I spoke briefly about wireless in a previous post. Here, I’ll discuss some observations from on-the-job learning.

Frequencies

In our setting, the main frequencies we use are 2.4GHz and 5GHz, which is newer. There a pros and cons to each which, although known in theory, can still require on-site experimentation and measurement (with a wifi analyzer) to find the best options. Also, some devices deployed still can’t use 5GHz, so we have to keep that in mind as well.

2.4GHz has lower bandwidth, so it can’t carry data as quickly, BUT it isn’t disrupted as much by walls and has a longer range the 5GHz.  5GHz is faster BUT it has less range and has a harder time getting through walls. This means that knowledge of the AP (access point) placement, as well as the design of the building and expected working areas, is required to determine which frequency to use. Fortunately, the devices we deploy have (at least) two antennae, so we can broadcast on both frequencies.

We also have to be mindful of the standards supported by the devices themselves. This is seen in the “letters” that often follow the channel or frequency listing. The letters reference that actual IEEE standard for the technology – 802.11, 802.11b, 802.11a, 802.11g, 802.11n, and so on. Newer technologies support higher link rates, and different frequencies, but older devices may not support them. We’ve had a few locations where we’ve had to use older, slower technologies because that’s all that was supported on the client devices themselves.

Channel Width

Moving along, we also have Channel Width – this is essentially how “wide” our signal is allowed to be within the frequency we’re using. For example, 2.4GHz is a range of frequencies from 2.4GHz to 2.5GHz – a 100 MHz range. The more channels we have, the more devices can communicate, BUT the more likely they are to interfere with each other, and the less bandwidth available to them. So channel width is a tradeoff between channel overlap and bandwidth – the more bandwidth we allow, the fewer channels available.

 Wifi Network Type

In our setting, we have three WiFi network types available – bridge, ad hoc, and mesh.

In Bridge networks, the Access Point is basically just a “bridge” back to the main network device (a firewall in our case). If we use integrated Access Points, we can define all of the wifi information on the firewall, plug the APs in, and they’ll just work. If we use other-vendor APs, we have to define the SSID etc. on the AP, which, when connected to by a wireless device, “bridges” the signal back to the firewall.

I’ve only seen an Ad Hoc network once – this is when the devices just communicate directly with each other over wifi. We only had to do it when the network died, so we got the sales PC wirelessly talking to the sales printer. It was ugly and I don’t recommend it at all if other options are available.

Finally, there’s Mesh wifi. We’ve only had to use it when there’s no easy way to get a wired connection from the APs back to the main network. In Mesh Networking, the AP doesn’t just wireless communicate with the client devices; it also uses a wireless connection to get back to the main network hub.

Conclusion

All that said, we’re fortunate in that, for the most part, our wifi setup is pretty straightforward. We configure the SSID and password on the firewall, plug in our (same-vendor) APs, and done. It’s rare that we have to do much more than that.

I’ll say up front that I’ve had less experience with these, but hopefully it’ll be somewhat useful. I’ll address Wireless up front, as all the rest are some type of wired media.

Wireless/WiFi

This is WiFi/Wireless that’s used by cell phones, tablets, and wifi-enabled laptops & desktops. It has the advantage of not requiring a wire (obviously), but it has a few downsides as well. In my experience, I always prefer wired if I can because of these downsides. First, walls and distance become a factor that can make wifi unreliable or unavailable. Also, the transmission speeds tend to be lower due to the signal being attenuated over distances & through obstacles. Also, it can technically be less secure as it’s easier for a less tech-savvy user to use an insecure connection method which allows their traffic to be intercepted. But obviously, the advantage of being mobile and able to use the device is much superior to the downsides in certain settings.

The rest of these are wired methods

Ethernet

This is the common “computer cable” you’re used to – Cat5, Cat6, “networking cable”, “weird phone cable”, etc. The Cat-* just indicates which generation the cable is. Higher numbers are later generation and are faster & more modern. Compatibility can be an issue, so don’t assume that buying a more recent cable will automatically make the connection faster, as the other network equipment may not support it.

Ethernet uses the RJ-45, which, when on the phone with non-tech savvy folks, I will summarize as “a wider phone connection, but too large to fit into a phone jack).

Ethernet is cheap and common, but there are length restrictions to it – you can’t run an ethernet cable hundreds of feet and expect a good connection (though I’ve had customers try that). After a few hundred feet, you’ll need SOMETHING to boost the signal – either a switch or a dedicated device.

