by Gabriel Ng
Introduction
In order to expand, most companies either grow organically or acquire new businesses. For newly acquired business, there will be a lot of groundwork need to be done to merge the acquired companies IT System to the purchaser company IT System. In IT Infrastructure areas, there are basic requirements that cannot be ignored especially if the new business is in another location or country. These requirements will assist in mitigating the risk of possible security threats from Internet such as trojans, viruses, and worms, hackers damaging business servers or worst unauthorized intrusion retrieving valuable data.
Basic IT Infrastructure investment includes:
a)Firewall
A proper firewall should have Packet filter, Stateful level protection, IPS, Anti-Spyware, Web Anti-Virus that acts as the first line of defense against any attacks, security threat from the Internet.
A Web-based firewall with easy secured configuration menu is preferred. Further, this is suitable for offices that are lack of dedicated local IT personnel. The HQ IT Experts can remotely assist in administering this firewall for the remote office. Remote administration should be via a secured HTTPS channel. Lookout for reputable firewalls that comes with built-in VPN, Web-based Application Filter (Proxy) Anti Virus and also Intrusion Protection.
b) Anti-Virus
To implement the first layer of anti-virus to protect the servers and PCs from harmful viruses, it will be advisable to setup a central Anti-Virus server in the HQ. This meant all acquired offices require are to install the Anti-Virus clients into their local servers and PCs. Management of the latest virus pattern file, scheduled scanning, and licence management will be centrally managed by HQ IT team using the central anti-virus Server.
Note: When your IT Infrastructure grows, it is better to place your servers in a proper Tier 3 or 4 Data Centre. These Data Centres often guarantees electrical and air-condition supply with a SLA agreement of 99.99%. If the HQ servers are not in a proper Data Centre, imagine a severe electrical outage may just cripple your main servers and also all your acquired companies and subsidiaries IT Systems.
c)E-Mail
Instead of investing ground up on an Industry standard communication software such as Lotus or Exchange E-Mail system, it will be advisable that the new acquired company also take advantage of your HQ E-Mail system. The acquired company only requires to install E-Mail clients and can start utilizing the e-mail for communication and data delivery (if required). The E-Mail system will also be administered centrally.
To mitigate risk further, HQ E-Mail system should be clustered for high-availability and comes with dual layer anti-virus systems, anti-spam and anti-relay mechanisms to mitigate risk of E-Mail viruses, spam and relay attacks.
d)Tape Backup System
To reduce the risk of not been able to recover data in the event of server or database failure, a proper tape backup should be implemented. It is recommended to use enterprise Backup Systems (e.g. CA, Veritas) software that comes with Open File Agent (allows to backup files that are currently still open), SQL Backup Agent (allows to backup database without shutting down the database). It will be prudent to conduct daily, weekly, monthly and yearly backups. Monthly and yearly backups should be kept off-site.
e) Telecommunication line
Option 1)
A WAN (Wide Area Network) link will provide a stable communication line given the provider will guarantee a minimum bandwidth. E-Mail replications, Business related application connections will be more predictable on a WAN line. As you have more subsidiaries and new acquired offices, you can leverage onyour numbers with your WAN provider for a better pricing and services. WAN links are costly but are stable and critical if your business relies on fast and reliable International connectivity.
Option 2)
Cost effective Internet lease line or broadband. This meant connection between the offices to HQ is via Internet. However, please note Internet connection is "best effort" where there is no guarantees of bandwidth or uptime. This is a cheaper solution that WAN.
For secure communication between the offices, I would recommend implementing VPN (Virtual Private Network) connections between these offices. This will facilitate encrypted communication between the offices.
These are basic measures that should be in place before allowing communications between these new offices and your HQ data servers. The impact is severe if security threats were to spread to your HQ and other offices from a new business via WAN or private lease lines.
About the Author
Gabriel Ng is a professional IT Security Consultant, IT Auditor (CISSP) and author of http://www.comsectutorial.com This site is setup to provide information, recommendation on hacking prevention, controls to minimise security threats from viruses, trojans, spywares, hacking based real life experience while conducting security assessment and penetration tests onsite in Asia, Europe and Africa.
Wednesday, February 20
Basic IT Infrastructure Investments That Cannot Be Ignored For An Acquired New Business
Wednesday, February 6
Windows Server 2008 Delivers Web-based Experiences
by Nick Pegley
For increased control of your servers, efficient management, and configured Web tasks, there's Windows PowerShell, Windows Server Manager and IIS7. eNetwork Access Protection and Read-Only Domain Controller protect and fortify the server environment, putting your business on a strong foundation.
