Network Devices:Repeaters, Bridges, Routers, and Gateways Network Repeater

Repeaters, Bridges, Routers, and Gateways Network Repeater

 A repeater connects two segments of your network cable. It retimes and regenerates the signals to proper amplitudes and sends them to the other segments. When talking about, ethernet topology, you are probably talking about using a hub as a repeater. Repeaters require a small amount of time to regenerate the signal. This can cause a propagation delay which can affect network communication when there are several repeaters in a row. Many network architectures limit the number of repeaters that can be used in a row. Repeaters work only at the physical layer of the OSI network model.

Bridge

 A bridge reads the outermost section of data on the data packet, to tell where the message is going. It reduces the traffic on other network segments, since it does not send all packets. Bridges can be programmed to reject packets from particular networks. Bridging occurs at the data link layer of the OSI model, which means the bridge cannot read IP addresses, but only the outermost hardware address of the packet. In our case the bridge can read the ethernet data which gives the hardware address of the destination address, not the IP address. Bridges forward all broadcast messages. Only a special bridge called a translation bridge will allow two networks of different architectures to be connected. Bridges do not normally allow connection of networks with different architectures. The hardware address is also called the MAC (media access control) address. To determine the network segment a MAC address belongs to, bridges use one of:
Transparent Bridging - They build a table of addresses (bridging table) as they receive packets. If the address is not in the bridging table, the packet is forwarded to all segments other than the one it came from. This type of bridge is used on ethernet networks.
Source route bridging - The source computer provides path information inside the packet. This is used on Token Ring networks.

Network Router


 A router is used to route data packets between two networks. It reads the information in each packet to tell where it is going. If it is destined for an immediate network it has access to, it will strip the outer packet, readdress the packet to the proper ethernet address, and transmit it on that network. If it is destined for another network and must be sent to another router, it will re-package the outer packet to be received by the next router and send it to the next router. The section on routing explains the theory behind this and how routing tables are used to help determine packet destinations. Routing occurs at the network layer of the OSI model. They can connect networks with different architectures such as Token Ring and Ethernet. Although they can transform information at the data link level, routers cannot transform information from one data format such as TCP/IP to another such as IPX/SPX. Routers do not send broadcast packets or corrupted packets. If the routing table does not indicate the proper address of a packet, the packet is discarded.

Router

 There is a device called a brouter which will function similar to a bridge for network transport protocols that are not routable, and will function as a router for routable protocols. It functions at the network and data link layers of the OSI network model.

Gateway

 A gateway can translate information between different network data formats or network architectures. It can translate TCP/IP to AppleTalk so computers supporting TCP/IP can communicate with Apple brand computers. Most gateways operate at the application layer, but can operate at the network or session layer of the OSI model. Gateways will start at the lower level and strip information until it gets to the required level and repackage the information and work its way back toward the hardware layer of the OSI model. To confuse issues, when talking about a router that is used to interface to another network, the word gateway is often used. This does not mean the routing machine is a gateway as defined here, although it could be.

Small story on the Firewalls

Firewalls


 Firewalls are mainly used as a means to protect an organization's internal network from those on the outside (internet). It is used to keep outsiders from gaining information to secrets or from doing damage to internal computer systems. Firewalls are also used to limit the access of individuals on the internal network to services on the internet along with keeping track of what is done through the firewall. Please note the difference between firewalls and routers as described in the second paragraph in the IP Masquerading section. 




Types of Firewalls
Packet Filtering - Blocks selected network packets. 
Circuit Level Relay - SOCKS is an example of this type of firewall. This type of proxy is not aware of applications but just cross links your connects to another outside connection. It can log activity, but not as detailed as an application proxy. It only works with TCP connections, and doesn't provide for user authentication. 
Application Proxy Gateway - The users connect to the outside using the proxy. The proxy gets the information and returns it to the user. The proxy can record everything that is done. This type of proxy may require a user login to use it. Rules may be set to allow some functions of an application to be done and other functions denied. The "get" function may be allowed in the FTP application, but the "put" function may not. 


