Network Administration

A network administrator improves the performance of network services in the following ways.

• Monitoring and baselining: uses tools (Nagios, Zabbix, PRTG, Wireshark) to track bandwidth, latency, CPU and error rates, and finds bottlenecks before users are affected.
• Capacity planning and upgrades: adds bandwidth, memory, faster links or servers as load grows.
• Traffic management: applies Quality of Service (QoS), traffic shaping and load balancing so that critical services get priority.
• Optimizing configuration: tunes DNS, DHCP, routing and switching (VLANs, segmentation) and uses caching and proxy servers.
• Server maintenance: applies patches and firmware updates, removes unneeded services and balances load across servers.
• Security: blocks malware, spam and attacks that consume resources.
• Backup, redundancy and documentation: provides failover links and keeps network diagrams and change logs for quick troubleshooting.
• Training and support: guides users and resolves problems quickly.

Workstation architecture design considerations:

• Purpose and user needs: the type of work (office, design, development, research) decides the CPU, RAM, storage and graphics needed.
• Performance: processor speed and cores, memory size, disk type (SSD vs HDD) and graphics capability.
• Operating system and software compatibility: the OS (Windows, Linux) must support the required applications and network services.
• Network connectivity: suitable NIC (Ethernet or Wi-Fi), bandwidth and IP addressing method (DHCP or static).
• Standardization: a common hardware and software image makes deployment, support and spares easier.
• Security: user authentication, antivirus, firewall, disk encryption and patch management.
• Scalability and upgradability: ability to add RAM, storage or new peripherals later.
• Reliability and maintenance: quality hardware, warranty, backup and remote management.
• Cost and ergonomics: total cost of ownership, power use and user comfort.

Network service requirements are the functions and performance levels that a network must provide to its users and applications, such as file sharing, printing, e-mail, web, DNS/DHCP, database access and remote access, along with their expected capacity, availability, security and response time.

Guidelines for requirement planning

1. Identify users and applications: list who needs which services and how many users there will be.
2. Define performance needs: bandwidth, latency, response time and number of concurrent users.
3. Availability and reliability: required uptime, redundancy and failover.
4. Security requirements: authentication, access control, encryption and compliance.
5. Scalability: allow for future growth in users and services.
6. Compatibility and integration: with existing hardware, software and standards.
7. Budget and resources: hardware, software licences and staff skills available.
8. Manageability: monitoring, backup and support needs.
9. Document and review: record requirements, get stakeholder approval and revise them regularly.

Data center: a dedicated facility that houses an organization's servers, storage, networking equipment and supporting systems (power, cooling, fire suppression, cabling) to store, process and deliver data and applications.

Security concerns

• Physical security: unauthorized entry, theft, sabotage. Controls include guards, CCTV, biometric/card access, mantraps and visitor logs.
• Environmental threats: fire, flood, earthquake, overheating and power failure. Controls include UPS, generators, fire suppression, climate control and redundant power.
• Network attacks: DDoS, intrusion, malware and ransomware. Controls include firewalls, IDS/IPS, segmentation and patching.
• Data breaches and loss: unauthorized access or leakage. Controls include encryption, access control, auditing and regular backups.
• Insider threats: misuse by staff or contractors. Controls include least privilege, logging and background checks.
• Availability and disaster recovery: need for redundancy, off-site backup and tested recovery plans.
• Compliance: meeting legal and industry standards (e.g. ISO 27001).

Network printer: a printer that connects directly to the network (by Ethernet or Wi-Fi) with its own IP address, or through a print server, so that many users can print to it without it being attached to a particular computer.

Procedure to set up a network printer

1. Unpack the printer, install consumables (toner/ink, paper) and power it on.
2. Connect it to the network using an Ethernet cable or join it to the Wi-Fi.
3. Assign an IP address: use DHCP reservation or configure a static IP from the printer panel or its web interface, and note it down.
4. Install the printer driver on the server or client computers.
5. Add the printer on the computer: Settings > Printers & scanners > Add printer > Add a printer using TCP/IP address, enter the IP, choose the driver (on Linux use CUPS).
6. If using a print server, share the printer and set permissions for users or groups.
7. Print a test page to confirm.
8. Set defaults, configure security (admin password, access control) and document the setup.

File server: a server dedicated to storing, managing and sharing files for users over a network, giving centralized storage, access control and backup.

