Computer Networking: A Survey

M. Benaiah Deva Kumar and B. Deepa,

1Scholar, 2Assistant Professor,

IT Department, Sri Krishna College of Arts and Science College,

Coimbatore, India.
lets them share data and/or devices such as
hard drives, CD-ROMs, fax-modems, printers,
Abstract- Computer networks have become etc [2]. A computer network is an
increasingly ubiquitous. In today‟s world, a interconnected collection of autonomous
computer network is much more than a computers where interconnected means that
collection of interconnected devices. Computer the computers can exchange information and
networks are a system of interconnected autonomous means that no computer can
computers for the purpose of sharing digital start, stop or control another computer
information. The computer network enables to connected to the network. Fig 1 gives an
analyze, organize and disseminate the example of a network in a school comprising of
information that is essential to profitability. local area network or LAN connecting
The rise of intranets and internets is the computers with each other, the internet, and
important aspect of computer networking. various servers [4].
Intranets and internets are private business
networks that are based on internet
technology. The businesses are currently
implementing intranets at a breakneck pace
and for one reason only, an intranet enables a
business to collect, manage and disseminate
information more quickly and easily than ever
before. Many businesses are implementing
intranets simply to remain competitive;
business that delay is likely to see their
competition outdistance them. In this article
we are presenting the basic concepts of
networking.

Keywords- Peer-to-peer; Client / Server;

Internetworks; Intra-networks; Communication
medium; Internet Protocol; Open Systems
Interconnection.
I. INTRODUCTION
Networking supports communication between
two or more programs running on physically
distant machines. A computer network is a
collection of computers, which are in some way
connected such that they can exchange data
between themselves and other computers on
the network. A network is created when two or
more computers are connected to share
information and resources. A set of computers
exchanging information by common
conventions called protocols over
communication media. A computer network is
simply computers wired together in a way that
II. TYPES OF NETWORK
CONFIGURATION
Broadly speaking, there are two types
of network configuration, peer-to-peer
networks and client/server networks.
A. Peer-to-peer networks
Peer-to-peer networks are more commonly
implemented where less than ten computers
are involved and where strict security is not
necessary. All computers have same status,
hence the term „peer‟, and they communicate
with each other on an equal footing. Files can
be shared across the network and all the
computers on the network can share devices
such as printers or scanners, which are
connected to any one computer.Fig 2
represents how the computers are connected communication is becoming more
in a peer-to-peer networks [4]. common.
• A network interface device on each
computer (this is called a network
IJTRD | Sep - Oct 2015
Available Online@www.ijtrd.com 126
interface card or NIC). A „switch‟ used
to switch the data from one point to
another. Hubs are outdated.
• Network operating system software [4].

IV. Types of network

The network can be divided into geographical

areas and fall into these major categories.

• Local Area Network (LANs).

• Wide Area Network (WANs).
B. Client/server networks • Metropolitan Area Network (MANs).
• Wireless networks.
Client/server networks are more suitable for
larger networks. A central computer, or A. Local Area Network
„server‟, acts as the storage location for files
A LAN is generally confined to a specific
and applications shared on the network.
location, such as floor, building or some other
Usually the server is higher than an average
small area. By being confined it is possible in
performance computer. The server also
most cases to use only one transmission
controls the network access of the other
medium (cabling). This technology is less
computers which are referred to as the „client‟
expensive to implement than WAN because you
computers. Only the network administrator
are keeping all of your expenses to a small
will have access rights to the server while
area, and generally you can obtain higher
others cannot. Others can only use the client
speed. They are widely used to connect
computers. Fig 3 represents how the
personal computers and workstations in
computers are connected in a client/server
offices and factories to share the resources.
network [4].
Traditional LANs runs at a speed of 10 to 100
mbps have low delay and make very few errors.
Never LANs may operate at higher speed up to
100 mbps.

1) Common Physical Topologies

Physical and logical topologies can take

several forms. The most common and the most
important for understanding the Ethernet and
Token Ring topologies are

• Bus topology.
• Ring topology.
III. COMPONENTS OF A NETWORK
• Star topology.
A computer network comprises • Mesh topology.
the following components: • Cellular topology.
a) Bus topology
• A minimum of at least two computers.
• Cables that connect the computers each A bus physical topology is one in which all
other, although wireless devices connect to a common shared cable. A
physical bus topology network typically uses Fig: 5 LAN with RING topology
one long cable called a backbone computers
(workstation and servers) are attached directly c) Star topology
to the backbone using Terrestrial microwave- Star topologies use a central device with drop
connectors. The backbone is terminated at cables extending in all directions. Each
both ends to remove the signal from the wire networked device is connected via a point-to-
after it has passed all devices. The bus topology point link to the central device called a hub or
is the first used topology to connect the multiport repeater or switch. Additionally, star
computers in a network. This is the oldest form topologies can be nested within other stars to
of topologies. This is a failure model. Most bus form tree or hierarchical network topologies. In
topologies allow electric or electro-magnetic star topology, electrical or electromagnetic
signals to travel in both directions. A LAN with signals travel from the networked device, up its
BUS topology is represented in Fig 4. drop cable, to the switch, from there the signal
is sent to other network. To avoid the
disadvantages of BUS topology and RING
topology, the STAR topology is invented. This
is not a failure model. But it is a standard
model and now-a-days this topology is
commonly used everywhere. A LAN with STAR
Fig: 4 LAN with BUS topology topology is represented in Fig 6.
b) Ring topology

Ring topologies are wired in a circle. Each

node is connected to its neighbors or either
side, passes around the ring in one direction
only. Each device incorporates a receiver and a
transmitter and serves as a repeater that
passes the signal to the next device in the ring.
Because the signal is regenerated at each
device, signal degeneration is low. After some
period of time the RING topology came into
existence. To avoid the disadvantages of BUS Fig: 6 LAN with STAR topology
topology, the RING topology is invented. But
d) Mesh topology
this is also a failure model. Ring topologies are
ideally suited for token passing access A mesh network has a point-to-point
methods. The token gets passed around the connection between every device in the
ring, and only the node that holds the token network. Because each device requires an
can transmit data. Ring topologies are quite interface for every other device on the network,
rare. A LAN with RING topology is represented mesh topologies are not usually considered
in Fig 5. practical. However, mesh networks are
extremely fault tolerant and each link provides
guaranteed capacity.