 Proxy Servers can be used to perform the following functions. 
Control outbound connections and data. 
Monitor outbound connections and data. 
Cache requested data which can increase system bandwidth performance and decrease the time it takes for other users to read the same data. 


 Application proxy servers can perform the following additional functions: 
Provide for user authentication. 
Allow and deny application specific functions. 
Apply stronger authentication mechanisms to some applications.  


Packet Filtering Firewalls


 In a packet filtering firewall, data is forwarded based on a set of firewall rules. This firewall works at the network level. Packets are filtered by type, source address, destination address, and port information. These rules are similar to the routing rules explained in an earlier section and may be thought of as a set of instructions similar to a case statement or if statement. This type of firewall is fast, but cannot allow access to a particular user since there is no way to identify the user except by using the IP address of the user's computer, which may be an unreliable method. Also the user does not need to configure any software to use a packet filtering firewall such as setting a web browser to use a proxy for access to the web. The user may be unaware of the firewall. This means the firewall is transparent to the client. 
Circuit Level Relay Firewall


 A circuit level relay firewall is also transparent to the client. It listens on a port such as port 80 for http requests and redirect the request to a proxy server running on the machine. Basically, the redirect function is set up using ipchains then the proxy will filter the package at the port that received the redirect. 
Configuring a Proxy Server


 The following packages are available in Linux: 
Ipchains soon to be replaced by netfilter (Packet filtering supported by the Linux kernel). It comes with Linux and is used to modify the kernel packet routing tables. 
SOCKS - Circuit Switching firewall. Normally doesn't come with Linux, but is free. 
Squid - A circuit switching proxy. Normally comes with Linux. 
Juniper Firewall Toolkit - A firewall toolkit product used to build a firewall. It uses transparent filtering, and is circuit switching. It is available as open source. 
The TIS Firewall Toolkit (FWTK). A toolkit that comes with application level proxies. The applications include Telnet, Rlogin, SMTP mail, FTP, http, and X windows. it can also perform as a transparent proxy for other services. 
Ipchains and Linux Packet filtering


 For complete information on the use of IP chains and setting up a firewall, see the following Linux how-tos: 
IPCHAINS-HOWTO 
Firewall-HOWTO 
IP-Masquerade-HOWTO 


 Some of the information in this section is based on these how-tos. This section summarizes and puts in simple steps some of the items you will be required to perform to set up a firewall. It is not meant as a replacement for the Linux how to documents, but a complement to them by giving an overview of what must be done. You may access the howtos from one of the websites listed in the Linux websites section. The Linux Documentation Project or Metalab's Index of Linux publications will have copies if these howtos. 


 The administration of data packet management is controlled by the kernel. Therefore to provide support for things like IP masquerading, packet forwarding, and port redirects, the support must be compiled into the kernel. The kernel contains a series of tables that each contain 0 or more rules. Each table is called a chain. A chain is a sequence of rules. Each rule contains two items. 
Characteristics - Characteristics such as source address, destination address, protocol type (UDP, TCP, ICMP), and port numbers. 
Instructions - Instructions are carried out if the rule characteristics match the data packet. 


 The kernel filters each data packet for a specific chain. For instance when a data packet is received, the "input" chain rules are checked to determine the acceptance policy for the data packet. The rules are checked starting with the first rule (rule 1). If the rule characteristics match the data packet, the associated rule instruction is carried out. If they don't match, the next rule is checked. The rules are sequentially checked, and if the end of the chain is reached, the default policy for the chain is returned. 


 Chains are specified by name. There are three chains that are available and can't be deleted. They are: 
Input - Regulates acceptance of incoming data packets. 
Forward - Defines permissions to forward packets that have another host as a destination. 
Output - Permissions for sending packets. 


 Each rule has a branch name or policy. Policies are listed below: 
ACCEPT - Accept the data packet. 
REJECT - Drop and the packet but send a ICMP message indicating the packet was refused. 
DENY - Drop and ignore the packet. 
REDIRECT - Redirect to a local socket with input rules only even if the packet is for a remote host. This applies to TCP or UDP packets. 
MASQ - Sets up IP masquerading. Works on TCP or UDP packets. 
RETURN - The next rule in the previous calling chain is examined. 


