubs, switches, bridges, and routers, all rolled into one.

Wireless Bridge   Device used to connect two wireless network segments together, or to join wireless and wired networks together in the same way that wired bridge devices do.

Wireless Network   See Wi-Fi.

Wiremap   Term that techs use to refer to the proper connectivity of wires in a network.

Wireshark   A popular packet sniffer.

Wiring Diagram   A document, also known as a wiring schematic, that usually consists of multiple pages and that shows the following: how the wires in a network connect to switches and other nodes, what types of cables are used, and how patch panels are configured. It usually includes details about each cable run.

Wiring Schematic   See Wiring Diagram.

Work Area   In a basic structured cabling network, often simply an office or cubicle that potentially contains a PC attached to the network.

Workgroup   A convenient method of organizing computers under Network/My Network Places in Windows operating systems.

Workstation   A general-purpose computer that is small enough and inexpensive enough to reside at a person’s work area for his or her exclusive use.

Worm   A very special form of virus. Unlike other viruses, a worm does not infect other files on the computer. Instead, it replicates by making copies of itself on other systems on a network by taking advantage of security weaknesses in networking protocols.

WPA2-Enterprise   A version of WPA2 that uses a RADIUS server for authentication.

WWW (World Wide Web)   The (graphical) Internet that can be accessed using Gopher, FTP, HTTP, Telnet, Usenet, WAIS, and some other tools.

X.25   The first generation of packet-switching technology, enables remote devices to communicate with each other across high-speed digital links without the expense of individual leased lines.

Yost Cable   Cable used to interface with a Cisco device.

Zombie   A single computer under the control of an operator that is used in a botnet attack. See also Botnet.

Index

Symbols and Numbers

/ (forward slash) in subnet masks

(double colons) in IPv6 addresses

; (colon) in IP addresses

8P8C connector

10 GbE (10 Gigabit Ethernet)

          defined

          tier 1 Internet

10Base2

10Base5

10BaseT

          defined

          Gigabit Ethernet

          star bus topology

32-bit IP addresses. See IPv4 addressing

66 block

100BaseFX

100BaseT

          defined

          Gigabit Ethernet

          star bus topology

100BaseT4

100BaseTX

110 block

128-bit addressing

802.1x

802.11

          collision avoidance

          defined

802.11a

802.11b

802.11g

802.11n

802.16

802.3

802.3ab

802.3z

802.6

1000BaseCX

1000BaseLX

1000BaseSX

1000BaseT

          defined

          Gigabit Ethernet

1000BaseX

A

acceptable use policy

access control

          administrative

          NAC

          share-level

          user-level

access control list (ACL)

          defined

          packet filtering

access points (APs). See also WAPs (wireless access points)

access, remote. See remote access

access security

access token

ACK (acknowledge)

          CSMA/CA

          TCP three-way handshake

ACL (access control list)

          defined

          packet filtering

activation

ad hoc mode

Address Resolution Protocol (ARP)

addresses, IP. See IP (Internet Protocol) addresses

addresses, MAC. See MAC (Media Access Control) addresses

addressing, IPv4. See IPv4 addressing

admin password

administrative access control

ADSL (Asymmetric DSL)

Advanced Encryption Standard (AES)

adware

AES (Advanced Encryption Standard)

agents

Allman, Eric

American Registry for Internet Numbers (ARIN)

analog

          DS0

          PSTN

          telephony

antenna upgrading

antimalware programs

anycast addresses

APIPA (Automatic Private IP Addressing)

APIs (Application Programming Interfaces)

Application layer

          defined

          protocols

          SSL VPNs

          in TCP/IP model

Application Programming Interface (API)

application service providers (ASPs)

applications

APs (access points). See also WAPs (wireless access points)

ARP (Address Resolution Protocol)

          defined

          ICMPv6

arp utility

arping

AS (Autonomous System)

ASN (Autonomous System Number)

ASPs (application service providers)

asset management

Asterisk

Asymmetric DSL (ADSL)

Asynchronous Transfer Mode (ATM)

          routing

          WANs

AT&T

ATM (Asynchronous Transfer Mode)

          routing

          WANs

attenuation

authentication

Authentication, Authorization, and Accounting (AAA)

Authentication Header (AH)

Authentication Server (AS)

          defined

          Kerberos

authenticator

authorization

Automatic Private IP Addressing (APIPA)

Autonomous System (AS)

Autonomous System Number (ASN)

B

B channels (Bearer channels)

backoff period

bad modules

bandwidth

          controlling data throughput

          routing metrics

          shaper

bandwidth shaping

bandwidth throttling

baseband

          vs. broadband

          coaxial cable types

          Ethernet standards

baselines

          monitoring networks

          network configuration management

basic NAT

Basic Rate Interface (BRI) setup

Basic Service Set (BSS)

Basic Service Set ID (BSSID)

baud

          vs. bits per second

          defined

baud rate

beam antenna

Bearer channels (B channels)

behavior-based IDS

BERT (Bit Error Rate Test)

BGPs (Border Gateway Protocols)

          distance vector routing

          dynamic routing

binary values

          calculating subnets

          class IDs

          converting decimal IP address to

          subnet masks

          subnetting

biometric devices

Bit Error Rate Test (BERT)

bits per second

Bluetooth

BNC connectors

bonding

Border Gateway Protocols (BGPs)

          distance vector routing

          dynamic routing

botnets

bounded media

BPDU (Bridge Protocol Data Unit)

BPL (Broadband over Power Line)

BRI (Basic Rate Interface) setup

Bridge Protocol Data Unit (BPDU)

bridged connections

bridged NICs

bridges

bridging loops

broadband

          vs. baseband

          coaxial cable types

          Ethernet standards

Broadband over Power Line (BPL)

broadcast

          calculating subnets

          class IDs

          flooded

          flooded vs. directed

          traffic

broadcast address

broadcast domains

          defined

          VLANs

BSS (Basic Service Set)

BSSID (Basic Service Set ID)

buffer overflows

bus topology

          overview

          star bus topology

butt set

C

cable breaks

          bus topology and Ethernet

          troubleshooting

cable certifiers

cable management

cable modems

          remote access

          WANs

cable shorts

cable strippers

cable testers

cabling. See also network media

          defined

          Ethernet

          wiring schemes

Cache Array Routing Protocol (CARP)

caching

caching engines

Cacti

calculations, subnetting

calculators

CAN (campus area network)

canonical name (CNAME)

career flight path

CARP (Cache Array Routing Protocol)

carrier sense

carrier sense multiple access/collision avoidance (CSMA/CA)

          vs. CSMA/CD

          WAPs and

carrier sense multiple access/collision detection (CSMA/CD). See CSMA/CD (carrier sense multiple access/collision detection)

case sensitivity

          nbtstat

          TCP/IP utilities

categories of UTP cabling

Category 5 (CAT 5)

          defined

          UTP cable types

Category 6 (CAT 6)

          defined

          UTP cable types

CCENT (Cisco Certified Entry Networking Technician) exam

CCITT (International Telegraph and Telephone Consultative Committee)

          defined

          Packet Switching Protocol

cells

cellular WANs

central offices

certifications

certifiers

Challenge Handshake Authentication Protocol (CHAP)

challenge messages

change management documentation

channel bonding

channel service unit/digital service unit (CSU/DSU)

          defined,

          getting WAN connection

channels

          B and D

          changing wireless settings

          copper carriers

          troubleshooting wireless networking

          wireless frequency ranges

checking system logs

checksum

CIDR (Classless Inter-Domain Routing)

circuit switches

circuit switching

Cisco

          3550

          certifications

          L2TP VPNs

          NAC

          network topology icons

          VTP

Cisco Certified Entry Networking Technician (CCENT) exam

Cisco Network Assistant

Cisco routers

          configuring NAT

          configuring to use ASN

          freedom from layer 2

          routing

          virtual switches

Citrix MetaFrame

class IDs

class licenses

          defined

          IPv4 addressing

Class of Service (CoS)

classes

Classless Inter-Domain Routing (CIDR)

