Networks Training

GNS3 is a graphical network simulator that allows simulation of complex networks.

To allow complete simulations, GNS3 is strongly linked with :

* Dynamips, the core program that allows Cisco IOS emulation.
* Dynagen, a text-based front-end for Dynamips.
* Qemu, a generic and open source machine emulator and virtualizer.

GNS3 is an excellent complementary tool to real labs for network engineers, administrators and people wanting to pass certifications such as CCNA, CCNP, CCIP, CCIE, JNCIA, JNCIS, JNCIE.

It can also be used to experiment features of Cisco IOS, Juniper JunOS or to check configurations that need to be deployed later on real routers.

This project is an open source, free program that may be used on multiple operating systems, including Windows, Linux, and MacOS X.
Features overview

* Design of high quality and complex network topologies.
* Emulation of many Cisco IOS router platforms, IPS, PIX and ASA firewalls, JunOS.
* Simulation of simple Ethernet, ATM and Frame Relay switches.
* Connection of the simulated network to the real world!
* Packet capture using Wireshark.

Important notice: users have to provide their own IOS/IPS/PIX/ASA/JunOS to use with GNS3.

More Info: http://www.gns3.net/

The most common attack against Service Provider IP Networks is Denial of Service. Usually these attacks take the form of “Many-to-One Attacks” where multiple attacking sources send flooding traffic towards a single destination. These attacks are sometimes called Distributed Denial of Service. Usually the attacking hosts are “zombie” computers which are compromised by hackers and belong to a BotNet network. Usually these attacks are directed towards a critical node of the ISP network (a Border Router, a public Server etc).

If the attack contains thousands of non-legitimate connections to initiate TCP communication (SYN packets) towards a single host, the target host gets overloaded from the requested connections because the three-way TCP handshake does not get completed (because these TCP connections have unreachable return addresses, the connections cannot be established).  The resulting volume of unresolved open connections eventually overwhelms the server and can cause it to deny service to valid requests. The above attack is also called SYN Attack.

TCP Intercept is a feature on routers used to prevent and mitigate TCP SYN-flooding attacks by monitoring the rate of SYN packets and intervening inside the TCP communication whenever necessary in order to reduce the number of incomplete TCP connections.

There are two modes for TCP Intercept: “Intercept Mode” and “Watch Mode”.

Intercept Mode

The most “invasive” mode is “Intercept Mode”. The router establishes a connection with the client on behalf of the destination server, and if successful, establishes the connection with the server on behalf of the client and knits the two half-connections together transparently. This means that if the connection is legitimate, it will reach the server with no problem. If the connection is from a non-legitimate client, the half-open connection will be dropped by the router. This mode consumes a lot of memory and CPU on the router.

Watch Mode

We recommend using the “Watch Mode” instead of the “Intercept Mode”.  In Watch Mode, the router passively watches the connection requests flowing through the router. If a connection fails to get established in a configurable interval, the software intervenes and terminates the connection attempt.

Configuration of TCP Intercept

On router connecting the host under attack, configure the following (assume target host under attack is 1.1.1.1):

Router(config)# access-list 101 permit tcp any host 1.1.1.1
Router(config)# ip tcp intercept mode watch
Router(config)# ip tcp intercept list 101

The above configuration will watch the TCP SYN packets towards host 1.1.1.1. If the SYN packets exceed a certain default value, the router starts to close incomplete TCP connections. Specifically, if the number of incomplete connections exceed 1,100, or the number of connections arriving in the last one-minute period exceed 1,100, each new arriving connection causes the oldest partial connection (or a random connection) to be deleted. These are the default values, which can be altered.

On June 17th, the IEEE has ratified the 802.3ba standard for Ethernet connections with speeds of 40 and 100 Gbps. Both Cisco and Juniper have been supplying high performance network equipment which support the above standard. Cisco for example supports the 100Gbps Ethernet card on its CRS-3 router, while Juniper supports its 100Gbps PIC card on its T1600 Core Router.

As its name suggests, the IEEE 802.3ba standard allows for Ethernet services of 40 and 100 Gbps in both LAN and WAN implementations. The initial plan for the fastest Ethernet ever was to develop the technology for the 40 Gbps to support high-speed connections between switches and core servers, while for the 100 Gbps speed the plan was to support transport trunks for Internet and Video over IP. Both standards are applicable for the transport of packets in optical fiber networks.

Of course, as in previous cases, the new standard maintains backward compatibility with the rest of the Ethernet family.

Well, actually not the latest news. Let’s say news from the past 2-3 months!!

Cisco is committed to release the TIP protocol:

After the acquisition of Tandberg , Cisco has pledged to release the protocol Telepresence Interoperability Protocol (TIP) on 1 July 2010. The draft release will be hosted on Sourceforge under the Apache 2.0 license. This decision is apparently the result of a concession to the European Commission for approval of acquisition of Tandberg.

Cisco completes acquisition of Tandberg

Cisco completed the acquisition of Norwegian company Tandberg, specializing in solutions for video conferencing and telepresence. Tandberg products are now integrated in the Cisco Telepresence product series. The solutions are based primarily on the TIP protocol (Telepresence Interoperability Protocol).

Cisco WebEx Meeting Center available on iPad

After the iPhone version, Cisco announced the availability of WebEx Meeting Center on the iPad. WebEx Meeting Center is a collaborative tool ”that combines professional interaction, voice and instant messaging”. This tool lets “to organize meetings for dispersed staff and using tools and heterogeneous systems”