First of all, a wireless controller is a centralized Wi-Fi management device that manages all the access points in a campus. The following points illustrate why a controller is inevitable for larger networks.

Centralized Authentication: No more individual MAC address tables and updation in each access point, controller provides for a centralized authentication mechanism through individual user name-password based Radius Server/ Active Directory/ LDAP Integration , centralized MAC address filtering or certificate/ shared key based authentication for all the clients from a central location.

Centralized Radio Management for all Access Points:

1. Interference Mitigation: Adjacent Access Points are always maintained to operate in different non-overlapping channels by the controller so that there is no loss of packets due to interference in a dense wireless network.
2. Load Balancing: The users are automatically shifted to adjacent access points if the load (number of users connecting) on one access point is high and the neighboring access point is lesser.
3. Radio Balancing: 802.11n enabled clients are connected to the 802.11n radios, 802.11a enabled clients are connected to 802.11a radios; 802.11b/g enabled clients are connected to 802.11b/g radios in a multi-radio enabled access point.
4. Fail over: Clients are automatically shifted to neighboring access points if any access point suddenly fails, thereby introducing redundancy in the network.

RF Visualization: Another advantage of today’s centralized wireless networks are the visualization capabilities of the Controller. Once the Floor plan of the campus is integrated with the controller, the coverage pattern, signal strength, users associated in each access point and various parameters can be viewed LIVE over a PC monitor (through a web based application) sitting in a central location. This makes monitoring and trouble shooting of networks very easy. You can also locate any active Wireless client in the network map by just typing its MAC ID in the software.

RF Visualization in a wireless network

Network Access Control based on User Identity: With today’s centralized Controller based Wireless networks, wireless users can be further segregated in to sub-groups and each group can be given separate network access policies. For example, all the wireless users accessing the network from the finance department can be given SAP/ERP access while the sales department can be denied the same. Internet access for the junior management staff can be blocked and guests can be given temporary internet access without giving access to internal network. IT department and senior management can be given full unrestricted access to the network resources. Certain laptops/ wireless clients can even be blocked network access if they do not have the latest versions of the anti-virus/ OS patch running on their systems. You thought all this is possible only with wired networks?? Not any more.

Security: After authentication, all the wireless packets are encrypted end to end using 128 bit encryption technology making it difficult for any casual intruders to get in to your network.

Wireless Intrusion Detection/ Prevention Systems (Where dedicated access points can act as scanners for wireless threats) can identify and block a whole range of wireless attacks like:

1. Ad-hoc network
2. Mis-association of AP/Client to other network access points
3. Rogue Access Points detection and prevention
4. Multiple futile attempts to connect to the wireless network
5. Honey pot attacks/ Man-In-The-Middle Attacks
6. Denial of Service Attacks etc.

Branch offices and remote offices are also protected as the controller can form a Secure VPN tunnel between the HO and branch locations. Rogue Access Points and Laptop’s can be even located using location visualizers.

Mesh Connectivity: Now you can connect even the Access Points without Cables!!

Bandwidth Restriction per user/ per group: You can prevent a few wireless users from clogging the entire network by restricting the bandwidth available to them at any point of time. You can also reserve a minimum bandwidth to all the critical users.

QoS: Quality of Service through Traffic Prioritization: A centralized controller based wireless infrastructure can identify and differentiate between different types data packets and prioritize the critical traffic on the wireless network infrastructure – This is crucial for real time wireless traffic like voice, video etc.

excITingIP.com

In case you have any questions, you can contact us using the contact form or leave a comment below. You can also subscribe with your email address (on the right side of this site) to get notified (title and summary) when a new article is published on this site.

An Internet Leased Line is usually a dedicated line which offers direct connectivity to the Internet. This is done by connecting the nearest service provider nodal point and the customer premises with a dedicated copper line, optical fiber cable, radio links or any combination of the above.