CLEAR home modem

client/server topology

client-to-site connection

clients

          DHCP

          installing wireless network

          network fundamentals

          protecting from physical intrusion

          remote terminal

          TCP three-way handshake

          VPNs

close-ended questions

cloud computing

CNAME (canonical name)

coaxial cabling

          cable modem

          media converters

          overview

collision domain

collisions

          CSMA/CA

          defined

          ring topologies

          switched Ethernet and,

colon (;) in IP addresses

color-coding of UTP wiring standards

commands. See TCP/IP utilities

communication

          connecting LANs

          connection-oriented vs. connectionless

          routing. See routing

compatibility

components of network

compound application protocols

compressing zeros

CompTIA Security+ Certification

CompTIA Server+ Certification

computing, virtual

configuration

          NAT

          network configuration management. See network configuration management

          VLAN-capable switch

connection-oriented communication

          vs. connectionless communication

          TCP three-way handshake

connectionless communication

          vs. connection-oriented communication

          with ICMP

          UDP

connections

          cross-connects, MDF, and IDF

          designing SOHO network

          IP addressing

          LANs

          sockets

          WAN

connectivity

          documenting network

          MTU black hole

          network components

          network media. See network media

          routing. See routing

          traceroute and ping

          WAN. See WANs (wide area networks)

connectors

          coaxial cabling

          optical fiber

          troubleshooting

          UTP

          wiring schemes

console cables

content filters

content switches

continuity testers

convergence

          defined

          with OSPF

copper carriers

Cordless Telephony Profile

core wires

CoS (Class of Service)

CoS (Cost of Service)

cost in distance vectors

Cost of Service (CoS)

counter-rotating rings

crimpers

cross connects

crossover cables

          connecting Ethernet segments

          T1

          wiring standards

crosstalk

          defined

          troubleshooting

          UTP testing

CSMA/CA (carrier sense multiple access/collision avoidance)

          vs. CSMA/CD

          WAPs and

CSMA/CD (carrier sense multiple access/collision detection)

          bus topology and Ethernet

          defined

          switched Ethernet and

          vs CSMA/CA

          WAPs and

CSU/DSU (channel service unit/data services)

          defined,

          getting WAN connection

cyclic redundancy check

D

D channels (Delta channels)

daisy-chained switches

DARPA (Defense Advanced Research Projects Agency)

Data Encryption Standard (DES)

data frames

          data link layer

          Ethernet

Data Link layer

          bridges

          defined

Data-Over-Cable Service Interface Specification (DOCSIS)

          cable modems

          defined

          routing

datagrams

DB-9 connectors

dB (decibel) loss

dB (decibels)

DCF (Distributed Coordination Function)

DDNS (Dynamic DNS)

DDoS (distributed denial of service) attacks

DEC (Digital Equipment Corporation)

decimal notation

          IP addresses

          subnet masks

dedicated connections

          defined

          remote access

default gateways

          configuring TCP/IP

          defined

          gateway router

          ipconfig

          subnet masks and

default routes

default subnetmask (DSM)

Defense Advanced Research Projects Agency (DARPA)

Delta channels (D channels)

demarc

          defined

          getting WAN connection

          PSTN

demarc extensions

demarcation point

demilitarized zone (DMZ)

demultiplexer

Denial of Service (DoS) attacks

Dense WDM (DWDM)

DES (Data Encryption Standard)

designing and implementing SOHO network

desktop, virtual

destination host unreachable message

Destination LAN IP

destination MAC addresses

destination port numbers

DF (Don’t Fragment) flag

DHCP (Dynamic Host Configuration Protocol)

          overview

          port numbers

          routing tables and

DHCP lease

DHCP reservations

DHCP scope

diagrams, network

          network maps and

dial-up

          private dial-up

          remote Internet access

          WANs

Dial-up Networking Profile

Differentiated Services Code Point (DSCP)

dig utility

Digital Equipment Corporation (DEC)

Digital-Intel-Xerox (DIX)

digital signal

digital signal 1 (DS1)

digital subscriber line (DSL)

          NIU

          remote access

          WANs

digital telephony

          overview

          switch to

Direct Sequence Spread Spectrum (DSSS)

directed broadcasts

direction in distance vectors

directional antennas

distance

          10 GbE

          Ethernet standards

          Gigabit Ethernet

          need for optical fiber

          troubleshooting wireless networking

          types of optical fiber

distance vectors

          BGP and

          dynamic routing

Distributed Coordination Function (DCF)

distributed denial of service (DDoS) attacks

DIX (Digital-Intel-Xerox)

DMZ (demilitarized zone)

DNS (Domain Name System)

          DHCP

          dig utility

          ipconfig

          load balancing

          nslookup utility

          overview

          port number

          records

          troubleshooting performance

DNS root

DNS root servers

DNS servers

DNS suffix

DOCSIS (Data-Over-Cable Service Interface Specification)

          cable modems

          defined

          routing

documentation

          baselines

          change management documentation

          implement and test solution

          network configuration management

          network connectivity

          policies, procedures, and configurations

          regulations

          troubleshooting findings, actions, and outcomes

Domain Name System (DNS). See DNS (Domain Name System)

Don’t Fragment (DF) flag

DoS (Denial of Service) attacks

dotted decimal notation

          calculating subnets

          class IDs

          defined

          subnet masks

          subnetting

dotted octet numbering system

double colons (::) in IPv6 addresses

downloads

          antimalware programs

          DSL and

DS0

DS1

DS3

DSCP (Differentiated Services Code Point)

DSL Access Multiplexer (DSLAM)

DSL (digital subscriber line)

          NIU

          remote access

          WANs

DSM (default subnetmask)

DSSS (Direct Sequence Spread Spectrum)

dumpster diving

duplex mismatch

duplication with virtualization

DVRs

DWDM (Dense WDM)

Dynamic DNS (DDNS)

Dynamic Host Configuration Protocol (DHCP). See DHCP (Dynamic Host Configuration Protocol)

dynamic NAT

dynamic ports

          port filtering and

          port numbers

dynamic routing

          distance vector

          Internet and

          link state

          metrics

          overview

dynamic VLANs

E

E1 (E-carrier level 1)

EAP (Extensible Authentication Protocol)

eBGP (exterior BGP)

edge routers

EGP (Exterior Gateway Protocol)

EIA (Electronics Industries Alliance)

EIGRP (Enhanced Interior Gateway Routing Protocol)

EMI (electromagnetic interference)

          coaxial cabling and

          need for optical fiber

          UTP testing

Encapsulating Security Payload (ESP)

encryption

          cracking wireless

          implementing on wireless network

          IPsec

          troubleshooting wireless networking

encryption devices

endpoints

          defined

          VPN

EngageIP Cache Server

Enhanced Interior Gateway Routing Protocol (EIGRP)

environmental monitors

ephemeral ports

equipment room

equipment testing

errors. See also troubleshooting networks

          FCS

          ICMPv6

          troubleshooting wireless networking

escalate

          defined

          implement and test solution or

          switching loops and routing problems

ESP (Encapsulating Security Payload)

ESS (Extended Service Set)

ESSID (Extended Service Set Identifier)