Internet Info Services 7 simplifies management of Web services. As a modular platform with an interface based on tasks, better control, improved security, and Web service health management, the user connects to their information and to others using Info Server (IIS) 7.0 and .NET 3.0. Visualization, sharing and acting upon the information with this inclusive apps platform.
It's possible to virtualize multiple operating systems to one server to max out the value, and virtual capabilities are bundled with the operating system for more flexible licensing. Sever 2008 facilitates dynamic data centers to meet business needs. Optimized for remote access and integrated apps, Terminal Services' Gateway and RemoteApp apply secure app deployment and do not require a VPN (Virtual Private Network).
Sever 2008 does a great job creating a hard operating system with great security features including network access protection, rights management, and read-only domain control. Levels of security which were previously not possible are now available for your business network data, including defense against data failure and network intrusion.
Machines that disobey the company's security policies are isolated by Network Access Protection, which completes ongoing maintenance including checks of compliance and remediation. Sensitive information is persistently protected by Federated Rights Management Services to lower the risk and make compliance possible in a total info protection system. Read-Only Domain Controller deploys Active Directory Domain Services while disallowing copying of the entire data base for better defense against data compromise.
Windows Server 2008, the most robust and flexible OS available, comes with Server Core, Windows Deployment Services, PowerShell, and better clustering technology, providing the best reliability and flexibility for your needs. Faster setup and configuration is possible, as well as easy ongoing management with a unified management console.
PowerShell, a command-line shell with over one hundred tools, uses a script language that lets sysadmins make routine tasks fully automated across servers. The new installation option Server Core has only the required components to provide good server availability with less service updates - without using a graphical user interface.
About the Author
Nick Pegley is a marketing expert with All Covered: Technology Services Partner for Small Business, providing information technology consulting and IT services in 20 major U.S. metro areas. Outsource your procurement, installation and technical headaches.
Understanding The International Private Leased Circuit (Or IPLC) Line of Oracle Contact Center Anywhere of Promero
by Remy Na
The IPLC system stands for international private leased circuit line which serves as a private point-to-point system used for communication between members of an organization who are occupying offices in various parts of the world. This private communication line can accommodate message delivery via different telecommunication systems like video conferencing, business data exchange, and the more common Internet access between members of the same organization, same company or same association (as deemed necessary.)
The IPLC is the deployment system used in the Promero offering dubbed Oracle Contact Center Anywhere which is a call center solution made by software developer Oracle. Oracle Contact Center Anywhere is used to create virtual call centers all around the world. To implement use of IPLC by call centers in the past, each call center had to file an application with one carrier to carry one private leased circuit line in one country, while contacting a different carrier in another country to carry the second private leased circuit …#34; so essentially, the contact center company would have to create one invoice per carrier per country.
But nowadays, a call center can rely on the OSS method (or One Stop Shopping method) for handling the billing of two lines (even if one line is in one country and the other line is used in another country) via just one invoice. With the IPLC One Stop Shopping method, one call center can manage currency issues, with just one carrier handling the IPLC systems in either country. This makes life easier for the call center so that it will only be doing business with one carrier for both lines. The IPLC is also good to use if the call center will be relying on bandwidth-intensive applications for its call center tasks. This is because the IPLC can supply enough bandwidth even for such bandwidth-intensive applications. At the same time, the IPLC will be able to handle seamless integration of voice, data and imaging services as needed. This means your enterprise can be able to conduct video conferencing, telemedicine, conferencing between different Local Area Networks (or LAN-to-LAN), and of course Internet access.
This does not mean that the IPLC is the perfect communication system for a call center or similar enterprise to use. The IPLC also has its disadvantages such as when various traffic varieties rely on the network, and display different traffic engineering features and influence setting performance in their respective ways. In India, there are now more carriers competing as IPLC carriers which means that prices of services tend to fall as a result. Though at the moment India only permits ILDOs (or International Long Distance Operators) to serve as IPLC merchants, the ILD sector has been opened up too as of February 2007. The Indian government is also planning to permit the ILD sector known as the IPLC segment to be opened for Resale activities five years from February 2007.
