What are transport and application gateways?

- Hosts and routers are separated in TCP/IP architecture. 

- For private networks, more protection is required to maintain an access control over it. 

- Firewall is one of the components of this TCP/IP architecture. 

- Internet is separated from Intranet by this firewall.

- This means all the incoming traffic must pass through this firewall. 

- The traffic that is authorized is allowed to pass through. 

- It is not possible penetrate the firewall simply. 

Firewall has two components namely:

Ø  Filtering router and

Ø  Two types of gateways namely application and transport gateways.

- All the packets are checked by the router and filtered based up on any of the attributes such as protocol type, port numbers, and TCP header and so on. 

- Designing the rules for filtering of the packets is quite a complex task. 

- A little protection is offered by this packet filtering since with the filtering rules on one side, it is difficult to cater to the services of the users on other side.

About Application Gateways

- Application layer gateways consist of 7 layer intermediate system designed mainly for the access control. 

- However, these gateways are not commonly used in the TCP/ IP architecture. 

- These gateways might be used sometimes for solving some inter-networking issues. 

- The application gateways follow a proxy principle for supporting the authentication, restrictions on access controls, encryption and so on. 

- Consider two users A and B. 

- A generates an HTTP request which is first sent to the application layer gateway rather than being send to its destination. 

- The gateway checks about the authorization of this request and performs encryption. 

- After the request has been authorized, it is sent to user B from the gateway just at it would have been sent by A.

- B responds back with a MIME header and data which might be de-crypted or rejected by the gateway.

- If the gateway accepts, it is sent to A as if from B. 

- These gateways are designed for all the protocols of application level.

About Transport Gateways

- The working of the transport gateway is similar to application gateway but it works at the TCP connection level. 

- These gateways are not dependent up on the application code but they do need client software so as to maintain awareness about the gateway. 

- Transport gateways are intermediate systems at layer 4. 

- An example is the SOCKS gateways. 

- IETF has defined it as a standard transport gateway.

- Again, consider two clients A and B. 

- A TCP connection is opened by A to the gateway. 

- The SOCKS server port is nothing but the destination port. 

- A sends a request to this port for opening the connection to B indicating the port number of the destination. 

- After checking the request, the request for connection from A is either accepted or rejected. 

- If accepted, a new connection is opened to B. 

- The server also informs A that the connection has been established successfully. 

- The data relay between the clients is kept transparent. 

- But in actual there are two TCP connections having their own sequence numbers as well as acknowledgements. 

- The transport gateways are simpler when compared with the application layer gateways. 

- This is so because the transport gateways are not concerned with the data units at the application layer. 

- It has to act on the packets simply once the connection has been established. 

- Also, this is the reason why it also gives higher performance in comparison with the application layer gateways. 

- But it is important that the client must be aware of its presence since there is no transparency here. 

- If between the two networks the only border existing is the application gateway, it alone can act as the firewall. 

What is meant by flow specification?

- There are many problems concerning the flow specification. 

- There are limited options for the provider for mitigation of the DDoS attacks that take place internally. 

- These can be categorized in to three different categories:

Ø  BGP (border gateway protocol) destination black holes

Ø  BGP src/ uRP

Ø  ACLS

- The basic idea is to make use of the BGP for the distribution of the flow specification filters. 

- This helps in dynamic filtering in the routers. 

- The flow specification rules are encoded according to the BGP NLRI address family. 

- The flow spec NLRI is used by the BGP as its opaque key is used as an entry key for its database. 

- The extended communities are used for specifying the actions such as accepting, discarding it, rate limiting, sampling, redirecting and so on. 

- The source/destination prefix and the source/destination port are matched in combinations according to the packet size, ICMP type/co9de, fragment encoding, DSCP, TCP flag and so on. 

- For example, the TCP ports 80…90 are matched with 192.168.0/24. 

- The flow specification trust model uni casts the routing advertisements for controlling the traffic. 

- Filter is considered as a hole for the traffic that is being transmitted to some destination. 

- Filter is accepted when it is advertised for the destination by the next hop. 

- Filters with various flow specifications are available today.

- The major benefit of the flow specifications is the filters with the fine grain specification which make it easy for deploying and managing the BGP. 

- The trust and the distribution problems are solved by the BGP. 

- ASIC filtering in routers is leveraged. 

- This is another major benefit of flow specifications. 

Apart from the benefits, there are various limitations of the flow specifications as mentioned below:

Ø  There is no update level security in the BGP.

Ø The statistics and the application level acknowledgement are not well defined.

Ø  The flow specifications work only for those nodes for which the BGP has been enabled.

