ABOUT NETWORKING

 ARP stands for Address resolution protocol, it is used to convert the IP address (Logical address in network layer ) to MAC address ( Physical address in the data link layer) that means it converts the 32 bit address of the IP address to 48 bit mac address. Some enthusiasts  treat ARP operates on both layer 2 and layer 3, its like 2.5 protocol. ARP is a crucial protocol to successfully send the traffic to the end host. Let's assume there is an 24 ports L3 capability switch configured with SVI interface IP 192.168.1.1 and the  subnet 255.255.255.0, four users are connected to the switch from port 2 to 5, port 2 connected user is user 2 and port 3 connected user is user 3 and so... Port 2 endhost has been configured with the IP 192.168.1.2, port 3 was configured with IP 192.168.1.3 and so..If user connected to port 2 require to send the data to the user on port 3, the user 2 endhost require both the IP and the mac addresses of user 3 without lacking any of these, there wou...

 We all know about how the ARP works and the importance of it to send the traffic to the endhost, it translates the IP to the mac address. Before we know about the dynamic arp inspection we would need to understand about the ARP poisoining, it is an man in the middle attack works by poisoining the ARP cache database.  IP to mac address tables are stored in the arp cache database in the switch or router. Hacker can poison the arp database by rewriting his own mac address for the default gateway IP so all the users traffic will redirect to the hacker laptop which causes the successful man in the middle attack. Dynamic ARP inspection works by inspecting the ARP cache database with the help of dhcp snooping database. Yesterday I explained the dhcp snooping so you can look into the article to  know how it works. It records the assigned IP with the mac addresses in the dhcp snooping table so the arp inspection would use the dhcp snooping database to find the correct IP to MAC a...

DHCP Snooping is one of the security features operating at layer 2, it has to be applied in the access layer which directly serves the end hosts.DHCP snooping helps to mitigate the attacks from the rogue dhcp server to assign IP addresses to the endhosts. It should be enabled to meet the security compliance for the organization. Given below are the two scenarios discussed about those attacks. Scenario-1 is not the intention of the user to attack the network and Scenario-2 is a hacker attempting to steal the information. Scenario-1: Company-A  has a  strict restricted policy for the employees personal laptops to connect to the network.  User-A who recently joined in the organisation was not aware of the policy and connected his laptop to the network, immediately user-A laptop responding to the dhcp messages from other host because its configured with a dhcp server and started assigning the IP address of the core network, this leads to the major outage of the network becaus...

 Netflow is the collection of flow of networks. It is a Cisco proprietary protocol used to collect the source and destination IP along with the bytes it consumes, totally it is a collection of flow of packets and export to the Netflow collector. Netflow collector is the server where the application is running ex Solarwinds, Logic Monitor etc.. It is a one way traffic, the routers or switches configured with Netflow would send the  traffic to the collector as per the threshold timers set in the devices. There was no trap like feature which is available in snmp where the traffic has been initiated from the server end. Netflow configuration has been divided into three parts - Flow record, Flow Exporter and Flow Monitor. As the name itself Flow record is the collection of information where it collects the flow. It defines the information that NetFlow gathers, such as packets in the flow and the types of counters gathered per flow. Flow record is the combination of the  “match...

If you have two routers / two Layer3 switches connected with two L3 links (two paths) you can route with two equal static routes towards the same prefix and the router will load balance traffic across both links. The idea is to make two same static routes on the same router but with different next-hops. The question was: Which link or which route will be used? And if the traffic will be load balanced, which mechanism will be used to share the traffic across both of links. ip route 10.0.0.0 255.0.0.0 192.168.10.2 ip route 10.0.0.0 255.0.0.0 192.168.11.2 If both routes have the same destination prefix and no different Administrative Distance is configured, both routes will get installed in the routing table. Routing table will then leave to the switching process the job of load-sharing. That is, route-cache mechanisms, CEF in case of Cisco device will do load-share per session using source-destination IP. MORE ABOUT THAT CEF Load-Balancing Overview CEF – Cisco E...