 You can create more chains then add rules to them. The commands used to modify chains are as follows: 
-N Create a new chain 
-X Delete an empty chain 
-L List the rules in the chain 
-P Change the policy for a chain 
-F Flush=Delete all the rules in a chain 
-Z Zero the packet and byte counters in all chains 


 Commands to manipulate rules inside the chain are: 
-A Append a new rule to a chain. 
-I Insert a new rule at some position in a chain. 
-R Replace a rule at some position in a chain. 
-D Delete a rule at some position in a chain. 
Options for masquerading: 
-M with -L to list the currently masqueraded connection. 
-M with -S to set the masquerading timeout values. 


 IPchains Options for setting rule specifications: 
-s Source 
-d Destination 
-p Protocol=tcp, upd, icmp, all or a name from /etc/protocols 
-j Jump target, Specifies the target of the rule. The target can be a user defined chain, but not the one this rule is in. 
-i Interface=Name of the interface the packet is received on or the interface where the packet will be sent 
-t Mask used to modify the type of service (TOS) field in the IP header. This option is followed by two values, the first one is and'ed with the TOS field, and the second is exclusive or'ed. The masks are eight bit hexadecimal values. An example of use is "ipchains -A output -p tcp -d 0.0.0.0/0 telnet -t 0x01 0x10" These bits are used to set priority. See the section on IP message formats. 
-f Fragment 


 When making changes to firewall rules, it is a good idea to deny all packages prior to making changes with the following three commands: 


 ipchains -I input 1 -j DENY
 ipchains -I output 1 -j DENY
 ipchains -I forward 1 -j DENY 


 These commands inserts a rule at location 1 that denies all packages for input, output, or forwarding. This is done so no unauthorized packets are not let through while doing the changes. When your changes have been completed, you need to remove the rules at position 1 with the following commands: 


 ipchains -D input 1
 ipchains -D output 1
 ipchains -D forward 1 
Examples of the use of ipchains to allow various services


Create a new chain: 


 ipchains -N chainame 


 The option "-N" creates the chain. 


Add the chain to the input chain: 


 ipchains -A input -j chainame 


Allow connections to outside http servers from inside our network: 




 ipchains -A chainame -s 10.1.0.0/16 1024: -d 0.0.0.0/0 www -j ACCEPT 


 The "-A chainame" adds a rule to the chain called "chainame". The "-s 10.1.0.0/16 1024:" specifies any traffic on network 10.1.0.0 at port 1024 or above. The "-d 0.0.0.0/0 www" specifies any destination for www service (in the /etc/services file) and the "-j ACCEPT" sets the rule to accept the traffic. 


Allow connections from the internet to connect with your http server: 


 ipchains -A chainame -s 0.0.0.0/0 www -d 10.1.1.36 1024: -j ACCEPT 


 The "-A chainame" adds a rule to the chain called "chainame". The "-s 0.0.0.0/0 www" specifies traffic from any source for www service. The "-d 10.1.1.36 1024:" specifies the http server at IP address 10.1.1.36 at ports above 1024 and the "-j ACCEPT" sets the rule to accept the traffic. 


Allow DNS to go through the firewall: 


 ipchains -A chainame -p UDP -s 0/0 dns -d 10.1.0.0/16 -j ACCEPT 


 The "-A chainame" adds a rule to the chain called "chainame". The "-p UDP" specifies UDP protocol. The "-s 0/0 dns" specifies any dns traffic from any location. The "-d 10.1.0.0/16" specifies our network and the "-j ACCEPT" sets the rule to accept the traffic. This allows DNS queries from computers inside our network to be received. 


Allow e-mail to go from our internal mail server to mailservers outside the network. 


 ipchains -A chainame -s 10.1.1.24 -d 0/0 smtp -j ACCEPT 


 The "-A chainame" adds a rule to the chain called "chainame". The "-s 10.1.1.24" specifies any traffic from 10.1.1.24 IP address. The "-d 0/0 smtp" specifies any smtp type of service going anywhere and the "-j ACCEPT" sets the rule to accept the traffic. 