While there are business broadband options available at pretty good price points, Internet Leased Lines are still preferred with a lot of customers for the following reasons:

• Internet Leased Lines offer same speed for both uploads and downloads (symmetric connectivity), while in broadband (through DSL technology) the speeds are always optimized for downloads and the upload speeds are much lesser. Symmetric connectivity is critical for applications like file sharing between two branches, hosting websites/ mail servers etc, video conferencing/ surveillance, voice over IP etc. all of which are used by medium and large businesses regularly.
• Generally, broadband connectivity is shared with multiple users in a locality. Broadband plans generally denote the best bandwidth that can be attained and not the assured bandwidth levels. But a 2 Mbps Internet Leased Line should give 2 Mbps of performance as it is a dedicated connection without any sharing.
• The backbone network and performance parameters (like latency, jitter etc) can be monitored in the case of Internet Leased Lines. So, it is easier to offer SLA (Service Level Agreements) to the customer and Internet Leased Lines generally come with an SLA. There are very few broadband plans that offer such performance guarantee. So, Internet Leased Lines are more reliable.
• There is a wider choice of bandwidth selection (64 Kbps, 128 Kbps,… 2 Mbps,… 155 Mbps etc) with Internet Leased Lines. With broadband, the selection is more restricted.
• Higher bandwidth (Greater than 8 Mbps) is possible only through Internet Leased Lines. That’s why it is the default choice for large organizations with hundreds of internet users.
• Internet Leased lines are provided through multiple media – Copper, Fiber, Radio links or a combination of the above. Optical media communication is more reliable and offers better fault tolerance/ performance/ monitoring abilities, especially for higher bandwidths.
• Internet Leased Lines come with unlimited usage plans which enables companies to add services like video, voice etc over IP in addition to the internet/ data connectivity. Most of the broadband plans offer usage based billing (based on the bandwidth consumed). Of course, there are unlimited usage plans with broadband as well.
• Internet Leased Lines offer a pool of permanent IP addresses which enables organizations to run their own mail servers, web servers and other applications.
• Internet Leased Lines offer better QoS (Quality of Service) when compared to broadband. So, it is more effective to run convergent services like voice, video etc. over Internet Leased Lines.
• Internet Leased Lines can be leveraged to form a Virtual Private Network across multiple branches more effectively than broadband connections.

Of course, broadband connectivity has its own advantages like lesser cost, wider reach, mobile internet access etc.  But the dedicated high performance Internet Leased Lines (cost of which is coming down every year) is the preferred choice for larger networks with a considerable internet user base.

excITingIP.com

You can click here to go to the home page or click on any category listed above to read some more informative articles. You can also contact us using the contact form or leave a comment below if you have something more to contribute.

Here is a small list of popular open-source downloadable (mostly free) technologies that help build/monitor enterprise/institutional networks:

Asterisk: Asterisk is a down-loadable VOIP Soft-switch. In other words, it is the IP PBX telephony software that can control all the phones in your company. You can connect IP Phones, analog phones, soft phones analog trunk lines (FXO, PRI etc), SIP trunks (Some of them may need hardware adaptors) and create a complete VOIP telephony infrastructure in your company. What’s more, there is no user based licensing and the number of concurrent calls it can handle is restricted only because of the hardware limitations. There are even predictive dialler’s based on asterisk that are available for setting up a call centre!

Zimbra/Mozilla Thunderbird/Evolution: Zimbra, interestingly offers a complete alternative to Microsoft Exchange when it comes to setting up an enterprise mail server. What more, you can use Zimbra’s own desktop client or more popular open source packages like Mozilla Thunderbird or Evolution instead of Outlook.

Linux: Linux, has been quite popular as the preferred operating system for enterprise servers. But the desktops were always on Windows/Mac. No other option? You would be surprised at how much functionalities are packed into some Linux based operating systems like Ubuntu (for example) that all you need to do is to install them (even as a parallel OS to Windows) and it comes inbuilt with most of the drivers required for immediate hassle free operation (Even my Samsung printer driver was in-built in Ubuntu!). With regular updates sent your way, its fast, secure, comfortable and best of all – free!

Openoffice: If you have not tried this, try it immediately. This is a perfect alternative to Microsoft Office. You can even save and read files in Microsoft Office formats. But I would love to see the day when .odt becomes the default format instead of .doc and files are sent across in that format. I have always wondered why people don’t use Openoffice! There is no reason not to!