For longer runs, we use:

Fiber

Fiberoptic cable uses one (or more; usually more) tiny, thin glass threads to send the signal along at near-light speed. While it can handle longer distances and is much faster than ethernet, it’s a lot more fragile (since the inside is glass threads instead of copper wires). So we either 1) use it in short runs to connect switches to each other, since that’s usually locked away in a network closet, or 2) run it through conduit longer distances to provide fast connections more remote locations.

Coax[ial] Cable

You’re probably used to seeing this as the Cable connection for the TVs. We don’t use it ourselves, but it is commonly used by ISPs to connect their cable run to their equipment, which we then bridge to our equipment either with Ethernet or Fiber. I see it as something of a tradeoff between Ethernet and Fiber – it has the long-range of Fiber and the sturdiness of Ethernet, with a price that’s probably in the middle (although I haven’t priced it out in a while). But it’s not as fast as Fiber, so, since we CAN get fiber and run it, we tend to use that for the backbone of our networks (connecting our switches to each other and eventually to the firewall/routers), as fiber doesn’t have as much issue with traffic congestion as cable does.

SFP Modules

Fortunately, most of our equipment comes with “SFP” module interfaces. This is a great feature on our equipment where it comes with an empty port. Into that port we plug an SFP (small form-factor pluggable) module which functions like a converter to ethernet, fiber, coax (and other) interfaces. So if we decide to swap what cable/wire we want to use, we can just replace the SFP module instead of the entire device. As indicated above, this is usually starting with an Ethernet SFP and then switching to a Fiber SFP when we need to handle more traffic.

Here’s some pics of SFP modules (shared with Creative Commons licenses)

In my last post, I discussed different devices that move your piece of information (“packets”) around your network, and also out to OTHER networks on the internet. In this post, I’ll look at a few different TYPEs of packets and what they do. Additionally, some protocols use custom “Ports” – not a physical port like a plug, but a software-defined port which is added as a “tag” to the network traffic to help the network devices understand what it is & where it’s going.

Ping

Ping is great for troubleshooting connection issues (which will be discussed more in a later post). Ping sends a packet out to an IP address that’s designated in the command and reports how long it takes to get a response, OR the error that arises if no response is given. There’s also the helpful -a flag which will try to resolve the Hostname for the IP via DNS (see below).

Tracert

Tracert is great for 1) determining how the traffic is flowing from your PC to the remote IP and 2) see where the connection is “breaking down” if it’s not resolving. It’s a pretty brilliant piece of software under the hood – basically, it increments the number of allowed “hops” (moves from one IP to another) and builds the chain that way. So first it tries to go to your destination IP but only allows 1 hop – so it’ll stop at the next IP in the chain (either your switch or router, probably), which then will report that there’s no more allowed hops and will give its name/IP. Then, tracert increments the allowed hops to ‘2’ so it will get to the next device IP, which will report on itself. It does this until it finally gets to its destination, and then reports the full list of IPs & hostnames. OR, if it fails to reach, you can see WHERE the failure occurred – somewhere AFTER the last successful IP/device.

SSL/TLS

Secure Sockets Layer and Transport Layer Security are cryptographic protocols for increasing security of network traffic. While the encryption methods & authentication systems are outside the scope of this post, they use a series of secret keys to encrypt & decrypt the data at each end of the traffic. Many older protocols will have a version with “S” appended to the end, indicating that it’s the Secure version.

SMTP/SMTPS

This is an actual data protocol, versus a troubleshooting one. In our setting, Simple Mail Transfer Protocol is used by 1) email servers delivering & receiving email to each other and 2) hacked computers sending spam. So on our firewalls, we ALLOW a local email server to send SMTP traffic, but BLOCK anything else from doing so.

A variant of SMTP is SMTPS (the S is for Secure) which is more secure as it uses TLS (Transport Layer Security) to authenticate the servers to each other to prevent security leaks. SMTP uses port 25, while SMTPS uses port 465. Some common email providers use alternate ports for SMTPS.

HTTP/HTTPS

This is your “web browsing” traffic – hence all webpages start with “HTTP(s)://). Hyper Text Transfer Protocol allows you to click on webpages and go to other webpages, or download something, etc. HTTP uses ports 80, while HTTPS (secure) uses 443.

FTP

File Transfer Protocol is used for transferring files from one system to another. It uses ports 20 & 21, based on what exactly is being done in the protocol (setting up the connection, reading files, or writing/sending them).

SSH

Secure SHell is used to remotely connect to other systems via a command line. It uses port 22. It’s helpful for remotely managing and working on other systems without having to setup a full Graphical User Interface. It can also be used to transfer files (SCP, SFTP).