ESX

          defined

          features

ESXi

Ethernet

          bus topology

          coaxial cable types

          connecting segments

          copper carriers

          frames

          ifconfig

          implementing with optical cabling

          ISPs and MTUs

          overview

          vs. ring topologies

          routers and

          vs. telephony WAN

          tier 1 Internet and

          UTP cable types

EUI-48

EUI-64

Event Viewer

evil twin attacks

experimental addresses

Extended DSL (XDSL)

Extended Service Set (ESS)

Extended Service Set Identifier (ESSID)

Extended Unique Identifier

Extensible Authentication Protocol (EAP)

exterior BGP (eBGP)

Exterior Gateway Protocol (EGP)

external connections

external threats

extranet

F

F connectors

far-end crosstalk (FEXT)

Fast Ethernet

          defined

          star bus topology

fault tolerance

          checking system logs

          controlling data throughput

          ESX

          system crash/hardware failure

Fax Profile

FCS (frame check sequence)

          data link layer

          defined

FDM (frequency division multiplexing)

FEC (Forwarding Equivalence Class)

FEP (fluorinated ethylene polymer)

FEXT (far-end crosstalk)

FHSS (Frequency Hopping Spread Spectrum)

fiber-optic

          100BaseFX

          carriers

          overview

          WANs

File Transfer Profile (FTP)

File Transfer Protocol (FTP) bounce attack

File Transfer Protocol (FTP) port numbers

filtering

          implementing MAC

          MAC

          packet

          port

          traffic

FIN, ACK (finished, acknowledge)

firewalls

          hiding IPs

          MAC filtering

          network topology icons

          network zones

          overview

          packet filtering

          personal firewalls

          port filtering

          vulnerability scanners

flags

          DF

          TCP

flooded broadcasts

          defined

          vs. directed broadcasts

flooding

fluorinated ethylene polymer (FEP)

formula, subnet

forward slash (/) in subnet masks

Forwarding Equivalence Class (FEC)

forwarding traffic

four stages of Bluetooth

Fox and Hound

FQDNs (fully qualified domain names)

fractional T1 access

fragmentation

          defined

          routing metrics

frame check sequence (FCS)

          data link layer

          defined

Frame Relay

          defined

          packet switching

frequencies

          Bluetooth

          IrDA

          troubleshooting wireless networking

          wireless standards

frequency division multiplexing (FDM)

Frequency Hopping Spread Spectrum (FHSS)

frequency ranges

          telephony

          wireless

FTP (File Transfer Profile)

FTP (File Transfer Protocol) bounce attack

FTP (File Transfer Protocol) port numbers

full duplex

full-duplex switches

fully qualified domain names (FQDNS)

G

gain

game consoles

GAN (global area network)

gateway router

gateways

          incorrect

          routing tables

          VPNs

gathering information

GbE (Gigabit Ethernet)

          10 GbE

          defined

          media converters

          star bus topology

          tier 1 Internet

GBIC (gigabit interface converter)

general logs

Generic Access Profile

Generic Object Exchange Profile

Gigabit Ethernet (GbE). See GbE (Gigabit Ethernet)

gigabit interface converter (GBIC)

global area network (GAN)

global unicast addresses

groups

H

H.323

hackers

          defined

          vs. social engineering

half duplex

half-duplex switches

hardware. See network hardware

hardware firewalls

hashing algorithms

HCC (horizontal cross-connect)

HDLC (High-Level Data Link Control) protocol

headers

          IP

          MPLS

          TCP

          UDP

Headset Profile

Hello packets

hextets

hidden node

HIDS (host-based IDS)

high availability

High-Level Data Link Control (HDLC) protocol

High-Speed Packet Access (HSPA)

history logs

home

HomePlug

honeynet

honeypots

hops

          defined

          distance vectors

          RIP maximums

horizontal cabling

horizontal cross-connect (HCC)

host-based firewalls

host-based IDS (HIDS)

host IDs

host-to-gateway tunnel

hosted virtualization

hosts

          calculating subnets

          DNS

          error messages

          subnetting and

          virtual

          virtual computing

          VMMs and hypervisors

          VPNs

HOSTS file

HSPA (High-Speed Packet Access)

HTTP (Hypertext Transfer Protocol)

          defined

          port number

HTTPS (Hypertext Transfer Protocol over SSL)

hubs

          defined

          overview

          star bus topology

          switched Ethernet and

HughesNet

Hulu

hybrid network

hybrid topology

Hypertext Transfer Protocol (HTTP)

          defined

          port number

Hypertext Transfer Protocol over SSL (HTTPS)

HyperV

hypervisors

          defined

          in modern networks

          why we virtualize

I

IANA (Internet Assigned Numbers Authority)

          BGP

          class IDs

          IPv4 addresses

          registered ports

iBGP (internal BGP)

ICA (Independent Computing Architecture)

ICMP (Internet Control Message Protocol)

          defined

          ping

ICMPv6 (Internet Control Message Protocol version 6)

icons

identifiers

          BSSID, SSID, and ESSID

          MPLS

          OUI

identify network problem

identifying symptoms

IDF (intermediate distribution frame)

IDS (intrusion detection system)

IEEE (Institute of Electrical and Electronics Engineers)

          802.11 committee

          802.6

          Ethernet standards

          MAC addresses

          wireless standards

IETF (Internet Engineering Task Force)

ifconfig

IGMP (Internet Group Management Protocol)

IGMP (Internet Group Multicast Protocol)

IGPs (Interior Gateway Protocols)

          defined

          dynamic routing protocols

          OSPF

IGRP (Interior Gateway Routing Protocol)

IKE and IKEv2 (Internet Key Exchange)

IMAP4 (Internet Message Access Protocol version 4)

impedance

implicit deny any

Independent Computing Architecture (ICA)

Infrared Data Association (IrDA) protocol

infrared wireless networking

infrastructure mode

inherent factor

installation

          access point

          cable modem

          DSL

          wireless network client

Institute of Electrical and Electronics Engineers (IEEE). See IEEE (Institute of Electrical and Electronics Engineers)

Integrated Services Digital Network (ISDN) service

Intercom Profile

Interface field in routing tables

interference

          troubleshooting networks

          troubleshooting wireless networking

Interior Gateway Protocols (IGPs)

          defined

          dynamic routing protocols

          OSPF

Interior Gateway Routing Protocol (IGRP)

intermediate distribution frame (IDF)

Intermediate System to Intermediate System (IS-IS)

internal BGP (iBGP)

internal connections

internal modems

internal threats

International Organization for Standardization (ISO)

International Telecommunication Union Telecommunication Standardization Sector (ITU-T)

International Telegraph and Telephone Consultative Committee (CCITT)

          defined

          Packet Switching Protocol

Internet

          BGP

          convergence

          dynamic routing and

          getting WAN connection

          switched Internet

          as WAN

Internet Assigned Numbers Authority (IANA). See IANA (Internet Assigned Numbers Authority)

Internet Control Message Protocol (ICMP)

          defined

          ping

Internet Control Message Protocol version 6 (ICMPv6)

Internet Corporation for Assigned Names and Numbers (ICANN)

Internet Engineering Task Force (IETF)

Internet Group Management Protocol (IGMP)

Internet Group Multicast Protocol (IGMP)

Internet Key Exchange (IKE and IKEv2)

Internet layer

          defined

          IPsec

          protocols

Internet Message Access Protocol version 4 (IMAP4)

Internet Protocol (IP)

Internet Protocol (IP) addresses. See IP (Internet Protocol) addresses

Internet Protocol Security (IPsec)

Internet Security Association and Key Management Protocol (ISAKMP)

