Networking System Administration

A router is a Layer 3 (network layer) device that forwards packets between different networks. It reads the destination IP address of each packet, consults its routing table and sends the packet along the best path, for example connecting a home LAN to the internet.

The two primary protocols of the TCP/IP model are TCP (Transmission Control Protocol) and IP (Internet Protocol).

The Presentation layer (Layer 6) translates data between the application and the network format. It handles data representation, encryption/decryption and compression/decompression, so that data sent by one system can be understood by another.

A subnet mask separates an IP address into its network portion and host portion. It lets a device decide whether a destination is on the local network or must be sent through a router, and it is used to divide a network into subnets.

Two common network attacks are:

• Denial of Service (DoS/DDoS) attack, which floods a target so legitimate users cannot access it.
• Phishing / Man-in-the-middle attack, which tricks users into revealing information or secretly intercepts their communication.

WPA stands for Wi-Fi Protected Access, a security standard that encrypts and authenticates wireless network traffic.

One example is user account management: creating, modifying and deleting user accounts and assigning their permissions. Others include taking backups and applying software updates.

SNMP (Simple Network Management Protocol) is used to monitor and manage network devices such as routers, switches and servers. A management station collects information (CPU load, traffic, errors) from agents on the devices and can also change their configuration or receive alerts (traps).

Cloud computing is the delivery of computing resources such as servers, storage, databases, networking and software over the internet on demand, usually on a pay-as-you-use basis, without owning or maintaining the physical infrastructure.

A LAN (Local Area Network) covers a small geographic area such as an office or building, has high speed, low cost and is privately owned. A WAN (Wide Area Network) covers a large area such as cities or countries (the internet is the largest WAN), has lower speed, higher cost and often uses leased lines or public carriers.

A firewall is a hardware or software security system placed between a trusted internal network and an untrusted external network (such as the internet). It monitors incoming and outgoing traffic and allows or blocks it according to a set of rules.

Its main purposes are:

• Blocking unauthorised access and malicious traffic from outside.
• Filtering traffic by IP address, port, protocol or application.
• Logging and monitoring traffic to detect suspicious activity.
• Enforcing the organisation's security policy, e.g. blocking certain websites or services.

Data encapsulation is the process by which each layer of the network model adds its own header (and sometimes a trailer) to the data received from the layer above before passing it down.

• Application/Presentation/Session: user data is created.
• Transport: data is split into segments and a TCP/UDP header with port numbers is added.
• Network: an IP header with source and destination IP addresses is added, forming a packet.
• Data link: a header with MAC addresses and a trailer (FCS) is added, forming a frame.
• Physical: the frame is sent as bits (electrical, light or radio signals).

At the receiver the reverse process, decapsulation, removes the headers layer by layer.

The main difference in length is:

• IPv4 addresses are 32 bits long, written as four decimal octets (e.g. 192.168.1.1), giving about $2^{32} \approx 4.3$ billion addresses.
• IPv6 addresses are 128 bits long, written as eight groups of four hexadecimal digits separated by colons (e.g. 2001:0db8:85a3::8a2e:0370:7334), giving $2^{128}$ addresses.

The longer IPv6 address solves the problem of IPv4 address exhaustion.

A Denial of Service (DoS) attack is an attack in which a single attacker floods a server, network or service with excessive requests or malformed traffic so that it becomes slow or unavailable to legitimate users.

A Distributed Denial of Service (DDoS) attack does the same but the traffic comes from many compromised computers (a botnet) at the same time.

Difference: a DoS attack originates from one source and can be blocked by filtering that source, whereas a DDoS attack comes from many distributed sources, is far larger in volume and much harder to trace and block.

Virtualization is the technology of creating a virtual (software-based) version of computing resources such as servers, storage, networks or operating systems on top of physical hardware. A software layer called a hypervisor (e.g. VMware ESXi, Hyper-V, KVM) divides one physical machine into several isolated virtual machines (VMs), each with its own OS and applications.