OpenNMS/ Nagios: There are many open-source based softwares that monitor the performance of your network. I have named just two of them, and there are many more there on the world wide net. Some of them even offer GUI based network monitoring systems totally free of cost and with open source, you can integrate just about any program that allows you to do so – You have the source code!

OpenLDAP: Many companies already use LDAP directories to store the information about all their employees, their log-in credentials etc. OpenLDAP is the open-source based program that allows you to create such directoties whose elements may be dispersed around the world! Many network equipments (like Wi-Fi Controllers etc) can integrate and refer to such LDAP directories, which ensures that you don’t need to create seperate directories for each service you use on the network.

FreeRadius: A radius server is a AAA server which does Authentication, Authorization and Accounting functionalities. When you need to deploy an Radius Server for authentication, try FreeRadius. What more, they can fetch information/user-credentials from programs like the LDAP directories.

SpamAssasin: Email Spam is a pain area for most of the companies that use their own emal servers. Spam-assasin offers a specialist open-source based freely downloadable Anti-Spam alternative to most of the commercial programs available out there.

Xibo: Xibo is an open-source multi-display, multi-zone, fully scheduled digital signage solution controlled from a centrally managed web interface. Ofcourse, it is free to download!

GIMP: GNU Image Manipulation Program is an interesting alternative to Photoshop. If you don’t have Photoshop, and want a free open-source program like that, why not try GIMP? It’s supported by a huge community and has a lot of features that make it a professional software package.

Snort: This is the Open-source based Network Intrusion Detection system. There is even an Open source based UTM (Unified Threat Management) program called Untangle that offers many of the security functionalities required for enterprise networks as a single package (Combining various open-source network security technologies).

We are not saying that the above technologies are a breeze to install and maintain, but once you attempt to do all that you can learn much more than just installing an off-the-shelf commercially available products. Open-source alternatives are not always ‘Free’ when you consider the time and efforts required to implement them (in some cases), so you might as well consider hiring a professional to implement open-source network technologies. But the best bet is to implement and learn them all yourselves, even if that process takes more time.

And yeah, the spirit of open-source software is to contribute back to the community. That means, using opensource software is just the first step!

This is not an exhaustive list, and hence I will keep updating them. But if you know some open-source technologies that helps in building/maintaining enterprise networks, please do suggest the same in the comments section.

excITingIP.com

In case you have any questions, you can contact us using the contact form or leave a comment below. You can also subscribe with your email address (on the right side of this site) to get notified (title and summary) when a new article is published on this site.

Wired Options:

The best way is to use fiber cables between the blocks (assuming that a bigger premises has blocks seperated by more than 100 meters – if they are less than 100 meters, you can also use the Cat5/6 Copper UTP Cables).

The fiber cables can be laid in a star topology (as shown in the above diagram) where a central fiber distribution switch / distribution layer switch with fiber modules connect with fiber cables that go to the individual blocks where they can be terminated in the fiber module of a network switch or a media converter and then a LAN segment using a network switch/UTP cables can be created locally.

In some places, it may not be feasible to have the fiber cables running from a central location to all the individual blocks. In those locations, multiple interconnected star fiber networks (as shown in the above diagram) could be utilized, or the departments can be connected with one another directly by fiber cables (as shown below), which is called ring topology.

All the above mentioned topologies are expandable to accomodate more switches in the future.

If you do not want to lay expensive fiber cables/fiber modules for a particular segment, you can also extend the LAN by using a LAN extender pair. These are SHDSL/HDSL/VHDSL based broadband routers that can be configured to operate in the bridge mode. They connect to the LAN on either side through the RJ-45 interface/ Cat5/6 cables and they connect to each other using the copper single pair telephone cables which are cheaper to procure and lay. In many places, the telephone cable networks are already present. You can realize full duplex bandwidths of about 2 Mbps over a couple of Kilo Meters (this depends on the model) using such a set up (HDSL is different from ADSL as it provides equal bandwidth both upstream and downstream, which is better for extending a LAN segment). You can use DSLAM/CPE broad band equipments (Using ADSL2+) to create a complete LAN using existing telephone cables as explained in this post.

Wireless Options:

Wireless technologies today are not only used for Wi-Fi client access but are also used for backhaul/interconnectivity.