e) Cellular topology

A cellular topology combines wireless point-

topoint and multipoint strategies to divide a
geographic area into cells. Each cell represents
the portion of the total network area in which
a specific connection operates. Devices within
the cell communicate with a central station or
switch. Switches are interconnected to route
data across the network and to provide the
complete network infrastructure. For example,
devices may roam from cell to cell while
maintaining connection to the network.
B. Wide Area Network
A wide area network spans a large
geographical area, often a country or
continent. It multiplies multiple connected
LANs that can be separated by any
geographical distance. In most WANs the
network contains numerous cables or
telephone lines, each one connection a pair of
routers. If two routers that do not share a cable
nevertheless and wish to communicate, they
must do it indirectly. On personal computers
we are using modem to communicate indirectly
with other computer. WAN connecting two
different networks is represented in Fig 7.
Fig: 7 WAN connecting two different
networks C. Metropolitan Area Network
Metropolitan Area Network is basically a
bigger version of LAN and normally uses same
technology. It might cover a group of nearby
corporate offices or a city and might be either
private or public. On the other hand, MAN is
network running throughout a metropolitan
area such as a backbone for a phone service
carrier. A MAN just has one or two cables and
does not contain switching elements.
D. Wireless Networks
Mobile computers such as notebook
computers, laptops are the fastest growing
segment of computer industry. Users want to
connect this machine to their office LANs to see
the data when they are out from the office,
since the wired connection is not possible we
have to use wireless networks.
For e.g. on aircraft single router will maintain
a radio link with some other router on ground,
changing routers as it flies along this
configuration is just a traditional LAN, except
that its connection to the outside world
happens to be a radio link instead of a wired
line.
V. COMMUNICATION LINKS
Various types and forms of communication
medium are
• Fiber-optic cable.
• Twisted-pair copper wire.
• Coaxial cable.
• Wireless local-area links. (e.g. 802.11,
Bluetooth) Satellite channel [3].
VI. INTERNET PROTOCOL (IP)
To solve the scaling problem with Ethernet,
and to allow support for other types of LANs
and point-topoint links as well, the Internet
Protocol was developed. To support universal
connectivity, IP provides a global mechanism
for addressing and routing, so that packets can
actually be delivered from any host to any
other host. IP addresses (for the most common
version 4, which we denote IPv4) are 4 bytes
(32 bits), [6] and are part of the IP header that
generally follows the Ethernet header. The
Ethernet header only stays with a packet for
one hop; the IP header stays with the packet
for its entire journey across the Internet. An
essential feature of IPv4 addresses is that they
can be divided into a “network” part and a
“host” part [5]. There are different types of
classes in IPv4 and their ranges are shown in
Table 1.
Table: 1 Range and types of classes
Class Address Range
Class A 0 to 126
Class B 128 to 191
Class C 192 to 223
Class D 224 to 239
Class E 240 to 254
Range 127 is reserved for the loopback or
localhost, for example, 127.0.0.1 is the
common loopback address. Range
255.255.255.255 broadcasts to all hosts on
the local network [9].
VII. OPEN SYSTEMS INTERCONNECTION
(OSI) MODEL
In 1977 the International Organization for
Standardization, or ISO, founded the Open
Systems Interconnection model, or OSI, a
process for creation of new network standards.
OSI represented an attempt at the creation of
networking standards independent of any
individual government. The OSI model is today
perhaps best known for its seven-layer
networking model. Those seven layers of the
OSI model and their purpose are stated in
Table 2. OSI has its own version of IP and TCP.
The IP equivalent is CLNP, the Connection Less
Network Protocol, although OSI also defines a
connection oriented protocol CMNS. The TCP
equivalent is TP4.

Table: 2 Layers of OSI model and their

purpose
Layer Purpose

Physical Network Interface Card,

wire and so on.
Data Link Error checking, manages
link control, communication
with cards.
Network Addressing, traffic,
switching.
Transport Handles network
transmission
Session Establishes rules for
communication, determines
synchronization.
Presentation Translator between
application and others,
redirector, encryption,
compression.
Application Interface to network
services.
Synthesis

Computer communication, it seems, will become a much more useful networking tool
when large numbers of people with similar interests acquire access to the technology.
Though it can expedite the formation of new interpersonal networks by overcoming the
space and time barriers faced by traditional networking techniques, it still requires a great
deal of concentrated effort and resources to get the people to use it. This problem should
become increasingly minimized over the coming years as the technological innovations
become more diffused throughout society [8].

Computer Networking: A Survey, that identifies the basic concept of networking and it
also explain the various functions of the different types of a network and to the different
types of topologies. It is a survey in which, illuminate the computer networks so that the
students will understand clearly.
Computer networks can be seen everywhere especially in today’s generation and it is
important to know the different functions of computer networking or what is this all
about.
Computer networks are a system of interconnected computers for the purpose of sharing
digital information. The computer network enables to analyze, organize and disseminate
the information that is essential to profitability. Computer network is a collection of
computers which is they are connected such that they can exchanging data to each other,
transmitting and receiving data using protocols.
This research also includes the different type of a network the LANs, WANs, MANs, and
Wireless networks. The LAN (Local Area Network) is generally confined to a specific
location, such as floor, building or some other small area. A WAN (Wide Area Network)
spans a large geographical area, often a country or continent. It multiplies multiple
connected LANs that can be separated by any geographical distance. In most WANs the
network contains numerous cables or telephone lines, each one connection a pair of
routers. On personal computers we are using modem to communicate indirectly with the
other computer. The MAN (Metropolitan Area Network) is basically a bigger version of LAN
and normally uses same technology. MAN is network running throughout a metropolitan
area such as a backbone for a phone service carrier. A MAN just has one or two cables
and does not contain switching elements. And lastly the Wireless networks, and it refers
to the mobile computers such as laptops, mobile phones that can be used if they are not
using cables for a connection.
Computer Networking, it seems, will become a much more useful networking tool when
large numbers of people with similar interests acquire access to the technology. And it is
important to know what computer networking first, in order to have a knowledge and a
background for computer networking.
A Constructivist Approach to Teaching:
Implications in Teaching Computer
Networking

Introduction

The Information Age is based on rapidly increasing and changing information,

and the goal of education is no longer to train students to store and retrieve
mastered information. The ability to recall and explain a concept does not
necessarily reflect understanding, nor does it guarantee that students can
apply and use the concept in a meaningful way (Julyan & Duckworth, 1996).
The goal of education in this new age is to prepare students to use their skills
to solve real-world problems; yet, education has been criticized for failing the
task. The common reason cited is that the learning experience provided in
school is so different from the experience in the real world that students cannot
transfer the skills between the two environments (Brown, Collins, & Duguid,
1989; Duffy & Jonassen, 1992; Hiebert et al., 1996; Schank, 1997; Sternberg,
1985).
From a different perspective, concepts and theories are difficult to learn
because they are not observable. Ordinary inductive processes are not effective
for constructing theoretical models because learners cannot observe the
entities that comprise the models. In a high-technology work environment,
neither the equipment’s functioning nor the mental activity of an expert
diagnosing a problem is visible, so observation alone is unlikely to foster
conceptual development in traditional apprenticeship activities (Resnick,
1986). Nevertheless, an understanding of computer networking is increasingly
important in a high-tech business world. Business graduates from colleges
and universities need to have working concepts in computer networking to be
able to communicate intelligently with computer networking professionals.
Graduates of end-user computing related programs may assume the roles of
network administrators. For these graduates, a comprehensive understanding
and hands-on experience of computer networking are important parts of their
employment preparation.
Recognizing the need, the Organizational Systems Research Association (OSRA,
1996) developed and revised the Organizational and EndUser Information
Systems Curriculum Model for
Undergraduate Education in Information
Technology, which includes a Communications

19
Technologies (OEIS-6) course. Crews and Ray (1998) used the Delphi
technique to poll OSRA members who had taught business
telecommunication to form a consensus on the course content. After five
rounds of inquiry, the panel reached common consent on 10 topics and 30
subtopics for a college/university course in telecommunication with an
emphasis on end-user computing. The ten topics include local area
Catherine Chen is Assistant
Professor, Information Systems
and Operations Management
Department, Ball State University,
Muncie, Indiana.
networks, wide area networks, communication media, communication
hardware, telecommunication systems, emerging technologies, network
topologies, data signals, conceptual foundations, and social and ethical issues
(p. 15). This result provides a guideline for what to teach in a computer

Information Technology, Learning, and Performance Journal, Vol. 21, No. 2, Fall 2003
17
networking class; yet, many questions remain regarding how to teach computer
networking concepts. Computer networking concepts often are technical, and
students may not have much of a knowledge base for learning the course
content.
I started teaching a university-level introduction to computer networking class
in 1999. After using the conventional teaching approach with many charts,
figures, drawings, graphics, and PowerPoint presentations, I realized that
students continued to have difficulty understanding the material. I then started
to use objects such as ropes, strings, and building blocks in the classroom to
build and provide three-dimensional displays of the concepts for discussion.
Students responded to the new approach in a very positive way, so I continued
to develop and refine these techniques. As von Glasersfeld (1995) states,
learning theories provide a solid conceptual foundation for the teaching
practices that teachers have been doing without theoretical foundation. The
theoretical foundation for using objects in teaching, I believe, is constructivism.