Allow e-mail to come from any location to our mail server: 


 ipchains -A chainame -s 0/0 smtp -d 10.1.1.24 smtp -j ACCEPT 


 The "-A chainame" adds a rule to the chain called "chainame". The "-s 0/0 smtp" specifies mail traffic from anywhere. The "-d 10.1.1.24 smtp" specifies mail traffic going to our mail server and the "-j ACCEPT" sets the rule to accept the traffic. 


Perform a HTTP port redirect for a transparent proxy server: 


 ipchains -A input -p tcp -s 10.1.0.0/16 -d 0/0 80 -j REDIRECT 8080 


 The "-A input" adds a rule to the input chain. The "-p tcp" specifies the protocol TCP. The "-s 10.1.0.0/16" specifies the source as a network with netmask 255.255.0.0. The "-d 0/0" specifies a destination of anywhere. The number 80 is the HTTP port number, and the command "-j REDIRECT 8080" redirects the traffic to port 8080. 


Give telnet transmissions a higher priority 


 ipchains -A output -p tcp -d 0.0.0.0/0 telnet -t 0x01 0x10" 


 The bits at the end of the line specified in hexadecimal format are used to set the priority of the IP message on the network. The first value is and'ed with the TOS field in the IP message header, and the second value is exclusive or'ed. See the section on IP message formats for more information. 
Using ipchains-save and ipchains-restore to make rules permanent


 When you are done setting your ipchains rules, use the following procedure while logged on as root to make them permanent: 
Type the command "ipchains-save > /etc/iprules.save". 
Create the following script named "packetfw": 
#! /bin/sh
# Packet filtering firewall script to be used turn the firewall on or off

if [ -f /etc/iprules.save ]
then
   case "$1" in
      start)
          echo -n "Turning on packet filtering firewall:"
          /sbin/ipchains-restore < /etc/iprules.save
          echo 1 > /proc/sys/net/ipv4/ip_forward
          echo "."
          ;;
       stop)
          echo -n "Turning off packet filtering:"
          echo 0 > /proc/sys/net/ipv4/ip_forward
          /sbin/ipchains -X
          /sbin/ipchains -F
          /sbin/ipchains -P input ACCEPT
          /sbin/ipchains -P output ACCEPT
          /sbin/ipchains -P forward ACCEPT
          echo "."
          ;;
       *)
          echo "Usage: /etc/init.d/packetfw {start|stop}"
          exit 1
          ;;
   esac
   exit 0
else
   echo the /etc/iprules.save file does not exist.
   exit 1
fi
Save the file in the /etc/rc.d/init.d directory. 
In the /etc/rc.d/rc3.d and the /etc/rc.d/rc5.d directories make a symbolic link called S07packetfw to the /etc/rc.d/init.d/packetfw file with the command "ln -s /etc/rc.d/rc3/S07packetfw /etc/rc.d/init.d/packetfw". This applies to runlevel 3. Do the same for the runlevel 5 initialization directory. Note: You may need to use a different number than the "S07" string to number your link file. Look in your /etc/rc.d/rc3.d and /etc/rc.d/rc5.d directories to determine what number is available to give this file. Try to give it a number just below your network number file. On my system the S10network file is used to start my network.

Everything You Possibly Want to Know---Windows 8 Screenshot Tour

Yesterday Microsoft released the first preview release of Windows 8, and we spent all night testing it out and diving into how it all works. Here’s our review, and the normal How-To Geek style screenshot tour, with loads and loads of pictures.

Note: this article was so incredibly long that we broke it up into multiple pages, which isn’t something we do often.

So What’s New in Windows 8?

There’s a ton of new stuff in Windows 8, but the biggest change that you’ll notice right away is the addition of the new tile-based Metro interface, which you can see in the screenshot above. Keep in mind that this is the developer preview release, which means it’s nowhere near finished, and you should definitely not install this on your primary PC.

We’ll go into loads of detail about everything as you read further, but first here’s a quick list of just some of the new features:

·                  Metro Interface – the new default interface in Windows 8, keep reading for everything about this.