A wireless mesh network can be formed with dual radio / multi-radio access points where one radio in each access points connects the clients and the other radio connects neighbouring access points. A mesh architecture is shown below. The number of such wireless mesh hops is limited as the available bandwidth reduces by half with each hop.

For departments/LAN segments that need to be interconnected but are slightly far away, point to point wireless solutions are available. Basically, these outdoor access points are configured to operate in the point-to-point or point-to-multipoint modes and one such access point along with antenna/tower is required in each department/building which needs to be interconnected. They are generally kept over a tower so that line of sight is realized between the locations, for best performance. This set-up can be used to connect two offices that are even up to 50/60 Kilometers apart, provided that a line of sight can be established with a tower. A basic wireless point-to-multipoint architecture is shown in the below diagram.

Service provider options:

In many situations, it is not possible to extend a LAN across a big area as public roads/tracks might be crossing in-between or the locations to be interconnected might be very far away. In such places, the fiber networks of bandwidth service providers can be utilized. Basically it is a shared private network where a limited amount of network bandwidth and infrastructure (in the form of Leased lines, MPLS VPN, Internet leased lines etc) can be leased from the service providers (Usually they charge per Mb per year). In certain areas, metro ethernet might be available where the service privider has the infrastructure to connect two locations of a same branch located in different places at speeds of 10/100 Mbps using his public network infrastructure. This is also provided on a leased basis.

VSAT connectivity is a satellite based connectivity that can be utilized to connect remote locations that are not accessible by wireline/wireless internet/connectivity options. Some examples where such VSAT connectivity can be used are hill tops, ships etc. In branch offices and SOHO type of offices, even broadband/3G internet connectivity can be used to create a small LAN segment. But it is advisable in such situations (where LAN traffic is going through a shared network like Internet) to use VPN tunnels/Encryption between the sites.

So, do you think there are more innovative ways of extending a LAN? Do contribute your suggestions in the comments section below.

excITingIP.com

Related reading: Components of IP Video Surveillance

What is Snort?

Snort is an Open Source Intrusion Detection System which can be downloaded free of cost. It is a software package which needs to be installed (along with other software in many cases) in a standard server which acts as the sensor. For a small company with single Internet/leased line connectivity, a single instance Snort implementation next to the router might be enough but for larger company, it is better if the network is monitored in multiple places (possibly at every point of entry/exit and in the individual network segments) by using an IDS like Snort. When Snort is set up, it can either passively monitor the network for threats (using signatures, patterns of known threats) and log the network activity for the security administrators to have a look later on or it can generates alerts (through emails, pop-up windows, SNMP traps etc) for instant notification of the administrators when an activity closely resembling to a known attack signature is found.

What are the Components of Snort?

Snort is logically divided in to the following five major components.

¤  A Packet Decoder is the first component which collects packets from different network interfaces and prepares the packets to be preprocessed.

¤ The second component, Pre-processors are used to arrange and modify packets before being analysed by the detection engine. There are pre-processors that detect some basic anomalies by de-fragmenting packets (which are fragmented by hackers as a method of deception), HTTP URL Decoding (If hexadecimal characters are used by hackers as a method of deception). There are pre-processors that detect and log port scanning activities, detect anomalies in ARP packets (to identify ARP spoofing), etc.

¤ The third component, the Detection engine is the heart of Snort. Its responsibility is to analyse all the packets passing through it for signs of intrusion by using certain pre-defined rules.  It can dissect a packet and apply rules to different parts of the packet like IP header, transport layer header, application layer header and packet payload.

¤ The fourth component is the Logging and Alerting System – Upon the detection of intrusion by the detection engine, either the activity is logged for the perusal of the network engineers or an alert is generated.

¤ The fifth component, Output modules or plug-ins are used to control the type of output produced by the logging and alerting system. Some of its functions may be generating log reports, logging alert reports in a file, sending SNMP traps, logging in to a database (like MySQL), sending a message to Syslog server, etc.

In some installations, some additional tools might be used along with snort like MySQL database to log the alert data, Apache could act as the web server, PHP could be the interface between the web server and MySQL database, a PHP package like ACID could be used to view and analyse Snort data, etc.

