TechRecepies

Common Multicast Addresses

2009-12-22T05:35:00.001-08:00

224.0.0.0  Base Address (Reserved)
224.0.0.1  All Systems on this Subnet
224.0.0.2  All Routers on this Subnet
224.0.0.5  OSPFIGP  OSPFIGP All Routers
224.0.0.6  OSPFIGP  OSPFIGP Designated Routers
224.0.0.9  RIP2 Routers                         
224.0.0.10 IGRP Routers                          
224.0.0.11 Mobile-Agents                          
224.0.0.12 DHCP Server / Relay Agent               
224.0.0.14 RSVP-ENCAPSULATION                       
224.0.0.18 VRRP                                      
224.0.0.22 IGMP                                       
224.0.0.24 OSPFIGP-TE                                  
224.0.0.102 HSRP

Reserved IP Addresses

2009-12-22T02:46:00.000-08:00

   Address Block             Present Use                       Reference
  ---------------------------------------------------------------------
  0.0.0.0/8            "This" Network                 [RFC1700, page 4]
  10.0.0.0/8           Private-Use Networks                   [RFC1918]
  14.0.0.0/8           Public-Data Networks         [RFC1700, page 181]
  24.0.0.0/8           Cable Television Networks                    --
  39.0.0.0/8           Reserved but subject
                          to allocation                       [RFC1797]
  127.0.0.0/8          Loopback                       [RFC1700, page 5]
  128.0.0.0/16         Reserved but subject
                          to allocation                             --
  169.254.0.0/16       Link Local                                   --
  172.16.0.0/12        Private-Use Networks                   [RFC1918]
  191.255.0.0/16       Reserved but subject
                          to allocation                             --
  192.0.0.0/24         Reserved but subject
                          to allocation                             --
  192.0.2.0/24         Test-Net
  192.88.99.0/24       6to4 Relay Anycast                     [RFC3068]
  192.168.0.0/16       Private-Use Networks                   [RFC1918]
  198.18.0.0/15        Network Interconnect
                          Device Benchmark Testing            [RFC2544]
  223.255.255.0/24     Reserved but subject
                          to allocation                             --
  224.0.0.0/4          Multicast                              [RFC3171]
  240.0.0.0/4          Reserved for Future Use        [RFC1700, page 4]

Important Protocol and Port Numbers

2009-11-27T11:05:00.000-08:00

# 1----ICMP Internet Control Message
# 2----IGMP Internet Group Management
# 6----TCP Transmission Control
# 8----EGP Exterior Gateway Protocol
# 9----IGP any private interior gateway (used by Cisco for their IGRP)
# 17---UDP User Datagram
# 41---IPv6 Ipv6
# 46---RSVP Reservation Protocol
# 47---GRE General Routing Encapsulation
# 50---ESP
# 51---AH
# 61---any host internal protocol
# 63---any local network
# 68---any distributed file system
# 88---EIGRP EIGRP
# 89---OSPFIGP OSPFIGP
# 99---any private encryption scheme
# 112--VRRP Virtual Router Redundancy Protocol
# 115--L2TP Layer Two Tunneling Protocol
# 135--254 Unassigned
# 255--Reserved

HTTP ---------TCP 80
FTP ------------TCP 20,21
TelNet ---------TCP 23
SMTP ---------TCP 25
DNS -----------TCP/UDP 53
TFTP --------- UDP 69
SNMP -------- TCP 161
RIP ------------ UDP 520
IMAP 4------- TCP 143
IMAP 3 ------- TCP 220
ISAKMP-------UDP 500
RPC ------------ TCP 135
LDAP ---------- TCP 389
WINS ---------- TCP 42
BootP ---------- UDP 67
DHCP ---------- UDP 68
POP2 ----------- TCP 109
POP3 ----------- TCP 110
Net BIOS ------ TCP 139
SSL(HTTPS) ---- TCP 443
SQL Server ---- TCP 1433
NFS -------------- UDP 2049
SSH -------------- TCP 22
BGP -------------- TCP 179

EIGRP important points

2009-11-27T10:40:00.000-08:00

1. EIGRP can be referred to as a hybrid protocol. It combines most of the characteristics of traditional distance vector protocols with some characteristics of link-state protocols. Specifically, EIGRP is "enhanced" by using four routing technologies:

-Neighbor discovery/recovery

-Reliable Transport Protocol (RTP)

-DUAL finite-state machine

-Protocol-dependent modules

2. It could be argued that EIGRP's weakest point is that it is a Cisco-proprietary protocol, but with the aid of redistribution, this point becomes moot.