We are going back to networking basics with this post. In few lines below you will find most important theory that makes network gear do its job. The main router job is to making routing decisions to be able to route packets toward their destination. Sometimes that includes recursive lookup of routing table if the next-hop value is not available via connected interface. ROUTING DECISION ON END DEVICES Lets have a look at routing decision that happens if we presume that we have a PC connected on our Ethernet network. If one device wants to send a packet to another device, it first needs to find an answer to these questions: Is maybe the destination IP address chunk of local subnet IP range? If that is true, packet will be forwarded to the neighbour device using Layer 2 in the ARP example below. If that is not the case, does the device network card configuration include a router address through which that destination can be reached? (default...

When DHCP starts the client has no idea about the network it’s currently on. Some clients may store the IP address they were previously on and send this out with the Discovery and Request packets, but the network is not truly set up until after the server has sent it’s final Ack message. Because of this the server does not know the network’s true broadcast address, however there is an address mapped for this very purpose. 255.255.255.255 If you run arp -a you will see that every interface has the following mapping 255.255.255.255 ff-ff-ff-ff-ff-ff static This means that just like a networks broadcast IP this message will be transmitted to all network adapters on the local network segment. The DHCP server listens for messages heading for port 67 UDP while the DHCP client listens for messages on port 68 UDP Lets lake a look at a DORA sequence in Wireshark 148 16.564069 0.0.0.0 255.255.255.255 DHCP 342 DHCP Discover - Transaction ID 0xaccba128 149 16.5...

What is a MAC Address? A MAC address, or Media Access Control address, is a 48- or 64-bit address associated with a network adapter. While IP addresses are associated with software, MAC addresses are linked to the hardware of network adapters. For this reason, the MAC address is sometimes called the hardware address, the burned-in address (BIA), or the physical address. MAC addresses are expressed in hexadecimal notation in the following format: 01-23-45-67-89-AB, in the case of a 48-bit address, or 01-23-45-67-89-AB-CD-EF, in the case of a 64-bit address. Colons (:) are sometimes used instead of dashes (-). MAC addresses are often considered permanent, but in some circumstances, they can be changed. There are two types of MAC addresses: Universally Administered Address The UAA, or Universally Administered Address, is the most commonly used type of MAC address. This address is assigned to the network adapter when it is manufactured. The first three octets define the manufacturer, whil...

Hubs, switches, and routers are all devices that let you connect one or more computers to other computers, networked devices, or to other networks. Each has two or more connectors called ports into which you plug in the cables to make the connection. Varying degrees of magic happen inside the device, and therein lies the difference. I often see the terms misused so let's clarify what each one really means. • A hub is typically the least expensive, least intelligent, and least complicated of the three. Its job is very simple: anything that comes in one port is sent out to the others. That's it. Every computer connected to the hub "sees" everything that every other computer on the hub sees. The hub itself is blissfully ignorant of the data being transmitted. For years, simple hubs have been quick and easy ways to connect computers in small networks. A switch does essentially what a hub does but more efficiently. By paying attention to the traffic that comes across it,...

The OSI, or Open System Interconnection, model defines a networking framework for implementing protocols in seven layers. Control is passed from one layer to the next, starting at the application layer in one station, proceeding to the bottom layer, over the channel to the next station and back up the hierarchy. The OSI , or Open System Interconnection, model defines a networking framework for implementing protocols in seven layers. Control is passed from one layer to the next, starting at the application layer in one station, and proceeding to the bottom layer, over the channel to the next station and back up the hierarchy. Application (Layer 7) This layer supports application and end-user processes. Communication partners are identified, quality of service is identified, user authentication and privacy are considered, and any constraints on data syntax are identified. Everything at this layer is application-specific. This layer provides application services for file transfers , e-...