Ø  Beyond routing the BGP payload has to be overloaded.

Ø  There are various operational issues between the security operations and the network operations.

Ø  The threat information cannot be gathered in one place.

- The integration of the flow specifications was announced by various security vendors. 

- The DDoS attacks are experienced by a large number of customers. 

- The DDoS attacks are now massive and have put the network infrastructure at risk apart from the end customer. 

- Congestion problems occur at both the exchange and the backbone. 

- The attacks of long durations add to the cost of bursting and circuit congestion problems. 

- Depending up on the size of the attack the POP has to be isolated.

- VoIP is also affected. 

- These attacks have negative economic effects as the cost of the operations has been increased. 

- This has led to a degradation of the business. 

- Measures such as firewall filtering and destination BGP black-holing have proved to be insufficient in preventing the attacks. 

- These methods are slow since it is required to log-in and configuring the devices. 

- The configuration has to be constantly. 

- The traffic is terminated to some destination. 

- This affects the availability. 

- The black hole routes are removed by constantly changing the configurations. - Earlier version of the flow specifications had many bugs. 

- There were some limitations on the performance. 

- However, it provided arbor support for the actions of the flow specifications. 

- It does not provide multi–vendor support. 

- To some extent it provides the mitigation facility for the attack that occurred at the source. 

- The collateral damage is eliminated for both the carriers and supports the change in the matching criteria. 

What is the difference between HTTP and HTTPS?

HTTP is quite a common language with us and stands for hyper text transfer protocol. This is actually an application protocol that has been developed exclusively for the hyper media, collaborative and distributed information systems. 

The foundation of the data communication is entirely based upon www or World Wide Web.  

Now what is HTTPS? HTTPS is nothing but HTTP secure! This one is much more secure than usual hyper text transfer protocol. And like HTTP, it is also a quite popular communication protocol for a much secure communication over a network of computers. It is quite popular with internet. 

If you see it technically, it is actually not a protocol in itself but rather a layered form of HTTP along with SSL/ TLS protocol. This allows the security capabilities of the SSL/ TLS to be added to the HTTP.  In this article we hold up to discuss the differences between the two i.e., the HTTP and HTTPS.

Difference #1:

- The transmission and receiving of the information across a computer network or internet is solely the responsibility of the HTTP.   

- HTTPS holds the responsibility of exchanging confidential information among the servers and also since the access to such information has to be secured to prevent it from any un- authorized access.

Difference #2:

-The transmission of HTTP takes place through a wire via PORT 80(TCP) but it is not at all secure! Some can easily interfere in the communication between your system and the server. 

- HTTPS is a creation of the NetScape and it comes as a built in thing with the netscape browser that uses it for the encryption and decryption of the user’s requests.

- HTTPS is actually HTTP working over the layer of netscape’s secure socket layer (SSL). 

- Unlike regular HTTP, HTTPS transmission takes place through a wire via PORT 443 for carrying out interactions between the lower layer TCP/ IP. 

- SSL or secure socket layer makes use of a 40 bit key size for encrypting the RC4 streams algorithm. 

- Therefore an adequate degree of encryption is possible for commercial exchange.

Difference #3:

- HTTPS being so very secure finds its use in shopping/ commercial sites and login pages. 

- HTTPS though being a standard secure protocol transmits the data over world wide web just like HTTP with the only difference being in the form in which data is transmitted i.e., the encrypted form. 

- When you put https:// instead of http:// you are asking the server to establish a secure connection path. 

- The server makes it a point that the secure and non secure connections are kept separately. 

- When the address in the address bar of the web browser that you are using, starts with http://, it simply means that your requests are being communicated over regular un-secure “HTTP” language.

- It is basically the letter ‘S’ that makes all the difference between HTTP and HTTPS. 

Difference #4:

- Most of the requests of the clients are processed via HTTP. The client in turn gets a response from the server on the completion of a request in the form of a web page. 

- In HTTPS the information is highly encrypted which means that no can have a clue of what you are looking for. 

This type of secure communication is commonly prevalent in those areas wheer security is quite mandatory like the following:

1. E- mails
2. Banking web sites
3. Payment gateways and so on.

To get an HTTPS connection, the server requires a public key trusted and signed certificate.