About the Author
About Promero, Inc Founded in 2001, Promero www.Promero.com is a Certified Partner in the Oracle Partner Network and is a leading application service provider of Internet-based call center, CRM and lead management software. Promero's products include Oracle's Contact Center Anywhere [a hosted virtu
Thursday, January 10
File Transfer Protocol
From Wikipedia, the free encyclopedia
This article is about the File Transfer Protocol standardised by the IETF. For other file transfer protocols, see File transfer protocol (disambiguation).
"FTP" redirects here. For other uses, see FTP (disambiguation).
FTP or File Transfer Protocol is used to transfer data from one computer to another over the Internet, or through a network.
Specifically, FTP is a commonly used protocol for exchanging files over any TCP/IP based network to manipulate files on another computer on that network regardless of which operating systems are involved (if the computers permit FTP access). There are many existing FTP client and server programs. FTP servers can be set up anywhere between game servers, voice servers, internet hosts, and other physical servers.
Contents
1 Connection methods
2 Criticisms of FTP
3 Security problems
4 FTP return codes
5 Anonymous FTP
6 Data format
7 FTP and web browsers
8 FTP and NAT devices
9 FTP over SSH
10 References
11 See also
11.1 FTP-like protocols
11.2 Software
12 External links
12.1 Tutorial/overview
Connection methods
FTP runs exclusively over TCP. FTP servers by default listen on port 21 for incoming connections from FTP clients. A connection to this port from the FTP Client forms the control stream on which commands are passed to the FTP server from the FTP client and on occasion from the FTP server to the FTP client. FTP uses out-of-band control, which means it uses a separate connection for control and data. Thus, for the actual file transfer to take place, a different connection is required which is called the data stream. Depending on the transfer mode, the process of setting up the data stream is different.
In active mode, the FTP client opens a random port (> 1023), sends the FTP server the random port number on which it is listening over the control stream and waits for a connection from the FTP server. When the FTP server initiates the data connection to the FTP client it binds the source port to port 20 on the FTP server.
In order to use active mode, the client sends a PORT command, with the IP and port as argument. The format for the IP and port is "h1,h2,h3,h4,p1,p2". Each field is a decimal representation of 8 bits of the host IP, followed by the chosen data port. For example, a client with an IP of 192.168.0.1, listening on port 1025 for the data connection will send the command "PORT 192,168,0,1,4,1". The port fields should be interpreted as p1×256 + p2 = port, or, in this example, 4×256 + 1 = 1025.
In passive mode, the FTP server opens a random port (> 1023), sends the FTP client the server's IP address to connect to and the port on which it is listening (a 16 bit value broken into a high and low byte, like explained before) over the control stream and waits for a connection from the FTP client. In this case the FTP client binds the source port of the connection to a random port greater than 1023.
To use passive mode, the client sends the PASV command to which the server would reply with something similar to "227 Entering Passive Mode (127,0,0,1,78,52)". The syntax of the IP address and port are the same as for the argument to the PORT command.
In extended passive mode, the FTP server operates exactly the same as passive mode, however it only transmits the port number (not broken into high and low bytes) and the client is to assume that it connects to the same IP address that was originally connected to. Extended passive mode was added by RFC 2428 in September 1998.
While data is being transferred via the data stream, the control stream sits idle. This can cause problems with large data transfers through firewalls which time out sessions after lengthy periods of idleness. While the file may well be successfully transferred, the control session can be disconnected by the firewall, causing an error to be generated.
The FTP protocol supports resuming of interrupted downloads using the REST command. The client passes the number of bytes it has already received as argument to the REST command and restarts the transfer. In some commandline clients for example, there is an often-ignored but valuable command, "reget" (meaning "get again") that will cause an interrupted "get" command to be continued, hopefully to completion, after a communications interruption.
Resuming uploads is not as easy. Although the FTP protocol supports the APPE command to append data to a file on the server, the client does not know the exact position at which a transfer got interrupted. It has to obtain the size of the file some other way, for example over a directory listing or using the SIZE command.
In ASCII mode (see below), resuming transfers can be troublesome if client and server use different end of line characters.
The objectives of FTP, as outlined by its RFC, are:
To promote sharing of files (computer programs and/or data).
To encourage indirect or implicit use of remote computers.
To shield a user from variations in file storage systems among different hosts.
To transfer data reliably, and efficiently.
Criticisms of FTP
Passwords and file contents are sent in clear text, which can be intercepted by eavesdroppers. There are protocol enhancements that circumvent this, for instance by using SSL or TLS.
