Network Lag…

Recently I received a call from an IS manager who described with great anguish, his local network lag time. He reported to me that his client’s access to a local file server was jaw droppingly slow. He went on to tell me that after checking the configurations of the switches and the file server, he did not see any irregularities. He could access other servers on the same network segment but for some reason he was having issues with this particular server.

Here is a visual:

As you can see I ran traces on the different network segments and I focused most of my attention on the file server/ media convert/ switch. I did not find any configuration issues with any of the network equipment and the file server seemed to be doing its job. After running the traces I did notice that packets were being dropped at the file server and runts were being detected.

In my experience physical connections/hardware or configuration is the leading cause of dropped packets. Since my customer thoroughly checked his hardware, the configuration piece could still be a problem. Looking back at my traces, there is one segment that could still be misconfigured. The inbound switch and the client computers.

…Conclusion

As you might expect, there was a configuration issue but it wasn’t as obvious as you might think. The clients were set to auto negotiate and the switch was hard-coded at Full duplex, the Windows clients could not negotiate a duplex with the switch and subsequently defaulted to half duplex, creating a mis-match.

Because of the duplex mismatch, packets were being dropped and therefore never made it to the File Server for acknowledgement.

The dropped packets caused retransmissions from the client, which resulted in huge network latency directly effecting the end-users.

To correct the issue the configuration of the client or the switch will need to be modified to allow proper duplex negotiation.

OSI Review

OSI Model

The OSI isn’t a physical model, rather, it is a set of guidelines that will allow many different operating system platforms to transfer data over a network. The OSI has seven different layers and is divided into two groups. The top three layers (5-7) are used to communicate with the application and the end user. The bottom four layers (1-4) define how the data is transmitted from node to node. The OSI model is a hierarchical structure that consists of seven layers all of which define the requirements to communicate over a network. Because the OSI model is layered, each layer operates independent of the other, this is ideal for implementing new technology without interruption. For example, a packet filter.

OSI Layers

(Layer 7) Application Layer

This is the layer where the users actually communicate with the computer. A great example of someone using the application layer is when you use a browser to access the internet. Every time you click a link or enter a search in a search engine, you are giving a set of parameters to be used to access your network.

(Layer 6) Presentation Layer

The Presentation Layer modifies the data from the Application Layer to be used effectively by all of the other layers. It also translates your incoming network requested data into a useable form for your application.

(Layer 5) Session Layer

The session layer controls sessions between nodes (computers) across a network. It establishes, manages and terminates connections between applications.

(Layer 4) Transport Layer

The Transport Layer allows the transfer of data between end users. It is responisble for end-to-end error recovery and flow control.

(Layer 3) Network Layer

The Network Layer allows the data to be routable through many different physical networks and provides a means for transferrring variable length data sequences.

The Network Layer is responsible for:

addressing

determining routes for sending

managing network problems such as packet switching, data congestion and routing

(Layer 2) Data Link Layer

The Data Link Layer provides the physical transmission of the data and handles errors in the physical layer. The Logical Link Layer (LLC) is responisble for frame synchronization, flow control, and error checking. Most importantly this layer encodes and decodes data packets into bits.

(Layer 1) Physical Layer

The Physical Layer defines the physical medium and electrical specifications of a network. The Physical Layer is responsible for the transmission of raw bit streams and defines the techniques to transfer the bit stream through cable.

Quick Internet Troubleshooting

Troubleshooting Your Internet Connection

 

The following is a quick reference to help you troubleshoot your internet or LAN connections. This quick guide is only a general home based networking reference, specific issues may need more advanced troubleshooting techniques. This guide assumes that you have a broadband connection with a dynamically assigned ip address, if you are not sure if our ip address is dynamically or statically assigned please consult your ISP. This article addresses connection issues resulting from wired and wireless network problems.

 

1. Decide whether it is your wireless connection (router) or your internet connection (modem).

• on your wireless computer make sure your wireless signal notification icon has full signal

• on your desktop computer or a computer directly connected to your router, try to access the internet

2. If you cannot access the internet on both wireless and non-wireless machines you may have an internet (modem) problem.