Internet service providers (ISPs). See ISPs (Internet service providers)

Internet Society (ISOC)

interVLAN routing

intranet

intrusion detection system (IDS)

intrusion prevention system (IPS)

IP filtering

IP (Internet Protocol)

IP (Internet Protocol) addresses

          configuring TCP/IP

          defined

          firewalls

          incorrect

          in network layer

          ping

          routing. See routing

IP packets

ipconfig /all

          displaying IP addresses

          MAC address display

ipconfig utility

IPS (intrusion prevention system)

IPsec (IP Security)

          remote connection security

          VPNs

IPv4 addressing

          class IDs

          DHCP

          interconnecting

          IP addresses

          IP addresses in action

          IP class licenses

          NAT and

          network IDs

          overview

          public vs. private IP addresses

          subnet masks

IPv6 addressing

          DHCP

          TCP/IP

IrDA (Infrared Data Association) protocol

ISAKMP (Internet Security Association and Key Management Protocol)

ISDN (Integrated Services Digital Network) service

ISO (International Organization for Standardization)

ISOC (Internet Society)

ISPs (Internet service providers)

          MPLS and

          MTUs and

          NAT and

          NIU

          tier 1

ITU-T (International Telecommunication Union Telecommunication Standardization Sector)

J

jitter

K

KDC (Key Distribution Center)

Kerberos

KINK (Kerberized Internet Negotiation of Keys)

knowledge factor

KVM switches

L

L2TP (Layer 2 Tunneling Protocol) VPNs

Label Distribution Protocol (LDP)

label edge router (LER)

Label field in MPLS

label switching router (LSR)

LAN Access Profile

LANs (local area networks)

          connecting

          defined

          interconnecting

          IP addresses in action

          network IDs

          subnet masks

          VLANs

laser links

last mile

          BPL

          cable modems

          cellular

          defined

          dial-up

          DSL

          fiber

          overview

          satellite

latency

          defined

          routing metrics

latency-sensitive applications

layer 2

          freedom from

          switches

Layer 2 Tunneling Protocol (L2TP) VPNs

layers of OSI model

layers of TCP/IP model

          defined

          implementing VPNs

LC (local connector)

LDAP (Lightweight Directory Access Protocol)

LDP (Label Distribution Protocol)

lease, DHCP

LEC (Local Exchange Carrier)

leeching

LER(label edge router)

Lightweight Directory Access Protocol (LDAP)

Line Printer (LPR)

Link layer

link lights

link-local unicast addresses

link state

link state advertisements (LSAs)

Linksys routers

          configuring NAT

          routing

Linux

          administrative access control

          ipconfig /all

          syslog

          viewing routing tables in

          virtualization software

LLC (Logical Link Control)

load balancing

local area networks (LANs). See LANs (local area networks)

local connector (LC)

Local Exchange Carrier (LEC)

local exchanges

local machine

Logical Link Control (LLC)

logical topology

logon security

logs

          checking system

          network traffic and

          SNMP

long distance

Long Term Evolution (LTE)

loopback addresses

          defined

          routing tables

loopback cables

loopback plugs

loopback testing

          defined

          troubleshooting NIC

loops, bridging

LPR (Line Printer)

LSAs (link state advertisements)

LSR (label switching router)

LTE (Long Term Evolution)

M

MAC-48

MAC filtering

          firewalls

          implementing wireless network

MAC (Media Access Control)

MAC (Media Access Control) addresses

          ARP and

          assigning to VLANs

          BSSID and

          defined

          destination and source

          display

          displaying

          dynamic VLANs

          network interfaces

          subnet masks and

          switched Ethernet and

Mac OS X

          administrative access control

          logs and network traffic

          Network utility

          Parallels

          RAS

          viewing routing tables in

          VPN

macro viruses

macros

Mail eXchanger (MX)

main distribution frame (MDF)

malware

Malwarebytes Anti-Malware

man-in-the-middle attacks

man nslookup

managed switches

Management Information Base (MIB)

MANs (metropolitan area networks)

          802.16

          defined

maps, network

master/slave scheme

Maximum Transmission Unit (MTU)

          defined

          routing metrics

MCITP (Microsoft Certified IT Professional) certification

MCTS (Microsoft Certified Technology Specialist) Certifications

MD5 (Message Digest 5)

MDF (main distribution frame)

MDI (media-dependent interface)

MDIX (media-dependent interface crossover)

mechanical-transfer registered jack (MT-RJ)

media. See network media

Media Access Control (MAC)

Media Access Control (MAC) addresses. See MAC (Media Access Control) addresses

media converters

media-dependent interface crossover (MDIX)

media-dependent interface (MDI)

media streaming with RSTP

mesh topology

Message Digest 5 (MD5)

metrics

          defined

          dynamic routing

          routing tables

metropolitan area networks (MANs)

          802.16

          defined

MIB (Management Information Base)

Microsoft

          drawing network diagrams

          ISPs and MTUs

          Kerberos and

          MS-CHAP

          patch management

          RRAS

          Windows. See Windows

Microsoft Certified IT Professional (MCITP) certification

Microsoft Certified Technology Specialist (MCTS) Certifications

MIME (Multipurpose Internet Mail Extension)

MIMO (multiple in/multiple out)

mini-GBIC

MLD (Multicast Listener Discovery)

MMF (multimode fiber)

          defined

          media converters

mobile devices

          cellular WAN

          as clients

models

          OSI seven-layer model

          TCP/IP model

modems (modulator-demodulators)

          cable modems

          defined

          installing DSL

          PSTN

modern networks

          network as a service

          virtual PBX

          virtual switches

          virtualization in

          VMMs and hypervisors

modulator-demodulators (modems). See modems (modulator-demodulators)

module troubleshooting

monitoring networks

          checking system logs

          checkpoint

          establishing baseline

          logs and network traffic

          Network Monitor

          Performance Monitor

          review answers

          review questions

          SNMP

MPLS (Multiprotocol Label Switching)

MS-CHAP

MT-RJ (mechanical-transfer registered jack)

mtr utility

MTU black hole

MTU (Maximum Transmission Unit)

          defined

          routing metrics

MTU mismatch

multicast addresses

multicast class licenses

Multicast Listener Discovery (MLD)

multicast traffic

          defined

          routing tables

          sending multiple frames

multifactor authentication

multifunction network devices

multihomed computers

multilayer switches

multimeters

multimode fiber (MMF)

          defined

          media converters

multiple access

multiple in/multiple out (MIMO)

multiplexer

          dawn of long distance

          defined

          DSLAM

          SONET

Multiprotocol Label Switching (MPLS)

Multipurpose Internet Mail Extension (MIME)

MX (Mail eXchanger)

N

NaaS (Network as a Service)

NAC (network access control)

          defined

          posture assessment

names, domain. See DNS (Domain Name System)

NAS (network attached storage)

NAT (Network Address Translation)

          hiding IPs

          overview

          translation table

native virtualization

nbtstat utility

ND (Neighboring Discovery)

near-end crosstalk (NEXT)

Neighboring Discovery (ND)