·                  Faster Boot Times – Windows 8 will boot much faster than Windows 7, thanks to a partial hibernation mode and a lot of improvements in the loading process. On my old Dell laptop, it boots in less than 10 seconds – on new machines, it’s crazy fast.

·                  Less Memory Usage than Windows 7. That’s right. Microsoft is saying that not only will this version use less RAM than Win7, it also uses less running processes.

·                  Windows Explorer overhauled, now has the Ribbon UI, Revamped File Copying, and ISO mounting.

·                  In-Place PC Refresh will reload Windows in just a couple of clicks, keeping your files intact.

·                  ARM processors are now supported, which will lead to an entirely new class of low-power, battery-efficient tablets.

·                  Hyper-V is now part of Windows – so now you can create virtual machines easily without installing anything extra.

·                  Taskbar can now span multiple monitors – this very simple feature has finally made it into Windows.

·                  Wallpaper can now span multiple monitors – yet another feature that should have been around 10 years ago.

·                  Universal Spell Check across Metro applications.

·                  Windows Live Integration for Sync, Mail, Skydrive lets you sync all your settings across your PCs, including your files, mail, and photos. The sync is available in the preview, but the Skydrive and Mail are not yet.

·                  Windows Store will let you purchase Windows apps all in a single place.

·                  New Task Manager is completely revamped with much better tools, including a way to disable startup applications, track application resource usage over time, and even easily restart Windows Explorer.

There’s way more changes all over the place, and we’ll try and cover as much as possible, but there’s no way we can get everything. Not to mention the fact that this is a preview, so there’s probably a whole lot more coming in the beta.

How Can I Get Windows 8?

First, you’ll want to make sure that your PC can run Windows 8, and thankfully the Windows 8 system requirements are basically the same as Windows 7. You can probably get away with installing this on a PC with lousy specs, but obviously you’ll have a better experience on a faster machine. Here’s the specs:

·                  1 gigahertz (GHz) or faster 32-bit (x86) or 64-bit (x64) processor

·                  1 gigabyte (GB) RAM (32-bit) or 2 GB RAM (64-bit)

·                  16 GB available hard disk space (32-bit) or 20 GB (64-bit)

·                  DirectX 9 graphics device with WDDM 1.0 or higher driver

·                  Taking advantage of touch input requires a screen that supports multi-touch

The key thing to note is that you don’t need a touch device to install Windows 8. Keyboard and mouse will work just fine.

Just head to dev.windows.com and download the ISO images from the page. Then head to the Microsoft Store page and download the USB/DVD Download Tool, which can put the ISO image onto a bootable flash drive for installation—all you have to do is choose the ISO, choose the drive, and wait for it to finish copying.

The setup process is nearly identical to Windows 7, so we’re not going to go into detail about it here. We’ll assume if you’re installing Windows 8 that you’re not a newb, and as such you shouldn’t need any help clicking through a couple of installer screens.

Notes:

·                  We were not able to get it working in VMware Workstation or Virtual PC.

·                  If you do want to virtualize, try VirtualBox. Many readers reported luck with this.

·                  You don’t need a product key or a login to download or install Windows 8.

·                  The preview release is supposed to auto-update. There’s no word on when the Beta release will be out, or whether it will automatically upgrade.

·                  The preview release does not have Media Center included. Microsoft says that it will be a part of Windows 8 though.

Good luck, and make sure to let us know in the comments how you fare.

What’s This Metro Interface All About?

Metro is a tile-based interface focused on being clean and simple, with simple icons and beautiful typography instead of the typical shadows and raised button interfaces that we’re used to. Many tiles are more than just an application launcher, they contain live data that updates automatically—a weather tile will automatically show the latest weather report, a news title will scroll the latest from your feeds, the social widget will show the latest photos from Facebook, and your stock ticker will automatically show you what those greedy Wall Street people are up to.

This interface was first released on Windows Phone, and while it’s definitely ideal for a touchscreen environment, it’s also quite usable with the keyboard and mouse—though you will find that scrolling multiple pages is much more tedious using just the mouse than using a simple swipe on the screen.

