ABOUT NETWORKING

 ARP stands for Address resolution protocol, it is used to convert the IP address (Logical address in network layer ) to MAC address ( Physical address in the data link layer) that means it converts the 32 bit address of the IP address to 48 bit mac address. Some enthusiasts  treat ARP operates on both layer 2 and layer 3, its like 2.5 protocol. ARP is a crucial protocol to successfully send the traffic to the end host. Let's assume there is an 24 ports L3 capability switch configured with SVI interface IP 192.168.1.1 and the  subnet 255.255.255.0, four users are connected to the switch from port 2 to 5, port 2 connected user is user 2 and port 3 connected user is user 3 and so... Port 2 endhost has been configured with the IP 192.168.1.2, port 3 was configured with IP 192.168.1.3 and so..If user connected to port 2 require to send the data to the user on port 3, the user 2 endhost require both the IP and the mac addresses of user 3 without lacking any of these, there would be no c

 We all know about how the ARP works and the importance of it to send the traffic to the endhost, it translates the IP to the mac address. Before we know about the dynamic arp inspection we would need to understand about the ARP poisoining, it is an man in the middle attack works by poisoining the ARP cache database.  IP to mac address tables are stored in the arp cache database in the switch or router. Hacker can poison the arp database by rewriting his own mac address for the default gateway IP so all the users traffic will redirect to the hacker laptop which causes the successful man in the middle attack. Dynamic ARP inspection works by inspecting the ARP cache database with the help of dhcp snooping database. Yesterday I explained the dhcp snooping so you can look into the article to  know how it works. It records the assigned IP with the mac addresses in the dhcp snooping table so the arp inspection would use the dhcp snooping database to find the correct IP to MAC address mapping

DHCP Snooping is one of the security features operating at layer 2, it has to be applied in the access layer which directly serves the end hosts.DHCP snooping helps to mitigate the attacks from the rogue dhcp server to assign IP addresses to the endhosts. It should be enabled to meet the security compliance for the organization. Given below are the two scenarios discussed about those attacks. Scenario-1 is not the intention of the user to attack the network and Scenario-2 is a hacker attempting to steal the information. Scenario-1: Company-A  has a  strict restricted policy for the employees personal laptops to connect to the network.  User-A who recently joined in the organisation was not aware of the policy and connected his laptop to the network, immediately user-A laptop responding to the dhcp messages from other host because its configured with a dhcp server and started assigning the IP address of the core network, this leads to the major outage of the network because those IP add

 Netflow is the collection of flow of networks. It is a Cisco proprietary protocol used to collect the source and destination IP along with the bytes it consumes, totally it is a collection of flow of packets and export to the Netflow collector. Netflow collector is the server where the application is running ex Solarwinds, Logic Monitor etc.. It is a one way traffic, the routers or switches configured with Netflow would send the  traffic to the collector as per the threshold timers set in the devices. There was no trap like feature which is available in snmp where the traffic has been initiated from the server end. Netflow configuration has been divided into three parts - Flow record, Flow Exporter and Flow Monitor. As the name itself Flow record is the collection of information where it collects the flow. It defines the information that NetFlow gathers, such as packets in the flow and the types of counters gathered per flow. Flow record is the combination of the  “match” and “collect

If you have two routers / two Layer3 switches connected with two L3 links (two paths) you can route with two equal static routes towards the same prefix and the router will load balance traffic across both links. The idea is to make two same static routes on the same router but with different next-hops. The question was: Which link or which route will be used? And if the traffic will be load balanced, which mechanism will be used to share the traffic across both of links. ip route 10.0.0.0 255.0.0.0 192.168.10.2 ip route 10.0.0.0 255.0.0.0 192.168.11.2 If both routes have the same destination prefix and no different Administrative Distance is configured, both routes will get installed in the routing table. Routing table will then leave to the switching process the job of load-sharing. That is, route-cache mechanisms, CEF in case of Cisco device will do load-share per session using source-destination IP. MORE ABOUT THAT CEF Load-Balancing Overview CEF – Cisco Express Fo

We are going back to networking basics with this post. In few lines below you will find most important theory that makes network gear do its job. The main router job is to making routing decisions to be able to route packets toward their destination. Sometimes that includes recursive lookup of routing table if the next-hop value is not available via connected interface. ROUTING DECISION ON END DEVICES Lets have a look at routing decision that happens if we presume that we have a PC connected on our Ethernet network. If one device wants to send a packet to another device, it first needs to find an answer to these questions: Is maybe the destination IP address chunk of local subnet IP range? If that is true, packet will be forwarded to the neighbour device using Layer 2 in the ARP example below. If that is not the case, does the device network card configuration include a router address through which that destination can be reached? (default gateway) Device then look