Nessus

NetBIOS

          nbtstat

          port numbers

NetMon (Network Monitor)

netstat -n

          defined

          port filtering

netstat -r

netstat utility

network access control (NAC)

          defined

          posture assessment

network adapter

Network Address Translation (NAT)

          hiding IPs

          overview

          translation table

network addressing

Network as a Service (NaaS)

network attached storage (NAS)

network-based firewalls

network-based IDS (NIDS)

network configuration management

          baselines

          change management documentation

          checkpoint

          documentation

          network connectivity

          overview

          policies, procedures, and configurations

          regulations

          review answers

          review questions

network design

network diagrams

          defined

          network maps and

network frames

network fundamentals

          applications

          checkpoint

          components

          connecting LANs

          Ethernet

          hubs and switches

          OSI seven-layer model

          overview of how networks work

          review answers

          review questions

          servers and clients

          software

          TCP/IP model

network hardware

          checkpoint

          connecting Ethernet segments

          consolidation with virtual computing

          Ethernet

          failure

          firewalls

          hubs and switches

          interfaces

          repeaters, hubs and bridges

          review answers

          review questions

          routers

          switched Internet

          troubleshooting

          WAPs

network IDs

          calculating subnets

          class IDs

          interconnecting

          IPv4 addressing

          subnet masks and

          subnetting

network interface cards (NICs). See NICs (network interface cards)

Network Interface layer

network interface unit (NIU)

          defined

          PSTN

network interfaces

network intrusion prevention system (NIPS)

Network layer

          defined

          Internet Protocol

          routers

network maps

network media

          checkpoint

          coaxial cabling

          multimeters

          network design

          optical fiber

          review answers

          review questions

          troubleshooting

          twisted-pair cabling. See twisted-pair cabling

          wireless media types. See wireless media types

Network Monitor (NetMon)

network monitoring. See monitoring networks

network name

Network News Transfer Protocol (NNTP)

network performance optimization, . See also troubleshooting network performance

network resources

network security

          administrative access control

          attacks on wireless connections

          authentication

          authorization

          checkpoint

          common threats

          Denial of Service (DoS) attacks

          firewalls

          hiding IPs

          IPsec

          logon and access security

          MAC filtering

          malware

          man-in-the-middle attacks

          mitigating risk with policies and procedures

          network zones

          overview

          packet filtering

          personal firewalls

          physical intrusion

          port filtering

          review answers

          review questions

          securing remote connections

          securing user accounts

          social engineering

          system crash/hardware failure

          VPNs

          vulnerability scanners

network sniffers

network threats

Network Time Protocol (NTP)

network topologies and standards

          bus topology and Ethernet

          checkpoint

          other topologies

          review answers

          review questions

          ring topologies

          star bus topology

network topology icons

Network utility

network zones

networks

          design

          troubleshooting. See troubleshooting networks

          utilities. See TCP/IP utilities

          virtualization in

          WANs (wide area networks). See WANs (wide area networks)

NEXT (near-end crosstalk)

NICs (network interface cards)

          collisions

          defined

          MAC addresses

          multihomed computers

          network hardware

          troubleshooting

          virtual switches

          visual indication of problems

NIDS (network-based IDS)

NIPS (network intrusion prevention system)

NIU (network interface unit)

          defined

          PSTN

Nmap

          creating network maps

          defined

NNTP (Network News Transfer Protocol)

nodes

          collisions

          defined

          hidden

          routing tables

          topologies

nslookup utility

NTP (Network Time Protocol)

O

Object Push Profile

OC (Optical Carrier) standards,

octet

OFDM (Orthogonal

Frequency-Division Multiplexing)

offsite virtualization

ohms

one-way satellite

onsite virtualization

open-ended questions

open impedance

Open Shortest Path First (OSPF)

opens shorts

OpenVPN

operating systems (OS)

Optical Carrier (OC) standards,

optical fiber

Optical Time-Domain Reflectors (OTDRs)

optimization. See troubleshooting network performance

organizationally unique identifier (OUI)

Orthogonal Frequency-Division Multiplexing (OFDM)

OS (operating systems). See also Windows

OS X. See Mac OS X

OSI seven-layer model

          overview

          vs. TCP/IP model

OSPF (Open Shortest Path First)

OTDRs (Optical Time-Domain Reflectors)

OUI (organizationally unique identifier)

overhead

ownership factor

P

packet analyzer

packet filtering

packet sniffing

          defined

          protocol analyzers

packet switching

packets

          defined

          IP address

          routing. See also routing

          TCP segments and UDP datagrams

pad

PAP (Password Authentication Protocol)

Parallels

parked devices

passive optical network (PON)

Password Authentication Protocol (PAP)

passwords

          securing user accounts

          setting wireless admin

PAT (Port Address Translation)

patch cables

patch management

patch panels

PathMTUDiscovery (PMTU)

payload

          defined

          STS

PBX

PCF (Point Coordination Function)

peer-to-peer topology

PerfMon (Performance Monitor)

          baselines

          defined

performance troubleshooting. See troubleshooting network performance

peripherals

          network design

          SOHO network

permanent virtual circuit (PVC)

permissions

personal firewalls

phishing

          defined

          evil twin attacks

physical addressing

          data link layer

          MAC address display

physical intrusion

Physical layer

          defined

          network media

          repeaters and hubs

physical networks

physical topology

piconet

ping utility

PKI (Private Key Infrastructure)

plain old telephone service (POTS)

plan of action

PLC (power line communications)

plenum

plenum cable

PMTU (PathMTUDiscovery)

PoE (Power over Ethernet)

Point Coordination Function (PCF)

point-to-multipoint topology

Point-to-Point Protocol over Ethernet (PPPoE)

          defined

          DSL and cable

Point-to-Point Protocol (PPP)

point-to-point topology

Point-to-Point Tunneling Protocol (PPTP)

          on Bluetooth

          vs. L2TP

          VPNs

pointer (PTR)

policies

PON (passive optical network)

Pooled NAT

POP (Post Office Protocol)

POP3 (Post Office Protocol 3)

          in Application layer

          port number

Port Address Translation (PAT)

port blocking

port filtering

port forwarding

port mirroring

port numbers

          list of Application protocols and

          overview

          PAT

port trunking

ports

          assigning to VLANs

          bridging loops and

          crossover cables

          speed and duplex mismatch

          TCP/IP numbering

          trunk

          uplink

          UTP cable types and

possible causes

Post Office Protocol 3 (POP3)

          in Application layer

          port number

Post Office Protocol (POP)

Postel, Jon

posture assessment

POTS (plain old telephone service)

powe rline communications (PLC)

power issues

Power over Ethernet (PoE)

power saving with virtualization

PowerPoint

PPP (Point-to-Point Protocol)

PPPoE (Point-to-Point Protocol over Ethernet)

          defined

          DSL and cable

PPTP (Point-to-Point Tunneling Protocol)

          on Bluetooth

          vs. L2TP

          VPNs

preamble

Presentation layer

          in Application layer

          defined

preventative measures

PRI (Primary Rate Interface)

private dial-up

private IP addresses

Private Key Infrastructure (PKI)

probable cause, theory of

          establish

          testing

procedures

profiles, Bluetooth

protocol analyzers

protocols

          authentication

          defined

          TCP/IP. See TCP/IP (Transmission Control Protocol/ Internet Protocol)

proxy servers

PSTN (public switched telephone network)

PTR (pointer)

public IP addresses

public switched telephone network (PSTN)

punch-down tools

PVC (permanent virtual circuit)

Q

QoS (Quality of Service)

          controlling data throughput

          MPLS

query

questioning users

R

radio frequency (RF)

radio-grade (RG) coaxial cabling

radio waves

RADIUS (Remote Authentication Dial-In User Service)

RAID (Redundant Array of Inexpensive Disks)

RAM (random-access memory)

range

          Bluetooth

          frequency ranges. See frequency ranges

          IrDA

          wireless standards

RARP (Reverse Address Resolution Protocol)

RAS (remote access server)

RAS (Remote Access Service)

RAT (remote administration tool)

