IA Module Notes

Middle East College of Information Technology
Module Name: Internet Administration
Module Code: COMP 0326
Module Guide
Department of computing
Internet Administration 1
Installing Windows 2000 Professional / Windows Xp
 Start the computer from the CD
 Select to install a new copy of Windows 2000 or XP
 Read and accept the Licensing agreement
 Select the file system Fat of NTFS
 Enter the name and organization.
 Enter the computer name and password for local administrator
 Select the date and time settings
Installation network components
After completing the setup wizard, install network components by performing

the following steps:
 Choose a networking setting.
Setting Description
Typical Installs Client for Microsoft Networks, File

and Printer Sharing for Microsoft Networks, and Transmission Control
Protocol/Internet Protocol (TCP/IP) as a Dynamic Host Control Protocol
(DHCP) client.
Custom Creates custom network connections: for

example, configuring a static IP address, configuring the computer as a WINS
client, or adding NetBIOS Enhanced User Interface (NetBEUI)
 Provide a workgroup or domain name.
 Click Finish to restart the computer.
 Configure the network ID for the computer.
After the computer restarts, Windows2000 Professional displays the Network

ID wizard. In this wizard, you do either of the following.
 Configure a specific user account and password for the computer.

When a user starts the computer, Windows2000 automatically logs on
using the configured user name and password.
 Choose not to configure a specific user account for the computer.

When a user starts the computer, the Log On t Windows dialog box
appears.
 Apply all necessary software or security updates to the operating

system.
Installing Windows 2003 Server
To install Windows 2003 server from a CD you must restart the computer
from a CD and then complete the setup wizard.
With the exception of the optional components, the information you provide
during the installation of Windows 2003 server is the same as the information
you provide during the installation of Windows 2000 Professional.
 Start the computer from the CD
 Select to install a new copy of Windows 2003 Server
 Read and accept the Licensing agreement
 Select the Partition on which to install Windows 2003 Server
 Select the file system for the new partition. You can also choose
to format the new partition.
After running the text-based portion of the Setup program, complete the
Setup wizard by providing the following information:
 Change regional settings, if necessary.
 Enter your name and organization.
 Select the licensing mode.
 Enter the computer name and password for the local Administrator
account.
 Select the Windows 2003 optional components. Optional components

provide additional functionality to Windows 2003, such as Web
services, Remote Installation Services (RIS), and management tools.
The following table describes these optional components.
 Certificate Services Allows you to create and request digital

certificates for authentication. Certificates provide a verifiable means of
identifying users on nonsecure network, such as the internet.
 Windows Clustering Enables two or more services to work

together to keep server-based applications available, regardless of
individual component features. This service is available only in
Windows 2000 Advanced Server and Windows 2000 Datacenter
Server.
 IIS Internet Information Server-Includes FTP and Web servers, the

administrative interface for IIS, common IIS components, and
documentation.
 Terminal Services Enables windows based clients to gain access to a

virtual Windows 2000 advanced server desktop session and windows
based applications.
DNS
The Domain Name System (DNS) is an integral part of client/server

communications in Internet Protocol networks. DNS is a distributed database
that is used in IP networks to translate, or resolve, computer names into IP
addresses. Microsoft Windows 2000 uses DNS as its primary method for
name resolution.
DNS is a distributed database system that can serve as the foundation for
name resolution in an IP network.
DNS Levels
DNS is a hierarchical naming structure with the following levels:
 Root designated by a dot (.).

 First level - This indicates country or type of organization such as "org",
"com", and "net".
 Second level - Indicates the organization name and can be purchased
for a yearly fee and can have many sub domains.
Notice that the highest level of the domain is listed last. An example of a
domain name is: mecit.edu.om
The common top-level domain names used are:
 .com: commercial organizations

 .edu: for educational institutes.
 .gov: for government.
 .int: for international organizations.
 .mil: for military organizations
 .net: for Internet providers, and networking organizations
 .org: non-commercial organizations
 .uk: United Kingdom
 .us: United States
 .ca: Canada
 .jp: Japan
The additional top-level domains defined by ICANN in late 2000 are:
 .aero: for the air transportation industry

 .biz: for businesses
 .coop: for cooperatives
 .info: for information
 .museum: for museums
 .name: for individual names
 .pro: for credentialed professions such as attorneys.
FQDN
 A FQDN is a complete DNS name. For example, if a server named mail
existed at the mecit, the FQDN of that server might be mail.mecit.edu.om.
 Technically, a FQDN must end in a period. This rule is almost always
ignored.
 A FQDN is limited to a maximum length of 255 characters.
 DNS uses the FQDN to resolve a host name to an IP address
DNS SERVER
This is a computer running the DNS Server service, or BIND; that provides
domain name services. The DNS server manages the DNS database that is
located on it. The DNS server program, whether it is the DNS Server service
or BIND; manages and maintains the DNS database located on the DNS
server. The information in the DNS database of a DNS server pertains to a
portion of the DNS domain tree structure or namespace. This information is
used to provide responses to client requests for name resolution.
When a DNS server is queried it can do one of the following:
o Respond to the request directly by providing the requested

information.
o Provide a pointer (referral) to another DNS server that can assist in
resolving the query
o Respond that the information is unavailable
o Respond that the information does not exist
A DNS server is authoritative for the contiguous portion of the DNS

namespace over which it resides.
Types of DNS servers:
 Primary DNS server: This DNS server owns the zones defined in its DNS
database, and can make changes to these zones.
 Secondary DNS server: This DNS server obtains a read-only copy of
zones via DNS zone transfers. A secondary DNS server cannot make any
changes to the information contained in its read-only copy. A secondary
DNS server can however resolve queries for name resolution. Secondary
DNS servers are usually implemented for the following reasons:
o Provide redundancy: It is recommended to install one primary
DNS server, and one secondary DNS server for each DNS zone
(minimum requirement). Install the DNS servers on different
subnets so that if one DNS server fails, the other DNS server can
continue to resolve queries.
o Distribution of DNS processing load: Implementing secondary
DNS servers assist in reducing the load of the primary DNS server.
o Provide fast access for clients in remote locations: Secondary
DNS servers can also assist in preventing clients from transverse
slow links for name resolution requests.
DNS zones: A DNS zone is the contiguous portion of the DNS domain name
space over which a DNS server has authority, or is authoritative. A zone is a
portion of a namespace . it is not a domain. A domain is a branch of the DNS
namespace. A DNS zone can contain one or more contiguous domains. A
DNS server can be authoritative for multiple DNS zones.
Zone files store resource records for the zones over which a DNS server has
authority.
Zone Types
 Primary zone: This is only zone type that can be directly updated or
edited because the data in the zone is the original source of the data for
all domains in the zone. Updates made to the primary zone are made by
the DNS server that is authoritative for the specific primary zone.
 Secondary zone: This is a read-only copy of the zone that was copied
from the master server during zone transfer. In fact, a secondary zone can
only be updated through zone transfer.
 Active Directory-integrated zone: This is an authoritative primary zone
that stores its data in Active Directory. Active Directory-integrated zones
can be regarded as enhanced standard primary zones.
 Stub zone: Stub zones only contain those resource records necessary to
identify the authoritative DNS servers for the master zone
DNS client: This is a machine that queries the DNS server for name
resolution. To issue DNS requests to the DNS server, DNS resolvers are
used.
DNS Record types:
 A - Address record allowing a computer name to be translated into an
IP address. Each computer must have this record for its IP address to
be located. These names are not assigned for clients that have
dynamically assigned IP addresses, but are a must for locating servers
with static IP addresses.
 AAAA Host resource record for IPv6 protocol.
 AFDSB - Andrew File System Database resource record
 ATMA - Asynchronous Transfer Mode resource record.
 CNAME - Canonical name allowing additional names or aliases to be
used to locate a computer.
 HINFO - Host information record with CPU type and operating system.
 ISDN - Integrated Services Digital Network resource record.
 MB - Mailbox resource record.
 MG - Mail group resource record.
 MINFO - Mailbox mail list information resource record.
 MR - Mailbox renamed resource record.
 MX - Mail Exchange server record. There may be several.
 NS - Name server record. There may be several.
 PTR - Pointer resource record.
 RP - Responsible person.
 RT - Route through resource record for specifying routes for certain
DNS names.
 SOA - Start of Authority record defines the authoritative server and
parameters for the DNS zone. These include timeout values, name of
responsible person,
 SRV - Service locator resource record to map a service to servers
providing the service. Windows 2000 clients will use this record to find
a domain controller.
 TXT - Test resource record for informative text.
 WKS - Well known service resource record.
 X25 - To map a host name to an X.25 address.
DNS Query Process
There are 2 types of queries that can be performed in DNS
Iterative. A query made from a client to a DNS server in which the server
returns the best answer that it can provide based on its cache or zone data. If
a queried server does not have an exact match for the request, it provides a
pointer to an Authoritative server in a lower level of the domain namespace.
Recursive. A query made from a client to a DNS server in which the server
assumes the full workload and responsibility for providing a complete answer
to the query. The DNS server has to reply with the requested information, or
with an error. The DNS server cannot provide a referral to a different DNS
server.
The events that occur to resolve a name requested in a query are