Procedure to set up a file server

1. Plan: estimate storage, users, permissions and backup needs.
2. Prepare hardware and OS: install a server OS (Windows Server or Linux) on suitable hardware, preferably with RAID disks.
3. Network configuration: set a static IP address and hostname, and join the domain if needed.
4. Install the file service role: on Windows, add the File and Storage Services role; on Linux install Samba (SMB) or NFS.
5. Create the directory structure and shares: create folders, then share them (e.g. smb.conf share definitions in Samba).
6. Set permissions: create users and groups and assign share and NTFS/file permissions on the principle of least privilege.
7. Add features: quotas, file screening, shadow copies/versioning and encryption.
8. Security: enable firewall rules, updates and auditing.
9. Backup: schedule regular backups.
10. Test: connect from client machines (map network drive) and verify access.

(a) Mail server

A mail server sends, receives and stores e-mail. It consists of an MTA (Mail Transfer Agent such as Postfix or Exchange) that transfers mail using SMTP, and an MDA/mailbox server that delivers mail to users who read it through POP3 or IMAP. DNS MX records direct mail to the server. Administrators must configure spam and virus filtering, authentication (SPF, DKIM, DMARC), TLS encryption, quotas and backups.

(b) Disaster recovery

Disaster recovery (DR) is the set of policies and procedures used to restore IT systems and data after a disaster such as fire, flood, hardware failure, cyber attack or human error. A DR plan includes risk assessment, regular backups (with off-site copies), redundant or standby systems (hot, warm or cold site), defined RTO (recovery time objective) and RPO (recovery point objective), assigned responsibilities, and regular testing and updating of the plan.

(c) Network operations

Network operations are the day-to-day activities that keep a network running: monitoring performance and availability, fault detection and troubleshooting, configuration and change management, user account management, patching, backup, security monitoring, capacity management and documentation. They are often handled by a Network Operations Center (NOC), working with help desk tickets and agreed service levels (SLAs).

Requirement analysis

A laboratory for 25 researchers needs reliable, fast connectivity, shared storage, internet access, printing, security and room for growth (plan for about 35-40 nodes).

Network design

• Topology: star topology using a managed switch at the centre, in a single building with structured cabling.
• Layout: ISP link -> router/firewall -> core/distribution switch -> access switches (and Wi-Fi access point) -> researcher workstations, server, printer.
• Addressing: private network 192.168.10.0/24 (254 hosts) with DHCP; static addresses for server and printer. Optional VLANs: researchers, servers, guest Wi-Fi.
• Logical flow: workstations get IP, DNS and gateway from the server/router; all internet traffic goes through the firewall.

Hardware specification

Software specification

• Server OS: Windows Server or Linux (Ubuntu Server) with Active Directory/Samba for authentication and file sharing, DHCP and DNS roles.
• Client OS: Windows 10/11 or Linux, with office and research software (statistics, programming tools).
• Security: antivirus, firewall, OS patching, VPN for remote access.
• Management: monitoring tool (Zabbix/Nagios), backup software, print server.

Policies

User accounts with strong passwords, role-based access, scheduled backups, Internet use policy and documentation of the network diagram and IP plan.

Server hardware strategies

• Choose by workload: size CPU, RAM, storage and network adapters for the service (mail, database, web, file) and the expected number of users.
• Server form factor: tower, rack-mount or blade servers, depending on space and scale.
• Redundancy: redundant power supplies, RAID disks, hot-swappable parts, multiple NICs and clustering or failover for high availability.
• Scalability: hardware that can be upgraded (extra slots, RAM, drives) or scaled out with more servers.
• Virtualization and consolidation: run many virtual servers on fewer physical hosts to save cost, power and space.
• Vendor and support: standardize on a vendor, with warranty, spare parts and service contracts.
• Environment: power, cooling and rack space.

Server software strategies

• Operating system: Windows Server or Linux, selected for application compatibility, skills available and licence cost.
• Services and applications: install only needed roles to reduce the attack surface.
• Licensing: commercial vs open source, per-user vs per-server licences.
• Patch and update management and version control.
• Security software: firewall, antivirus, access control and logging.
• Management and monitoring tools, and backup software.

Service requirement planning

1. Identify the services needed (file, print, mail, web, DNS, DHCP, database, authentication) and who uses them.
2. Estimate load: users, concurrent connections, storage growth and peak usage.
3. Set service levels: availability (uptime), response time, backup and recovery targets.
4. Decide placement: which services share a server and which need dedicated servers, and where (on-premises or cloud).
5. Plan security and access control for each service.
6. Plan for growth, budget and staff training.
7. Document the plan, pilot test, deploy, and review regularly.