Metro Features

·                  Universal Sharing across applications allows applications to easily share files or text with cloud services (and each other). You can load a picture from Facebook into a photo editing app, then share it on Twitter once you’re done. And it’s all hooked into the common file open dialogs, and the new Share feature.

·                  Universal Search allows applications to register with the global search in the Metro interface, so you can search across any application that supports it.

·                  Hardware Acceleration – all Metro applications are automatically hardware accelerated, making the entire experience much more smooth.

·                  Process Suspending – Windows can automatically suspend Metro applications for better battery life when they aren’t being used.

·                  New WindowsRT runtime provides these features to any application in almost any language, with almost no extra code. That means existing applications can be easily modified to connect to social networks without writing any networking code.

To bring up the Metro Start screen when you’re in any other application, just hit the Windows button.

The main Start screen is also a complete replacement for the Windows 7 Taskbar—you can just start typing at any point while viewing the main Metro Start screen and you’ll be able to quickly find any application on your system the same way that you could on Windows 7.

Metro Keyboard Shortcuts
These are a few keyboard shortcuts that I’ve personally been using. There’s others, but I haven’t figured out whether they work for mouse/keyboard mode or only if you’re using a touch screen with a keyboard also connected, so I won’t include them.

·                  Windows+F – Opens File Search

·                  Windows+C – Opens Charms Bar

·                  Windows+I – Opens Settings

·                  Windows+Q – Opens App Search pane

·                  Windows+W – Opens Settings Search app

·                  Windows+Z – Opens App Bar

If you aren’t at the Start screen, all you have to do is hit the Windows key to get back to the screen, and then start typing to launch an application—it’s the same set of keystrokes you would use before, but a different interface.

Back on the main Metro screen, you can easily click and drag to move items around on the screen. If you’re using a touch interface, you can do the same thing with your fingers. You can even zoom out using a Pinch gesture to see all of the items on the screen without having to scroll—as far as we can tell, there’s no way to do that in the mouse-only interface, but if you know how to do that, please leave a comment and tell us how.

If you right-click on a tile you’ll see a check box—if you’re using the touch interface you can nudge the tile up or down…

Which will enable a menu at the bottom of the screen. Depending on what tile you’ve selected, you’ll either get items to make it Larger, Smaller, Uninstall it, Pin it, or Unpin it.

If you were to click on a regular application like Task Manager or the command prompt, you’ also get some extra items like Run as Administrator, which is pretty useful for many system tasks.

Some of the tiles will open up a Metro-style application, which is always full screen. The Weather application can be customized for your location, and you can even pin multiple weather tiles to the home screen for multiple locations.

You might notice the purple bar on the left hand side of the screen—that’s very important. Whenever you’re in a Metro application using a touch interface, you can swipe from the left side to flip between applications. Keep swiping left to cycle through all of the applications. This is roughly the same as using Win+Tab, which works differently in Windows 8 than it did in Windows 7. You can, of course, still use Alt+Tab the way you always did.

If you swipe from the left and then drop the thumbnail into the screen, you can actually dock two separate full-screen applications into the same screen—notice the green line in the middle of the two applications below. On the left is the news feed, and the right is a photo application. You can switch which side of the screen has the “sidebar” application, or switch which application is on either side. What you can’t do, however, is adjust them to be 50/50, it’s a fixed ratio.

Swiping from the right side will pull up another menu, which they call the “Charms” menu. Yes, that’s a very silly name. This allows you to get to various functions like Search, Share, or Settings, and this works across the board in Metro applications. You’ll most likely use this feature most often to search and share from within applications—for instance, if you were viewing a photo and wanted to share it on Facebook, or if you needed to do a search through an application for a file.

If you’re using the keyboard and mouse, you can use the Win+C menu to pull up the same menu, except in the lower left-hand corner. Oddly, you can also move your mouse to the lower left corner of the screen, and the menu will show up—in fact, this works whether you are in the Metro interface or back on the Windows 7 style Taskbar.

Here’s a closer view of the menu:

Keep reading for the rest of the review, including the new Windows 8 Explorer, Task Manager, the new Control Panel, and a bunch more.