Lesson_6_Mid_level_Networking_concepts

#Introduction

Previously in basic networking we covered an overhead view of how one computer communicates to another from their perspective. Now we shall cover how network communications function from a more infrastructure view. By that I mean we shall get into a lot of the main things needed to create a network and certain details/nuances that are noteworthy. 

#The hardware and medium that the communications go through

To begin in order for two computers to talk they must be connected to a device that is able to handle, forward and/or renew the electrical signals that make up their messages. The devices that do this tend to be separated into a few categories which are switches, routers, hubs and repeaters with loadbalancers, firewalls, IDS and IPS being extra devices used for security, policies and management of the workload certain devices and connections have to deal with. These devices will normally be connected together through the use of a fiber optic, cross-over, straight through, patch cable or serial cable. Cross over cables are used to connect two devices of the same type e.g. two routers, switches computers etc ... . Straight through cables are used to connect two devices of different categories (router to switch for example), while patch cables have started to become the norm because instead of relying on a human to know what type of cable to use. This cable is setup so that computers/machines can automatically setup the connection on their end so that you can use one cable to connect like and unlike devices (things in the same and different categories/types). Serial cables were used in the past to normally connect to the Internet service providers device but has become less common today thanks to ethernet and fiber being much more efficient. Though it is less common it still exists since a routers purpose is not only to handle the routing/directing of traffic but it is also designed to connect machines that use different mediums/connections to communicate hence why a router has slots so you can install an interface that accepts serial connections, fiber connections, ethernet and etc.. It is in part because a router can connect different devices even if one only has/supports serial connections while another only supports ethernet  that the internet has been able to thrive since thanks to the ability to interface/interact with such a wide array of communication methods a computer is able to send its traffic through pretty much any device that is able to carry/renew a signal (electrical and light based). Lastly I mentioned fiber optic cables which are typically used for long distance communications and will either be single mode (the light just travels in a straight line down the cable) or multimode (the light is able to travel down the cable in a straight line and/or at an angle (there is a set range of allowed angles that ensure the light doesn't leak/escape) bounce off the sides to reach the end). Another thing worth mentioning is that you can send power not just data over an ethernet cable (it is called power over ethernet) which is a way to make it where you can just connect an ethernet cable to a device that is in a place with no available outlets.  Now that we have covered what is normally used to connect these devices we shall now delve into the actual devices used to transmit the signal sent by one computer to another. 

#In the beginning everyone received everything

When things started off hubs were used to connect computers with the downside that hubs do not keep track of who they are connected to so whenever they received something they would just send it out every interface except the one the message/signal came in through (this method of sending something to everyone you are connected to is known as broadcasting). This device did its job of ensuring two computers could talk but the more devices you connected to it the messier the communications became because messages/signals would be sent to someone who it wasn't meant for. That person would also just so happen to be trying to send something themselves causing a collision/crash to happen because the hubs broadcasted signal/message would collide with that devices signal/message. The area in which this collision could/would probably happen is called a collision domain and in this particular case a hub is basically one giant collision domain since if more than one person tried to send a message at the same time it would create a collision. That is why switches were created so that multiple machines could talk/send messages/signals/traffic at one time though collisions still happened they occurred fewer times than if a hub had been used. 