• without turning anything off, unlplug the RJ45 (ethernet) cable running from your computer to your router (at the router end)

• now plug the cable in from your computer directly into your modem

• wait a few minutes (you may also need to restart your desktop computer or simply repair your internet connection), now try to access the internet

3. If you cannot access the internet directly connected to the modem, you could have a modem problem.

• unplug the power to your modem, wait 30sec and plug back in … try to access the internet

• if restarting your modem does not work, call your ISP, the network may be down

• at this point you may want to check your ip configuration, in a command prompt type “ipconfig”. If your ip address is (0.0.0.0 or starts with 169.x.x.x) then you do not have a valid ip. Your ISP will need to know this information.

4. You can access the internet directly connected to the modem OR you can access the internet from your desktop machine which is connected to the router.

• you could have a wireless communication problem between your router and your wireless enabled computer

• unplug your desktop machine from the modem and return the connection backto your router (your normal configuration)

• restart your wireless router by unpluggin it, waiting 30sec and plugging it back in, during this time restart your laptop

• try to access the internet from your laptop (through your wireless connection)

• if you are still not getting signal, you are not “associated” with the router and will need to make some changes

• navigate to Start> Control_Panel> Network_Connections> Wireless_Connection> Properties> Wireless_Networks> select your networks SSID (or name)> Properties>

• once their you will need to re-enter your password or key for the WPA-PSK/WEP encryption scheme, to Apply> hit “OK”

• wait a few moments … your connection should establish

5. You still cannot connect wirelessly.

• their maybe a problem with your wireless router configuration

• you will need to take approximately the same actions as step 4 but for your router

• from your desktop open an internet browser and type your wireless router’s IP address (i.e. 192.168.1.1) in the address bar

• you will need to login with your username and password, if you have never changed this option it will be the factory default username and password

• navigate to your wireless options where you are able to select “encryption”

• you should see options for WEP, WPA-PSK, or none, select the appropriate security method. You may now need to re-type your password or key (the same one you typed for your wireless enabled computer)

• save your settings and make sure your “SSID” is set.

Your wired and wireless network connection is now through the first and the most common steps of troubleshooting. If problems still exist at this point you may need to call a computer technician for more specialized troubleshooting.

Ethernet Pin-Out Guide

RJ45 (ethernet) Pin-Out guide

How to wire a 10BaseT or 100BaseT connector with Category 5 cable and RJ45 connectors using USOC 568B wiring standards.

	EIA/TIA 568B (straight through cable) Wiring Standard
PIN	Wire Color
1	White/Orange Stripe
2	Orange
3	White/Green Stripe
4	Blue
5	White/Blue Stripe
6	Green
7	White/Brown Stripe
8	Brown

	EIA/TIA T568B (crossover cable) Wiring Standard
Pin (End #1)	Wire Color	Pin (End #2)	Wire Color
1	White/Orange	1	White/Green
2	Orange	2	Green
3	White/Green	3	White/Orange
4	Blue	4	White/Brown
5	White/Blue	5	Brown
6	Green	6	Orange
7	White/Brown	7	Blue
8	Brown	8	White/Blue

Use the follwing diagram for pin referencing.

Securing your Passwords

Password Security Explored

In this article we will discuss the security issues surrounding passwords. We will show how passwords can be compromised, how to ensure you maintain a good password set, and we will provide links to tools that can be used to audit your passwords’ effectiveness.

A password is usually the first and sometimes the only security defense guarding sensitive data. With all of the modern tools and technology that your business or home network may employ, the password can act as a “window” in a largely inpenatrable fortification. As a systems administrator, I feel that a compromised password may not be a top priority for your IT staff. Large and mid-size companies have other measures in place to protect the sensitive corporate data. A compromised password may effect you more personally though. Because your password is the primary security measure in place, if someone can gain access to your password(s) they can have access to all of the information that password protects. In most cases a person’s password is the same from business to home, which can translate to total access of your personal information. The intruder could then gain access to your business/personal contacts, they can run malicious programs that “sniff” out other passwords (i.e. email, financial) and they can do all of this undetected because you have no way of knowing your password has been stolen.

Password security, like network security, is more of a philosophy. For your password to help protect you, you must help protect your password.

First let’s discuss choosing a password. Since a password is so important to your overall security it should not be chosen in haste. I would highly recommend using a password generator. Password generators create a random password that consists of letters, numbers and symbols in no distinguishable order. These generators can be downloaded to your computer or usb drive, there are also some on-line password generators. At the bottom of this article I will provide links to some well known password generators.