(a) Recent trends in network administration

• Cloud computing and hybrid cloud: services and servers moved to public/private clouds, and the administrator manages cloud resources.
• Virtualization and containers: virtual machines, Docker and Kubernetes.
• Software-defined networking (SDN) and NFV: centralized, programmable control of the network.
• Automation and Infrastructure as Code: Ansible, Python scripts and network configuration managed through version control.
• AI/ML for network operations (AIOps): predictive monitoring, anomaly detection and automated troubleshooting.
• Zero-trust security and stronger cyber-security: continuous verification, MFA, SASE.
• IoT and edge computing, with 5G and Wi-Fi 6/6E.
• Remote work support: VPN, SD-WAN and remote monitoring.
• IPv6 adoption and network observability tools.

(b) Plan to upgrade a server

1. Justify and define scope: identify the reason (performance, end of support, security) and requirements.
2. Assess the current system: inventory hardware, OS, applications, dependencies and users.
3. Plan and approve: choose the new hardware/software, budget, schedule and downtime window (off-hours), and inform users.
4. Backup: take a full backup and verify it can be restored.
5. Test: try the upgrade in a test or staging environment.
6. Prepare a rollback plan in case of failure.
7. Perform the upgrade: apply hardware or OS/software changes, migrate data and services.
8. Verify: test services, performance and security, and check logs.
9. Go live and monitor: watch the server closely for the first days.
10. Document and review: update records, configuration and lessons learned.

A network administrator has privileged access to systems and data, so professional ethics are essential. Key aspects:

• Confidentiality and privacy: do not read or disclose users' emails, files or personal data except when authorised.
• Integrity and honesty: report faults truthfully, do not falsify logs, and do not misuse privileges.
• Authorised use of access: use admin rights only for legitimate work, with the principle of least privilege.
• Professional competence: keep skills current and do not undertake work beyond one's ability.
• Responsibility and accountability: take ownership of mistakes, follow change-management and document actions.
• Legal compliance: respect laws (such as Nepal's Electronic Transactions Act), software licences and company policy.
• Fairness and respect: treat all users equally without discrimination.
• Protecting the organisation and public: maintain security and availability, and report breaches promptly.
• Respect for intellectual property and avoiding conflicts of interest.

Why remote administration is needed

• Administrators can manage servers and devices in other rooms, buildings or cities without travelling, which saves time and cost.
• Faster response to faults and 24x7 support, including outside office hours.
• Centralised management of many machines (updates, configuration, monitoring).
• Supports remote work and distant branches, and reduces downtime.
• Allows help-desk support to be given to users directly.

It must be protected with strong authentication, encryption (VPN, SSH) and logging, because it is an attractive target for attackers.

Remote administration tools

• SSH (OpenSSH, PuTTY): secure command-line access, mostly for Linux and network devices.
• Telnet: unencrypted, so it is avoided.
• RDP (Remote Desktop Protocol): graphical access to Windows.
• VNC (TightVNC, RealVNC): cross-platform graphical sharing.
• TeamViewer, AnyDesk: commercial remote support tools that work through NAT.
• Webmin / Cockpit: browser-based administration of Linux servers.
• PowerShell Remoting, Windows Admin Center, Ansible: scripted and automated administration.
• SNMP-based and monitoring tools such as Nagios and Zabbix.

Artificial intelligence (AI) and automation change network management from manual and reactive to proactive and self-managing.

Impact

• Automated configuration and provisioning: scripts, Ansible and SDN controllers deploy changes consistently and quickly, with fewer human errors.
• Predictive maintenance: machine learning analyses logs and telemetry to predict failures and capacity problems before they affect users.
• Anomaly and threat detection: AI detects unusual traffic, intrusions and DDoS attacks faster than fixed rules.
• Faster troubleshooting: root-cause analysis and self-healing reduce mean time to repair; chatbots handle routine requests.
• Traffic optimisation: dynamic routing, load balancing and QoS adapt to real-time demand.
• Efficiency: administrators spend less time on repetitive tasks and more on design and strategy.

Challenges: initial cost, data quality, false positives, security of automation tools, the need for new skills, and the risk of over-reliance on automated decisions.

DNS (Domain Name System): translates human-readable names (for example www.example.com) to IP addresses (and back with reverse lookup). A DNS server holds records (A, AAAA, MX, CNAME, PTR) and answers queries, so workstations can find servers by name instead of remembering IP addresses. Internal DNS also supports Active Directory and service discovery. Caching and secondary servers improve speed and reliability.