Purpose

The purpose of this paper is to provide a theoretical foundation for using a

constructivist approach in teaching computer networking. In addition, this
paper shares practical examples based on constructivist theory to be used in a
computer networking class. It is also the goal of this paper to invite educators
to share their teaching practices.

Review Letirature

The literature review section reviews the relevant learning theories,

behaviorism, cognitivism, and constructivism. It then reviews learning
environments, the teacher’s role, the learner’s role, and assessment in the
constructivist approach to teaching.

20
Learning Theories

This section provides a brief review of behaviorism and cognitivism. It continues

with a more detailed review of constructivism, since this learning theory is the
foundation for the proposed teaching approach. This section, however, will not
review a recent movement, situated learning (e.g., Lave, 1990; Lave & Wenger,
1991; Rogoff & Lave, 1984), because I do not view situated learning per se as
the foundation of the proposed teaching practice.
Behaviorism. Basing their approach on Thorndike’s stimulus-response
principle, behaviorists view learning as a result of stimuli and responses
through the use of rewards (von Glasersfeld, 1995). This approach emphasizes
performance rather than the reasons that the learner performs a certain way.
Educators who use this framework break a content area into component
subskills, sequence them, and then transmit them to students mostly by direct
instruction such as lectures or reading assignments. This teaching approach
assumes that once students have learned the parts, they can put them together
as a whole and apply them when needed (Bredo, 1997; Fosnot, 1996). Further,
students are viewed as passive learners who need external motivation and are
affected by reinforcement (Skinner, 1953). The behaviorist tradition dominated
educational thinking and designs for many decades.
Cognitivism. In the 1960s cognitive psychology signaled a major conceptual
shift from the behaviorist tradition (Anderson, Reder, & Simon, 1995; Bredo,
1997). In contrast to behaviorism, cognitive psychology focuses directly on the
structure and operation of the human mind.
One of the main influences on cognitive psychology was the development of the
information processing approach (Anderson, 1985). Information processing
theory is a branch of cognitive psychology concerned with the way humans
collect, store, modify, and interpret information from the environment; how the
information is retrieved and stored; and how people use the knowledge and
information in their activities. The way knowledge is represented and coded for
storage in the human memory and the internal processing mechanisms
underlying behavior are the concerns of information processing theory
(Lachman, Lachman, & Butterfield, 1979).
Information processing theory generated a wealth of research that provided
insight into how components of the processing system function. Yet, critics
viewed information processing research as overly focused on thinking and
problem representation and not taking context and social aspects into
consideration (Cooper, 1993). The information processing perspective is helpful
when interpreting the construction of personal knowledge (constructivism), in
that all human beings are viewed as processing information by using a common
set of processing components, although each individual may have a unique
knowledge structure.
Constructivism. Constructivism is an outgrowth of cognitive science.
Constructivism views learning as a process of knowledge construction, with
concept development and comprehensive understanding as the goals (Fosnot,
1996; Resnick, 1986). Phye (1997) states that constructivism is a movement
that combines cognition from a developmental perspective with other important
issues, such as motivation, self-directed learning, and a focus on the social
context of learning.

21
According to von Glasersfeld (1996), there are two main aspects of
constructivism. First, learning is a process of knowledge construction instead
of absorption. We construct knowledge based on our own perceptions and
conceptions of our world; therefore, each of us constructs a different meaning
or concept (Duffy & Jonassen, 1992; Fosnot, 1996; von Glasersfeld, 1996).
Learning, in constructivists’ view, requires the building of conceptual
structures through reflection and abstraction (Schuman, 1987; von
Glasersfeld, 1995). Since each learner has to construct his or her knowledge,
concepts cannot be transmitted from teacher to learner by means of words
(Schank, 1997; von Glasersfeld, 1996). Learning occurs only when the learners
are actively involved in the construction and reorganization of concepts.
Second, knowledge is highly related to the environment in which the learner
experiences and constructs the knowledge (Duffy & Jonassen, 1992; Resnick,
1986; von Glasersfeld, 1996). In other words, understanding is indexed by
experience. Therefore, constructivists emphasize cognitive experience in
authentic activities. The context need not be the real world of work, however,
to be authentic; rather, learning activities should employ the type of tasks
that are the ordinary practices of the culture (Brown et al., 1989; Duffy &
Jonassen, 1992; Resnick, 1987).
The second main aspect of constructivism is similar to situated learning.
Situated learning “takes the theory of social and ecological interaction as its
basis…” and emphasizes the “information structures in the contents of people’s
interactions” (Greeno, 1997, p. 5); therefore, situated learning emphasizes
social interaction. Constructivism, on the other hand, emphasizes context and
environment.
One of the recommendations of constructivism is to engage students in building
objects (Kafai & Resnick, 1996). According to Resnick (1986), this is a
promising approach to assist learners in constructing theoretical constructs
because it creates the “means of objectifying constructs, that is, building
physical displays that allow explicit representation of key theoretical
constructs” (p. 6).
This objectifying approach serves several purposes. First, it becomes possible
to manipulate these objects and observe the effects, and by doing so the
presentation of the concept is visible. Second, manipulating objects allows
learners to raise their own questions, generate their own hypotheses, and then
test the hypotheses (Fosnot, 1996). Third, object displays ensure that
individuals talk about the same thing and have visible references for the
discussion (Resnick, 1986).
In constructivism, constructing an understanding requires that the learners
have the opportunities to articulate their ideas, to test those ideas through
experimentation and conversation, and to consider connections between the
phenomena that they are examining and other applications of the concept
(Dykstra, 1996; Nesher, 1989; Julyan & Duckworth, 1996). The opportunity
for learners to discuss and clarify their experiences is essential, because it
encourages self-organization and reflective abstraction. This reflective
abstraction is the driving force of learning (Fosnot, 1996; Perkins, 1992).
Dialogue within a community promotes further thinking. A constructivist
classroom is seen as a community engaged in activity, reflection, and
conversation (Fosnot, 1996).
Starting with the assumptions that knowledge is constructed and that the
environment in which the construction takes place is highly related to the
knowledge, Spiro, Feltovich, Jacobson, and Coulson (1992) proposed a

22
Cognitive Flexibility Theory. They maintain that for students to achieve
advanced knowledge acquisition, multiple presentations that revisit the same
concepts in different contexts, at different times, and for different purposes are
essential for obtaining mastery.
Perkins (1992) proposed two variations of constructivism: BIG (beyond the
information given) constructivism and WIG (without information given)
constructivism. A teacher using a BIG approach would directly introduce the
concepts, provide examples, and then engage students in activities that
challenge them to apply and refine their initial understanding through the use
of multiple applications and examples. This approach presents information to
the learners but stresses the need to go beyond the information given. In
contrast, a WIG approach would not present the concept. It is a discovery-
learning approach to teaching. Instead, learners would be presented with
phenomena and then encouraged to explain the phenomena with their existing
knowledge. Learners would discover for themselves, and the teacher would
scaffold the process without providing answers. In Perkins’ view (1992), an
exclusive WIG approach is inefficient and ineffective and fails to present past
achievements to students. However, education without any WIG instruction
would not engage students in learning the processes of discovery and idea
construction.