Multiple TCP/IP connections are used, one for the control connection, and one for each download, upload, or directory listing. Firewalls may need additional logic and or configuration changes to account for these connections.
It is hard to filter active mode FTP traffic on the client side by using a firewall, since the client must open an arbitrary port in order to receive the connection. This problem is largely resolved by using passive mode FTP.
It is possible to abuse the protocol's built-in proxy features to tell a server to send data to an arbitrary port of a third computer; see FXP.
FTP is a high latency protocol due to the number of commands needed to initiate a transfer.
No integrity check on the receiver side. If a transfer is interrupted, the receiver has no way to know if the received file is complete or not. Some servers support extensions to calculate for example a file's MD5 sum (e.g. using the SITE MD5 command) or CRC checksum, however even then the client has to make explicit use of them. In the absence of such extensions, integrity checks have to be managed externally.
No date/timestamp attribute transfer. Uploaded files are given a new current timestamp, unlike other file transfer protocols such as SFTP, which allow attributes to be included. There is no way in the standard FTP protocol to set the time-last-modified (or time-created) datestamp that most modern filesystems preserve. There is a draft of a proposed extension that adds new commands for this, but as of yet, most of the popular FTP servers do not support it.
Security problems
The original FTP specification is an inherently insecure method of transferring files because there is no method specified for transferring data in an encrypted fashion. This means that under most network configurations, user names, passwords, FTP commands and transferred files can be "sniffed" or viewed by anyone on the same network using a packet sniffer. This is a problem common to many Internet protocol specifications written prior to the creation of SSL such as HTTP, SMTP and Telnet. The common solution to this problem is to use either SFTP (SSH File Transfer Protocol), or FTPS (FTP over SSL), which adds SSL or TLS encryption to FTP as specified in RFC 4217.
FTP return codes
Main article: List of FTP server return codes
FTP server return codes indicate their status by the digits within them. A brief explanation of various digits' meanings are given below:
1xx: Positive Preliminary reply. The action requested is being initiated but there will be another reply before it begins.
2xx: Positive Completion reply. The action requested has been completed. The client may now issue a new command.
3xx: Positive Intermediate reply. The command was successful, but a further command is required before the server can act upon the request.
4xx: Transient Negative Completion reply. The command was not successful, but the client is free to try the command again as the failure is only temporary.
5xx: Permanent Negative Completion reply. The command was not successful and the client should not attempt to repeat it again.
x0x: The failure was due to a syntax error.
x1x: This response is a reply to a request for information.
x2x: This response is a reply relating to connection information.
x3x: This response is a reply relating to accounting and authorization.
x4x: Unspecified as yet
x5x: These responses indicate the status of the Server file system vis-a-vis the requested transfer or other file system action
Anonymous FTP
Many sites that run FTP servers enable anonymous ftp. Under this arrangement, users do not need an account on the server. The user name for anonymous access is typically 'anonymous'. This account does not need a password. Although users are commonly asked to send their email addresses as their passwords for authentication, usually there is trivial or no verification, depending on the FTP server and its configuration. As modern FTP clients hide the login process from the user and usually don't know the user's email address, they supply dummy passwords, for example:
Mozilla Firefox (2.0) — mozilla@example.com
KDE Konqueror (3.5) — anonymous@
wget (1.10.2) — -wget@
lftp (3.4.4) — lftp@
Internet Gopher has been suggested as an alternative to anonymous FTP, as well as Trivial File Transfer Protocol and File Service Protocol.
Data format
While transferring data over the network, several data representations can be used. The two most common transfer modes are:
ASCII mode
Binary mode: In "Binary mode", the sending machine sends each file bit for bit and as such the recipient stores the bitstream as it receives it.
In "ASCII mode", any form of data that is not plain text will be corrupted. When a file is sent using an ASCII-type transfer, the individual letters, numbers, and characters are sent using their ASCII character codes. The receiving machine saves these in a text file in the appropriate format (for example, a Unix machine saves it in a Unix format, a Windows machine saves it in a Windows format). Hence if an ASCII transfer is used it can be assumed plain text is sent, which is stored by the receiving computer in its own format. Translating between text formats might entail substituting the end of line and end of file characters used on the source platform with those on the destination platform, e.g. a Windows machine receiving a file from a Unix machine will replace the line feeds with carriage return-line feed pairs. It might also involve translating characters; for example, when transferring from an IBM mainframe to a system using ASCII, EBCDIC characters used on the mainframe will be translated to their ASCII equivalents, and when transferring from the system using ASCII to the mainframe, ASCII characters will be translated to their EBCDIC equivalents.