explained below:
1. The resolver sends a recursive DNS query to its local DNS server, to
request the IP address of a particular name.
2. Because the local DNS server cannot refer the resolver to a different
DNS server, the local DNS server attempts to resolve the requested
domain name.
3. The local DNS server checks its zones.
4. If it finds no zones for the requested domain name, the local DNS
server sends an iterative query for the requested name to the root DNS
server.
5. The root DNS server is authoritative for the root domain. It responds
with an IP address of a name server for the specific top-level domain.
6. The local DNS server next sends an iterative query for the requested
name to this name server who in turn replies with the IP address of the
particular name server servicing the requested domain name.
7. The local DNS server then sends an iterative query for the requested
name to the particular name server servicing the particular domain.
8. The name server responds with the requested IP address.
9. The IP address is returned to the resolver.
Zone Look up Types

The zone lookup type determines the tasks that a DNS server will perform.
When you create a zone, you specify whether the zone will be used for
resolving forward or reverse lookup queries by specifying the zone type.
Forward Lookup: A request to map a name to IP address. This is the most

common type of lookup and is used to locate a server’s IP address so that a
connection can be made to it. This type of request requires name to address
resolution.
Reverse lookup: A request to map an IP address to a name. This is most

commonly used when you know an IP address, but you want to know the
domain name that is associated with the IP address.
It is used when monitoring IP connections that are made to the server.
DHCP
Dynamic Host Configuration Protocol (DHCP)

This protocol is used to assign IP addresses to hosts or workstations on the
network. Usually a DHCP server on the network performs this function.
Basically it "leases" out address for specific times to the various hosts. If a
host does not use a given address for some period of time, that IP address
can then be assigned to another machine by the DHCP server. When
assignments are made or changed, the DHCP server must update the
information in the DNS server.
As with BOOTP, DHCP uses the machine's or NIC Ethernet (MAC) or

hardware address to determine IP address assignments. The DHCP protocol
is built on BOOTP and replaces BOOTP. DHCP extends the vendor specific
area in BOOTP to 312 bytes from 64. RFC 1541 defines DHCP.
DHCP RFCs
DHCP RFCs are 1533, 1534, 1541, and 1542. Information Sent from DHCP
server to the client machine are:
 IP address
 Subnet mask
 Default Gateway address
 DNS server address(es)
 NetBIOS Name server (NBNS) address(es).
 Lease period in hours
 IP address of DHCP server.
Manual vs. Automatic TCP/IP Configuration
Manual TCP/IP Configuration Automatic TCP/IP Configuration
IP addresses entered manually on each IP addresses are supplied

client computer automatically to client computers
Possibility of entering incorrect or invalid Ensures that clients always use

IP address correct configuration information
Incorrect configuration can lead to Elimination of common source of

communication and network problems network problems
Administrative overload on networks Client configuration updated

where computers are frequently moved automatically to reflect changes in
network structure
DHCP Lease Stages (DHCP Lease Generation Process)
1. Lease Request - The client sends a broadcast requesting an IP

address
2. Lease Offer - The server sends the above information and marks the
offered address as unavailable. The message sent is a DHCPOFFER
broadcast message.
3. Lease Acceptance - The first offer received by the client is accepted.
The acceptance is sent from the client as a broadcast
(DHCPREQUEST message) including the IP address of the DNS
server that sent the accepted offer. Other DHCP servers retract their
offers and mark the offered address as available and the accepted
address as unavailable.
4. Server Lease Acknowledgement - The server sends a DHCPACK or
a DHCPNACK if an unavailable address was requested.
IP Lease Request DHCP SERVER

DHCP
CLIENT
IP Lease Offer
IP Lease Selection
IP Lease
Acknowledgement
DHCP discover message - The initial broadcast sent by the client to obtain a
DHCP lease. It contains the client MAC address and computer name. This is
a broadcast using 255.255.255.255 as the destination address and 0.0.0.0 as
the source address. The request is sent, then the client waits one second for
an offer. The request is repeated at 9, 13, and 16 second intervals with
additional 0 to 1000 milliseconds of randomness. The attempt is repeated
every 5 minutes thereafter.
The client uses its own port 68 as the source port with port 67 as the
destination port on the server to send the request to the server. The server
uses its own port 67 as the source port with port 68 as the destination port on
the client to reply to the client. Therefore the server is listening and sending
on its own port 67 and the client is listening and sending on its own port 68.
This can be confusing when you consider which way the message is going.
To be clear on this, I quote RFC 1531 which states "DHCP messages from a
client to a server are sent to the 'DHCP server' port (67), and DHCP
messages from a server to a client are sent to the 'DHCP client' port (68)"
DHCP Lease Renewal

After 50% of the lease time has passed, the client will attempt to renew the
lease with the original DHCP server that it obtained the lease from using a
DHCPREQUEST message. Any time the client boots and the lease is 50% or
more passed, the client will attempt to renew the lease. At 87.5% of the lease
completion, the client will attempt to contact any DHCP server for a new
lease. If the lease expires, the client will send a request as in the initial boot
when the client had no IP address. If this fails, the client TCP/IP stack will
cease functioning.
DHCP Scope and Subnets

One DHCP scope is required for each subnet.
DHCP Relay Agents

May be placed in two places:
 Routers
 Subnets that don't have a DHCP server to forward DHCP requests.
Client Reservation
Client Reservation is used to be sure a computer gets the same IP address
all the time. Therefore since DHCP IP address assignments use MAC
addresses to control assignments, the following are required for client
reservation:
 MAC (hardware) address

 IP address
Exclusion Range
Exclusion range is used to reserve a bank of IP addresses so computers with
static IP addresses, such as servers may use the assigned addresses in this
range. These addresses are not assigned by the DHCP server.
IP address
An IP address (also called an IP number) is a number (typically written as four

numbers separated by periods, i.e. 107.4.1.3 or 84.2.1.111) which uniquely
identifies a computer that is making use of the Internet. It is analogous to your
telephone number in that the telephone number is used by the telephone
network to direct calls to you. The IP address is used by the Internet to direct
data to your computer, e.g. the data your web browser retrieves and displays
when you surf the net. One task of DHCP is to assist in the problem of getting
a functional and unique IP number into the hands of the computers that make
use of the Internet.
MAC address
A MAC address (also called an Ethernet address or an IEEE MAC address) is

a number (typically written as twelve hexadecimal digits, 0 through 9 and A
through F, or as six hexadecimal numbers separated by periods or colons, i.e.
0080002012ef, 0:80:0:2:20:ef) which uniquely identifes a computer that has
an Ethernet interface. Unlike the IP number, it includes no indication of where
your computer is located. In DHCP's typical use, the server uses a requesting
computer's MAC address to uniquely identify it.
DHCP lease
A DHCP lease is the amount of time that the DHCP server grants to the
DHCP client permission to use a particular IP address. A typical server allows
its administrator to set the lease time.
DHCP Relay Agent
Definition
A DHCP relay agent is a computer or router that is configured to listen for
DHCP/BOOTP broadcasts from DHCP clients and then relay those messages
to DCHP servers on different subnets. DHCP/BOOTP relay agents are part of
the DHCP and BOOTP standards, and they function according to the Request
for Comments (RFCs) standard documents that describe protocol design and
related behavior.
An RFC 1542- compliant router is a router that supports the forwarding of
DHCP broadcast traffic.
Why use a DHCP relay agent?
DHCP clients use broadcasts to secure a lease from a DHCP server. Routers
normally do not pass broadcasts unless specifically configured to do so.
Consequently, without additional configuration, DHCP servers can provide IP
addresses only to clients located on the local subnet. Many organizations find
it more efficient to centralize the servers that provide the DCHP Server
service. To do so, they must configure the network so that DHCP broadcasts
will be passed from the client to the DCHP server. This can be done in one of
two ways: by configuring the routers that connect the subnets to forward
DHCP broadcasts or by configuring them to implement DCHP relay agents.
Windows Server 2003 supports the Routing and Remote Access service that
is configured to function as a DHCP relay agent.
DHCP strategies in a routed network