Learning Environment

Perkins (1992) identified five facets of a learning environment, not all of which
are always present. An information bank is any resource that provides
information about a topic, such as the teacher, a textbook, videos, or the
Internet. Symbol pads are surfaces for the construction and manipulation of
symbols; examples are notebooks, word processors, and drawing software
applications. Construction kits are sets of modular parts that students can use
to make things, such as Legos and laboratory tools. Phenomenaria are
artificially limited arenas where students can investigate phenomena.
Computer simulations in which students can investigate and observe physics
phenomena are phenomenaria, for example. Task managers are the agents that
guide the learning activity and provide feedback. Classic task managers are the
teacher and texts.
Although construction kits sound similar to symbol pads, they are designed
with a different emphasis. Students use symbol pads to record any structures
that they have in mind, whereas construction kits are prefabricated parts or
processes that students can use to build things. In constructivism, learners do
not just receive and store information. They make interpretations of experience
and elaborate and test those interpretations. Information banks therefore
become less central with a constructivist approach. Symbol pads are not just
for recording but working through ideas. The center of a constructivist-oriented
learning environment is a construction kit or a phenomenarium, because these
two provide tools for students to make sense of new information. In addition,
students themselves are given much more task management responsibility
(Perkins, 1992).

The Teachers Roles

Using a constructivist approach, teachers are challenged to provide teaching

techniques that support students’ construction of their understanding.

23
Teachers need to make the concepts and phenomena interesting and important
to the students (Julyan & Duckworth, 1996; Schank, 1997). The teacher
should offer a variety of methods for exploration and provide various
approaches.
Applying the Cognitive Flexibility Theory proposed by Spiro et al. (1992),
content must be covered multiple times. Multiple implications and applications
of the concept must be presented in realistic, meaningful contexts, and the
interconnections among knowledge components must be made explicit. No
single presentation is sufficient to provide all pertinent information.
In addition, merely providing the experience is not sufficient; the teacher
should ask questions and listen carefully to students’ interpretations of the
data. The teacher must push students to think as clearly as they can about
their ideas. The teacher should perceive errors as the results of the learners’
conceptions for the moment, because at that moment that is what makes sense
to the student (Fosnot, 1996; von Glasersfeld, 1995). To modify students’
misconceptions, the teacher will need to elicit an explanation as to how the
students have arrived at their answers, and ask questions or provide a different
presentation to allow the students to discover their errors and construct the
correct concept (von Glasersfeld, 1995). This is when the objectifying theory
becomes useful. By allowing students to manipulate objects, the concepts
become visible, as do the misconceptions. Students may discover their
misconceptions themselves because their designs do not make sense even to
them.
It will be the teacher’s decision to use the BIG (beyond the information given)
or the WIG (without the information given) approach. Many agree that for
introductory learning, BIG is more effective, while WIG is more appropriate for
advanced learning (Perkins, 1992, Schank, 1997; Spiro et al., 1992).
Both Schank (1997) and Julyan and Duckworth (1996) agree that an
atmosphere of playfulness is important. As long as students are having fun,
they are motivated and attentive, and it also helps to release the frustration
inherent in constructing understanding.

The Learners Role

Constructivism places the learner in the center of the learning process;

however, little discussion has focused on learners themselves and how they
experience the approach. Perkins (1992) identified three demands imposed on
learners, cognitive complexity, task management, and acceptance of the
approach. The constructivist approach usually confronts learners with
construction kits or with phenomenaria which are complex and challenging.
Most constructivist instruction intentionally presents learners with situations
that make them examine their existing knowledge and structures, forcing them
to reorganize and construct new models. The learners, not the teacher, are
responsible for defending, proving, justifying, and communicating their ideas
to the classroom. These types of tasks place a very high cognitive demand on
the learners. Learners are no longer able simply to memorize the content and
repeat it on tests and assignments.
Second, learners are asked to take on more responsibility for task management
than in conventional instruction. This shift of responsibility is necessary if
students are to become autonomous thinkers and learners; yet, many students
are not used to managing their own learning. Perkins (1992) suggests that, to
help with both cognitive complexity and task management, the teacher should

24
make sure that just enough help and guidance is provided, but not too much.
It would be difficult, however, for a teacher to support large groups of students.
This is where the support that comes from working in groups can be helpful to
students.
Third, some students may not want to do the hard work of constructing their
understanding and taking on the responsibility of managing their learning. As
teachers, we probably have heard students’ reactions such as “What do you
want?” and “I don’t know what you want.” From the students’ perspective, they
are being asked to discover concepts for themselves when they thought that
they could be told the concepts, do some exercises, and move on. A
constructivist approach asks students to think both about the concept and the
process of learning the concept, and many students may not buy in to the
teaching approach (Perkins, 1992).

Assessment

The most criticized aspect of constructivism is assessment. Instructional

designers ask what to assess and how to assess (Dick, 1992). If the process of
construction is the essence of learning, should the process or the result of the
process be assessed? If concepts constructed may vary from student to
student, what criteria should be used for evaluation?
Jonassen (1992) recommends evaluation strategies that are consistent with the
two main aspects in constructivism, namely, learning is a process of
construction, and context is important in the learning process. He suggests
that effective assessment should be part of the instructional process. Students’
demonstrations of knowledge acquisition, their products, should be noted as
only part of the evaluation; the process should also be evaluated.
The second suggestion is that evaluation should occur in contexts that are as
rich and complex as those used in instruction. Jonassen (1992) states that
“simplified, decontextualized problems are inappropriate outcomes for
constructivistic environments” (p. 141). Since it is important to present
multiple perspectives in a constructivist learning environment, the evaluation
process should also reflect and accept multiple perspectives. Evaluation
therefore requires a panel of reviewers, and each reviewer should have the
credentials for evaluating students from a meaningful perspective (Jonassen,
1992). Allowing for multiple perspectives does mean the absence of standards.

A Constructivist Approach to Teaching Computer Networking

The general constructivist learning principles helped me rethink and redesign

my teaching practices when it was clear that the traditional lecture/
presentation approach was not effective in teaching the introduction to
computer networking class. The contents of the class include most of the ten
topics identified in Crews and Ray’s (1998) study, with additional units on
network operating systems and network administration and support. This class
starts with the topics listed in Crews and Ray’s study, and students then work
in groups to set up server-based and peer-to-peer networks, install network

25
operating systems, create and manage user accounts, and perform other
network administration and support activities. Providing hands-on computer
experience may not be an option for some teachers, but if it is, a great many
materials are available to assist and support this teaching approach.
The focus of this paper is on teaching basic networking concepts. The students’
backgrounds, the general approach used, and the group project assignments
will be described to provide an overall structure of the class. Finally, examples
of using objects to objectify network topology concepts and using construction
kits for students to learn network architectures will be presented.

Students Background

The prerequisite for the class is an introduction to computers class. Students

enrolled in the networking class have a limited understanding of computer
hardware; however, the majority of students are either majoring or minoring in
business information technology and have had several computer software
application courses at the time of enrolling in this computer networking class.
This usually is an evening class that meets once a week for two hours and forty
minutes.