By default, most FTP clients use ASCII mode. Some clients try to determine the required transfer-mode by inspecting the file's name or contents, or by determining whether the server is running an operating system with the same text file format.
The FTP specifications also list the following transfer modes:
EBCDIC mode
Local mode
In practice, these additional transfer modes are rarely used. They are however still used by some legacy mainframe systems.
FTP and web browsers
Most recent web browsers and file managers can connect to FTP servers, although they may lack the support for protocol extensions such as FTPS. This allows manipulation of remote files over FTP through an interface similar to that used for local files. This is done via an FTP URL, which takes the form ftp(s)://
FTP and NAT devices
The representation of the IPs and ports in the PORT command and PASV reply poses another challenge for NAT devices in handling FTP. The NAT device must alter these values, so that they contain the IP of the NAT-ed client, and a port chosen by the NAT device for the data connection. The new IP and port will probably differ in length in their decimal representation from the original IP and port. This means that altering the values on the control connection by the NAT device must be done carefully, changing the TCP Sequence and Acknowledgment fields for all subsequent packets.
For example: A client with an IP of 192.168.0.1, starting an active mode transfer on port 1025, will send the string "PORT 192,168,0,1,4,1". A NAT device masquerading this client with an IP of 192.168.15.5, with a chosen port of 2000 for the data connection, will need to replace the above string with "PORT 192,168,15,5,7,208".
The new string is 23 characters long, compared to 20 characters in the original packet. The Acknowledgment field by the server to this packet will need to be decreased by 3 bytes by the NAT device for the client to correctly understand that the PORT command has arrived to the server. If the NAT device is not capable of correcting the Sequence and Acknowledgement fields, it will not be possible to use active mode FTP. Passive mode FTP will work in this case, because the information about the IP and port for the data connection is sent by the server, which doesn't need to be NATed. If NAT is performed on the server by the NAT device, then the exact opposite will happen. Active mode will work, but passive mode will fail.
It should be noted that many NAT devices perform this protocol inspection and modify the PORT command without being explicitly told to do so by the user. This can lead to several problems. First of all, there is no guarantee that the used protocol really is FTP, or it might use some extension not understood by the NAT device. One example would be an SSL secured FTP connection. Due to the encryption, the NAT device will be unable to modify the address. As result, active mode transfers will fail only if encryption is used, much to the confusion of the user.
The proper way to solve this is to tell the client which IP address and ports to use for active mode. Furthermore, the NAT device has to be configured to forward the selected range of ports to the client's machine.
See also Application-level gateway
FTP over SSH
FTP over SSH refers to the practice of tunneling a normal FTP session over an SSH connection.
Because FTP uses multiple TCP connections (unusual for a TCP/IP protocol that is still in use), it is particularly difficult to tunnel over SSH. With many SSH clients, attempting to set up a tunnel for the control channel (the initial client-to-server connection on port 21) will protect only that channel; when data is transferred, the FTP software at either end will set up new TCP connections (data channels) which will bypass the SSH connection, and thus have no confidentiality, integrity protection, etc.
If the FTP client is configured to use passive mode and to connect to a SOCKS server interface that many SSH clients can present for tunneling, it is possible to run all the FTP channels over the SSH connection.
Otherwise, it is necessary for the SSH client software to have specific knowledge of the FTP protocol, and monitor and rewrite FTP control channel messages and autonomously open new forwardings for FTP data channels. Version 3 of SSH Communications Security's software suite, and the GPL licensed FONC are two software packages that support this mode.
FTP over SSH is sometimes referred to as secure FTP; this should not be confused with other methods of securing FTP, such as with SSL/TLS (FTPS). Other methods of transferring files using SSH that are not related to FTP include SFTP and SCP; in each of these, the entire conversation (credentials and data) is always protected by the SSH protocol.
How Does Voip Work?
by Dave Markel
To make your VoIP (Voice over Internet Protocol) work good enough you need to have broadband internet connection. Internet broadband connections are represented with cable or DSL modems with bandwidth of 56 kbits and higher.