To understand why you would use a Microsoft DHCP relay agent, it is
important to identify strategies that can be implemented in a routed network.
For example:
 Include at least one DHCP server on each subnet.
This method requires at least one DHCP server on each subnet to
directly respond to DHCP client requests. However, this configuration
potentially requires more administrative and equipment overhead
because of the need to locate a DHCP server on each individual
subnet rather that providing DHCP server services from a centralized
location to multiple subnets. In addition, to provide fault tolerance, this
solution would require two servers configured on each subnet as
DHCP servers. Placing two DHCP servers of each subnet is often
impractical.
 Configure an RFC 1542-compliant router to forward DHCP messages
between subnets.
An RFC 1542-compliant router can be configured to selectively forward
DHCP broadcasts to another subnet. Although this option is preferable
to using DHCP servers on each subnet, it can complicate router
configuration and cause unnecessary broadcast traffic to be forwarded
to other subnets.
 Configure a Microsoft DHCP relay agent of each subnet to forward
DHCP messages to one or more particular DHCP servers on another
subnet.
Configuring a Microsoft DHCP relay agent of each subnet has several
advantages over the other options: It limits broadcasts to the subnet in
which they originate, and adding DHCP relay agents to multiple
subnets allows a single DHCP server to provide IP addresses to
multiple subnets more efficiently than when using RFC 1542-compliant
routers. You can also configure a Microsoft DHCP relay agent to delay
its response to a client request by a few second, in effect creating
primary and secondary DHCP responders.
 Configure a DHCP server that has multiple network cards.

When you configure a DHCP server that has multiple network cards,
you can connect each network card to a different subnet. You can then
configure DHCP scopes for each network that is attached to the
server. This is the recommended configuration if all subnets are in a
single location.
Network Troubleshooting Commands
Troubleshooting computer network is among the most important job

descriptions of the network administrators, system administrators, network
technicians and the IT consultants. A computer network can have different
kinds of problems such as it can be infected with virus and spyware, attacked
by hackers, accessed by unauthorized users and may face connectivity
failure issues due to the faulty network devices or configurations. Following is
a list of the basic network troubleshooting commands that are built-in the
Windows based operating systems and UNIX etc. The right use of these
troubleshooting commands can helps a lot in diagnosing and resolving the
issues with your computer network.
PING
Ping is the most important troubleshooting command and it checks the
connectivity with the other computers. For example your system’s IP address
is 10.10.10.10 and your network servers’ IP address is 10.10.10.1 and you
can check the connectivity with the server by using the Ping command in
following format.
At DOS prompt type Ping 10.10.10.1 and press enter
If you get the reply from the server then the connectivity is ok and if you get
the error message like this ―Request time out‖ this means the there is some
problem in the connectivity with the server.
IPCONFIG
Ipconfig is another important command in Windows. It shows the IP address
of the computer and also it shows the DNS, DHCP, Gateway addresses of
the network and subnet mask.
At DOS prompt type ipconfig and press enter to see the IP address of your
computer.
At DOS prompt type ipconfig/all and press enter to see the detailed
information.
At DOS prompt type ipconfig/displaydns and press enter to display DNS
Cache Info Configuration
At DOS prompt type ipconfig /flushdns and press enter to Clear DNS
Cache.
At DOS prompt type ipconfig /release and press enter to Release All IP
Address Connections
At DOS prompt type ipconfig /renew and press enter to Renew All IP
Address Connections
NSLOOKUP
NSLOOKUP is a TCP/IP based command and it checks domain name
aliases, DNS records, operating system information by sending query to the
Internet Domain Name Servers. You can resolve the errors with the DNS of
your network server
HOSTNAME
Hostname command shows you the computer name.
At DOS prompt type Hostname and press enter
NETSTAT
NETSTAT utility shows the protocols statistics and the current established
TCP/IP connections in the computer.
NBTSTAT
NBTSTAT helps to troubleshoot the NETBIOS name resolutions problems.
ARP
ARP displays and modifies IP to Physical address translation table that is
used by the ARP protocols.
FINGER
Finger command is used to retrieve the information about a user on a
network.
TRACERT
Tracert command is used to determine the path of the remote system. This
tool also provides the number of hops and the IP address of each hop. For
example if you want to see that how many hops (routers) are involved to
reach any URL and what’s the IP address of each hop then use the following
command.
At command prompt type tracert www.yahoo.com you will see a list of all the
hops and their IP addresses.
TRACEROUTE
Traceroute is a very useful network debugging command and it is used in
locating the server that is slowing down the transmission on the internet and it
also shows the route between the two systems
ROUTE
Route command allows you to make manual entries in the routing table.
Pathping
combines functions of Ping and Tracert
net session
Shows all Windows networking sessions
net use
Retrieves a list of network connections
net share
Lists all Windows shares that are available on this machine
net user
Shows user account for the computer
net user /domain

Displays user accounts for the domain
net view
Displays domains in the network
net user /domain <UserName>
Shows account details for specific user
whether the port is open
WEB SERVER
A Web server is a program that, using the client/server model and the World
Wide Web's Hypertext Transfer Protocol ( HTTP ), serves the files that form
Web pages to Web users (whose computers contain HTTP clients that
forward their requests). Every computer on the Internet that contains a Web
site must have a Web server program. Two leading Web servers are Apache ,
the most widely-installed Web server, and Microsoft's Internet Information
Server ( IIS ).
Other Web servers include Novell's Web Server for users of its NetWare
operating system and IBM's family of Lotus Domino servers, primarily for
IBM's OS/390 and AS/400 customers.
Configuring a WEB SERVER
By default IIS is installed automatically when you install Windows 2000.IIS is

designed to support simple websites in addition to multiple web sites on a
single server. In addition to the World Wide Web (WWW) server other internet
services that IIS include
 FTP File Transfer Protocol Service: Enables you to set up FTP sites for
uploading and downloading files.
 NNTP Network News Transfer Protocol Service. Enables you to host

electronic discussion groups or newsgroups.
 SMPT Simple Mail Transfer Protocol. Enables you to receive mail

messages from client applications and send these mail messages to
another server over the Internet.
Methods of Authentication
 Anonymous access provides users access to he public areas of your

website without prompting them for user name and password. This
authentication method id configured by default during IIS Installation.
 Basic Authentication prompts the users for a user name and

password before allowing access to a web page. You can set basic
authentication at the Web Site, Folder or File level.
 Digest Authentication is a new feature in IIS 5.0.This method is

similar to Basic authentication, but it involves a different way of
transmitting the authentication Credentials. The authentication
Credentials pass through a process called Hashing.
 Integrated Windows Authentication: You are configuring an intranet

site, where both the users and the web server are in the same domain,
or in domains with a trust relationship
FTP
What is FTP?
FTP (File Transfer Protocol) is the simplest and most secure way to exchange
files over the Internet. Most often, a computer with an FTP address is
dedicated to receive an FTP connection. Just as a computer that is setup to
host Web pages is referred to as a Web server or Website, a computer
dedicated to receiving an FTP connection is referred to as an FTP server or
FTP site.
What is an FTP Site?
An FTP site is like a large filing cabinet. With a traditional filing cabinet, the
person who does the filing has the option to label and organize the files how
ever they see fit. They also decide which files to keep locked and which
remain public. It is the same with an FTP site.
The virtual 'key' to get into an FTP site is the UserID and Password. If the
creator of the FTP site is willing to give everyone access to the files, the
UserID is 'anonymous' and the Password is your e-mail address (e.g.
name@domain.com).
If the FTP site is not public, there will be a unique UserID and Password for
each person who is granted access.
When connecting to an FTP site that allows anonymous logins, you're