DHCP (Dynamic Host Configuration Protocol): automatically gives hosts an IP address, subnet mask, default gateway, DNS servers and a lease time from a defined scope (the DORA process: Discover, Offer, Request, Acknowledge). It prevents address conflicts, saves manual work and allows reservations for servers and printers, which keeps addressing consistent.

VPN (Virtual Private Network): creates an encrypted tunnel (IPsec, SSL/TLS, OpenVPN, WireGuard) over a public network such as the internet, so remote workstations or branches reach internal servers securely as if they were on the LAN. It provides confidentiality, authentication and integrity.

Together: DHCP configures a workstation when it connects, DNS resolves the server's name, and the VPN carries the traffic securely when the workstation is remote. This keeps communication between workstations and servers automatic, reliable and secure.

After the operating system is installed, the administrator hardens and configures it in a planned way.

1. Basic setup

• Apply all updates and patches, set the host name, time zone and static IP/DNS settings, and join the domain if required.
• Install drivers, remove unnecessary software and services.

2. User accounts

• Rename or disable default administrator/root accounts and set strong passwords.
• Create user accounts and groups (preferably through Active Directory/LDAP) and grant access by role, with least privilege.
• Configure password expiry, lockout and multi-factor authentication.

3. Security policies

• Apply Group Policy (Windows) or PAM/sudo and file permissions (Linux).
• Enable the firewall (Windows Defender Firewall, iptables/ufw) and open only needed ports.
• Install antivirus or endpoint protection, enable disk encryption, auditing and logging.
• Disable guest accounts and unused protocols; enable SELinux/AppArmor where appropriate.

4. Network services

• Install and configure only required services such as DNS, DHCP, file sharing, print, web or SSH.
• Secure remote access (SSH keys, RDP with network-level authentication, VPN).
• Set up time synchronisation (NTP) and monitoring (SNMP agents).

5. Final steps: configure backup, test the services and security, document the configuration, and create a baseline image.

A procurement plan describes how the hardware, software and services for a network are selected and bought. Its key components:

1. Needs and requirements analysis: what is needed (devices, licences, cabling, services), quantities and specifications, based on the network design.
2. Budget and cost estimation: total cost of ownership, including installation, licences, support, training and maintenance.
3. Vendor selection criteria: reputation, quality, compatibility, standards compliance, price, warranty and support.
4. Request documents: RFI, RFP and RFQ sent to vendors, and bid evaluation.
5. Standards and compatibility: interoperability with existing equipment and future growth.
6. Schedule and delivery: timeline, lead times, phased purchase and delivery terms.
7. Contracts and SLAs: warranty, service-level agreements, penalties, licence terms and payment terms.
8. Risk management: vendor lock-in, supply delays, spare parts.
9. Approval and legal process: internal approvals and compliance with the public procurement rules where applicable.
10. Acceptance testing and asset records: verification of delivered items and an updated inventory.

A server is a computer (hardware and software) that provides services or resources to client machines over a network.

Types of servers

How they interact to deliver seamless services

When a user logs in to a workstation, the DHCP server provides an IP address and DNS settings. The authentication server verifies the user's credentials. The user types a website name and the DNS server resolves it. The request may pass through a proxy/firewall, then reaches the web server, which calls an application server, which queries the database server; the response returns along the same path. Meanwhile the file and print servers provide shared documents and printers, the mail server handles email, and backup and monitoring servers protect and watch all of these.

Seamless delivery depends on correct configuration of dependencies (especially DNS, DHCP and authentication), redundancy, load balancing, time synchronisation, and security between servers.

(a) Three main types of network infrastructure

1. Wired (LAN) infrastructure: copper (UTP) or fibre cabling, switches, routers and patch panels. It gives high speed, reliability and security.
2. Wireless infrastructure: access points, controllers and Wi-Fi/cellular links. It offers mobility and easy deployment but lower security and variable speed.
3. WAN / internet infrastructure: connections between sites and to the internet through ISPs, leased lines, MPLS, VPN or SD-WAN.

(Other classifications also name the physical, logical and cloud/virtual layers. The above is the usual device and media view.)

Logical versus physical network diagram

(b) High-level enterprise data centre strategy options

1. On-premises (own) data centre: the enterprise builds and runs its own facility. It gives full control and customisation, but needs high capital cost, space, power and skilled staff.
2. Colocation: the enterprise places its own servers in a third-party facility that supplies space, power, cooling and connectivity. Lower facility cost than owning, but hardware is still owned and managed by the enterprise.
3. Cloud / managed hosting (public cloud): resources are rented (IaaS, PaaS, SaaS) from providers such as AWS or Azure. It is quickly scalable with pay-as-you-go pricing and low capital cost, but gives less control and depends on the provider and the internet.
4. Hybrid: a mix of on-premises and cloud, keeping sensitive or steady workloads in-house and using the cloud for peaks and backup.