#Then switches came and remembered who they where connected to

Switches will typically be the first thing computers are actually directly connected to in a network and normally these switches will have anywhere from ten to thousands of interfaces so that a small/large number of computers can connect to them. The two types of switches are managed and unmanaged with the difference being managed switches allow you to configure things like speed, quality of service and vlans whereas unmanaged switches just forward the traffic and cannot be configured. Unmanaged switches are good if you just need to connect a handful of computers together and nothing else but once you start needing to actually access anything outside of the thing directly connected you will need to use a managed switch. Typically once a managed switch is setup and has had multiple vlans (virtual Local Area Networks) created on it they will need to have a trunk port setup in order for the vlans to communicate to other switches also through the target switches trunk port. Vlans are used to separate interfaces so that computers cannot communicate with whatever is inside of a different vlan unless it goes through a different device through a trunk port (example: Computer in the computer vlan composed of interfaces 1 and 2 cannot talk to the video camera vlans composed of interfaces 2 and 3 or the voice over ip vlans composed of interfaces 4 and 5). Now something to remember is that in the beginning when a switch is first started up it will still broadcast out messages since it does not know who it is connected to, but unlike a hub it will remember the interface each host came in through so that next time it gets a message for that host it can just send it directly to it. A switch will also remember which interface other switches are connected to so that it can send messages destined for machines it knows it is not directly connected to out through that interface so that it will continue to be forwarded until it reaches it destination or it fails because that host is not on this network. The problem with this method though is that if a set of redundant links exist switches would just keep sending the same message back to each other until they just shutdown/crashed because they couldn't handle the number of messages they ended up creating. This is why spanning tree protocol was created to manage these redundant links by selecting one of them to be a primary and then shutting down all the secondary connections to the same switch, only bringing one of them up if the primary connection goes down. Lastly one other key ability of switches is the ability to configure individual interfaces so that someone can setup a policy that allows only one/a set of MAC addresses to connect to a particular interface (or that interface gets shutdown) and/or so that interfaces have different max allowed speeds so that certain people like the owner or people who need faster connection speeds can always have faster connections. Typically when it comes to the design/layout of a network Local area connections (LANs) are considered to be composed of the switches used to connect a single sites people together while also providing them a way to communicate to others through an external/boarder router. 

#Afterwards routers were used to send the signal/message to things that were kind of far away

Switches will connect to routers so that they can communicate with things that are a long distance away, with the restriction that if any host connected to the switch has a private IP address the router will just drop the traffic. That is why Network Address Translation (NAT ) was implemented so that when an internal host (an internal host is one that is connected to the switch connected to this router) with a private IP address connects to a router it will be loaned a public IP address so that other routers will forward its traffic. Besides forwarding traffic routers also have slots so that you can install an interface that support different types of cables though normally Ethernet or fiber optic will be used. Also typically a router will be connected to a modem which allows people to use one line to send electrical signals that represent data, cable and telephone calls. When someone is talking about Wide Area Networks they are normally referring to networks that are connected by a modem (Host to switch to router = LAN, LAN router to modem to LAN router = WAN). Routers know how to get traffic to its destination through the use of one of three methods which are static routes, default routes and routing protocols. A static route is when a router will be configured so that it knows how to get to a few preset places for example in order to reach Network A go through interface 1. Next a default route is an interface or IP address that is configured in such a way so that all traffic that is to a destination it does not know how to reach, will be sent to this interface/IP(in other words a last ditch attempt to get the traffic to its destination). Then there are routing protocols which generate a table that summarizes everything that is connected to them and then shares certain values from those tables to help tell other routers what is the best path to forward their traffic. There are multiple routing protocols built/suited for different networks (RIP routing information protocol has a limit of about 16 routers making it usable for like a medium small sized network) but in the end they all have the similar purpose of giving routers and idea of where to send their traffic to get it to the destination. 

#Repeaters were used to ensure the signal didn't just fade 

Everything slowly dies/fades away and because of that if you send an eletrical signal it will slowly fall apart until nothing is left. That is why a device called a repeater tends to be setup at certain points in a cables connection so that the electrical signal is renewed which allows it to travel a further distance. This is not something you will typically interact with though and was only noted so that you are aware that there is a limit to how long a connection can be. 

#Security controls implemented on routing devices and on network connections

Access control List are how routers restrict access to the network that is located behind them and the network that allows them to connect to remote machines. ACLs are based around allowying/denying a connection by looking at if it is an authorized/unauthorized source/destination IP/port in an Authorized connection state(for example they may only allow connections from the outside if it has already completed the TCP three way handshake). While they do work as a mid level security method for restricting access to a network ACLs are not enough to deal with more flexible attempts at accessing a network. That is why firewalls were created so that a program could be setup on a device and then attached to a network while being given the responsibility of doing more in depth analysis of a connection to try and verify if something unauthorized is happening. It will make use of its ability to create a more detailed restriction to stop certain actions that it sees being attempted in the network traffic.  Thanks to ACLs and firewalls it is a relatively easy matter to place restrictions on what most people can/cannot do on the network since general/simple rules/restrictions are enough to stop 80% of the people who will access the network.