3. EIGRP is a classless routing protocol. It directly interfaces to IP as protocol 88. EIGRP uses the multicast address of 224.0.0.10 for hellos and routing updates.

4. Only partial routing updates are sent when network topology changes occur.

5. EIGRP uses a composite metric much like IGRP, except that it is modified by a multiplier of 256.

-Bandwidth

-Delay

-Load

-Reliability

-MTU

6. When EIGRP calculates this metric for a route, it calls it the feasible distance to the route. EIGRP calculates a feasible distance to all routes in the network.

K1=K3=1, K2=K4=K5=0

BW=10⁷/bandwidth-of-slowest-link

DELAY=Σ(delays-along-the-path)

7. EIGRP does not periodically advertise it routes. Because of this, it needs some way to locate and then exchange routing information with adjacent devices. EIGRP accomplishes this through the use of neighbors.

8. When EIGRP initializes, it sends out a multicast hello on address 224.0.0.10, on broadcast media.

9. EIGRP sends hellos every 5 seconds on the following interfaces:

LAN broadcast media, such as Ethernet, Token Ring, and FDDI

High-speed serial link greater than T1 speeds, such as Frame Relay HSSI links

Point-to-point serial links, such as PPP or HDLC

ATM and Frame Relay point-to-point subinterfaces

EIGRP sends hellos every 60 seconds on the following interfaces:

Low-speed serial links less than T1 speeds, including Frame Relay and multipoint X.25

ATM and Frame Relay multipoint interfaces, and ATM SVCs

ISDN BRIs

Process:

1. Hellos are sent out each interface participating in EIGRP, except interfaces quieted by the passive interfaces. All EIGRP hellos and routing updates use the multicast address of 224.0.0.10.

2. Routers on the same IP subnet receive the multicast and respond with a full routing update. This is accomplished by setting the INITialization bit in the EIGRP header; the updates include all networks that EIGRP is aware of and the metric for those routes, except for those suppressed by split horizon. This update packet establishes a neighbor relationship (adjacency). The hello packet also includes a hold timer, which tells the router how long it should wait before receiving a hello and declaring the route unreachable and reporting it to the DUAL process. The hold timer is set to three times the value assigned for the hello timer. This usually is 15 or 180 seconds, depending on the media.

3. The other router responds to the initialization packet by sending a hello with the ACK bit set. EIGRP sets the ACK bit to acknowledge all messages that it receives that have data. This is one way that EIGRP has reliable transports.

4. The other router now inserts the new update into its route table. Because it has a new update, it sends an update to all its neighbors.

5. The neighbors that received the update respond with an acknowledgment packet.

6. The router holds the adjacency by the continuous exchange of hellos. If a hello is not received by the time the hold timer expires, the router marks the route as unreachable.

7. When the router forms an adjacency, it treats this as a virtual link to transport routing information.

Packets:

Hello— Used to discover and maintain neighbors. This packet type uses unreliable delivery.

Acknowledgments (ACKs)— Used to acknowledge updates. They are essentially hellos with no data in them. ACKs also use unreliable delivery.

Updates— Contain routing information. Updates can be either unicast or multicast, depending on how they are generated. Updates use reliable delivery. Uses RTP (Reliable Transport Protocol).

Queries— Used by the DUAL process to find feasible successor for routes. The query can be unicast or multicast. Queries always use reliable delivery.

Uses RTP.

Replies— Used by the DUAL process to aid in finding feasible successor for routes. Replies are always unicast and use reliable delivery. Use RTP.

DUAL: (Diffusing Update Algorithm)

With the help of DUAL, EIGRP keeps the following tables:

Neighbor table— EIGRP tracks every formed adjacency in the neighbor table. A neighbor will be held until an ACK is not received after 16 unicast retransmissions to that neighbor. At this time, the neighbor is dropped. Neighbors can be displayed with the show ip eigrp neighbors command.

Topology table— All learned routes reported by neighbors are kept in the topology table. The topology table also tracks the metrics and feasible distances associated with those routes. The topology table can be displayed with the show ip eigrp topology as_number command.

Route table/forwarding table— Only the routes with the lowest composite metric are entered into the final route or forwarding table. This is the route that the router will forward to.

The DUAL process is in control of determining feasible distances, feasible successors, and the successor of the routes in the EIGRP topology table. By having a backup path already defined in the topology table, the router can quickly converge to the new path in case the primary path fails.

The successor is the primary path for the route, or the path that the router will forward packets to. The feasible successor becomes the next-hop address only if the primary route to the destination becomes unreachable. The feasible successor is always downstream and, thereby, must have a distance or feasible distance that is less than that of the current preferred route.