What are the different installation methods with Snort?

If it is a very small organization, just a single sensor (on a PC/Server) will do (Of course, with a pre-installed Operating system). This, when put up just behind a router or firewall (in single Internet line scenarios) would generate alarms if any intrusion activity is found. For slightly bigger organizations, Snort could generate alarms and send it to an NMS (Network Management System) that they might be using, provided they support SNMP traps, which most of the NMS vendors do. Snort could also be configured to integrate with a database (like MySQL, which stores the Logs), and a web interface (through PHP) could be provided to view the required data from the database. This is a more structured way of using and retrieving log information. For small organizations all these three components could be in the same server too.

In the case of a bigger organization with multiple locations, Snort might be needed to be installed in multiple locations. Maintaining and managing multiple databases in this scenario is difficult. So, multiple sensors of Snort could be configured to the same centralized database from where the logs could be viewed.

Network Sniffer Mode:

If Snort is configured to operate in the network sniffer mode, it logs all packet data in to the database or in binary/text files. Some of the information that is available to the network administrators are: Date and Time of capture of packet, Source IP address, Source Port number, Destination IP address, Destination Port, Transport Layer protocol used, TTL/TOS/Packet ID values, Length of IP header, IP Payload, TCP header length etc.

Network Intrusion Detection Mode:

In Network Intrusion Detection mode, Snort logs only those packets which match a certain rule (pre-defined attack signatures) and generates alarms. Common rules (signatures) can be obtained from the installation files itself, and new rules keep updating regularly. These alerts can be of different categories like high priority, low priority etc and for each category, different actions can be taken. Snort itself maybe configured to operate in stealth mode where the presence of an IDS machine is not visible to intruders (One way is to not configure any IP address for the Snort sensor server).

Based on the Snort rules, a Snort sensor can take various decisions like ignoring a packet (passing them), log a packet, generating an alert, activate another action after generating an alert, or take a user-defined action like sending messages to syslog, sending SNMP traps, logging data as xml files or do multiple such actions at the same time. The standard Snort rules can also be changed as per the network conditions.

There are a lot of categories of rules written for Snort and an example could be a rule written to generate an alert if a user tries to ’su to root’ through a telnet session or generating an alert for incorrect login in a telnet session.

Snort can be downloaded free of cost (along with the rules, manuals) from the Snort website and some good information regarding the installation and usage is available in this book.

You could also click here to read an overview of IPS – Intrusion Prevention Systems and types of network threats

excITingIP.com

In case you have any questions, you can contact us using the contact form or leave a comment below. You can also subscribe with your email address (on the right side of this site) to get notified (title and summary) when a new article is published on this site.

What is an Electronic Document Management System and why is it required?

A document is any readable material that is used for business processes. Documents can be in multiple formats – printed pages, word processing documents, spread sheet, fax, presentation documents, photos, internet pages, medical images, AutoCAD drawings etc. We are handling more of electronic documents these days and then converting it to paper based documents, where required, by printing them. What if the entire process can be handled electronically without having to use papers at all? Then comes the storage and retrieval of such printed documents – it always happens that the most important file we are looking for is always not available (like a copy of a purchase order/ invoice etc). So, if all the important documents are stored electronically, it would be much easier to locate an important document that we may want to reference at that instant. And then comes the electronic documents (like word documents, power point files, auto cad files, emails etc) – If the critical electronic documents are also indexed by a central document management system, they could also be searched using some keywords in their contents, tags like date of creation, person who saved etc.

So, basically an electronic document management system refers to the creation, capture, organization, storage, retrieval, manipulation and controlled circulation of documents in electronic format.

The advantages of electronic document management systems are numerous. Some of them are given below:

¤ The documents stored in EDMS can be easily searched and viewed from any computers ensuring their instant and fast access/availability.
¤ As the printed documents are scanned, they would retain their original look, colour etc.
¤ Optical Character Recognition technology is useful to digitize the entire text of a document and allows the users to search using any textual term contained in them.
¤ Documents can be quickly shared for collaboration on the network.
¤ Electronic documents can be stored in multiple places (useful for disaster recovery).
¤ The real estate costs of storing paper based documents is reduced.
¤ Internal processes like approvals etc. can be done faster as most of the companies are multi-location based and it would take a long time to send and get back individual documents.