If you choose to create your own password you should keep the following in mind:

• Choose a seemingly random set of letters, numbers and symbols while varying the case. (i.e. TXUu39!Q$66)

• Choose a lengthy password roughly between 8 and 12 characters

• If you have many password protected accounts, choose a password that can be decramented. (i.e. TXUu39!Q$66 -yahooID, TXUu39!Q$65 -googleID, TXUu39!Q$64 -workID)

• Which brings me to my next point … pay attention, this is important … Do NOT use a universal password! If the password to your workID account is compromised then all of your accounts have been compromised. You don’t use the same key for your house, car, and lockbox, do you?

• Finally, memorize! Don’t write your password(s) down and don’t write down an obvious hint. Simply say your password in your head for a while and memorize it.

Next, let’s take a look at what the Bad Guys are doing to compromise your passwords.

Most people today that have a computer also have some sort of Anti-Virus software installed. This software protects you from a variety of viruses and malware programs, including some of the favorite programs used by attackers … Keyloggers. These nifty little programs contain a very small footprint on your system resources and can run in the background collecting all of your keystrokes, web pages visited, and sometimes programs launched. Keyloggers are definitely one of the best ways to spy on a user or set of users on a computer. Keyloggers do not have to be programs run on your machine either, attackers can actually attach a hardware keylogger to the back of your computer (plugged directly into your keyboard port). Needless to say not many people (at least marginally sane people) check the back of their computer everyday for keyloggers! Other methods of obtaining your passwords can be a little more sophisticated, like: wireless traffic sniffing, dictionary attacks, man-in-the-middle attacks, memory image forensics, and much more!

By this point you are probably getting a little paranoid, if you’re not then you should be. These methods I just mentioned and the tools that employ them are being distrubuted over the internet freely and for the use of many different skill sets. Some of these hacking tools have become as easy as clicking a button. So you might be asking yourself, “How do I protect myself from these types of attacks?” The short and disturbing answer is “you can’t”, but that is a result of only the most determined attackers. For the casual kid in the basement attack there are some things you can do to protect your passwords.

Here are a few:

• Create a good password (as mentioned above)

• Don’t share your password with ANYONE

• Change your passwords regularly

• For those of you afraid of keyloggers, try filler characters. If you are entering your password “flower81″ start by typing “fl” in the box, then click away and type rubish “asdkf;lkj” then click back into the box and finish with “ower81″. If a keylogger is present your password will look like “flasdf;lkjower81″.

• Do not go to sensitive areas (like bank websites) when you are unknown or “coffee shop” networks.

• Always look for the “https” or secure lock icon on your browser when entering sensitive areas. (Https means your communication is encrypted)

• Always lock your computer or laptop before leaving it.

• Don’t use important dates or names for passwords.

• I’m going to push this one again … Memorize your passwords!

Following these rules can help deter attackers and help protect you from potential headache or worse, Identity Theft!

As I promised, here are a few links to some great password applications.

Online password strength tester: Microsoft Password Checker

Online password generator: www.techzoom.net/security-password.

Password generator and safe: Keepass (Highly recommended!!)

Secure your communication: PGP

Secure your data: True Crypt

Enjoy!

Faster Windows Shutdown

Faster Windows Shutdown with a Simple Download

If you are a Windows user you have certainly noticed that it can sometimes take a very long time to do something as simple as shutting down your computer. This article will explain why a shutdown can take so long and what Microsoft has done to fix the problem.

In an earlier article I explained why the Windows boot process can eventually become a several minute ordeal and how the prefetch cache plays an important role. Now with a simple download Windows has fixed the problem of shutting down your computer.

When you click Start> Shutdown to turn off your computer you are also telling all subsequent programs to close. For any operating system to properly shutdown it needs to sync the disk and flush all program memory. If an application is still open or did not close with the proper exit status, it is in a sense “hanging” and still partially resides in memory. These programs can become a nuisance when you need to shutdown because Windows will try to unload the profile until it eventually “times-out”. Waiting for the time-out is why shutdown times become annoying.

To address this issue Microsoft has developed a free utility that automatically cleans the user profiles and prevents the “time-out” wait. This utility is packaged in an installer and runs as a service. It will continually monitor users to log off and will reclaim those unused resources.