Raw SMB

RDC (Remote Desktop Connection)

RDP (Remote Desktop Protocol)

Real Time Streaming Protocol (RTSP)

Real-time Transport Protocol (RTP)

receive pins

records, DNS

Redundant Array of Inexpensive Disks (RAID)

reflection

registered jacks

registered ports

regulations

remote access

          dedicated connection

          defined

          dial-up to Internet

          DSL and cable

          overview

          private dial-up

          remote terminals

          RTP

          SIP and H.323

          Skype

          streaming media with RSTP

          VOIP

remote access server (RAS)

Remote Access Service (RAS)

remote administration tool (RAT)

Remote Authentication Dial-In User Service (RADIUS)

remote connection security

          IPsec

          overview

          VPNs

remote connectivity

Remote Desktop Connection (RDC)

Remote Desktop Protocol (RDP)

remote terminals

repeaters

replication

requirements, SOHO network

research with virtualization

reservations, DHCP

resistance

resistors

Reverse Address Resolution Protocol (RARP)

RF (radio frequency)

RG (radio-grade) coaxial cabling

rights

ring topologies

RIP (Routing Information Protocol)

riser cables

RJ-45 connectors

          Ethernet

          MPLS

          UTP connectors

rogue access points

rollover cables

root domain

rootkit

round trip time (RTT)

route print

route utility

routers

          change wireless settings

          configuration

          defined

          IP addressing

          L2TP VPNs

          MAC filtering

          network hardware

          network topology icons

          set admin password

          traceroute

routing

          checkpoint

          dynamic. See dynamic routing

          freedom from layer 2

          interVLAN

          network address translation

          overview

          review answers

          review questions

          routing tables

          troubleshooting performance

          troubleshooting problems

Routing and Remote Access Service (RRAS)

Routing Information Protocol (RIP)

routing tables

          defined

          freedom from layer 2

          routing

RRAS (Routing and Remote Access Service)

RS-232 connectors

RTP (Real-time Transport Protocol)

RTSP (Real Time Streaming Protocol)

RTT (round trip time)

S

S field in WANs

SaaS (Software as a Service)

SANs (storage area networks)

SAs (security associations)

SAT (source address table)

satellite

SC (stick and click) connectors

scope, DHCP

SCP (Secure Copy)

SDH (Synchronous Digital Hierarchy)

SDSL (Symmetric DSL)

Secure Copy (SCP)

Secure Shell (SSH)

port number

VPNs

Secure Sockets Layer (SSL)

          on Bluetooth

          defined

          VPNs

security. See also network security

          Bluetooth

          concerns with wireless

          signaling

          designing SOHO network

          IrDA

          NAT

          optical fiber

          WAP

security associations (SAs)

Security Identifier (SID)

security logs

security policy

segments

          connecting Ethernet

          defined

          Ethernet frames

          TCP

          UTP cable types

sequence number

Serial Port Profile

server farms

servers

          authentication

          DHCP

          DNS root

          network design

          network fundamentals

          protecting from physical intrusion

          RAS

          remote terminal

          specialized network devices

          TCP three-way handshake

          virtual

          VPNs

Service Discovery Profile

Service Profile ID (SPID)

Service Set Identifier (SSID)

          changing wireless settings

          defined

          mismatch

Session Initiation Protocol (SIP)

Session layer

sessions

          Application protocols

          defined

SFP (small form-factor pluggable)

share-level access control

sheaths

shielded twisted-pair (STP) cable

          defined

          media converters

shorts

show startup-config

SID (Security Identifier)

signal bounce,

signal hole

signature-based IDS

Simple Mail Transfer Protocol (SMTP)

          defined

          port number

Simple Network Management Protocol (SNMP)

          monitoring networks

          port number

single-mode fiber (SMF)

          defined

          media converters

single sign-on

SIP (Session Initiation Protocol)

site-local unicast addresses

site-to-site VPN connection

small form-factor pluggable (SFP)

small office/home office (SOHO) network. See SOHO (small office/home office) network

smart devices

smart jacks

smartphones

SMF (single-mode fiber)

          defined

          media converters

SMTP (Simple Mail Transfer Protocol)

          defined

          port number

smurf attacks

snapshot

SNAT (StaticNAT)

SNMP (Simple Network Management Protocol)

          monitoring networks

          port number

social engineering attacks

socket pairs

sockets

software

          antimalware programs

          firewalls

          overview of how networks work

Software as a Service (SaaS)

SOHO (small office/home office) network

          checkpoint

          design and implementation

          review answers

          review questions

          WAPs

solid-core cables

solutions

SONET (Synchronous Optical Network)

          10 GbE and

          HDLC and

          overview

          tier 1 Internet

source address table (SAT)

source MAC addresses

source port numbers

Spanning Tree Protocol (STP)

          defined

          switching loops and

specialized network devices

          checkpoint

          overview

          review answers

          review questions

specifications

          Bluetooth

          wireless standards

speed

          ATM

          cable modem

          categories of UTP cabling

          collisions and Ethernet

          copper carriers

          DSL downloads

          Gigabit Ethernet

          IrDA

          OC

          optical fiber

          types of DSL

          wireless

          wireless standards

Speed Test at Speakeasy

SPID (Service Profile ID)

split cables

splitters

spyware

SSH (Secure Shell)

          port number

          VPNs

SSID (Service Set Identifier)

          changing wireless settings

          defined

          mismatch

SSL (Secure Sockets Layer)

          on Bluetooth

          defined

          VPNs

ST (stick and twist) connectors

stages of Bluetooth

standards. See also network topologies and standards

          10 GbE

          802.11 wireless networks

          Ethernet

          fiber-optic cabling

          mismatch

          V standards

          wireless

star bus topology

star ring

stateful filtering

stateful inspection

stateless filtering

static configuration

static routes

static VLANs

StaticNAT (SNAT)

steady state

Stevens, Senator Ted

stick and click (SC) connectors

stick and twist (ST) connectors

storage area networks (SANs)

STP (Spanning Tree Protocol)

          defined

          switching loops and

straight-through cables

          defined

          wiring standards

stranded core

streaming media with RSTP

STS (Synchronous Transport Signal)

          common Optical Carriers

          defined

subdomains

subnet masks

          configuring TCP/IP

          ipconfig

          IPv4 addressing

          routing tables

          subnetting and

          troubleshooting performance

subnetting

          calculating hosts

          calculating subnets

          CIDR and

          first subnet

suffix, DNS

super accounts

SUPERAntiSpyware

supervisors

supplicant

switched Internet

Switched Virtual Interfaces

switches

          Cisco 3550

          configuration

          configuring VLAN

          defined

          vs. hubs

          incorrect placement

          network topology icons

          protecting from physical intrusion

          sending multiple frames

          specialized network devices

          star bus topology

          trunking

          virtual

          VLANs

          WAPs

switching loops

          defined

          troubleshooting

Symmetric DSL (SDSL)

symptom identification

SYN, ACK (synchronize, acknowledge)

SYN (synchronize)

Synchronization Profile

Synchronous Digital Hierarchy (SDH)

Synchronous Optical Network (SONET). See SONET (Synchronous Optical Network)

Synchronous Transport Signal (STS)

          common Optical Carriers

          defined

syslog

system crash/hardware failure

system duplication

system logs

          checking

          network traffic and

system recovery

T

T-carriers

          defined

          getting WAN connection

T1 connection

T1 crossover cable

T1 lines

T3 lines

T568A

T568B

TA (terminal adapter)

TACACS+ (Terminal Access Controller Access-Control System Plus)

TCP/IP (Transmission Control Protocol/Internet Protocol)