First Day of Class

In the first class period, a pretest, called a “get-toknow-you” questionnaire to

ease test anxiety, is administered to all students to identify their knowledge of
computer networking. Meanwhile, three-by-five-inch index cards are
distributed to students to make name cards. After the pretest and name cards
are collected, the cards are then used for an icebreaker. The name cards are
mixed into pairs and handed back to students, but not to the owners of the
cards. For example, John would get Josh’s card and Josh would get John’s
card. If possible, students who do not know each other are matched. Students
are then asked to take a few minutes to get to know each other and share a
funny story, and each student tells the story to the class. This exercise
establishes a playful learning atmosphere and a sense of community.
Playfulness motivates students, and a sense of community encourages
students to articulate their ideas (Fosnot, 1996; Julyan & Duckworth, 1996;
Schank, 1997). Motivation and willingness to participate are essential for
students to take part in their construction of concepts.
Students are then asked to introduce themselves and to share with the class
the computer networking experience they have had, either from previous
courses or jobs. Again, this helps students to know each other as well as
providing information on students’ existing computer networking knowledge
that the instructor might not have received in the pretest. Information gathered
from the pretest and the students’ introductions provides indications of how
much knowledge students already have to allow them to construct new
networking concepts. This is also a first step toward creating a unique
community of learning among this particular group of students. In addition, it
allows the teacher to ensure that heterogeneous groups are formed to
encourage discussion throughout the semester, as discussion and clarification
help learners construct and reorganize their concept structures (Fosnot, 1996;
Perkins, 1992).

26
General Approach

Since the majority of students in this class have limited hardware knowledge,
and since networkrelated hardware concepts are main components of the
course content, Perkins’ (1992) BIG (beyond information given) constructivist
approach is used. I use a brief PowerPoint slide presentation in each class
period to provide key concepts, and the slide presentation is posted a few days
before the class period on Blackboard, software that allows instructors to post
class materials on or communicate via the Internet.
Students are told in the first class period that the class will have a hands-on
approach, and they are expected to explain, explore, and discuss what is
presented. They are told, to their delight, that lectures will be kept to a
minimum. Students are made aware that they must take responsibility for their
own learning by participating in class discussions, keeping up with the reading,
following the instructions and guidelines in assignments, checking Blackboard,
and checking the e-Gradebook on a regular basis. I use the e-Gradebook
software to post assignments and test grades on the Internet. I explain to
students that to make a nearly three-hour evening class interesting, a variety
of activities will be used, but students will have to do their share to make it
work. This gets students to buy in (Perkins, 1992) to a constructivist approach.
Generally, the class starts with a 40-minute PowerPoint presentation on the
concepts covered for the class period. Various hands-on activities follow.
Construction kits (Perkins, 1992) are used frequently to assist students in their
construction of concepts. In most cases, I ask questions and students explain
the phenomena or demonstration.
At the conclusion of the class, students work in groups to go over questions,
either from a handout or from the textbook. Then, the class as a whole goes
over the questions, with one of the groups leading the discussion. This provides
another opportunity for students to discuss the concepts in groups and as a
class, and to reflect on what they have learned that day. Furthermore, this
provides an opportunity for me to ask questions on the interrelationships
among concepts and challenge students to examine their overall
understanding. As constructivism stresses, presenting the material in multiple
passes with multiple formats assists students to build constructs with multiple
concepts (Perkins, 1992; Spiro et al., 1992).

Groups Projects

Students are required to complete three group projects. Students are divided
into 3- to 4-person groups. The first project asks students to gather computer
network information on a business of their choice. Students work on this
project out of class after network hardware and architecture are covered as
class topics. Students identify and visit a business, collect information on the
computer network used in the business, relate the collected information to the
course content, and reflect on what they learned in the class. Students submit
one report from each group for evaluation and present their findings orally in
class. This project allows students to put the concepts they learn in a realworld
context and gather information on the hardware problems and obstacles
network personnel encounter. Meanwhile, this project provides an opportunity
for students to reflect on their learning. Students frequently indicate that

27
seeing the real thing and asking questions is a great help in clarifying their
understanding.
In the latter half of the semester, students have the opportunity to connect
computers in networks, install network operating systems, and try out network
administration tasks. Since this hands-on activity is not evaluated and
students do not earn points, it is not considered a formal project. Due to facility
constraints, students are divided into two large groups, and each large group
is divided into 3- or 4-person groups. While one large group works on the
computers, the other large group works on the second project, network design.
These two large groups rotate their tasks so that every student has the
opportunity to complete both exercises.
The second project presents students with a scenario of a fictitious company
named ToyQuest. In this scenario, students are hired as new network
administrators and are asked to revise an existing single-floor token ring
network plan to incorporate new Ethernet workstations on a second floor,
forming a new network. Other information provided includes a diagram of the
existing networks for ToyQuest, floor plans, the number of workstations and
network utilization in each department, and a statement indicating that the
company has plans to expand to the third floor in the near future. Students
take all these parameters into consideration to determine the type and quantity
of network media to use and the additional hardware needed. Students then
shop for the hardware on the Internet to get the best pricing. Finally, students
prepare a proposal with a budget detailing the hardware, the quantity, and the
costs. The reports are graded based on both the design and the budget. This
project provides an opportunity for students to go “beyond the information
given” (Perkins, 1992). Students must apply the networking concepts they have
learned and integrate them to design the most desirable plan using the
appropriate hardware. At the same time, they need to be concerned about
pricing, as in the real world. This project is rich in context and complex as an
evaluation tool (Jonassen, 1992).
The third project is about network administration. After students have hands-
on experience with network installation, user management, and other
administrative functions, they revisit the business from which they gathered
information for the first project. The focus of this visit, however, is on the
administrative aspect of networking, such as the network operating systems
used, account and user management, network security issues, disaster
recovery plans, and other administrative issues and concerns. The
requirements are similar to those of the first project.
Students finish all three projects with the same group members. The goal is to
develop a good teamwork experience and allow time for students to work out
their differences and manage any conflicts that they might have.

Objectifying Network Topology Concepts

Ropes, key rings, and post-it notes can be used to objectify (Resnick, 1986)
bus, ring, and star topologies. These substitutes are also accompanied with
actual cables, connectors, and network cards. To objectify a bus topology, each
student sitting in the front row is asked to hold on to a point of the rope and
pretend to be a computer. I ask questions about what would be needed for
cabling a bus topology. When students answer, “terminator,” I tie knots on each
end of the rope as terminators. This set up then is used for discussing the
characteristics of a bus topology, how signals travel, and what happens when

28
a cable breaks or computers break down. This discussion then leads to the
advantages and disadvantages of a bus topology. At the same time, various
cables, terminators, network cards are presented and available for students to
manipulate.
For a ring network, the same rope then is tied to a ring with a key ring on it.
To simulate a ring topology, students sitting on both sides of a pathway are
computers and hold the rope to form a circle. The key ring on the rope is the
token for the token ring. A post-it note is posted on the token key ring to signify
a message. With this setting, I can ask questions about the characteristics, the
signals, the effect of computer break down, advantages, disadvantages, and
other related questions to encourage students to articulate their thinking and
clarify their ideas. Another rope can then be added to form a Fiber Distributed
Data Interface (FDDI), and the similarity and differences between token ring
and FDDI can be discussed with the physical displays as references.
The same principle can be used to discuss star topology. One student holds
several shorter ropes at one end to represent the switch, and several students
who represent computers hold the other ends of these ropes. As Resnick (1986)
points out, this approach makes the presentation of the concepts visible.
Students raise questions. Some of the questions can be answered by more
experienced students in the class, and others by me. I try to do the asking,
however, and let students do the explaining. Discussion and communication
become easier because both students and I have the objects as reference and
are talking about the same thing.