Creation/Capture/Organization:

A document management system consists of an imaging server which contains the EDMS software that allows to store, retrieve and access documents based on any combination of indexes, text (if the scanned documents have gone through an Optical Character Recognition process). EDMS generally use database management systems like MySQL, Oracle etc to store and organize the documents. Some EDMS can be integrated with the existing database system used by the company.

People are also an integral part of the Document Management System as they have the knowledge about the type of documents, how to segregate them in to various groups, how the communication lines flow and take decisions as to which processes/work-flows need to be automated. Equally important is the business processes which define the organization and the flow of documented information between people within and outside the organization.

Printed documents are generally scanned by using specialized high volume scanners or certain Multi-Function Printers/Copier’s etc which can be integrated with the document management systems. These documents are indexed using certain parameters like date of creation, person who created, time of creation etc, and they can be organized in to related groups of folders.

Some EDMS allow automated capture and storage of incoming/ outgoing email messages and their attachments in to the document management system folders so that they can be stored and accessed whenever required.

Storage and Retrieval:

The electronic documents are generally stored in servers and other permanent storage. The current documents (that are used frequently or recently at that point of time) can be stored in a server/ hard disks and the archived documents can be kept on tape drives, CD’s, DVD’s, Storage Area Networks, CD/Optical Jukeboxes etc. Mostly the documents are stored in pdf format (scanned ones) so that they can be instantly accessed, viewed and searched from any PC/workstation.

Generally, some security features are applied to the accessing of the documents to control which users can access which documents at what times. And only one user is allowed to modify a given document at a point of time (as the documents can be accessed by multiple users at the same time).

EDMS allow locating/searching documents based on the text they contain (if the scanned pages have gone through an OCR) or through any of the indexed parameters. Some times, compression mechanisms are applied to images before storing them in order to reduce the disk space required for storing them.

Some EDMS softwares allow the search module can be integrated in to the existing software applications that the employees use on a daily basis like CRM/ERP modules etc.

Manipulation and Controlled Circulation:

The EDMS check if the stored documents have undergone any changes and intimate to the respective personnel concerned when some changes happen to important documents before saving them. Some times, approvals might be needed to be obtained before saving the changes to the saved documents, and EDMS allow to do the same.

One of the biggest advantages of EDMS is to quickly share the documents over the network (Internet/Intranet). Another important function of EDMS is to apply work-flow routing to the documents. All companies have some processes where important tasks are required to go through multiple approvals. An Electronic Document Management System automates this process and lets the  personnel to give approvals over the network. You could imagine how much time a manual system of approvals would have consumed with printed paper and multi-location offices.

Some EDMS can also be integrated with the web and the documents can be presented to the user via a normal browser and displayed as dynamically generated HTML pages.

excITingIP.com

In case you have any questions, you can contact us using the contact form or leave a comment below. You can also subscribe with your email address (on the right side of this site) to get intimated when a new article is published on this site.

What is an Intrusion Prevention System (IPS)?

An Intrusion Prevention System is a network device/software that goes deeper than a firewall to identify and block network threats by assessing each packet based on the network protocols in the application layer, the context of the communication and tracking of each session.

A network based Intrusion Prevention System sits in-line on the network monitoring the incoming packets based on certain prescribed rules (which can be tweaked by the security administrator) and if any bad traffic is detected, the same is dropped in real-time. It is useful to detect and prevent attacks like DoS/DDoS attacks, brute force attacks, vulnerability detection, protocol anomaly detection and prevention of zero day unknown attacks. IPS technologies are mostly session based and traffic flow is examined based on session flow.

What are the ways in which Intrusion Prevention Systems work?

Signature based threat detection: Intrusion detection/prevention systems contain a large repository of signatures that help identify attacks by matching attempts to known vulnerability patterns.

Anomaly threat detection: Anomaly detection techniques protect against first strike or unknown threats. This is done by comparing the network traffic to a baseline to identify abnormal and potentially harmful behaviour. They basically look for statistical abnormalities in the data traffic as well as protocol ambiguities and atypical application activities.