          Application protocols

          checkpoint

          CIDR

          defined

          DHCP

          DNS

          DNS records

          Internet protocols

          IPv4 addressing. See IPv4 addressing

          IPv6 addressing

          list of Application protocols and port numbers

          model

          review answers

          review questions

          Transport protocols

TCP/IP utilities

          arp

          arping

          checkpoint

          dig

          ipconfig and ifconfig

          mtr

          nbtstat

          netstat

          nslookup

          review answers

          review questions

          route

          tracert

TCP (Transmission Control Protocol)

          defined

          segments

          in Transport layer

          Transport protocols

TDM (time division multiplexing)

TDRs (Time-Domain Reflectometers)

Telecommunications Industry Association (TIA)

telephony

          alternatives to

          dawn of long distance

          digital telephony

          packet switching

          real-world WANs

          WANs

Telnet

          port number

          remote terminal

temperature monitors

Terminal Access Controller Access-Control System Plus (TACACS+)

terminal adapter (TA)

Terminal Services

terminals

termination

testing

          BERT

          cables

          equipment

          loopback cables

          power issues

          solutions

          theory of probable cause

          throughput

          UTP

TFTP (Trivial File Transfer Protocol)

TGS (Ticket-Granting Service)

TGT (Ticket-Granting Ticket)

theory of probable cause

          establish

          testing

Thicknet cabling

threats to network security

          administrative access control

          attacks on wireless connections

          Denial of Service (DoS) attacks

          malware

          man-in-the-middle attacks

          overview

          physical intrusion

          social engineering

          system crash/hardware failure

three-way handshake

throughput

          Bluetooth

          IrDA

          testers

          wireless standards

TIA (Telecommunications Industry Association)

Ticket-Granting Service (TGS)

Ticket-Granting Ticket (TGT)

time division multiplexing (TDM)

Time-Domain Reflectometers (TDRs)

Time to Live (TTL)

          IP

          MPLS

timestamping

TLD (top-level domain) names

TLD (top-level domain) servers

TLS (Transport Layer Security)

Token Ring

tokens

tone locators

toners

top-level domain (TLD) names

top-level domain (TLD) servers

topology. See also network topologies and standards

          defined

          icons

traceroute

tracert utility

traffic analysis

traffic analyzers

traffic shaping

Transmission Control Protocol/Internet Protocol (TCP/IP). See TCP/IP (Transmission Control Protocol/Internet Protocol)

Transmission Control Protocol (TCP). See TCP (Transmission Control Protocol)

transmission media

transmit beamforming

transmit pins

transparent fault tolerance

transparent server transfer

Transport layer

          in OSI seven-layer model

          protocols

          in TCP/IP model

Transport Layer Security (TLS)

Transport mode

Trivial File Transfer Protocol (TFTP)

Trojan

Trojan horse

troubleshooting network performance

          checkpoint

          ISPs and MTUs

          network performance optimization

          overview

          protocol analyzers

          review answers

          review questions

          throughput testers

          troubleshooting networks

          checkpoint

          determine if anything has changed

          document findings, actions, and outcomes

          establish plan of action and identify potential effects

          establish theory of probable cause

          identify problem

          implement and test solution

          network hardware

          process

          review answers

          review questions

          test theory of probable cause

          testing equipment

          verify functionality and implement preventative measures

          wireless

troubleshooting utilities. See TCP/IP utilities

trunk ports

trunking

          defined

          protocol

TTL (Time to Live)

          IP

          MPLS

Tunnel mode

tunnels

          PPTP VPNs

          VPN

twisted-pair cabling

          crossover cables

          overview

          UTP cabling. See UTP (unshielded twisted-pair) cabling

two-factor authentication

two-way satellite

TX/RX reversed

Type field in Ethernet frames

Type of Service

U

UART (Universal Asynchronous Receiver/Transmitter)

UC (unified communications)

UDP (User Data Protocol)

          datagrams

          defined

          list of Application protocols and port numbers

          in Transport layer

          Transport protocols

unbounded media

unicast addresses

unicast traffic

          defined

          sending multiple frames

unified communications (UC)

uninterruptible power supply (UPS)

Universal Asynchronous Receiver/Transmitter (UART)

Universal Serial Bus (USB)

unknown host message

unmanaged switches

unshielded twisted-pair (UTP) cabling. See UTP (unshielded twisted-pair) cabling

uplink ports

UPS (uninterruptible power supply)

uptime

USB (Universal Serial Bus)

user accounts

          authentication

          authorization

          control

          logon and access security

          network security

User Data Protocol (UDP). See UDP (User Data Protocol)

user-level access control

users, questioning

utilities, TCP/IP. See TCP/IP utilities

UTP (unshielded twisted-pair) cabling

          cable types

          connectors

          media converters

          overview

          testing

          wiring distribution

          wiring standards

V

V standards

VCC (vertical cross-connect)

VDSL (Very High Bitrate DSL)

versions

          IP

          IPv4 addressing

          research with virtualization

          RIP

vertical cross-connect (VCC)

Very High Bitrate DSL (VDSL)

virtual CPUs

virtual desktops

          defined

          VMMs and

virtual local area networks (VLANs). See VLANs (virtual local area networks)

virtual machine managers (VMMs). See VMMs (virtual machine managers)

virtual machines (VMs)

Virtual Network Computing (VNC)

virtual PBX

Virtual PC

Virtual Private Networks (VPNs)

          concentrators

          MPLS

          remote connection security

virtual switches

Virtual Trunk Protocol (VTP)

virtualization

          checkpoint

          computing

          LANs

          in modern networks

          network as a service

          review answers

          review questions

          virtual PBX

          virtual switches

          VMMs and hypervisors

viruses

Visibility Status

Visio

visual indications of problems

VLAN Trunking Protocol (VTP)

VLANs (virtual local area networks)

          configuring switches

          incorrect

          interVLAN routing

          overview

          trunking

          trunking protocol

VMMs (virtual machine managers)

          defined

          in modern networks

          virtual computing

          why we virtualize

VMs (virtual machines)

VMTools

VMware Fusion

VMware Workstation

          defined

          ESX

virtual computing

VNC (Virtual Network Computing)

VoIP (Voice over IP)

          connection-oriented vs. connectionless communication

          defined

          QoS

voltage event recorder

VPNs (Virtual Private Networks)

          concentrators

          MPLS

          remote connection security

VTP (Virtual Trunk Protocol)

VTP (VLAN Trunking Protocol)

vulnerability scanners

W

wall sockets

WANs (wide area networks)

          alternative to telephony

          BPL

          cable modems

          cellular

          checkpoint

          dawn of long distance

          defined

          dial-up

          digital telephony

          DSL

          fiber

          interconnecting

          IP addresses in action

          overview

          packet switching

          real-world

          remote access. See remote access

          review answers

          review questions

          satellite

          telephony and beyond

          which connection?