Differences: on-premises has the highest cost and control; colocation has medium cost and moderate control; cloud has the lowest upfront cost, the best scalability and the least control; hybrid balances them but is more complex to manage.

(a) Network service monitoring

Definition. Network service monitoring is the continuous process of checking that the services running on a network (DNS, DHCP, HTTP/HTTPS, SMTP, FTP, SSH, databases, VPN and so on) are reachable, responding correctly and performing within acceptable limits. It also covers the devices and links that carry them (routers, switches, servers, bandwidth). A monitor probes each service at regular intervals, records availability, response time and resource use, compares the results with thresholds, and raises alerts when something fails or degrades.

How it works.

• Active checks: the monitor sends ping (ICMP), TCP port checks, HTTP requests, DNS lookups or a test login, and measures the reply.
• Passive and device-based collection: SNMP polling and traps, syslog messages, NetFlow/sFlow records and agents on servers report CPU, memory, disk, interface traffic and errors.
• Results are stored for trend graphs, compared with thresholds, and sent as email, SMS or dashboard alerts.

Why it is important.

1. Availability. Failures of a service or link are detected within minutes, often before users complain, which reduces downtime.
2. Fast troubleshooting. Logs and history show when and where a problem began, shortening mean time to repair.
3. Performance and capacity planning. Trend data on bandwidth, CPU and disk shows when upgrades are needed, so bottlenecks are removed before they hurt users.
4. Security. Unusual traffic, repeated failed logins or unexpected new services can indicate attacks or malware.
5. SLA and reporting. Uptime and response-time reports prove that service level agreements are met.
6. Cost control. Proactive fixes are cheaper than emergency repair, and unused resources can be identified.

Commonly used tools.

---

(b) Backup types and ransomware

Types of backup.

1. Full backup. Copies all selected data every time.

   • Advantages: simplest and fastest restore, since only one backup set is needed.
   • Disadvantages: needs the most storage and the longest backup window.

2. Incremental backup. Copies only data changed since the last backup of any kind (full or incremental).

   • Advantages: fastest backup and smallest storage use.
   • Disadvantages: restore is slowest. The last full backup and every incremental after it are needed in order, and if one is damaged the later ones are unusable.

3. Differential backup. Copies all data changed since the last full backup.

   • Advantages: restore needs only the last full backup plus the latest differential.
   • Disadvantages: each differential grows larger until the next full backup, so it uses more space and time than an incremental.

Example: full backup on Sunday, then daily backups. To restore on Thursday with incrementals, we need Sunday full + Mon + Tue + Wed + Thu. With differentials, we need Sunday full + Thursday differential only.

Impact of ransomware on backup and recovery strategy.

Ransomware encrypts files and demands payment for the key. Modern strains also look for and delete or encrypt backups, shadow copies and network shares, so a backup that the infected machine can write to may be lost too. Backups are often the only way to recover without paying, so the strategy must change:

1. 3-2-1 rule (or 3-2-1-1-0). Keep 3 copies of data on 2 different media with 1 copy offsite, plus 1 offline or immutable copy, and verify 0 errors.
2. Offline, air-gapped or immutable backups. Use tape, disconnected disks or write-once (WORM, object-lock) storage so that malware cannot modify or delete them.
3. Isolation and access control. Keep backup servers on a separate network segment, use separate credentials with multi-factor authentication, and give least privilege so that a compromised domain account cannot reach the backups.
4. Versioning and longer retention. Ransomware can lie dormant, so older clean restore points are needed. Incremental chains also mean an infected file may be copied into every later backup, so retaining several full backups is safer.
5. Frequent backups and a low RPO. More frequent backups reduce the data lost between the last clean backup and the attack.
6. Regular restore testing and a documented recovery plan. Test that backups restore correctly, and set recovery time objectives (RTO) and a step-by-step incident response plan.
7. Scan before restoring. Clean the infected systems (rebuild from known-good images), remove the malware and restore from a point before infection, otherwise the data is encrypted again.
8. Detection and monitoring. Alerts on mass file changes, unusual backup deletion or sudden growth of backup size help detect an attack early.

In summary, full, incremental and differential backups trade off speed, storage and restore time, and under the ransomware threat the plan must add protected, offline and tested copies so recovery is possible without paying the ransom.