After the User Profile Hive Cleanup Service is installed, the next time you logoff or shutdown your computer it should be within seconds.

Protect your Wireless Network

Old Wireless Router = Security Decoy

Many people today have switched from their old 802.11B wireless routers to an updated 802.11G. Considering that wireless G has a greater range and faster transfer rates many people have decided to ditch their old wireless routers. Well, don’t throw that old wireless router away just yet. You can use this old router to confuse and deter would-be hackers and wardrivers. If you have recently purchased a router (depending on the model) you have probably noticed an SSID option. Your SSID is simply the name you give to your wireless access point. For example, Linksys routers have a default SSID called “Linksys”. This means when you search for wireless networks you will see an access point based on their SSID name.

If you haven’t figured it out, having an extra wireless router can offer a special network security benefit. You can use your old wireless router by applying power to it and positioning it next to a window or outside wall. The old wireless router will act as a network decoy to the would-be bandwidth moochers or network attackers. They will see the stronger wireless signal and think they are connecting to your network, when in fact they will not be connecting to any part of your network.

Further Security Details

Your main wireless router should have some security features already in place. At minimum, those features should include:

• Encryption (WPA-PSK or WEP)

• SSID Modification

• A Router password

I will explain in a later Article how to apply encryption to your wireless network but for now know that if you have the choice between choosing WPA-PSK or WEP, choose WPA-PSK. WPA-PSK is easier to use and offers much better security features. (Do not use encryption on your decoy wireless router. We want people to be able to connect to the decoy with little or no effort.)

What is meant by SSID Modification? Simply put, you need to change your default SSID to something uninformative and mildly obscure. If your router gives you the option to turn off your beacon or turn off your SSID broadcast, then you should definitely employ this option. Let’s say you live in a neighborhood or an apartment complex and you choose your SSID to be “The Smith Family” or “John’s Network”, everyone who is in proximity of your wireless signal will see this description. Most hackers and attackers want to gain something from their efforts, so if you choose a descriptive name associated with your home or your person, hackers now have a target. (This precaution should also be taken for the decoy wireless router. You do not want to announce your location or the fact that you are hosting a wireless connection to anyone.)

Finally, you need to set an “Admin” password for your wireless router. In many cases, when you buy a wireless router there is no password set or it is manufactured with a default password. If a new password is not set, anyone that can connect to your router can also make changes to your router settings. If this happens, many critical security issues can arise and a more sophisticated hacker could forward all the information you send to and from other computers (i.e. bank servers) through his machine first. This is known as the ‘man-in-the-middle’ attack and your most secretive information can be compromised. Here is a bit of proof that your default passwords are not safe. It is also one more reason to change your default SSID, if I was connecting to a “linksys” router I would use this list to locate a linksys default password. (This precaution should be taken for the decoy wireless router as well, if someone could log into your decoy router they could easily find out that router’s purpose in your home.)

Re-Cap

You can use your old wireless router as a decoy for would-be hackers and bandwidth pirates.

First, you must secure both routers in the following manner:

• Main wireless router should employ at minimum:

• Encryption (WPA-PSK or WEP)

• SSID Modification

• A Router Password

• Decoy wireless router needs:

• SSID Modification

• A Router Password

Second, your decoy wireless router should be placed next to a window or outside wall and should ONLY have the power connected to it.

Finally, …monitor. Depending on your decoy router features you may be able to log the number of computers that connect to your decoy. If not, you can always monitor by logging into your decoy and looking at your LAN status. By monitoring the number of people that connect to your wireless decoy you can effectively gauge the traffic and potential risk you assume when you host a wireless network.

Protecting your Identity

Identity Theft

Protect whats yours, don’t be another statistic.

” To secure your identity is to alter your way of thinking, a cautious and inquisitive mindset will help you protect your personal identification. “

What are thieves looking for? - Identity theft is almost always a crime of opportunity.

• Account Information. (i.e. numbers, maiden names, card types, pin numbers, exp. dates)

• Social Security Numbers.

• Drivers License.

These are the three basic needs of any identity thief, however, it is important to note that any one of these may lead to troubling times. Identity theft is becoming easier and more abundant because thieves are using the internet to exchange information and sell your identity.