Benefits include better hardware utilisation, lower cost, easier backup and migration, isolation between workloads and fast provisioning. Virtualization is the foundation of cloud computing.

The Transport layer (Layer 4) provides end-to-end communication between processes on the source and destination hosts. Its functions are:

• Segmentation and reassembly of data into segments.
• Port addressing (service-point addressing) to deliver data to the correct application.
• Flow control so a fast sender does not overwhelm a slow receiver.
• Error control and reliable delivery using acknowledgements and retransmission (TCP).
• Connection management: connection-oriented (TCP) or connectionless (UDP) service.

IaaS (Infrastructure as a Service): the provider supplies virtualized computing infrastructure such as virtual machines, storage and networks. The user manages the OS, middleware and applications. Examples: Amazon EC2, Microsoft Azure VMs.

PaaS (Platform as a Service): the provider supplies a ready platform (OS, runtime, database, development tools) so developers can build, test and deploy applications without managing the underlying servers. Examples: Google App Engine, Heroku.

SaaS (Software as a Service): the provider delivers complete applications over the internet, usually through a browser, and manages everything. The user simply uses the software. Examples: Gmail, Google Docs, Microsoft 365.

Control decreases and convenience increases from IaaS to PaaS to SaaS.

Device to connect to the internet: a router (usually with a modem or ISP-supplied ONT, often a combined broadband router).

• It connects the company's LAN to the ISP and the internet.
• It performs routing between the private network and the internet, and NAT so that all 25 computers can share one public IP address.
• With DHCP it automatically assigns IP addresses to the computers.
• A switch (or the router's ports) connects the 25 computers inside the office, and a wireless access point can be added for Wi-Fi.

Device for security: a firewall (hardware firewall, or a router with a built-in firewall).

• It sits between the internal network and the internet and filters traffic according to rules.
• It blocks unauthorised incoming connections, scans and attacks, while allowing legitimate traffic such as web and email.
• It can restrict employees' access to unwanted sites and log traffic for monitoring.

Together, the router gives the company connectivity and the firewall protects the internal network from external threats.

When I click "send", the email passes down the OSI layers on my computer (encapsulation) and up the layers at the receiving side (decapsulation).

Encapsulation at the sender

• Application layer: the email client uses SMTP to create the message (header, body, attachments).
• Presentation layer: the data is formatted, encoded (e.g. MIME/ASCII/UTF-8) and may be encrypted (TLS) or compressed.
• Session layer: a session with the mail server is established, maintained and later closed.
• Transport layer: the data is divided into segments; a TCP header with source port and destination port 25/587 and sequence numbers is added, ensuring reliable delivery.
• Network layer: an IP header with the source and destination IP addresses is added, forming packets; routers use it to choose the path.
• Data link layer: a header with source and next-hop MAC addresses and a trailer with a frame check sequence are added, forming frames.
• Physical layer: the frame is converted into bits and transmitted as electrical, light or radio signals.

Transit: routers decapsulate up to the network layer to read the IP address, then re-encapsulate in a new frame for the next link.

Decapsulation at the receiver

The signals are converted to bits, the data link layer checks the frame and removes its header/trailer, the network layer removes the IP header, the transport layer checks, reorders and reassembles the segments and removes the TCP header, and the upper layers decrypt and decode the data. Finally the mail server delivers the original email to the colleague's inbox, where it is read through POP3/IMAP.

The address 192.168.10.0 with mask 255.255.255.0 is the network 192.168.10.0/24.

Purpose of the mask

In binary the mask is

$11111111.11111111.11111111.00000000$

The first 24 bits (the 1s) identify the network and the last 8 bits (the 0s) identify the host. A bitwise AND of an IP address with the mask gives the network address, e.g. 192.168.10.25 AND 255.255.255.0 = 192.168.10.0. A device uses this to decide whether a destination is on the same network (deliver directly) or on another one (send to the default gateway/router).