The main idea of VoIP is voice connection using computers. All you need is appropriate software installed on your computer and microphone with a headset or speakers connected. Do not forget that using such software is free and easy to download.
Unlike computer-to-computer calls which are free of charge VoIP software is also used as simple trunk-line. But even so such calls are still cheaper then phone-to-phone ones.
Remember- to make computer-to-computer calls you should run the same software at both sides. But in case of making cellular or land-line call via VoIP no extra software or equipment is needed.
How does it work?
All internet transmissions including VoIP appear to be digital data that travels through the telephone, optical fiber or even satellite lines. To transmit the voice signal VoIP software must convert human (analog) voice to the set of 1s and 0s (digital data). It is done with the help of ADC (analog-to-digital converters) and codecs which compress and decompress (on receive) data to make it more compact during transfer.
Compressed data is divided into packets. Without going into details i can say that these packets consist of the header and the body. Headers contain source and destination addresses and other system data. And the body is the spitted and compressed audio file.
All data transmitted over internet follows the set of rules gathered in the models (OSI, TCP/IP). Models consist of layers that represent particular network function.
Video and audio transmission use the set of protocols originally developed or changed for faster work over the internet. Transport layer in VoIP is usually represented with User Datagram Protocol (UDP). And the application layer is Real-time Transport Protocol (RTP).
Drop of delayed packets is the main advantage of RTP. By doing so the VoIP software skips the delayed packets that must be reassembled and decoded. It is quite preferable because it prevents undesirable pauses in the conversation. Even if the amount of dropped packets is big enough the conversation is still legible. Of course, the better internet connection you possess- the better conversation you'll be having after the remote software will receive, reassemble and decode data into the analog signal (human voice).
About the Author
Dave Markel is the owner of a Voip Services Blog. Visit it at http://voip--services.blogspot.com
Dynamic Host Configuration Protocol
DHCP" redirects here. This article is about the networking protocol. For other uses, see DHCP (disambiguation).
From Wikipedia, the free encyclopedia
Applicability
Dynamic Host Configuration Protocol is a way to administer network parameter assignment at a single DHCP server, or a group of such servers arranged in a fault-tolerant manner. Even in a network which has a few machines, Dynamic Host Configuration Protocol is useful, because a machine can be added to the local network with little effort.
Even for servers whose addresses rarely change, DHCP is recommended for setting their addresses, so if the servers need to be readdressed (RFC2071), the changes need to be made in as few places as possible. For devices, such as routers and firewalls, that should not use DHCP, it can be useful to put TFTP or SSH servers on the same machine that runs DHCP, again to centralize administration.
DHCP is also useful for directly assigning addresses to servers and desktop machines, and, through a PPP proxy, for dialup and broadband on-demand hosts, as well as for residential NAT gateways and routers. DHCP is usually not appropriate for infrastructure such as non-edge routers and DNS servers.
History
DHCP emerged as a standard protocol in October 1993, succeeding the BOOTP protocol. The current DHCP definition can be found in RFC 2131, while a proposed standard for DHCP over IPv6 (DHCPv6) can be found in RFC 3315.
Basic Protocol Operation
The Dynamic Host Configuration Protocol (DHCP) automates the assignment of IP addresses, subnet masks, default gateway, and other IP parameters. [1]
When a DHCP-configured client (be it a computer or any other network aware device) connects to a network, its DHCP client sends a broadcast query requesting necessary information from a DHCP server. The DHCP server manages a pool of IP addresses and information about client configuration parameters such as the default gateway, the domain name, the DNS servers, other servers such as time servers, and so forth. Upon receipt of a valid request the server will assign the computer an IP address, a lease (the length of time for which the allocation is valid), and other TCP/IP configuration parameters, such as the subnet mask and the default gateway. The query is typically initiated immediatetly after booting and must be completed before the client can initiate IP-based communication with other hosts.
DHCP provides three modes for allocating IP addresses. The best-known mode is dynamic, in which the client is provided a "lease" on an IP address for a period of time. Depending on the stability of the network, this could range from hours (a wireless network at an airport) to months (for desktops in a wired lab). At any time before the lease expires, the DHCP client can request renewal of the lease on the current IP address. A properly-functioning client will use the renewal mechanism to maintain the same IP address throughout its connection to a single network, otherwise it may risk losing its lease while still connected, thus disrupting network connectivity while it renegotiates with the server for its original or a new IP address.