Ways your identity can be stolen. - Most people don’t know their identity has been stolen.

• Internet Phishing Scams - Rouge websites posing as valid sites to gain your account information.

• Credit Card “Skimmers” - Small devices that can scan a credit card and retrieve all needed information from it. This can be used to duplicate credit cards.

• Phone or Email Inquiries - Someone calling or emailing you wanting you to verify account information.

• Computer “Hacking” - Hackers these days are not looking to just mess with your internet site or steal your meeting minutes, hacking is big business, they want some reward for their effort. It is more likely if a hacker is attacking you or your company they know what they are looking for and they know it will produce some value for them. Internal computer hacking is a much bigger threat than a random person on the internet.

• Your Person - You are sometimes the primary cause of identity theft. Keep only the nessacaties in your wallet or purse. Be conscious of your surroundings and your situation. Don’t be quick to give out information just because they ask for it. (i.e. You don’t need to give out your phone number to buy some batteries!)

Analyze the way you think, be conscious of your situation and only give out information if it is necessary. Be proactive in protecting your identity, practice it, and make it routine.

How you can protect yourself.

• Ask Questions - Don’t think that the phone company needs your social security number, ask them why. Some compaines such as financial institutions need it to run a credit report, other compaines gather this information as a convenience or for their own account verifications.

• Keep a separate CC for online purchases - I recommend that everyone has a separate card with a small limit, strictly for online purchases. If your card number is ever stolen, you know your purchases and your card limit will not effect your credit score.

• Have an IT professional help secure your network - An IT professional will be able to find security holes that you may not be aware of, remember it is their job to stay current with technology.

• Internet Consciousness - Don’t reply to rouge emails, watch out for insecure websites. If you are making a purchase or checking your account information make sure the site is secure (https://) and there is not a certificate violation.

• Check your financial records - Check your bank statements each month, look for unusual purchases. Online banking has made it easier to check your purchases with real-time updates. Be aware of your credit score, monitor it regularly, monitor it regularly, monitoring does NOT lower your score.

• Protect your documents - Keep your important documents in a secure place, like a lockbox or safe. Destroy your mail, shred any evidence of your existence in your mail. Don’t let a dumpster diver find you. Secure your laptop and thumbdrives, these portable devices can sometimes contain very personal information about you or your company, make sure they are readable by you only.

” There are an infinite number of ways your identity can be compromised, protecting it starts with you. “

10 Ways to Secure your Computer

Top Ten Ways to Secure Your System

1. Use anti-virus software and update it regularly.

If you have a PC, antivirus software is a must. Many companies offer antivirus software and some are even freely downloadable.

2. Keep Windows and your other software current.

Keeping your OS and your software up-to-date is crucial. Many patches and vulnerabilitie fixes that can pose a major threat to your software are offered through updates.

3. Strengthen your passwords.

Creating a hard to guess password is, in most cases, the first and only line of defense against an attacker. Try not to use passwords that have significant value to you. There are many random password generators on the web, but if you create your own then be sure to use letters, numbers and some special characters.

4. Enable your Windows firewall or a third party firewall.

Firewalls are used mostly to block ports and malicious internet requests. In most cases using a firewall will hide your existance on the internet from would be attackers. If you use a router you already have a firewall.

5. Use anti-spyware software.

If you are an internet web surfer then you need anti-spyware software. Spyware programs are the annoying programs that tend to make your internet experience and your computer slower. Collecting a bunch of these programs could lead to an alomost worthless computer. There are many free anti-spyware programs on the web.

6. Be cautious of installing computer software from unknown sources.

A big portion of the spread of viruses and spyware today is due to users installing software they “found” on the internet. While the software may look appealing and useful, it may contain viruses and malware code.

7. Be cautious of downloading email attachments from unknown sources

Another great way to transmit viruses and worms is by downloading email attachments from unknown sources. Rule of thumb: if you are not expecting an attachment, don’t open it!

8. Encrypt or password protect your files.

This is especially true if you own a laptop or a thumb drive. A great way to do this is by downloading the free software called True Crypt. I use it and it works great!