DNS

Domain Name System is used to resolve IP address (like 64.233.177.138) to a Hostname (in this case, “google.com”). Computers only know numbers, while Humans prefer names. DNS is the “glue” to convert one to the other. It uses port 53.

DHCP

Dynamic Host Configuration Protocol, usually on ports 67 & 68, is used to determine what IP address a new device on the network will have assigned. A dedicated DHCP server is responsible for assigning the minimum information required to devices that ask. Generally, that’s

1. The IP address (what’s my local address on this network),
2. The subnet mask, used to determine how large the local network is so a device knows if an IP is nearby OR if it needs to send the traffic to
3. The IP of the Default Gateway, which is a routing device that will handle traffic needing to leave the local network.

The local PC will get its IP address, and then use the Subnet Mask to calculate what OTHER IPs will be on its local network. That way, if it needs to communicate with something directly, it’ll do so. Otherwise, it’ll know the IP address of the Default Gateway and will send the network traffic to THAT IP and allow the Gateway to handle moving it to its correct destination. Every device on the way will use this same structure to get the packet to where it needs to go.

This is already longer than I had intended, but this hopefully addresses the more commonly encountered ports & protocols.

This is the first of (hopefully) a serious of learnings, observations, troubleshooting steps, and informative stories learned at my new IT job.  While the job is generally “all IT related”, most of it is network-related due to the interconnectedness of everything among my employer’s systems. So, most of these posts will probably be somewhat network-related. Also, this will hopefully be used to for my CompTIA Continuing Ed credits if I end up not getting Security+ for that.

In this first post, I want to discuss the various pieces of networking hardware and their purposes. All of these are items I work with regularly at work, but they can also be encountered in a home setup.

Routers

                Routers handle…routing. That is, when a piece of information needs to travel on the network (aka a “packet”), the routers handle moving that packet FROM one network TO another (this differentiates them from Switches, below). In a later post I’ll discuss how the equipment knows what to do, but in the meantime just think of a router as a device that helps packets move outside their home network and find where they should go next.

                Many devices include a routing function – firewalls, dedicated routers, and so on. In a home setting, your ISP-provided equipment includes a router so that packets can get outside your home to the rest of the internet.

Switches

                A switch is, basically, a way to plug multiple network connections into a single device, which is then itself plugged in via a single cable somewhere else. A common setup might be that each PC/smart TV/etc. on a single floor of a building is plugged into a single switch for that floor (or, in a smaller building, a switch for the entire building). Then, the switch has a single cable run from it to another destination (a “master” switch, or a router/firewall). This removes the requirement to have EVERY cable from EVERY device plugged into your firewall/router.

Firewalls

                I’ve mentioned firewalls several times. These are a security device that handles packet/traffic flow according to pre-determined rules setup inside it. I think of a firewall as “a device that routes packets from one port to another based on the rules you set”. In my settings, the firewall sits between the switch(es), which are plugged into its “LAN” ports, and the ISP equipment, which is plugged into the firewall’s “WAN” port(s). Inside the software of the firewall, we determine what traffic can flow where (LAN to WAN and vice-versa) according to business needs.

                More advanced firewalls can also have routing functions, switching functions, DHCP/DNS functions, and more.

Access Points (APs)

                In our settings, APs are wireless APs. Via an ethernet cable run from the firewall/switch to the AP, the AP then broadcasts a WiFi signal for wireless devices to connect to. Based on the setup, they either expand an existing WiFi network, OR serve an independent wifi signal that’s routed back via the ethernet cable to the main network.

VPN

                Virtual Private Networks (VPNs) are a (usually) software-defined network that runs on computer. In  our setting, it’s an app that, after logging into it, connects via an encrypted tunnel to a firewall somewhere else. All traffic is 1) routed through the tunnel. This mean it can’t be snooped on our monitored in-transit, for security purposes. Additionally, since it “comes out” on the other end of the tunnel at the business firewall, 2) the computer can function as if it were physically plugged into the network at the business. This means that a laptop can connect to local resources at the office, but, when taken home, the VPN can be connected so the laptop can STILL connect to “local” (at the office) resources WITHOUT sacrificing security or having to allow those resources to have an open, inbound connection.

Summary

A common “connection” flow might be something like this:

INTERNET -> ISP Equipment -> Firewall/Router -> Switch(es) — many connections to different devices and access points. Additionally, a VPN (in our setting) logs into the Firewall and would be branches off of that.

That concludes a brief survey of networking equipment and applications. Next week, we’ll look at various Ports & Protocols that network traffic uses, and how that can be used on a firewall for increased security.