We can not use passive-interface to stop a router sending routing updates by using "passive-interface..." command (in EIGRP or OSPF), because it will shut down the neighbor relationship of these two routers (no hello packets are exchanged).

DHCP Process and Configuration

2009-11-27T09:39:00.000-08:00

PROCESS:

1. A user turns on the computer with the DHCP client enabled on it.

2. The client PC sends broadcast request (known as DHCP DISCOVER) and then look for the DHCP server to answer.

3. The DHCP server receives the DISCOVER packet and based on the availability and defined settings, the server choose any available IP address and then give to the client. Then DHCP server sends back to the client with DHCP OFFER with that available address information.

· If the configuration parameters sent to the client in the DHCPOFFER unicast message by the DHCP server are invalid (a misconfiguration error exists), the client returns a DHCPDECLINE broadcast message to the DHCP server.

4. Again client sends (broadcast) a request to DHCP server known as DHCP REQUEST, in which it lets the server know that it is using the address offered by the DHCP.

5. The DHCP server then again send a acknowledgement to the client known as DHCP ACK, in which it confirm the client that the specific IP address has been assigned to it for a given period of time.

· The DHCP server will send to the client a DHCPNAK denial broadcast message, which means the offered configuration parameters have not been assigned, if an error has occurred during the negotiation of the parameters or the client has been slow in responding to the DHCPOFFER message (the DHCP server assigned the parameters to another client) of the DHCP server.

________________________________________________________________________________

This process of assigning the IP addresses by the DHCP server also known as DORA (Discover, Offer, Request, and Acknowledgement).

When a computer uses a static IP address there can be the chances of error and conflict when two computers use the same IP address. By using the DHCP server there are no chances of such kind of conflicts and errors.

Along with the IP addresses, the DHCP server also enables the client computers to extract all the settings and configurations from the DHCP server on an IP network. These settings include the Firewall, Router, DNS, NAT, WINS, Gateway and Subnet masks settings.

The overall purpose of the DHCP server is to reduce the workload and error margins, which can occur in assigning the IP addresses manually.

The IP address assigned by the DHCP server is for the limited or leased period of time and if a client needs an to extend that leased period for the IP address then client must send a extension request to the DHCP server before this period expires. If the client do not send an extension request, then this IP address becomes free on expiration and is assigned to another client.

The DHCP server database is organized as a tree. The root of the tree is the address pool for natural networks, branches are subnetwork address pools, and leaves are manual bindings to clients.

CONFIGURATION:

•Configuring a DHCP Database Agent or Disabling DHCP Conflict Logging (Required)

A DHCP database agent is any host, for example, an FTP, TFTP, or RCP server that stores the DHCP bindings database. You can configure multiple DHCP database agents and you can configure the interval between database updates and transfers for each agent.

Router(config)# ip dhcp database url [timeout seconds | write-delay seconds]

If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP server.

Router(config)# no ip dhcp conflict logging

•Excluding IP Addresses (Required)

Router(config)# ip dhcp excluded-address low-address [high-address]

•Configuring a DHCP Address Pool (Required)

Router(config)# ip dhcp pool name

Ø Configuring the DHCP Address Pool Subnet and Mask

Router(config-dhcp)# network network-number [mask | /prefix-length]

Ø Configuring the Domain Name for the Client

The domain name of a DHCP client places the client in the general grouping of networks that make up the domain.

Router(config-dhcp)# domain-name domain

Ø Configuring the Domain Name System IP Servers for the Client

Router(config-dhcp)# dns-server address [address2 ... address8]

Ø Configuring the Default Router for the Client

Router(config-dhcp)# default-router address [address2 ... address8]

Ø Configuring the Address Lease Time

Router(config-dhcp)# lease {days [hours][minutes] | infinite}

•Configuring Manual Bindings (Optional)

Manual bindings are IP addresses that have been manually mapped to the MAC addresses of hosts that are found in the DHCP database. Manual bindings are stored in NVRAM on the DHCP server.

Router(config)# ip dhcp pool name

Router(config-dhcp)# host address [mask | /prefix-length]

Router(config-dhcp)# hardware-address hardware-address type

Router(config-dhcp)# client-name name

The client name should not include the domain name

•Configuring a DHCP Server Boot File (Optional)

Router(config-dhcp)# bootfile filename

•Configuring the Number of Ping Packets (Optional)

By default, the DHCP server pings a pool address twice before assigning the address to a requesting client.