#Intrusion Detection Systems/Network Security Monitors created to show what was happening in a network 

While placing restrictions on what can and cannot be done on a network is all find and dandy it is not enough if you cannot get a pretty good view of what is happening that is not getting blocked. That is where a tool like snort/suricata comes to play because through the use of its signatures it can tell you when certain events or things are seen in traffic. So by setting certain rules in an intrusion detection system like snort/suricata you will be alerted if it sees the traffic you either tried to block or  deemed bad enough that you want to be told if it happens but not bad enough that you would try to block it. There is also the Network security monitor route of keeping track of what is happening. Instead of being signature based where you tell it what type of traffic you want to be told about. A Network Security Monitor  will show you every piece of traffic either by summarizing what happened like the tool bro does, or by showing you the actual raw capture that contains everything but takes a lot more space. Both are valid methods of knowing what is going on in a network, what people choose depends on how much they want/need to know/can handle and how much space they have available for log/traffic storage.

#Intrusion Prevention Systems/Firewalls were setup to try and stop what the ACLs couldn't

Intrusion Prevention Systems (IPS) and firewalls tend to be used  interchangeably because they are both basically just used to block/stop certain actions from being performed on the network. They tend to be devices dedicated to processing traffic and making sure no unauthorized actions are performed. Typically they are placed at the entrances of networks to control what comes in and also before servers/important pieces of equipment to control who accesses those pieces of hardware. 


#General design of networks

Since you are now familiar with the type of equipment used on networks now it is time to talk about the logic behind their setup. To begin now a days a lot of theses  devices tend to be built into each other. For example switches which are capable of routing IP addresses have become commonplace and routers with firewalls built into them is also pretty common (PFsense is a pretty good example of a device designed to be a firewall with routing capabilities). Something else worth noting is that people will sometimes use words like LAN, WAN and MAN. A Local Area Network typically refers to the hosts connected to switches connected to routers all owned by one person/company. A Wide area Network is used to refer to networks owned by multiple different people being connected together (Example: Three different law agencies networks all being connected to their ISP spread out over 2 streets, WAN could be used to refer to them and the two streets they take up). Lastly a Metropolitan Area Network is basically every network that exist inside of a city, though most of theses terms (LAN, WAN, MAN) are typically used to talk about who is responsible for a certain piece of infrastructure and/or where a configuration problem resides. One last thing that is worth covering is what is called a Demilitarized Zone (DMZ) which is the portion of a network that is separated from the rest of the network. While people already divide up their networks in multiple ways, for example using private IP addresses so that all internal machines can communicate to each other but cannot talk to anything remote unless they go through their router or put different types of equipment into different vlans (laptops = vlan 1, security cameras = vlan 2, cash registers = vlan 3 and etc... ). The router portion is all about controlling how things enter/leave your network, the IP and VLAN controls/settings are all about controlling what things can talk to. A DMZ is basically the portion of a network that provides a service/is accessed by remote machines, because things outside of the networks owners control access these machines it is understandable for them to separate these parts of the network so that if they are compromised it won't affect the rest of the network. The reason this has a special name for it (DMZ) is because there will be different rules and restriction placed for things remote machines can access and the internal network most remote machines should not be initiating connections to.

#Conclusion

While there are more things to creating, maintaining and understanding a network than what is covered here this information is a lot of the baseline information you need to know to fully understand a network map. Now you should understand how a computer network works/function though things like cable placement and the range of coverage a wireless access point has were not mentioned. Those things are important but are better learned with pictures, videos and hands on experience which is why they will likely be delved into a bit more in later post. On a closing note one thing worth being aware of is that some networks make use of load balancers to even out the workload/strain on the network by evenly distributing the amount of traffic each connection is handling. This is done so that instead of everything taking the fastest route bogging it down everyone's traffic is split up, but thanks to this capability network traffic at certain points can appear to be strange because it is getting passed through this device. Just remember that while at their core most networks tend to follow the same standard layout, there is a lot of different and special devices/software people use that will have to be taken into consideration because they have different sensitivities like how latency has a very noticeable effect on voice over IP (phone calls over Ethernet cables). It is due to those kind of requirements that configurations can quickly grow in size to make sure everything is given the consideration it needs but just make sure you are able to tell the quality of life noise from the actually core capabilities that have been setup.