The two other modes for allocation of IP addresses are automatic (also known as DHCP Reservation), in which the address is permanently assigned to a client, and manual, in which the address is selected by the client (manually by the user or any other means) and the DHCP protocol messages are used to inform the server that the address has been allocated.
The automatic and manual methods are generally used when finer-grained control over IP address is required (typical of tight firewall setups), although typically a firewall will allow access to the range of IP addresses that can be dynamically allocated by the DHCP server.
Security
Due to its standardization before Internet security became an issue, the basic DHCP protocol does not include any security provisions, potentially exposing it to two types of attacks:[2]
Unauthorized DHCP Servers: as you can not specify the DHCP you want, an unauthorized server can respond to client requests, sending the client network configuration values that are beneficial to a hijacker. As an example, a hacker can configure the DHCP server to configure clients to a DNS server which has been poisoned.
Unauthorized DHCP Clients: By masquerading as a legitimate client an unauthorized client can gain access to network configuration and an IP on a network it should otherwise not be allowed to connect to. Also, by flooding the DHCP server with requests for IP addresses it is possible for an attacker to exhaust the pool of available IP addresses, disrupting normal network activity.
To combat these threats RFC 3118 ("Authentication for DHCP Messages") introduced authentication information into DHCP messages allowing clients and servers to reject information from invalid sources. Although support for this protocol is widespread a large number of clients and servers still do not fully support authentication, forcing servers to support clients that do not support this feature. As a result other security measures are usually implemented around the DHCP server (such as IPsec) to ensure that only authenticated clients and servers are granted access to the network.
Wherever possible, DHCP-assigned addresses should be dynamically linked to a secure DNS server, to allow troubleshooting by name rather than by a potentially unknown address. Effective DHCP-DNS linkage requires having a file of either MAC addresses, or local names that will be sent to DNS, that uniquely identifies physical hosts.IP addresses and other parameters such as the default gateway, subnet mask, and IP addresses of DNS servers from a DHCP server. The DHCP server ensures that all IP addresses are unique, e.g., no IP address is assigned to a second client while the first client's assignment is valid (its lease has not expired). Thus IP address pool management is done by the server and not by a network administrator.plz ref.This
IP address allocation
Depending on implementation, the DHCP server has three methods of allocating IP-addresses:
dynamic allocation: A network administrator assigns a range of IP addresses to DHCP, and each client computer on the LAN has its TCP/IP software configured to request an IP address from the DHCP server during network initialisation. The request-and-grant process uses a lease concept with a controllable time period, allowing the DHCP server to reclaim (and then allocate) IP addresses that are not renewed (dynamic re-use of IP addresses).
automatic allocation: The DHCP server permanently assigns a free IP address to a requesting client from the range defined by the administrator.
manual allocation: The DHCP server allocates an IP address based on a table with MAC address - IP address pairs manually filled in by the server administrator. Only requesting clients with a MAC address listed in this table will be allocated an IP address.
DHCP and firewalls
Firewalls usually have to permit DHCP traffic explicitly. Specification of the DHCP client-server protocol describes several cases when packets must have the source address of 0x00000000 or the destination address of 0xffffffff. Anti-spoofing policy rules and tight inclusive firewalls often stop such packets. Multi-homed DHCP servers require special consideration and further complicate configuration.
To allow DHCP, network administrators need to allow several types of packets through the server-side firewall. All DHCP packets travel as UDP datagrams; all client-sent packets have source port 68 and destination port 67; all server-sent packets have source port 67 and destination port 68. For example, a server-side firewall should allow the following types of packets:
Incoming packets from 0.0.0.0 or dhcp-pool to dhcp-ip
Incoming packets from any address to 255.255.255.255
Outgoing packets from dhcp-ip to dhcp-pool or 255.255.255.255
where dhcp-ip represents any address configured on a DHCP server host and dhcp-pool stands for the pool from which a DHCP server assigns addresses to clients
Example in ipfw firewall
To give an idea of how a configuration would look in production, the following rules for a server-side ipfirewall to allow DHCP traffic through. Dhcpd operates on interface rl0 and assigns addresses from 192.168.0.0/24 :
pass udp from 0.0.0.0,192.168.0.0/24 68 to me 67 in recv rl0
pass udp from any 68 to 255.255.255.255 67 in recv rl0
pass udp from me 67 to 192.168.0.0/24,255.255.255.255 68 out xmit rl0
Example in Cisco IOS Extended ACL
The following entries are valid on a Cisco 3560 switch with enabled DHCP service. The ACL is applied to a routed interface, 10.32.73.129, on input. The subnet is 10.32.73.128/26.