frequently not prompted for a name and password. Hence, when
downloading from the Internet, you most likely are using an anonymous FTP
login and you don't even know it.
To make an FTP connection you can use a standard Web browser (Internet
Explorer, Netscape, etc.) or a dedicated FTP software program, referred to as
an FTP 'Client'.
When using a Web browser for an FTP connection, FTP uploads are difficult,
or sometimes impossible, and downloads are not protected (not
recommended for uploading or downloading large files).
When connecting with an FTP Client, uploads and downloads couldn't be

easier, and you have added security and additional features. For one, you're
able to to resume a download that did not successfully finish, which is a very
nice feature for people using dial-up connections who frequently loose their
Internet connection.
What is an FTP Client?
An FTP Client is software that is designed to transfer files back-and-forth

between two computers over the Internet. It needs to be installed on your
computer and can only be used with a live connection to the Internet.
The classic FTP Client look is a two-pane design. The pane on the left
displays the files on your computer and the pane on the right displays the files
on the remote computer.
File transfers are as easy as dragging-and-dropping files from one pane to

the other or by highlighting a file and clicking one of the direction arrows
located between the panes.
Additional features of the FTP Client include: multiple file transfer; the auto re-
get or resuming feature; a queuing utility; the scheduling feature; an FTP find
utility; a synchronize utility; and for the advanced user, a scripting utility.
FTP commands using DOS prompt
FTP can also be done using the DOS prompt. The port number for FTP is 21.
A user should type FTP and then open the port for the server
A user must login to a server with a valid username and Password.
Decide weather he has to send Images or Text, Html files.
 If you need to send Images change from the default ASCII mode to
Binary
 If you need to send html, ASP or other text files use the default ACSCII
mode.
To send a file the command is ―send‖ filename.
To receive a file from the remote server it is ―get‖ filename.
―mput‖ and ―mget‖ can be used to send and receive multiple file.
―help‖ will display different commands
―lcd‖ is used to change the directory in the local machine and ―cd‖ is used to
change the directory in the remote machine
―Dir‖ will display all then files and ―status‖ will show the status as to weather it
is in ASCII mode or Binary mode.
―bye‖ is used to disconnect from the ftp server.
NETWORK SECURITY
What is PKI?
 PKI is the acronym for Public Key Infrastructure.

 The technology is called Public Key because, unlike earlier forms of
cryptography, it works with a pair of keys. One of the two keys can be
used to encrypt information that can only be decrypted with the other key.
 One key is made public and the other is kept secret. The secret key is
usually called the private key.
 Since anyone can obtain the public key, users can initiate secure
communications without having to previously share a secret through some
other medium with their correspondent.
 The Infrastructure is the underlying system needed to issue keys and
certificates and to publish the public information.
 PKI is a set of comprehensive system policies, procedures, and
technologies working together to allow secure and confidential
communication between internet users.
 PKI is based on the idea of encryption using public and private keys.
 PKI uses key pairs (public and private keys) where the public key is
digitally signed by a third party known as a certification authority.
Public Key Certificates

A public key needs to be associated with the name of its owner. This is done
by using a public key certificate, which is a data structure containing the
owner's name, their public key and e-mail address, validity dates for the
certificate, the location of revocation information, the location of the issuer's
policies, and possibly other information such as their affiliation with the
certificate issuer (often an employer or institution). The certificate data
structure is signed with the private key of the issuer so that a recipient can
verify the identity of the signer and prove that the data in the certificate has
not been altered. Public Key Certificates are then published, often in an LDAP
directory, so users of PKI can locate the certificate for an individual with
whom they wish to communicate securely.
Encryption and Signing

A secret key allows two transformations of data to occur. Plain text is
transformed to cipher text, which is unreadable until it is transformed back to
plain text using the secret key. A public key system uses the Encrypt and
Decrypt functions to implement two primitive operations, data encryption and
signatures.
To encrypt data, the public key of the recipient is used to transform a plain
text message to cipher text. The cipher text of the message can be converted
back to plain text only by using the corresponding private key. Since this
private key is known only by the intended recipient, only that individual can
decrypt the message.
A signature is created by transforming plain text to cipher text using the
private key of the signer. A signature is verified by looking up the public key of
the signer and attempting to transform the cipher text of the signature back to
plain text. If the operation is successful, it verifies that the data encryption was
done with the corresponding private key. This implies that the signature was
produced by the owner of that private key.
What is the relationship between PKI and security?
The relationship between PKI and security lies in the fact that the public and
private keys can be used for encryption. To secure online transactions one
must hide the content of the data being transmitted over the wire, PKI is used
to do this task through the use of SSL and TLS.
What are the major elements of PKI?
The major components of PKI are listed below.
 Certification Authority
 Digital certificates
 Public & private key pairs
 Certificate Policy (CP)
 Certification Practices Statement (CPS)
What is a Certificate Authority (CA)?

A Certification Authority is a trusted third party that verifies the identity of an
entity registering for a digital certificate. Once a Certification Authority
authenticates the requesting entity's identity, it issues a digital certificate to
the requesting entity binding his or her identity to a public key. (Digital
certificates can be issued to organizations and devices in addition to people)
What is digital certificate?
 Digital Certificates are the electronic counterparts to driver licenses,
passports and membership cards. You can present a Digital Certificate
electronically to prove your identity or your right to access information
or services online.
 Digital Certificates bind an identity to a pair of electronic keys that can
be used to encrypt and sign digital information.
 Used in conjunction with encryption, Digital Certificates provide a more
complete security solution, assuring the identity of all parties involved
in a transaction.
 A Digital Certificate is issued by a Certification Authority (CA) and
signed with the CA's private key.
 A Digital Certificate typically contains the:
o Owner's public key
o Owner's name
o Expiration date of the public key
o Name of the issuer (the CA that issued the Digital
Certificate
o Serial number of the Digital Certificate
o Digital signature of the issuer
 The most widely accepted format for Digital Certificates is defined by
the ITU-T X.509 international standard; thus certificates can be read or
written by any application complying with X.509.
X.509
X.509 is an ITU-T (ITU Telecommunication Standardization Sector) standard
for PKI (Public Key Infrastructure) in cryptography, which, amongst many
other things, defines specific formats for PKC (Public Key Certificates) and
the algorithm that verifies a given certificate path is valid
Certificate Structure
A X.509 version 3 digital certificate has three main variables - the certificate,
the certificate signature algorithm and the certificate signature. The certificate
is described by attributes such as version, algorithm ID, serial number, issuer,
subject, validity, subject public key info, extensions and several other optional
ones like subject and issuer unique identifier. The subject public key info
attribute is further detailed by the public key algorithm and subject public key,
while validity attribute comes has further options for an upper and lower date
limit, which eventually decides the life of the certificate.
Structure of a certificate
The structure of a X.509 v3 digital certificate is as follows:
Certificate
Version
Serial Number
Algorithm ID
Issuer
Validity
 Not Before
 Not After
Subject
Subject Public Key Info
 Public Key Algorithm
 Subject Public Key
Issuer Unique Identifier (Optional)
Subject Unique Identifier (Optional)
Extensions (Optional)
 ...
Certificate Signature Algorithm
Certificate Signature
IPSec
 Internet Protocol Security (IPSec) is a collection of standards that was
designed specifically to create secure end-to-end secure connections.
 The standards were developed by the Internet Engineering Task Force
(IETF) to secure communications over both public and private
networks, though it is particularly beneficial to public networks.
 Using Internet Protocol Security (IPSec), you can provide data privacy,
integrity, authenticity, and anti-replay protection for network traffic
 The bundle of protocols, hashing, and encryption algorithms used in
IPSec include:
o IKE [Internet Key Exchange protocol]
o ISAKMP [Internet Security Association and Key Management
Protocol]
o AH [Authentication Header protocol]
o ESP [Encapsulating Security Payload protocol]
o STS [Station-to-Station protocol]
o HMAC [Hash Message Authentication Code]
o MD5 [Message Digest 5]
o SHA-1 [Security Hash Algorithm]
o 3DES [Triple Data Encryption Standard]
o XAUTH [Extended Authentication]
o AES [Advanced Encryption Standard]AH versus ESP
AH Vs ESP
"Authentication Header" (AH) and "Encapsulating Security Payload" (ESP)