Dynamic Trunking Protocol (DTP)

The Dynamic Trunking Protocol (DTP) is a proprietary networking protocol developed by Cisco Systems for the purpose of negotiating trunking on a link between two VLAN-aware switches, and for negotiating the type of trunking encapsulation to be used. It works on the Layer 2 of the OSI model. If a port can become a trunk, it may also have the ability to trunk automatically, and in some cases even negotiate what type of trunking to use on the port. DTP provides this ability to negotiate the trunking method with the other device.
There are a couple of other potential issues that arise when you start trunking.
- The first issue is that both ends of a trunk cable had better agree they're trunking, or they're going to be interpreting trunk frames as normal frames. To resolve this, Cisco came up with a protocol for switches to communicate intentions. The first version of it was VTP, VLAN Trunking Protocol, which worked with ISL. The newer version works with 802.1q as well, and is called Dynamic Trunking Protocol (DTP).
- The second issue is creating VLAN's.

Switch port modes

- auto : causes the port to passively be willing to convert to trunking. The port will not trunk unless the neighbor is set to on or desirable . This is the default mode.
- on : forces the link into permanent trunking, even if the neighbor doesn't agree.
- off : forces the link to permanently not trunk, even if the neighbor doesn't agree.
- desirable : causes the port to actively attempt to become a trunk, subject to neighbor agreement.
- nonegotiate : forces the port to permanently trunk but not send DTP frames.

Protocol Structure of DTP

On a Catalyst set-based switch, the syntax for setting up a link as a trunk is:

set trunk mod_num/port_num [on | desirable | auto | nonegotiate] [isl | dot1q | negotiate] [vlan_range]
Use this command to set the specified port or ports to trunking.

UDP - User Datagram Protocol

The User Datagram Protocol (UDP) is a transport layer protocol defined for use with the IP network layer protocol.UDP is often used in videoconferencing applications or computer games specially tuned for real-time performance.
- UDP network traffic is organized in the form of data grams.A data-gram comprises one message unit. The first eight bytes of a data-gram contain header information and the remaining bytes contain message data.
- UDP can be used in networks where TCP is traditionally implemented.
- It does not guarantee reliability or the correct sequencing of data.
- UDP makes use of a simple communication model without implicit transmission checks for guaranteeing reliability, sequencing, or data-gram integrity.
- UDP considers that error checks and corrections should be carried out in the communicating application, and not at the network layer.
- UDP makes the protocol that much faster and more efficient because it does not have the overhead of checking whether the data has reached the destination every time it is sent.
- UDP is a stateless protocol. UDP is used for packet broadcast or multi-casting whereby the data is sent to all the clients in the network.

The UDP header consists of four fields each of 2 bytes in length :

- Source Port : Source port recognizes the sending port and should be understood to be the port to respond to if required. If not used, then its value should be zero.

- Destination Port : UDP packets from a client use this as a service access point (SAP) to indicate the service required from the remote server.

- UDP length : The number of bytes comprising the combined UDP header information and payload data.

- UDP Checksum : A checksum to verify that the end to end data has not been corrupted by routers or bridges in the network or by the processing in an end system.

Introduction to Serial Ports

Serial ports are a type of computer interface that complies with the RS-232 standard. They are 9-pin connectors that relay information, incoming or outgoing, one byte at a time. Each byte is broken up into a series of eight bits, hence the term serial port. Serial ports are one of the oldest types of interface standards.

In traditional computers, serial ports were configured as follows:
Serial Ports Interrupt Memory Address
COM 1 IRQ 4 0x3f8
COM 2 IRQ 3 0x2f8
COM 3 IRQ 4 0x3e8
COM 4 IRQ 3 0x2e8
Devices configured to use serial ports COM 1 and COM 3 could not be active at the same time, as they shared interrupt IRQ 4. The same was true of COM 2 and COM 4 port devices. The serial port is much more than just a connector. It converts the data from parallel to serial and changes the electrical representation of the data.
Serial flow is a stream of bits over a single wire (such as on the transmit or receive pin of the serial connector). For the serial port to create such a flow, it must convert data from parallel (inside the computer) to serial on the transmit pin (and conversely).
The advantage is that a serial port needs only one wire to transmit the 8 bits (while a parallel port needs 8). The disadvantage is that it takes 8 times longer to transmit the data than it would if there were 8 wires. Serial ports lower cable costs and make cables smaller. Serial ports, also called communication (COM) ports, are bi-directional. Bi-directional communication allows each device to receive data as well as transmit it.
Serial ports rely on a special controller chip, the Universal Asynchronous Receiver/Transmitter (UART), to function properly. The UART chip takes the parallel output of the computer's system bus and transforms it into serial form for transmission through the serial port. In order to function faster, most UART chips have a built-in buffer of anywhere from 16 to 64 kilobytes. This buffer allows the chip to cache data coming in from the system bus while it is processing data going out to the serial port.