10 permit udp host 0.0.0.0 eq bootpc host 10.32.73.129 eq bootps
20 permit udp 10.32.73.128 0.0.0.63 eq bootpc host 10.32.73.129 eq bootps
30 permit udp any eq bootpc host 255.255.255.255 eq bootps
Technical details
Schema of a typical DHCP sessionDHCP uses the same two IANA assigned ports as BOOTP: 67/udp for the server side, and 68/udp for the client side.
DHCP operations fall into four basic phases. These phases are IP lease request, IP lease offer, IP lease selection, and IP lease acknowledgement.
After the client obtained an IP address, the client may start an address resolution query to prevent IP conflicts caused by address pool overlapping of DHCP servers.
DHCP discovery
The client broadcasts on the physical subnet to find available servers. Network administrators can configure a local router to forward DHCP packets to a DHCP server on a different subnet. This client-implementation creates a UDP packet with the broadcast destination of 255.255.255.255 or subnet broadcast address.
A client can also request its last-known IP address (in the example below, 192.168.1.100). If the client is still in a network where this IP is valid, the server might grant the request. Otherwise, it depends whether the server is set up as authoritative or not. An authoritative server will deny the request, making the client ask for a new IP immediately. A non-authoritative server simply ignores the request, leading to an implementation dependent time out for the client to give up on the request and ask for a new IP address.
DHCP offers
When a DHCP server receives an IP lease request from a client, it extends an IP lease offer. This is done by reserving an IP address for the client and sending a DHCPOFFER message across the network to the client. This message contains the client's MAC address, followed by the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer.
The server determines the configuration, based on the client's hardware address as specified in the CHADDR field. Here the server, 192.168.1.1, specifies the IP address in the YIADDR field.
DHCP requests
When the client PC receives an IP lease offer, it must tell all the other DHCP servers that it has accepted an offer. To do this, the client broadcasts a DHCPREQUEST message containing the IP address of the server that made the offer. When the other DHCP servers receive this message, they withdraw any offers that they might have made to the client. They then return the address that they had reserved for the client back to the pool of valid addresses that they can offer to another computer. Any number of DHCP servers can respond to an IP lease request, but the client can only accept one offer per network interface card.
===information that the client might have requested. At this point, the TCP/IP configuration process is complete.
The server acknowledges the request and sends the acknowledgement to the client. The system as a whole expects the client to configure its network interface with the supplied options.
DHCP information
The client sends a request to the DHCP server: either to request more information than the server sent with the original DHCPACK; or to repeat data for a particular application - for example, browsers use DHCP Inform to obtain web proxy settings via WPAD. Such queries do not cause the DHCP server to refresh the IP expiry time in its database.
DHCP releasing
The client sends a request to the DHCP server to release the DHCP and the client unconfigures its IP address. As clients usually do not know when users may unplug them from the network, the protocol does not mandate the sending of DHCP Release.
Client configuration parameters
A DHCP server can provide optional configuration parameters to the client. RFC 2132 describes the available DHCP options defined by Internet Assigned Numbers Authority (IANA) - DHCP and BOOTP PARAMETERS.
Options
DHCP Option 60 is an option for specifying the Vendor Class Identifier.[3] Within the DHCP there is default route. Option60 is the Vendor ID. Based on this option, you can make special decisions on the CPE to treat the STB. The biggest benefit with using DHCP option 60 is that you do not need to define a port to be bridge or router. Bridging is based on the MAC address of the option 60 so a switch could be connected to the SE567 and have both PC's and STB's on a single interface.
Option 60 can be used by DHCP clients to identify the vendor and functionality of a DHCP client. The information is a variable length string of characters or octets which has a meaning specified by the vendor of the DHCP client. One method that a DHCP client can communicate that it is using a certain type of hardware or firmware, is to set a value in its DHCP requests called the Vendor Class Identifier (VCI) (Option 60). This method has a DHCP server differentiate between the two kinds of CMs and process the requests from the two types of modems appropriately. Some types of set-top boxes also set the VCI (Option 60) to inform the DHCP server about the hardware type and functionality of the device. The value that this option is set to gives the DHCP server a hint about any required extra information that this client needs in a DHCP response.