are the two main wire-level protocols used by IPsec, and they authenticate
(AH) and encrypt + authenticate (ESP) the data flowing over that connection.
AH is used to authenticate — but not encrypt — IP traffic
Authentication Header (AH): provides authenticity guarantee for packets, by

attaching strong crypto checksum to packets. If you receive a packet with AH
and the checksum operation was successful, you can be sure about two
things if you and the peer share a secret key, and no other party knows the
key:
o The packet was originated by the expected peer. The packet

was not generated by impersonator.
o The packet was not modified in transit.
Encapsulating Security Payload (ESP) provides confidentiality guarantee

for packets, by encrypting packets with encryption algorithms. If you receive a
packet with ESP and successfully decrypted it, you can be sure that the
packet was not wiretapped in the middle, if you and the peer share a secret
key, and no other party knows the key.
Modes of Operation for IPSec
 There are two modes of operation for IPSec: transport mode and
tunnel mode.
Transport Mode
 In transport mode, only the payload of the message is encrypted.
 Transport Mode is used to protect an end-to-end conversation between
two hosts. This protection is either authentication or encryption (or
both), but it is not a tunneling protocol. It has nothing to do with a
traditional VPN: it's simply a secured IP connection.
Tunnel Mode
 In tunnel mode, the payload, the header, and the routing information
are all encrypted.
 Tunnel mode is intended for secure site-to-site communications over
an untrusted network. Each site has an IPsec gateway configured to
route traffic to the other site. When a computer in one site needs to
communicate with a computer in the other site, the traffic passes
through the IPsec gateways
Secure Socket Layer
The Secure Socket Layer protocol was created by Netscape to ensure secure
transactions between web servers and browsers. The protocol uses a third
party, a Certificate Authority (CA), to identify one end or both end of the
transactions. This is in short how it works.
1. A browser requests a secure page (usually https://).
2. The web server sends its public key with its certificate.
3. The browser checks that the certificate was issued by a trusted party
(usually a trusted root CA), that the certificate is still valid and that the
certificate is related to the site contacted.
4. The browser then uses the public key, to encrypt a random symmetric
encryption key and sends it to the server with the encrypted URL
required as well as other encrypted http data.
5. The web server decrypts the symmetric encryption key using its private
key and uses the symmetric key to decrypt the URL and http data.
6. The web server sends back the requested html document and http
data encrypted with the symmetric key.
7. The browser decrypts the http data and html document using the
symmetric key and displays the information.
The SSL protocol runs above TCP/IP and below higher-level protocols such
as HTTP.
SSL server authentication allows a user to confirm a server's identity. SSL-

enabled client software can use standard techniques of public-key
cryptography to check that a server's certificate and public ID are valid and
have been issued by a certificate authority (CA) listed in the client's list of
trusted CAs. This confirmation might be important if the user, for example, is
sending a credit card number over the network and wants to check the
receiving server's identity.
SSL client authentication allows a server to confirm a user's identity. Using

the same techniques as those used for server authentication, SSL-enabled
server software can check that a client's certificate and public ID are valid
and have been issued by a certificate authority (CA) listed in the server's list
of trusted CAs. This confirmation might be important if the server, for
example, is a bank sending confidential financial information to a customer
and wants to check the recipient's identity
An encrypted SSL connection requires all information sent between a client

and a server to be encrypted by the sending software and decrypted by the
receiving software, thus providing a high degree of confidentiality.
Confidentiality is important for both parties to any private transaction. In
addition, all data sent over an encrypted SSL connection is protected with a
mechanism for detecting tampering--that is, for automatically determining
whether the data has been altered in transit.
The Algorithms used in SSL are
DES. Data Encryption Standard, an encryption algorithm used by the U.S.

Government
RSA. A public-key algorithm for both encryption and authentication.

Developed by Rivest, Shamir, and Adleman.
MD5. Message Digest algorithm developed by Rivest.
Overview of Routers
Introduction
A router is a device that has more than one network interface (in other words,
it is multi-homed) that can forward packets, based on network addressing
(such as IP addresses), to multiple network segments. Routers are an
intermediate system that functions at the network layer to connect networks
based on a common network layer protocol.
Purpose of routers
Routers allow you to scale your network and to maintain bandwidth by
segmenting network traffic. Routers are configured to make intelligent
decisions to determine how packets should be forwarded between network
segments. This helps ensure that a network segment is not inundated with
traffic not destined for hosts on its segment. Routers also prevent certain
types of traffic, such as broadcast traffic, from saturating the network.
Types of routers
The two types of routers that are used in a network environment are:
 Hardware Routers. These dedicated hardware devices run
specialized software for the exclusive purpose of routing. Hardware
routers provide very good performance; however, they can be
expensive and may provide little functionality beyond their intended
purpose. Many hardware routers today provide greater flexibility by
offering security services such as packet filtering and VPN access.
Hardware routers should be used in environments that require high
throughput between network segments.
 Software Routers. These routers are not dedicated to routing alone;

they perform routing as one of multiple processes running on the router
computer. Windows Server 2003 Routing and Remote Access is a
service that performs routing as one of its multiple processes. When
enabled as a network router, Windows Server 2003 can also offer
services such as Microsoft Windows Internet Name Service (WINS),
Domain Name system (DNS), and Dynamic Host Configuration
Protocol (DHCP).
Main components of routing solution
The three main components of a routing solution are:
 Routing interface. This is a physical or logical interface over which

packets are forwarded.
 Routing protocol. This is a set of messages that routers use to share
routing tables so that routers can determine the path by which data
should be forwarded.
 Routing table. This table of information is maintained on a system that
determines the path to various network segments. Routing tables
contain information about various network segments, based on their
network ID and the routers that should be used to communicate with
those network segments.
How information is routed
Network communication between hosts is performed either directly or

indirectly. Direct communications occur between two hosts on the same
network segment. Indirect communications occur when a host needs to
communicate with a remote system. Because the host cannot establish a
direct communication with the remote system, it must forward the packet to a
router. When sending a packet to a remote system, hosts forward packets to
a router by using direct communications.
Remote Access
Types of Remote Access Connectivity
Dial-Up Connections.
To connect to the network with dial-up remote access, a remote access client
uses a communications network, such as the Public Switched Telephone
Network (PSTN), to create a physical connection to a port on a remote
access server on the Private Network. This is done by using a Modem or a
ISDN adapter to dial in to the remote access server.
Dial-up remote access allows an organization to keep users connected to

their network when they are working remotely. However if your organization
has a large number of users traveling to many locations, the expense of long
distance telephone charges will become significant. An alternative to
increasing the size of a dial-up remote access network is to consider a VPN
solution for remote connectivity.
Virtual Private Network Connections.
A VPN provides secure remote access through the Internet, rather than
through direct dial-up connection. A VPN client uses an IP internetwork to
create an encrypted virtual point to point connection with a VPN gateway on
the private network. Typically the user connects to the Internet through an
Internet Service Provider (ISP) and then creates a VPN connection to the
VPN gateway. By using the internet in this way, companies can reduce the
long distance telephone expenses. Traveling employees can dial a local ISP
and then make a VPN connection back to the corporate network
How a VPN Connection Works
Introduction
The Routing and Remote Access service provides VPN services so that users
can access corporate networks in a secure manner by encrypting the
transmitted data over an insecure transport network such as the Internet.
What a VPN does

A VPN extends the capabilities of a private network to encompass links
across shared or public networks such as the Internet. With a VPN, you can
send encrypted data between two computers across a shared or public
network in a manner that emulates a point-to-point link on a private network.
To emulate a point-to point link, data is encapsulated, or wrapped, with a
header that provides routing information, which allows the data to traverse the
shared or public network to reach its endpoint. To emulate a private link, the
data is encrypted for confidentiality. Packets that are intercepted on the
shared or public network cannot be read without the encryption keys. The link
in which the private data is encapsulated and encrypted is a VPN connection.
The VPN connection is also referred to as a VPN tunnel.
VPN connection process