9. Secure your wireless connection.

If you are connected to a network wirelessly this step is a must. Without wireless security features such as WEP or WPA-PSK, you are leaving your internet transmissions open for capture. That’s right! By not using wireless encryption methods, hackers can use techniques to “listen in” to your internet browsing. They can gain passwords, account numbers, and other personal information.

10. Back Up! Back Up! Back Up!

I hope we got our point across. Back up’s are extremely important and can save you from a major headache and heartache. Just think of your impressive music collection or all of your priceless family photos … gone in a flash! If just the thought of this doesn’t set you running for an extra hard drive, then the what about all those hours of financial data you’ve set up in Quicken or Money? Your best bet is to find a back up solution and stick with it, trust us.

Unleash the VPN within.

Secure Remote Connection

Connect to your Windows XP computer using VPN

Have you ever gotten to meeting or drove three hours to your family function, only to realize you forgot your presentation or digital photos? If you have ever wished you could access your home documents from work, school, or a friends house then you should definitely check out the VPN capabilities Windows XP already has.

A Virtual Private Network or VPN is simply an encrypted connection between two remote computers or networks. There are many ways to accomplish setting up a VPN, but few know that Windows XP actually has a built-in VPN server. Having a VPN server will allow you to establish a secure connection to your home computer, this is more than just accessing your home computer you can access your entire LAN from IP Cameras, printers, or storage servers. This means that the remote computer will be virtually connected to your LAN, don’t worry though, because it is a Virtual Private Network so your connection is secured by encryption.

This article will show you the exact method of setting up your regular Windows XP machine into a fully functional VPN server.

XP VPN Set-Up

I will break the set-up into steps…

Step 1 - Go to Start / Settings (or Control Panel) / Network Connections

Step 2 - Start the New Connection Wizard

Step 3 - Click on the Next button

Step 4 - Select Set-Up advanced connection.

Step 5 - Click on the Next button.

Step 6 - Click on Accept incoming connections.

Step 7 - Click on the Next button.

Step 8 - At the LPT1 page, skip it and just click on the Next button.

Step 9 - Click on Allow virtual private connection.

Step 10 - Click on the Next button.

Step 11 - Add user accounts that ou want to be able to connect to your Windows XP computer.

Step 12 - Click on the Next button.

Step 13 - Highlight Internet Protocol (TCP/IP) and click on Properties.

Step 14 - Determine how you want the remote computers to get their IP address.

Step 15 - You can Allow callers to access your local area network or internal LAN. Check this if you would like to access all of your computers or devices.

Step 16 - Under TCP/IP address assignment you can let your DHCP server hand out IP addresses or you can assign a range of IP’s within the scope of your subnet.

Step 17 - Click OK.

Step 18 - If you are behind a router you will need to foward port 1723 to your Windows XP IP address. You may also need to configure your router for PPTP Passthrough. Port usage for IPSec is 500, 50-51.

XP VPN Client Set-Up

Now you can use another remote Windows XP machine to connect to your LAN resources. Follow these steps on the remote machine to establish a connection:

Please note you will need to know the IP address of your VPN server or you will need to have a domain name (i.e. example.com).

Step 1 - Click Start / Control Panel.

Step 2 - Open Network Connections in the Control Panel.

Step 3 - Choose the Create a new connection item from the left-hand side of the window. (The Windows XP New Connection Wizard will appear on the screen.)

Step 4 - Click Next to begin the wizard, then choose the Connect to the network at my workplace item from the list and click Next.

Step 5 - On the Network Connection page of the wizard, choose the Virtual Private Network Connection option and click Next.

Step 6 - Enter a name for the new VPN connection and click Next. (This is just an identifier).

Step 7 - On the Public Network screen choose Do not dial the intitial connection option. This option requires that a connection to the internet already be established.

Step 8 - Enter the domain name or IP address of your remote VPN Server. (the one we just created above) Click Next.

Step 9 - In the Connection Availability screen choose an option and click Next. Choosing My Use Only will allow the VPN connection only for the current logged on user.

Step 10 - Click Finish to complete the wizard. You will now see the VPN Connection icon in the Network Connections window under the Control Panel. Double-click this icon to connect to your VPN server, you will have to enter your username and password for the remote VPN server. (this is the same username and password you use to login to your computer)

That’s it! You should now be able to access your home network from a remote computer. Once connected to your VPN server you can use Remote Desktop to login to your remote computer.

Next Page »