Network Architecture

Network architecture usually is confusing to students because there are many

hardware elements involved, such as cables, connectors, hubs, switches,
bridges, routers, and firewalls. In addition, topology and speed affect the use
of these hardware elements. To help students assemble these, I use children’s
building blocks, ropes, and strings. Again, students are divided into groups of
three or four. Each group is provided with wooden building blocks in various
sizes as well as ropes and strings in various thicknesses and textures. Smaller
cube blocks simulate workstations, larger cube blocks simulate file servers,
and other sizes simulate printers, switches, routers, and other hardware. For
networking media, fishing lines simulate fiber optic cables. Thicker, less flexible
strings can be thicknet coaxial cables. With these, students are asked to build
a wide variety of network architectures ranging from simple bus networks to
complex networks consisting of multiple topologies. This construction kit helps
students construct the basic concepts of computer networking, including
network topologies, communication media, and communications hardware as
listed in Crews and Ray’s (1998) study.
This is an example of what Perkins (1992) refers to as a construction kit. These
construction kits allow students to put their understanding on display. Their
understanding and misconceptions become observable, and modifying
students’ misconceptions become much easier. In addition to using this

29
construction kit in the network architecture unit, it can be used in the network
topologies unit and in the local area and wide area network unit. By using the
construction kit in different units, I present basic networking concepts in
multiple passes as Spiro et al. (1992) recommend.

Conclusions

Today’s business world requires graduates to have in-depth knowledge and to

be able to use this knowledge to solve problems. The traditional teaching
approach that breaks course content into sequenced components, presents
concepts to students through lectures, and provides exercises may not be
effective in teaching theories and concepts. Constructivism provides a
conceptual foundation for rethinking and redesigning teaching practice. The
principle that conceptual knowledge cannot be transferred from teacher to
students by telling disputes the traditional didactic teaching strategies that
consist mainly of lectures. The principle that knowledge exists in meaningful
contexts, not just in individual heads, challenges teachers to present concepts
through meaningful experiences and to provide situations where multiple,
interrelated concepts apply so that students have the opportunity to construct
a comprehensive understanding.
Constructivism provides a sound theoretical foundation for teaching any
complex knowledge domain. This paper presented teaching practices that apply
constructivism to teaching computer networking. These practices include using
objects to build three-dimensional displays of networking concepts to promote
discussion and clarification, using construction kits to allow students to raise
questions and see their constructed concepts in action, building a friendly and
safe learning atmosphere to encourage idea discussion and sharing, and
supplying meaningful projects for students to bring in real-world experience.

Recommendation

Consistent with the constructivist theory, teachers should continue to

construct and refine their teaching strategies; therefore, it is the goal of this
paper to invite teachers to share and, working in teams, continue to develop
and construct teaching practices that foster students’ learning of useful
knowledge.
To validate the constructivist approach in teaching computer networking
concepts, empirical research is needed to investigate the effectiveness of this
strategy. Experimental designs are needed to compare the effectiveness of
various teaching approaches, such as lectures alone versus construction kits,
on students’ knowledge and understanding. Effectiveness should also include
a measure of students’ ability to use the knowledge to solve computer
networking problems. The results of such investigations will be very beneficial
for teachers to help them select the most effective strategies based on sound
evidence.

30
Synthesis

Constructivism is a learning theory found in psychology which explains how

people might acquire knowledge and learn. Has direct application to education.
Theory suggest that humans construct knowledge and meaning from their
experiences. (University of Sydney)
As what of the papers presents in these studies, it is an approach that teachers
are challenged to provide teaching techniques that support student’s
constructing of their understanding of the lessons that has been discussed.
This study helps the teachers to make a way in order to a student’s
understands every lesson they have been tackled. It is common to everyone
that in every learning we gained has a process, and according to von Glasersfeld
(1996)in these study, there are two main aspects of constructivism. First,
learning is a process of knowledge construction instead of absorption, it means
that learning occurs only when the learners are actively involved in the
construction and reorganization of concepts because sometimes people
construct knowledge based on their own perceptions or concepts. Second,
knowledge is highly related to the environment in which the learner experiences

31
and constructs the knowledge. And in other word’s Understanding also needs
an experience, that’s why it is important to demonstrate the lessons or
discussions to the students through giving an activity that is involved by
showing their participation so, that they understand the lesson easily through
their experiences to the activity that has been given.

A constructivist approach to teaching networking, also used an approach

that can help the students to understand the progress of computer networking,
just like to the other subject, the students also had limited understanding to
the computer networking. In this case, the researcher found an example that
can be used as a basis that a student can understand the concept of computer
networking through giving example like construction kit, like hands on
approach in which the hardware elements will be applied such as cables, hubs,
connectors, switches, bridges, routers, and firewalls, where the students will
represent as the elements of hardware and they are expected to explain,
explore, and discuss what is presented and it will lead to their learnings on
what are the different functions of the elements in terms of computer
networking. This construction kit helps students construct the basic concept
of computer networking and it allows them to put their understanding on
display.
In constructivism, constructing an understanding requires that the learners
could have the opportunities to articulate their ideas, to test those ideas
through experimentation and conservation, and to consider connections
between the phenomena that they are examining and other applications of the
concept.

Indra: A peer-to-peer approach to

network intrusion detection and
prevention
Ramaprabhu Janakiraman Marcel Waldvogel Qi Zhang rama@arl.wustl.edu
mwl@zurich.ibm.com qz@cs.wustl.edu

32
Abstract— While advances in computer and communications technology have made the network
ubiquitous, they have also rendered networked systems vulnerable to malicious attacks orchestrated from
a distance. These attacks or intrusions start with attackers infiltrating a network through a vulnerable host
and then launching further attacks on the local network or Intranet. Attackers rely on increasingly
sophisticated techniques like using distributed attack sources and obfuscating their network addresses. On
the other hand, software that guards against them remains rooted in traditional centralized techniques,
presenting an easily-targeted single point of failure. Scalable, distributed network intrusion prevention
techniques is sorely needed.
We propose Indra – a distributed scheme based on sharing information between trusted peers in a network
to guard the network as a whole against intrusion attempts. We present initial ideas for running Indra over
a peer-to-peer infrastructure to distribute up-to-date rumors, facts, and trust information in a scalable
way.

I. INTRODUCTION
A. Intrusion detection systems
Intrusion is the act or attempted act of using a computer system or computer resources without the
requisite privileges, causing willful or incidental damage. Intrusion detection involves identifying
individuals or machines that perform or attempt intrusion. Intrusion Detection Systems (IDS) are
computer programs that attempt to perform intrusion detection by comparing observable behavior
against suspicious patterns, preferably in real-time. Intrusion is primarily a network based activity. With
increasing global network connectivity, the topic of intrusion has gained prominence, spurring active
research on efficient IDS.
Intrusion detection systems can be classified on the basis of a multitude of factors. Some factors
significant to our project are listed below. [1] provides more and deeper information.
Response to Intrusion: This can be passive or active. A passive system is content with just detecting
intrusion, leaving its handling to a second, typically human, agency. On the other hand, an active system
takes action, for example terminating network connections to a suspected host. Obviously, active
systems can react more quickly and to more events, but open themselves up to denial of service attacks
by over-reacting to deliberately triggered false alarms.
Source of audit data: The data to be examined can be network data (network packets etc.) or host data
(application logs, system call traces etc.).
Data collection and processing: Data collection can be centralized or distributed. Again, this data can
be processed centrally or at distributed locations.
In recent times, there has been a lot of interest in distributed schemes for intrusion detection. While the
research community has been active in this area [2–8], most existing schemes are passive in the sense
that they only implement the act of collecting information in a distributed manner. The controlling
intelligence is centralized in the person of the system administrator(s) managing the administrative
domain. Getting exactly the relevant information to this central entity is a critical task, which needs to
be balanced between overloading the person or not providing enough information. Therefore, a system
is needed to augment or eventually replace this central entity.

B. Outline of this paper

The motivations and current design of the Indra system are described in II. III discusses the deployment
of Indra over peer-to-peer (P2P) systems. In IV, we discuss issues with trust and key distribution. In
Sections V and VI, we propose a plugin mechanism that provides for dynamic extensibility in Indra.
We discuss future and related work in Sections VII and VIII and summarize in IX.