The process of a VPN connection is described in the following steps:
1. A VPN client makes a VPN connection to a remote access/VPN server
that is connected to the Internet. (The VPN server acts as a gateway
and is normally configured to provide access to entire network to which
the VPN server is attached.)
2. The VPN server answers the virtual call.
3. The VPN server authenticates by contacting a domain controller and
verifies the caller’s authorization to connect.
4. The VPN server transfers data between the VPN client and the
corporate network.
Advantages of a VPN
VPNs allow users or corporations to connect to remote servers, branch
offices, or to other organizations over a public network, while maintaining
secure communications. In all of these cases, the secure connection appears
to the user as a private network communication-despite the fact that this
communication occurs over a public network. Other benefits include:
 Cost advantages. VPNs do not use a phone line and require less
hardware (your Internet service provider, or ISP, maintains the
communication hardware).
 Enhanced security. Sensitive data is hidden from unauthorized users,
but it is accessible to users authorized through the connection. The
VPN server enforces authentication and encryption.
 Network protocol support. You can remotely run and application that
depends on the most common network protocols, such as
Transmission Control Protocol/Internet Protocol (TCP/IP).
 IP address security. Because information sent over a VPN is
encrypted, the private IP addresses that you specify are protected, and
the traffic transmitted over the Internet will have only the external IP
address visible.
Components of a VPN Connection
Introduction
A VPN connection is made up of several components including VPN servers,
VPN clients, tunneling protocols, and authentication methods.
Components of a VPN connection

A VPN connection includes the following components:
 VPN server. A computer that accepts VPN connections from VPN

clients. The Routing and Remote Access service on Windows Server
2003 can be configured as a VPN server.
 VPN client. A computer that initiates a VPN connection to a VPN
server.
 Transit network. The shared or public network that the encapsulated
data crosses. Common VPN implementations use the Internet as the
transit network.
 VPN connection or tunnel. The portion of the connection in which your
data is encrypted and encapsulated.
 Tunneling protocols that are used to manage tunnels and encapsulate
private data (for example, Point-to-Point Tunneling Protocol, or PPTP).
 Tunneled data. Data that is sent across a private point-to-point link.
 Authentication. The identity of the client and the server in a VPN
connection are authenticated. To ensure that received data originated
from the other end of the connection and was not intercepted and
modified, a BPN also authenticates the data that was sent. The VPN
server use Active Directory as an account database.
 Address and name server allocation. The VPN server is responsible for
assigning IP addresses, which it does either by using the default
protocol, Dynamic Host Configuration Protocol (DHCP), or from a static
pool of addresses that the administrator defines. The VPN server can
also allocate Domain Name System (DNS) and Windows Internet
Name Service (WINS) server addresses to clients.
Virtual Private Network Protocols
PPTP L2TP
Internetwork
Internetwork Must
Must Be
Be IP
IP Based
Based Internetwork
Internetwork Can
Can BeBe IP,
IP, Frame
Frame
Relay,
Relay, X.25,
X.25, or
or ATM
ATM Based
Based
No
No Header
Header Compression
Compression Header
Header Compression
Compression
No
No Tunnel
Tunnel Authentication
Authentication Tunnel
Tunnel Authentication
Authentication
Built-in
Built-in PPP
PPP Encryption
Encryption Uses
Uses IPSec
IPSec Encryption
Encryption
Internet
Client PPTP or L2TP Server
SLIP and PPP
# SLIP PPP
1 Serial Link Internet Protocol is widely Point to Point Protocol has several
used to connect systems to the advantages over SLIP.
Internet over a dial up line using a
modem.
2 It does not do any error detection or It does provide error detection or
correction correction.
3
SLIP supports only IP Supports multiple protocols.
4 Each side must know the others IP Allows IP addresses to be negotiated
address in advance. IP address at connection time dynamically.
cannot be assigned dynamically
during setup.
5
No Authentication Provides Authentication
Components of a Network Access Infrastructure
Introduction
To provide a secure network access infrastructure, an administr5ator needs
to have an understanding of the following basic components that make up
network access infrastructure:
 Network access server

 Network access clients
 Authentication service
 Active Directory- directory service
Network access server

A network access server is a server that acts as a gateway to a network for a
remote client. The Microsoft Routing and Remote Access service supports
remote access to a network. By configuring the Routing and Remote Access
service to act as remote access server, you can connect remote workers to
and organization’s networks. The network access server for these remote
clients authenticates sessions for users and services until the user or network
administrator terminates them. Remote users can work as if their computers
are physically connected to the network.
Network access clients

A network access server provides network access connectivity for VPN and
dial-up clients.
These network access clients can use standard tools to access resources.
For example, on a server that is configured with the Routing and Remote
Access service, remote clients can use Windows Explorer to make drive
connections and to connect to printers. Connections are persistent so that the
clients do not need to reconnect to network resources during remote
sessions.
Authentication service
When you provide greater network access, you need to increase the level of
security in your network to safeguard against unauthorized access and usage
of internal resources. You can help safeguard our network by providing strong
authentication to validate identity in addition to providing strong encryption to
protect data.
Authentication methods typically use an authentication protocol that is
negotiated during the process of establishing a connection. The remote
access server (a server configured with the Routing and Remote Access
service) handles authentication between the remote access client and the
domain controller.
If you have multiple network access severs, you can centralize authentication
by using Remote Authentication Dial-In User Service (RADIUS) to
authenticate and authorize network access clients. Using RADIUS eliminates
the need for each network access server in your network to perform
authentication and authorization.
Active Directory
Active Directory domains contain the user accounts, passwords, and dial-up
properties that are required to authenticate user credentials and evaluate both
authorization and connection constraints.
After a client is connected to your network, you can control access to
resources by various administrative controls on both the client computer and
the network access servers. These administrative controls include File and
Printer Sharing, Local Group Policy, and Group Policy through the Active
Directory service.
Wireless Networks
Wireless networks utilize radio waves and/or microwaves to maintain

communication channels between computers. Wireless networking is a more
modern alternative to wired networking that relies on copper and/or fiber optic
cabling between network devices.
A wireless network offers advantages and disadvantages compared to a
wired network. Advantages of wireless include mobility and elimination of
cables. Disadvantages of wireless include the potential for radio interference
due to weather, other wireless devices, or obstructions like walls.
Wireless is rapidly gaining in popularity for both home and business

networking. Wireless technology continues to improve, and the cost of
wireless products continues to decrease. Popular wireless local area
networking (WLAN) products conform to the 802.11 "Wi-Fi" standards. The
gear a person needs to build wireless networks includes network adapters
(NICs), access points (APs), and routers.
Benefits of Wireless Networks
Companies can realize the following benefits by implementing wireless

networks:
• Mobility
• Ease of installation in difficult-to-wire areas
• Reduced installation time
• Increased reliability
• Long-term cost savings
Mobility
User mobility indicates constant physical movement of the person and their
network appliance. Many jobs require workers to be mobile, such as inventory
clerks, healthcare workers, policemen, emergency care specialists, and so
on. Wireless networking offers mobility to its users much like the wireless
phone, providing a constant connection to information on the network.
Installation in Difficult-to-Wire Areas
The implementation of wireless networks offers many tangible cost savings

when performing installations in difficult-to-wire areas. If rivers, freeways, or
other obstacles separate buildings you want to connect, a wireless MAN
solution may be much more economical than installing physical cable or
leasing communications circuits such as T1 service or 56 Kbps lines.
Reduced Installation Time
The installation of cabling is often a time-consuming activity. For LANs,

installers must pull twisted-pair wires above the ceiling and drop cables
through walls to network outlets that they must affix to the wall. These tasks
can take days or weeks, depending on the size of the installation.
Increased Reliability
A problem inherent to wired networks is the downtime due to cable faults. The
accidental cutting of cables can also bring a network down quickly. Water
intrusion can also damage communications lines during storms.. The
advantage of wireless networking, then, is experiencing fewer problems
because less cable is used.
Long-Term Cost Savings
Companies reorganize, resulting in the movement of people, new floor plans,

office partitions, and other renovations. These changes often require re-
cabling the network, incurring both labor and material costs. In some cases,
the re-cabling costs of organizational changes are substantial, especially with
large enterprise networks.
Wireless Devices
Antenna
The antenna radiates the modulated signal through the air so that the
destination can receive it. Antennas come in many shapes and sizes and
have the following specific electrical characteristics:
• Propagation pattern
• Radiation power
• Gain
• Bandwidth
The propagation pattern of an antenna defines its coverage. A truly

omnidirectional antenna transmits its power in all directions, whereas a
directional antenna concentrates most of its power in one direction.
Radiation power is the output of the radio transmitter. Most wireless network
devices operate at less than 5 watts of power.
A directional antenna has more gain (degree of amplification) than the

omnidirectional type and is capable of propagating the modulated signal
farther because it focuses the power in a single direction.
Most wireless LANs and WANs utilize omnidirectional antennas, and wireless
MANs use antennas that are more directives.
Bandwidth is the effective part of the frequency spectrum that the signal
propagates. For example, the telephone system operates over a bandwidth
roughly from 0–4 KHz. This is enough bandwidth to accommodate most of the
frequency components within our voices. Radio wave systems have greater
amounts of bandwidth located at much higher frequencies. Data rates and
bandwidth are directly proportional—the higher the data rates, the more
bandwidth you will need.
Access Points
The main thing to remember is that access points allow wireless clients
access to a single network
A wireless network uses an access point, or base station. The access point
acts like a hub, providing connectivity for the wireless computers. It can
connect (or "bridge") the wireless LAN to a wired LAN, allowing wireless
computer access to LAN resources, such as file servers or existing Internet
Connectivity.
There are two types of access points:
 Dedicated hardware access points (HAP) such as Lucent's WaveLAN.