Resulting network

• Network address: 192.168.10.0
• Usable host addresses: 192.168.10.1 to 192.168.10.254
• Broadcast address: 192.168.10.255
• Number of hosts: $2^8 - 2 = 254$

How it helps organise the network

• The administrator knows exactly which range of addresses belongs to this network and how many hosts it can hold.
• By borrowing host bits (e.g. 255.255.255.192, /26) the network can be split into smaller subnets for departments, with each subnet logically separate.
• Subnets reduce broadcast traffic, improve performance, make security policy (ACLs, firewall rules) easier to apply, and simplify troubleshooting and efficient use of addresses.

A DDoS attack tries to exhaust the bandwidth, connection capacity or application resources of the company's servers so that customers cannot shop. A layered defence combining a firewall and an Intrusion Prevention System (IPS) is used.

Role of the firewall

• Placed at the network perimeter, it filters traffic by IP address, port and protocol using a rule set.
• Allows only needed services (e.g. HTTP/HTTPS on ports 80/443) and blocks everything else.
• Blocks known malicious IP ranges, drops spoofed or malformed packets, and applies rate limiting and connection limits (e.g. against SYN floods).
• A stateful firewall tracks connection state, so unsolicited or half-open connections can be dropped.
• A web application firewall (WAF) can inspect HTTP requests to stop application-layer floods.

Role of the IPS

• It sits inline and inspects the content and behaviour of traffic with deep packet inspection.
• It detects attacks using signatures and anomaly/behaviour analysis (e.g. unusual request rate, protocol violations).
• Unlike an IDS, it automatically takes action: drops the malicious packets, blocks the offending source, resets the connection and raises an alert.

How they work together

1. The firewall first removes the bulk of unwanted traffic by policy, reducing the load.
2. The IPS examines the traffic that is permitted and catches attacks that appear to be legitimate, such as HTTP floods.
3. The IPS can update firewall rules dynamically to block attacker addresses; logs from both go to a SIEM for monitoring and alerts.

Additional measures in the strategy

• Use a CDN and DDoS-mitigation or scrubbing service from the ISP/cloud provider to absorb volumetric attacks.
• Load balancers and auto-scaling of servers to handle legitimate traffic surges.
• Over-provisioned bandwidth and redundant links.
• Keep systems patched, monitor traffic baselines, and prepare an incident response plan.

In summary, the firewall provides first-line access control and the IPS provides intelligent detection and active prevention, and together they keep the site available during a traffic surge or attack.

Virtualization

Virtualization creates multiple virtual machines on one physical server by using a hypervisor to abstract the CPU, memory, storage and network. Each VM has its own operating system and runs in isolation. It allows resources to be shared, scaled and provisioned quickly, and it is the technology that lets cloud providers serve many customers from shared hardware.

Cloud service models

• IaaS: the provider gives virtual machines, storage and networks. The customer installs and manages the OS, runtime, middleware and application (e.g. Amazon EC2). It gives maximum control but needs administration effort.
• PaaS: the provider gives a managed platform with OS, runtime, database and deployment tools. The customer only develops and deploys the application and manages its data (e.g. Google App Engine, Heroku, Azure App Service).
• SaaS: the provider gives a complete ready-made application over the internet (e.g. Gmail, Salesforce). The customer only uses it.

Most suitable model: PaaS

The startup wants to host and run its own web application without buying or maintaining servers.

• SaaS is unsuitable because it gives ready software and the startup would not be running its own application.
• IaaS would remove hardware costs but would still make the startup responsible for installing and patching the OS, web server and runtime, and for scaling, which needs skilled staff and time.
• PaaS lets developers concentrate on writing code: the provider manages servers, OS, patches, load balancing and automatic scaling. It has pay-as-you-go pricing, faster time to market and low operational cost, which suits a small startup.

If the startup later needs full control over the environment, it can move to IaaS.