33
 II. INDRA

Project Indra is named after an Indian God credited with a protective function. It also expands to
INtrusion Detection and Rapid Action, which describes its goal and functionality with surprising
accuracy, given the fact that the acronym was retro-fitted.
A. Attacks on Immune Systems
Indra is an intrusion detection tool that takes a proactive and P2P approach to network security. It is
often the case that attackers try out common exploits on different machines, hoping to stumble upon a
machine on which a particular vulnerability is extant. Sometimes these attacks are detected and repulsed
by intrusion detection software in place on a particular machine. But a persistent attacker, after many
attempts [9], eventually manages to find a weak link in the chain. The broad goals of project Indra is to
distribute such attempt information (gathered by the intended victim) among all interested peers in a
P2P network. This allows the system to react, either proactively (e.g., by applying patches, temporarily
disconnecting services, or both) or retroactively (e.g., disconnect machines that may have been
compromised, to limit further damage).
The chance that at least one of the machines does notice an attack to which it is not itself vulnerable
increases with the number of machines, the heterogeneity of the machines (operating systems and/or
applications), and the level of currency of the applied security fixes. This makes it very attractive to
have a system spreading such information quickly and widely.

B. Neighborhood Watch
Each interested host on the P2P network runs a special security daemon, the Indra daemon, which both
watches out for intrusion attempts and also enforces access control based on its memory of earlier
attempts. The P2P network needs to be reliable and trusted. This is achieved by applying trust
management schemes such as the Web of Trust as known from PGP [10]. Extreme care must be taken
when implementing the system not to open any security holes or opportunities for denialof-service
attacks.

Fig. 1. Neighborhood Watch with Indra

Besides notifications occuring when immune systems see an attack on themselves (see above), it is
also possible for other machines (“neighbors”) sharing a network to detect other hosts as being under
attack. This is particularly effective if the network is a shared medium, but the same effect can be
achieved by installing Indra on network gateways or on a machine attached to a “snoop” port of a
network switch. In particular, as shown in Figure 1, the following sequence of events could occur.
Please note that in Figure 1, at least hosts C needs to be able to listen to B’s network traffic.
1. The attacker on A finds the weak access point B in the network.

34
2. The attacker initiates attacks from B1 to hosts in the trusted network to which the host C is
connected. It is assumed that all hosts in the network, including C, run Indra daemons.
3. The Indra daemon at C detects the attack from B and then multicasts a secure warning message
regarding B to its trusted neighbors.
4. Each Indra daemon receives the message from C, verifies its integrity and then places B on a
‘black-list’ of suspected intrusion sources.
5. The attacker, having failed in his attempt on C, tries it out with other hosts in the same domain.
These subsequent attacks are repelled straightaway by the forewarned hosts.
While this ideal situation easy to spell out, it presents practical difficulties at various levels that have to
be overcome first:
Communication: How do the daemons communicate with each other? How do they transmit a message
to all the other daemons? Some communication model has to be devised.
Trust: How do the daemons trust messages and their senders? Obviously, messages have varying
importance depending on who sends them.
Policy: Suppose intrusion is suspected. How do the daemons react to it? Solutions can range from
paranoia to indifference.
In the next few sections, we deal with each of these in turn.

III. PEER-TO-PEER COMMUNICATION AND INDRA

Indra relies on efficient group communication primitives in the underlying network in-order to exchange
intrusion information with peers. We argue that P2P systems, by providing fast and fault-tolerant
primitives for search and data retrieval, provide an ideal platform on which Indra can be deployed.
As a case in point, we consider the Scribe [11] project, which overlays a topic-based publish-subscribe
or a sequence of such B’s
multicast mechanism on top of a peer-to-peer network Pastry [12]. In this scheme, Indra nodes are part
of the Pastry network and communicate using Scribe groups, as shown in Figure 2.
Alternate implementations might be built around the Tapestry [13] P2P system and might use Bayeux
[14], its mechanism for multicast communication.
PASTRY nodes

Indra Nodes

SSH Vulnerabilities

DOS Attacks

Fig. 2. Indra over Pastry and Scribe

As an alternative to the deterministic multicast mechanisms outlined above, rumor-spreading models of

communication have been proposed where each node propagates information to a randomized subset of
its neighbors [15]. Such mechanisms are particularly relevant to Indra, since they enable Indra to be
deployed on any peer-to-peer network without the additional overhead of creating multicast trees for
each topic.

35
 IV. TRUST AND KEY DISTRIBUTION
Trust is an important issue in an intrusion-detection system, more so in the absence of a centralized
trusted authority to provide digital certificates. The usual decentralized alternate to central CA’s is the
web-of-trust model, where certifying happens among peers rather than from a central authority.
Our work on this is rather less concrete than that of Indra itself. In the prototype version, we rely on
trusted keyservers from which Indra gets certificates for its peers. In a decentralized P2P system,
variants of the Web of trust model from PGP [10] are more realistic. In this model, as shown in Figure
3, nodes are connected by trust relationships shown by edges, where edge weights represent degrees of
trust. In reality, some nodes have pre-assigned trust values on entry, while trust values of other nodes
must be computed based on their trust relationships. While there has been some work on trust metrics
[16,17] in a Web-of-trust model, this is currently an area of active research.
Preassigned trust Untrusted node

Trusting node

Fig. 3. Web of trust

V. INDRA DAEMONS

At the topmost level, all the functionality of Indra is achieved by a set of daemons which, in our
implementation, correspond to Java threads. These daemons belong to one of the following classes.
Watchers: These are the first level daemons that are on the outlook for any suspicious activity, either
on the local system or over the network, for example multiple failed login attempts, port-scan attempts
or suspicious system-call sequences.
Access Controllers: These daemons provided controlled access to resources. The control is dynamic
and depends on what the listeners tell them to do. When they get a warning against a particular user-id
on a machine, they selectively filter out access to that particular (account, machine) combination. For
determining accounts, it uses the IDENT protocol [18]. We are investigating enhancements to the
IDENT protocol to incorporate digital signatures.
Listeners: These are daemons that listen to the watchers. Listeners aggregate the warnings that are
generated by the Watchers. Then based on the security level or any other policy dictated by the
administrator, the listeners convey the warnings to the Access Controllers. Listeners are essentially
selective filters that stand between the watchers and access controllers. If watchers were sense organs
and access controllers limbs, the listener would be the central intelligence that drives motor function
based on sensory input. For example, certain kinds of exploit attempts might result in vulnerable
services being denied while other, presumably secure, services continue to operate normally. Reporters:
These daemons are responsible for communicating with other hosts, either receiving warnings and
passing them on to the listeners or aggregating warnings from listeners and passing them along the
network to other hosts.
The daemons could be configured by the system administrator for different levels of security. For
example, a host with critical information could be configured to deny all network connections to a
machine which is identified as an originator of repeated failed logins. At another level, routers could
run security agents that cut off packets that originate from a compromised machine, effectively isolating

36
the machine from the network. Instead of taking it upon itself to make all these decisions, Indra provides
a scaffold or framework that allows these options to be implemented by the administrator with ease.

VI. INDRA PLUGINS

Indra provides a mechanism by which additional daemons 2 can be plugged in at run-time into the Indra
system. Whenever the administrator needs to change the security policy, either because a new exploit
has surfaced or the security concerns have changed, she can write Java code that implements the
necessary functionality and E-Mail or distribute it to interested peer daemons. These modules will be
authenticated against the administrator’s public key by the Plugin manager and then dynamically loaded
into the daemon’s address space.
We find that using Java for our implementation serves us well here. Code that compiles to native
machine code, with its ability to forge pointers to arbitrary memory locations and to execute any
combination of native machine instructions, is extremely difficult to audit or validate. Java, with its
concept of a virtual machine as a sandbox, allows fine grained access control to resources, enabling
different security policies for inbuilt code and code that is loaded over the network. This is analogous
to executing Java applets securely inside the context of a browser.