Hardware access points offer comprehensive support of most wireless
features.
 Software Access Points runs on a computer equipped with a wireless
network interface card as used in an ad-hoc or peer-to-peer wireless
network.
Multiple access points can be connected to a wired LAN, or sometimes even
to a second wireless LAN if the access point supports this.
In most cases, separate access points are interconnected via a wired LAN,
providing wireless connectivity in specific areas such as offices or
classrooms, but connected to a main wired LAN for access to network
resources, such as file servers
If a single area is too large to be covered by a single access point, then
multiple access points or extension points can be used. -- Note that an
"extension point" is not defined in the wireless standard, but have been
developed by some manufacturers. When using multiple access points, each
access point wireless area should overlap its neighbors. This provides a
seamless area for users to move around in using a feature called "roaming.‖
WLAN Configurations
Independent WLANs
The simplest WLAN configuration is an independent (or peer-to-peer) WLAN

that connects a set of PCs with wireless adapters. Any time two or more
wireless adapters are within range of each other, they can set up an
independent network These on-demand networks typically require no
administration or preconfiguration.
Access points can extend the range of independent WLANs by acting as a

repeater effectively doubling the distance between wireless PCs.
Infrastructure WLANs
In infrastructure WLANs, multiple access points link the WLAN to the wired
network and allow users to efficiently share network resources. The access
points not only provide communication with the wired network but also
mediate wireless network traffic in the immediate neighborhood. Multiple
access points can provide wireless coverage for an entire building or campus.
Microcells and Roaming
Wireless communication is limited by how far signals carry for given power
output. WLANs use cells, called microcells, similar to the cellular telephone
system to extend the range of wireless connectivity. At any point in time, a
mobile PC equipped with a WLAN adapter is associated with a single access
point and its microcell, or area of coverage. Individual microcells overlap to
allow continuous communication within wired network. They handle low-
power signals and ―hand off‖ users as they roam through a given geographic
area.
Wireless Network Standards
802.11a, 802.11b, 802.11g, and 802.11n are the wireless standards

collectively known as Wi-Fi technologies. Additionally, Bluetooth and various
other non Wi-Fi technologies also exist, each also designed for specific
networking applications.
802.11b
 Very common and inexpensive

 Communicates on the 2.4GHz frequency
 Maximum data transmission rate up to 11 Mbps
 Indoor range of about 150 feet
 Week Security
Pros of 802.11b - lowest cost; signal range is good and not easily obstructed
Cons of 802.11b - slowest maximum speed; home appliances may interfere
on the unregulated frequency band
802.11a
 Not as common as 802.11b.

 More expensive than 802.11b equipment
 Communicates on the 5 GHz frequency
 Indoor range of about 75 feet
 Not backward compatible with 802.11b
 Weak Security – Uses WEP
Pros of 802.11a - fast maximum speed; regulated frequencies prevent signal

interference from other devices
Cons of 802.11a - highest cost; shorter range signal that is more easily
obstructed
802.11g
 Most common Wireless network standard.

 More expensive than 802.11b equipment
 Communicates on the 2.4 GHz frequency
 Good Indoor range of about 150 feet
 backward compatible with 802.11b
 Improved Security – Uses WPA
Pros of 802.11g - fast maximum speed; signal range is good and not easily
obstructed
Cons of 802.11g - costs more than 802.11b; appliances may interfere on the
unregulated signal frequency
802.11n
The newest IEEE standard in the Wi-Fi category is 802.11n. It was designed
to improve on 802.11g in the amount of bandwidth supported by utilizing
multiple wireless signals and antennas (called MIMO technology) instead of
one.
When this standard is finalized, 802.11n connections should support data
rates of over 100 Mbps. 802.11n also offers somewhat better range over
earlier Wi-Fi standards due to its increased signal intensity. 802.11n
equipment will be backward compatible with 802.11g gear.
Pros of 802.11n - fastest maximum speed and best signal range; more
resistant to signal interference from outside sources
Cons of 802.11n - standard is not yet finalized; costs more than 802.11g; the
use of multiple signals may greatly interfere with nearby 802.11b/g based
networks.
Bluetooth
Bluetooth is an alternative wireless network technology that followed a

different development path than the 802.11 family. Bluetooth supports a very
short range (approximately 10 meters) and relatively low bandwidth (1-3
Mbps in practice) designed for low-power network devices like handhelds.
The low manufacturing cost of Bluetooth hardware also appeals to industry
vendors. You can readily find Bluetooth in the networking of PDAs or cell
phones with PCs, but it is rarely used for general-purpose WLAN networking
due to the range and speed considerations.
WiMax
WiMax also was developed separately from Wi-Fi. WiMax is designed for
long-range networking (spanning miles or kilometers) as opposed to local
area wireless networking.
SSID
An SSID is the name of a wireless local area network (WLAN). All wireless
devices on a WLAN must employ the same SSID in order to communicate
with each other.
The SSID on wireless clients can be set either manually, by entering the SSID
into the client network settings, or automatically, by leaving the SSID
unspecified or blank. A network administrator often uses a public SSID, that is
set on the access point and broadcast to all wireless devices in range. Some
newer wireless access points disable the automatic SSID broadcast feature in
an attempt to improve network security.
SSIDs are case sensitive text strings. The SSID is a sequence of

alphanumeric characters (letters or numbers). SSIDs have a maximum length
of 32 characters.
Also Known As: Service Set Identifier, Network Name
Wireless Security
WEP (Wired Equivalent Privacy)
WEP is a protocol that adds security to wireless local area networks (WLANs)
based on the 802.11 Wi-Fi standard. WEP is an OSI Data Link layer (Layer 2)
security technology that can be turned "on" or "off." WEP was designed to
give wireless networks the equivalent level of privacy protection as a
comparable wired network.
WEP is based on a security scheme called RC4 that utilizes a combination of
secret user keys and system-generated values. The original implementations
of WEP supported so-called 40-bit encryption, having a key of length 40 bits
and 24 additional bits of system-generated data (64 bits total). Research has
shown that 40-bit WEP encryption is too easy to decode, and consequently
product vendors today employ 128-bit encryption (having a key length of 104
bits, not 128 bits) or better (including 152-bit and 256-bit WEP systems).
When communicating over the wire, wireless network equipment uses WEP
keys to encrypt the data stream. The keys themselves are not sent over the
network but rather are generally stored on the wireless adapter or in the
Windows Registry.
Regardless of how it is implemented on a wireless LAN, WEP represents just
one element of an overall WLAN security strategy.
WPA (Wi-Fi Protected Access)