WAPs (wireless access points)

          defined

          incorrect placement

          installation

          network hardware

          rogue access points

          upgrading antenna

          wireless basics

war chalking

war driving

Wavelength Division Multiplexing (WDM)

WDM (Wavelength Division Multiplexing)

well-known port numbers

WEP (Wired Equivalent Privacy)

WEP (Wired Equivalent Privacy) cracking

Wi-Fi channels

Wi-Fi Protected Access 2 (WPA2)

Wi-Fi Protected Access (WPA)

Wi-Fi Protected Access (WPA) cracking

wide area networks (WANs). See WANs (wide area networks)

WiMAX

Windows

          administrative access control

          Clustering

          displaying gateway

          firewalls

          HyperV

          ipconfig /all

          ISDN settings

          Kerberos and

          logon and access security

          MS-CHAP

          Network Monitor

          Performance Monitor

          RAS

          research with virtualization

          route print

          SID

          syslog

          Virtual PC

          VPNs

WinFrame/MetaFrame

wire schemes

Wired Equivalent Privacy (WEP)

Wired Equivalent Privacy (WEP) cracking

wireless access points (WAPs). See WAPs (wireless access points)

Wireless Channel

wireless media types

          802.11 wireless networks

          Bluetooth

          BSSID, SSID, and ESSID

          infrared wireless

          networking

          laser links

          wireless basics

          wireless frequency ranges

          wireless standards

wireless mode

wireless networks

          attacks on wireless connections

          authentication

          change wireless settings

          checkpoint

          defined

          implement encryption

          installing access point

          installing client

          MAC filtering

          review answers

          review questions

          security concerns with signaling

          set admin password

          standards

          troubleshooting

          upgrading antenna

Wireless Personal Area Networks (WPANs)

Wireshark

wiring distribution

wiring schematics

wiring schemes

wiring standards

          patch panels

          UTP

workgroup switches

workstations

          network design

          network topology icons

World of Warcraft

worms

WPA-Enterprise (WPA-802.1X)

WPA-Personal (WPA-PSK)

WPA (Wi-Fi Protected Access)

WPA (Wi-Fi Protected Access) cracking

WPA2 (Wi-Fi Protected Access 2)

WPANs (Wireless Personal Area Networks)

X

X.25

XDSL (Extended DSL)

Y

Yagi antenna

YouTube

Z

Zenmap

zombies

ZoneAlarm Pro

LICENSE AGREEMENT

THIS PRODUCT (THE “PRODUCT”) CONTAINS PROPRIETARY SOFTWARE, DATA AND INFORMATION (INCLUDING DOCUMENTATION) OWNED BY THE McGRAW-HILL COMPANIES, INC. (“McGRAW-HILL”) AND ITS LICENSORS. YOUR RIGHT TO USE THE PRODUCT IS GOVERNED BY THE TERMS AND CONDITIONS OF THIS AGREEMENT.

LICENSE: Throughout this License Agreement, “you” shall mean either the individual or the entity whose agent opens this package. You are granted a non-exclusive and non-transferable license to use the Product subject to the following terms:

(i) If you have licensed a single user version of the Product, the Product may only be used on a single computer (i.e., a single CPU). If you licensed and paid the fee applicable to a local area network or wide area network version of the Product, you are subject to the terms of the following subparagraph (ii).

(ii) If you have licensed a local area network version, you may use the Product on unlimited workstations located in one single building selected by you that is served by such local area network. If you have licensed a wide area network version, you may use the Product on unlimited workstations located in multiple buildings on the same site selected by you that is served by such wide area network; provided, however, that any building will not be considered located in the same site if it is more than five (5) miles away from any building included in such site. In addition, you may only use a local area or wide area network version of the Product on one single server. If you wish to use the Product on more than one server, you must obtain written authorization from McGraw-Hill and pay additional fees.

(iii) You may make one copy of the Product for back-up purposes only and you must maintain an accurate record as to the location of the back-up at all times.

COPYRIGHT; RESTRICTIONS ON USE AND TRANSFER: All rights (including copyright) in and to the Product are owned by McGraw-Hill and its licensors. You are the owner of the enclosed disc on which the Product is recorded. You may not use, copy, decompile, disassemble, reverse engineer, modify, reproduce, create derivative works, transmit, distribute, sublicense, store in a database or retrieval system of any kind, rent or transfer the Product, or any portion thereof, in any form or by any means (including electronically or otherwise) except as expressly provided for in this License Agreement. You must reproduce the copyright notices, trademark notices, legends and logos of McGraw-Hill and its licensors that appear on the Product on the back-up copy of the Product which you are permitted to make hereunder. All rights in the Product not expressly granted herein are reserved by McGraw-Hill and its licensors.

TERM: This License Agreement is effective until terminated. It will terminate if you fail to comply with any term or condition of this License Agreement. Upon termination, you are obligated to return to McGraw-Hill the Product together with all copies thereof and to purge all copies of the Product included in any and all servers and computer facilities.

DISCLAIMER OF WARRANTY: THE PRODUCT AND THE BACK-UP COPY ARE LICENSED “AS IS.” McGRAW-HILL, ITS LICENSORS AND THE AUTHORS MAKE NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE RESULTS TO BE OBTAINED BY ANY PERSON OR ENTITY FROM USE OF THE PRODUCT, ANY INFORMATION OR DATA INCLUDED THEREIN AND/OR ANY TECHNICAL SUPPORT SERVICES PROVIDED HEREUNDER, IF ANY (“TECHNICAL SUPPORT SERVICES”). McGRAW-HILL, ITS LICENSORS AND THE AUTHORS MAKE NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT TO THE PRODUCT. McGRAW-HILL, ITS LICENSORS, AND THE AUTHORS MAKE NO GUARANTEE THAT YOU WILL PASS ANY CERTIFICATION EXAM WHATSOEVER BY USING THIS PRODUCT. NEITHER McGRAW-HILL, ANY OF ITS LICENSORS NOR THE AUTHORS WARRANT THAT THE FUNCTIONS CONTAINED IN THE PRODUCT WILL MEET YOUR REQUIREMENTS OR THAT THE OPERATION OF THE PRODUCT WILL BE UNINTERRUPTED OR ERROR FREE. YOU ASSUME THE ENTIRE RISK WITH RESPECT TO THE QUALITY AND PERFORMANCE OF THE PRODUCT.

LIMITED WARRANTY FOR DISC: To the original licensee only, McGraw-Hill warrants that the enclosed disc on which the Product is recorded is free from defects in materials and workmanship under normal use and service for a period of ninety (90) days from the date of purchase. In the event of a defect in the disc covered by the foregoing warranty, McGraw-Hill will replace the disc.

LIMITATION OF LIABILITY: NEITHER McGRAW-HILL, ITS LICENSORS NOR THE AUTHORS SHALL BE LIABLE FOR ANY INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, SUCH AS BUT NOT LIMITED TO, LOSS OF ANTICIPATED PROFITS OR BENEFITS, RESULTING FROM THE USE OR INABILITY TO USE THE PRODUCT EVEN IF ANY OF THEM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL APPLY TO ANY CLAIM OR CAUSE WHATSOEVER WHETHER SUCH CLAIM OR CAUSE ARISES IN CONTRACT, TORT, OR OTHERWISE. Some states do not allow the exclusion or limitation of indirect, special or consequential damages, so the above limitation may not apply to you.

U.S. GOVERNMENT RESTRICTED RIGHTS: Any software included in the Product is provided with restricted rights subject to subparagraphs (c), (1) and (2) of the Commercial Computer Soft ware-Restricted Rights clause at 48 C.F.R. 52.227-19. The terms of this Agreement applicable to the use of the data in the Product are those under which the data are generally made available to the general public by McGraw-Hill. Except as provided herein, no reproduction, use, or disclosure rights are granted with respect to the data included in the Product and no right to modify or create derivative works from any such data is hereby granted.

GENERAL: This License Agreement constitutes the entire agreement between the parties relating to the Product. The terms of any Purchase Order shall have no effect on the terms of this License Agreement. Failure of McGraw-Hill to insist at any time on strict compliance with this License Agreement shall not constitute a waiver of any rights under this License Agreement. This License Agreement shall be construed and governed in accordance with the laws of the State of New York. If any provision of this License Agreement is held to be contrary to law, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.