VII. RESEARCH AGENDA

Indra is very much work-in-progress. We have a prototype implementation working, but it is too bare-
bones to be useful in practice. For example, we use simple port-logging or failed-login counts as
indicators of intrusion attempts. Overall, the fundamental contribution of Indra is not that of new
intrusion detection techniques. Instead, we have tried to provide a framework that complements these
techniques and help them maintain relevance in a massively networked scenario.
Ongoing research on Indra is on several fronts: The most important issue is that of trusting sources in a
P2P system in the absence of centralized certifying authori-
Watchers, Listeners or AccessControllers
ties. We are investigating variations on the Web of trust model [10] which are appropriate for deploying
Indra in a decentralized P2P manner. In addition, we will be using reliability measures as described in
[19].
Another area of interest is information propagation mechanisms for multiparty communication in P2P
networks. We find that the publish-subscribe model described in [11] is closest to our work. Another
area of relevant research is work on randomized rumorspreading techniques [15] as a scalable
alternative to deterministic flooding.
Currently, security advisories are written with system-administrators. However, it is a notorious fact
that many sysadmins are tardy in applying security patches. For example, it is known that over 30% of
SSH servers on the Internet still contain the critical CRC32 bug discovered more than a year ago [20].
An interesting area of future research is on machine-readable advisories written in XML, which Indra
daemons can autonomously act on.
Further, we are working on a standard and flexible interface to writing security plugins for Indra.
Ultimately, this would enable the advisory agency to write plugin modules as soon as a vulnerability is
detected, and place signed copies on the P2P network. As an alternative to P2P systems, an efficient
multicast transport mechanism like SRM [21] or ALMI [22] could be used, if and when such
mechanisms are widely deployed over the Internet. In any case, we predict turn-around time to be of
the order of a few minutes, for machines distributed throughout the Internet.

VIII. RELATED WORK

The idea of using distributed intrusion detection has been proposed with several variations over the past
decade. Schemes have been proposed using distributed data collection and, in relatively fewer cases,
distributed analysis agents.
An interesting approach to this problem using concepts of Immunology is [23]. The Distributed Firewall
scheme [24] proposes a central access control access policy which is enforced by individual endpoints.
The NADIR system [2] uses distributed data collection and centralized analysis by an expert system.

37
The GrIDS project [3] uses data source modules running in each host to extract information, which is
used by graph engines to build a graph representation of network activity. GrIDS is again a purely a
passive detection-based scheme, with corrective action presumably left to the system administrator.
AAFID architecture [4] describes a distributed IDS based on which is based on multiple autonomous
agents that can be added and removed from a system on the fly. There is no facility for automated
handling of Intrusions, i.e., AAFID is a passive IDS.
The two schemes that are most closely related to Indra are Cooperating Security Managers (CSM) [5]
and EMERALD [6]. CSM is an peer based IDS designed for use in a distributed network environment.
Each CSM acts like a host-based local IDS for its host, while additionally cooperating with other CSMs
without the use of a central controller. EMERALD is a powerful distributed IDS that is active and
distributed. However, it does not seem to support on-the-fly plugin upgrades.

IX. SUMMARY
As the global Internet becomes increasingly pervasive, computer intrusion and its prevention assumes
greater importance. To be scalable with exploding network sizes, it is imperative that IDS’s be
distributed and self-maintaining.
In this paper, we argue the case of distributed intrusion-detection systems running over P2P networks.
We describe the design of such a scheme, Indra, which promises to scale well under increasing network
sizes and more determined attackers. We believe Indra, by leveraging the resilience of the underlying
P2P network, has the potential to provide a robust intrusion detection system even in the face of
concerted attacks.
At the frenetic pace at which software is written and deployed over the network, new vulnerabilities in
networked systems crop up as fast as older ones are detected and plugged. In such a scenario, protection
systems need to be pluggable to keep up with the latest bugreports. Indra offers a scalable solution by
providing for security plugins that can be loaded on the fly simultaneously by thousands of machines in
an administrative domain.
REFERENCES
[1] S. Axelsson, “Research in intrusion-detection systems: A survey,” Tech. Rep. 98–17, Department of Computer
Engineering, Chalmers University of Technology, Dec. 1998.
[2] Judith Hochberg, Kathleen Jackson, Cathy Stallings, J. F. McClary, David DuBois, and Josephine Ford, “Nadir: An
automated system for detecting network intrusion and misuse,” Computers & Security, vol. 12, no. 3, pp. 235–248, 1993.
[3] S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, J. Rowe, S. Staniford-Chen, R. Yip, and D. Zerkle,
“The design of grids: A graph-based intrusion detection system,” Tech. Rep. CSE-99-2, U.C. Davis Computer Science
Department, Jan. 1999.
[4] J. S. Balasubramaniyan, J. O. Garcia-Fernandez, D. Isacoff, E. Spafford, and D. Zamboni, “An architecture for intrusion
detection using autonomous agents,” Tech. Rep. 98/05, Purdue University, 1998.
[5] G. White, E. Fisch, and U. Pooch, “Cooperating security managers: A peer-based intrusion detection system,” IEEE
Network, vol. 10, no. 1, pp. 20–23, 1994.
[6] P. A. Porras and P. G. Neumann, “Emerald: Event monitoring enabling responses to anomalous live disturbances,” in
Proceedings of the 20th National Information Systems Security Conference, Oct. 1997, pp. 353–365.
[7] G. Helmer, J. Wong, V. Honavar, and L. Miller, “Intelligent agents for intrusion detection,” in IEEE Information
Technology Conference, Sept. 1998, pp. 121–124.
[8] M. Crosbie and G. Spafford, “Defending a computer system using autonomous agents,” Tech. Rep. 95-022, Dept. of
Computer Sciences, Purdue University, Mar 1996.
[9] J. Howard, An Analysis of Security Incidents on the Internet, Ph.D. thesis, Carnegie Mellon University, 1998.
[10] William Stallings, “Pretty Good Privacy,” ConneXions, vol. 8, no. 12, pp. 2–11, Dec. 1994.
[11] Antony I. T. Rowstron, Anne-Marie Kermarrec, Miguel Castro, and Peter Druschel, “SCRIBE: The design of a large-
scale event notification infrastructure,” in Networked Group Communication, 2001, pp. 30–43.
[12] Antony I. T. Rowstron and Peter Druschel, “Pastry: Scalable, distributed object location and routing for large-scale peer-
topeer systems,” in Middleware, 2001.
[13] B. Zhao, J. Kubiatowicz, and A. Joseph, “Tapestry: An infrastructure for fault-resilient wide-area location and routing,”
Tech. Rep. UCB//CSD-01-1141, U. C. Berkeley, 2001.
[14] S. Zhuang, B. Zhao, A. Joseph, R. Katz, and J. Kubiatowicz, “Bayeux: An architecture for scalable and fault-tolerant
widearea data dissemination,” in In Proc. NOSSDAV 2001, 2001.

38
[15] Richard M. Karp, Christian Schindelhauer, Scott Shenker, and Berthold Vo¨cking, “Randomized rumor spreading,” in
IEEE Symposium on Foundations of Computer Science, 2000, pp. 565–574.
[16] Ueli Maurer, “Modelling a public-key infrastructure,” in ESORICS: European Symposium on Research in Computer
Security. 1996, LNCS, Springer-Verlag.
Michael K. Reiter and Stuart G. Stubblebine, “Path independence for authentication in large-scale systems,” in

39