WPA is a security technology for wireless networks. WPA improves on the
authentication and encryption features of WEP (Wired Equivalent Privacy). In
fact, WPA was developed by the networking industry in response to the
shortcomings of WEP.
One of the key technologies behind WPA is the Temporal Key Integrity
Protocol (TKIP). TKIP addresses the encryption weaknesses of WEP.
Another key component of WPA is built-in authentication that WEP does not
offer. With this feature, WPA provides roughly comparable security to VPN
tunneling with WEP, with the benefit of easier administration and use.
One variation of WPA is called WPA Pre Shared Key or WPA-PSK for short.
WPA-PSK is a simplified but still powerful form of WPA most suitable for
home Wi-Fi networking. To use WPA-PSK, a person sets a static key or "pass
phrase" as with WEP. But, using TKIP, WPA-PSK automatically changes the
keys at a preset time interval, making it much more difficult for hackers to find
and exploit them.
WEP Keys
A WEP key is a security code used on some WiFi networks. WEP keys allow
a group of devices on a local network (such as a home network) to exchange
encoded messages with each other while hiding the contents of the
messages from easy viewing by outsiders.
A WEP key is a sequence of hexadecimal digits. These digits include the
numbers 0-9 and the letters A-F. Some examples of WEP keys are:
 1A648C9FE2
 99D767BAC38EA23B0C0176D15
WEP keys are chosen by a network administrator. WEP keys are set on WiFi
routers, adapters and other wireless network devices. Matching WEP keys
must be set on each device for them to communicate with each other.
The length of a WEP key depends on the type of WEP security (called
"encryption") utilized:
 40- / 64-bit WEP: 10 digit key

 104- / 128-bit WEP: 26 digit key
 256-bit WEP: 58 digit key
To assist with the process of creating correct WEP keys, some brands of
wireless network equipment automatically generates WEP keys from ordinary
text called a "pass phrase."
10 Tips for Wireless Home Network Security
1. Change Default Administrator Passwords (and Usernames)

At the core of most Wi-Fi home networks is an access point or router. To set
up these pieces of equipment, manufacturers provide Web pages that allow
owners to enter their network address and account information. These Web
tools are protected with a login screen (username and password) so that only
the rightful owner can do this. However, for any given piece of equipment, the
logins provided are simple and very well-known to hackers on the Internet.
Change these settings immediately
2. Turn on (Compatible) WPA / WEP Encryption

All Wi-Fi equipment supports some form of encryption. Encryption technology
scrambles messages sent over wireless networks so that they cannot be
easily read by humans. Several encryption technologies exist for Wi-Fi today.
Naturally you will want to pick the strongest form of encryption that works with
your wireless network. However, the way these technologies work, all Wi-Fi
devices on your network must share the identical encryption settings.
3. Change the Default SSID

Access points and routers all use a network name called the SSID.
Manufacturers normally ship their products with the same SSID set. For
example, the SSID for Linksys devices is normally "linksys." True, knowing
the SSID does not by itself allow your neighbors to break into your network,
but it is a start. More importantly, when someone finds a default SSID, they
see it is a poorly configured network and are much more likely to attack it.
Change the default SSID immediately when configuring wireless security on
your network.
4. Enable MAC Address Filtering

Each piece of Wi-Fi gear possesses a unique identifier called the physical
address or MAC address. Access points and routers keep track of the MAC
addresses of all devices that connect to them. Many such products offer the
owner an option to key in the MAC addresses of their home equipment, that
restricts the network to only allow connections from those devices. Do this,
but also know that the feature is not so powerful as it may seem. Hackers and
their software programs can fake MAC addresses easily.
5. Disable SSID Broadcast

In Wi-Fi networking, the wireless access point or router typically broadcasts
the network name (SSID) over the air at regular intervals. This feature was
designed for businesses and mobile hotspots where Wi-Fi clients may roam
in and out of range. In the home, this roaming feature is unnecessary, and it
increases the likelihood someone will try to log in to your home network.
Fortunately, most Wi-Fi access points allow the SSID broadcast feature to be
disabled by the network administrator.
6. Do Not Auto-Connect to Open Wi-Fi Networks
Connecting to an open Wi-Fi network such as a free wireless hotspot or your
neighbor's router exposes your computer to security risks. Although not
normally enabled, most computers have a setting available allowing these
connections to happen automatically without notifying you (the user). This
setting should not be enabled except in temporary situations.
7. Assign Static IP Addresses to Devices

Most home networkers gravitate toward using dynamic IP addresses. DHCP
technology is indeed easy to set up. Unfortunately, this convenience also
works to the advantage of network attackers, who can easily obtain valid IP
addresses from your network's DHCP pool. Turn off DHCP on the router or
access point, set a fixed IP address range instead, then configure each
connected device to match. Use a private IP address range (like 10.0.0.x) to
prevent computers from being directly reached from the Internet.
8. Enable Firewalls On Each Computer and the Router

Modern network routers contain built-in firewall capability, but the option also
exists to disable them. Ensure that your router's firewall is turned on. For
extra protection, consider installing and running personal firewall software on
each computer connected to the router.
9. Position the Router or Access Point Safely

Wi-Fi signals normally reach to the exterior of a home. A small amount of
signal leakage outdoors is not a problem, but the further this signal reaches,
the easier it is for others to detect and exploit. Wi-Fi signals often reach
through neighboring homes and into streets, for example. When installing a
wireless home network, the position of the access point or router determines
its reach. Try to position these devices near the center of the home rather
than near windows to minimize leakage.
10. Turn Off the Network During Extended Periods of Non-Use
The ultimate in wireless security measures, shutting down your network will
most certainly prevent outside hackers from breaking in! While impractical to
turn off and on the devices frequently, at least consider doing so during travel
or extended periods offline. Computer disk drives have been known to suffer
from power cycle wear-and-tear, but this is a secondary concern for
broadband modems and routers.
If you own a wireless router but are only using it wired (Ethernet) connections,
you can also sometimes turn off Wi-Fi on a broadband router without
powering down the entire network.
References : Mackin, J.C. and Ian Mc Lean. Windows server 2003 network
infrastructure : implementing, managing and maintaining a microsoft . New Delhi:
Prentice Hall India,2006. ISBN:8120324684.
Compiled By: Arun
Revised By: R. Meganathan

IA Module Notes

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IA Module Notes

Uploaded by

Copyright:

Available Formats

Middle East College of Information Technology

Module Name: Internet Administration

Module Code: COMP 0326

 Start the computer from the CD

 Select to install a new copy of Windows 2000 or XP

 Read and accept the Licensing agreement

 Select the file system Fat of NTFS

 Enter the name and organization.

 Enter the computer name and password for local administrator

 Select the date and time settings

Installation network components

After completing the setup wizard, install network components by performing

 Choose a networking setting.

Typical Installs Client for Microsoft Networks, File

Custom Creates custom network connections: for

 Click Finish to restart the computer.

 Configure the network ID for the computer.

After the computer restarts, Windows2000 Professional displays the Network

 Configure a specific user account and password for the computer.

 Choose not to configure a specific user account for the computer.

 Apply all necessary software or security updates to the operating

Installing Windows 2003 Server

 Start the computer from the CD

 Select to install a new copy of Windows 2003 Server

 Read and accept the Licensing agreement

 Select the Partition on which to install Windows 2003 Server

 Change regional settings, if necessary.

 Select the licensing mode.

 Select the Windows 2003 optional components. Optional components

The following table describes these optional components.

 Certificate Services Allows you to create and request digital

 Windows Clustering Enables two or more services to work

 IIS Internet Information Server-Includes FTP and Web servers, the

 Terminal Services Enables windows based clients to gain access to a

The Domain Name System (DNS) is an integral part of client/server

DNS is a hierarchical naming structure with the following levels:

 Root designated by a dot (.).

The common top-level domain names used are:

 .com: commercial organizations

The additional top-level domains defined by ICANN in late 2000 are:

 .aero: for the air transportation industry

When a DNS server is queried it can do one of the following:

o Respond to the request directly by providing the requested

A DNS server is authoritative for the contiguous portion of the DNS

Types of DNS servers:

DNS Record types:

The events that occur to resolve a name requested in a query are

Zone Look up Types

Forward Lookup: A request to map a name to IP address. This is the most

Reverse lookup: A request to map an IP address to a name. This is most

Dynamic Host Configuration Protocol (DHCP)

As with BOOTP, DHCP uses the machine's or NIC Ethernet (MAC) or

IP addresses entered manually on each IP addresses are supplied

Possibility of entering incorrect or invalid Ensures that clients always use

Incorrect configuration can lead to Elimination of common source of

Administrative overload on networks Client configuration updated

DHCP Lease Stages (DHCP Lease Generation Process)

1. Lease Request - The client sends a broadcast requesting an IP

IP Lease Request DHCP SERVER

DHCP Lease Renewal

DHCP Scope and Subnets

DHCP Relay Agents

 MAC (hardware) address