Passive Network Monitoring: IPS can also be set to passively monitor network traffic at certain points and identify abnormal behaviour/ deviation of certain security threshold parameters and report the same by generating reports/alerts (like email alerts) about the device communications to the security administrator.

What are the important IPS performance metrics?

IPS performance metrics are measured in terms of:

¤ Dynamic alerting capability
¤ Lower false positives
¤ Threat blocking capability
¤ High availability/ redundancy/ speed of working
¤ Ability to correctly identifying attacks and dropping packets accurately

Some IPS solutions offer the flexibility to implement different protection options (rules) for different segments of the networks, which is especially useful for large networks. Some of them are capable of isolating the attack traffic to a network segment and limiting the bandwidth to reduce the effect of network threats. IPS help identify and mitigate the following types of network threats.

Types of Network threats:

¤ ICMP Storms: High volumes of ICMP echoes may indicate maliciously intended transmissions such as scanning for IP addresses etc.

¤ Ping to Death: A ping command is sent across a network to determine if another computer is active. This ping command can be misconfigured by a user to send n unusually large packet of information to the target computer, which might cause it to crash or go down temporarily.

¤ SSL Evasion: An attacker tries to bypass the security device by launching attacks using encrypted SSL tunnels as these are not verified by the security devices.

¤ IP Fragmentation: Programs like Flag route intercepts modifies and rewrites egress traffic destined for a specific host thereby perpetuating an attack.

¤ SMTP mass mailing attacks: SMTP DoS attacks from malformed email addresses causes unnecessary load on mail server.

¤ DoS/DDoS attacks: Attackers launch an attack on enterprise network server by flooding it with a high number of connection requests which appear genuine to the server. If the number of such connection requests exceed the server request rate, it would prevent the genuine users from accessing the server. This is called a Denial of Service (DoS) attack. In a Distributed Denial of Service attack, attackers place malicious code on lot of individual computers and use them to simultaneously launch DoS attacks from various locations.

¤ SYN Flood attacks: Attacker sends a lot of ‘Please start a communication with me’ packets to a server but doesn’t send any follow up packets, thus wasting the memory resources that were allocated for these requests by the server.

¤ Http obfuscation: A number of attacks on web servers are carried out by obfuscating URL characters (like using hexadecimal numbers, for example) which gives unwarranted access the attackers.

¤ Port Scanning: This is an attempt by the attackers to find out which ports are open on a specific host or multiple hosts on the network by scanning different ports. Once this information is obtained, attacks for known vulnerabilities for these services are tried.

¤ ARP Spoofing: An Address Resolution Protocol (ARP) is used to find a MAC address in a local network, when its IP address is already known. A sending host usually broadcasts an ARP packet (request) on the network requesting the MAC address of the host with a particular IP address and the same is sent back. By spoofing fake ARP requests from outside the network, the network traffic is redirected to some other location with the information that might be useful to the attackers.

¤ CGI Attacks: It is possible for remote attackers to submit a malicious web request containing Shell meta characters (such as ‘|’ etc) to execute arbitrary commands on a host running vulnerable CGI script. If these commands are executed, an attacker can gain local or interactive access to the host.

¤ Buffer Overflow attacks: A buffer overflow occurs when a program or a process tries to store more data in a buffer than it was intended to hold. This additional data can overflow into certain buffers and can contain code to make specific actions to damage the user’s files, for example.

¤ OS Fingerprinting attacks: OS Fingerprinting is a process of learning which Operating System is running on a device. Based on that information, a hacker can perform a reconnaissance process on the network prior to launching an attack. The vulnerabilities of certain Operating Systems are exploited with this information.

¤ SMB Probes: A Server Message Block (SMB) protocol operates as an application layer network protocol mainly used to provide shared access to printers, files, serial ports etc. SMB probe attacks involving file sharing or print sharing in MS Windows environment focus on scenarios where users put SMB protocol to work across different subnets across the internet.

Click here to read about an open source intrusion detection system called Snort

excITingIP.com

In case you have any questions, you can contact us using the contact form or leave a comment below. You can also subscribe with your email address (on the right side of this site) to get intimated when a new article is published on this site.