Router(config)# ip dhcp ping packets number

•Configuring the Timeout Value for Ping Packets (Optional)

By default, the DHCP server waits 500 milliseconds before timing out a ping packet.

Router(config)# ip dhcp ping timeout milliseconds

•Enabling the Cisco IOS DHCP Server Feature (Optional)

Router(config)# service dhcp

· Monitoring and Maintaining the DHCP Server

Router# clear ip dhcp binding address | *

Router# clear ip dhcp conflict address | *

Router# clear ip dhcp server statistics

Router# debug ip dhcp server {events | packets | linkage}

Router> show ip dhcp binding [address]

Router> show ip dhcp conflict [address]

Router# show ip dhcp database [url]

Router> show ip dhcp server statistics

ip dhcp database ftp://user:password@172.16.4.253/router-dhcp write-delay 120

ip dhcp excluded-address 172.16.1.100 172.16.1.103

ip dhcp excluded-address 172.16.2.100 172.16.2.103

ip dhcp pool 0

        network 172.16.0.0 /16

        domain-name cisco.com

        dns-server 172.16.1.102 172.16.2.102

        netbios-name-server 172.16.1.103 172.16.2.103

        netbios-node-type h-node

ip dhcp pool 1

        network 172.16.1.0 /24

        default-router 172.16.1.100 172.16.1.101

        lease 30

ip dhcp pool 2

        network 172.16.2.0 /24

        default-router 172.16.2.100 172.16.2.101

        lease 30

ip dhcp pool Mars

        host 172.16.2.254 mask 255.255.255.0

        hardware-address 02c7.f800.0422 ieee802

        client-name Mars

        default-router 172.16.2.100 172.16.2.101

        domain-name cisco.com

        dns-server 172.16.1.102 172.16.2.102

        netbios-name-server 172.16.1.103 172.16.2.103

        netbios-node-type h-node

DHCP Relay Agent

Place the ip helper-address command on the interface you expect to be receiving the broadcast.

By default, the ip helper-address command will forward these 8 UDP ports:

UDP
PORT Common Name
69 TFTP
67 BOOTP Client
68 BOOTP Server
37 Time Protocol
49 TACACS
53 DNS
137 NetBios
138 NetBios Datagram

Use ‘no ip forward-protocol’ if you don’t want to forward any of the above port through ip helper-address.

To allow all the nodes in the server farm to receive the broadcasts at Layer 2, configure the server facing ethernet interface to forward directed broadcasts with the following commands:

RTA(config)#interface e3

RTA(config-if)#ip directed-broadcast

ip dhcp relation information option

Enables the system to insert the DHCP relay agent information option in forwarded BOOT REQUEST messages to a Cisco IOS DHCP server.

rbe nasip source-interface

Specifies the IP address of an interface on the DHCP relay agent that will be sent to the DHCP server via the Agent Remote ID suboption.

2009-11-27T04:50:00.000-08:00

LAN

OSPF Process in detail...

2009-11-27T03:07:00.001-08:00

OSPF Header:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|   Version #   |       5       |         Packet length         |

-----------------------------------------------------------------

|                          Router ID                            |

-----------------------------------------------------------------

|                           Area ID                             |

-----------------------------------------------------------------

|           Checksum            |             AuType            |

-----------------------------------------------------------------

|                       Authentication                          |

-----------------------------------------------------------------

|                       Authentication                          |

-----------------------------------------------------------------

Hello Packet:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                      Network Mask                             |

-----------------------------------------------------------------

|         HelloInterval         |    Options    |    Rtr Pri    |

-----------------------------------------------------------------

|                     RouterDeadInterval                        |

-----------------------------------------------------------------

|                      Designated Router                        |

-----------------------------------------------------------------

|                   Backup Designated Router                    |

-----------------------------------------------------------------

|                          Neighbor                             |

-----------------------------------------------------------------

DBD Packet:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|         Interface MTU         |    Options    |0|0|0|0|0|I|M|MS

-----------------------------------------------------------------

|                     DD sequence number                        |

-----------------------------------------------------------------

|                                                               |

-                       An LSA Header                           -

|                                                               |

-----------------------------------------------------------------

|                              ...                              |

LS Request:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                          LS type                              |

-----------------------------------------------------------------

|                       Link State ID                           |

-----------------------------------------------------------------

|                     Advertising Router                        |

-----------------------------------------------------------------

|                              ...                              |

LS Update:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                            # LSAs                             |

-----------------------------------------------------------------

|                             LSAs                              |

|                              ...                              |

LS ACK:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                                                               |

--                         An LSA Header                       --

|                                                               |

-----------------------------------------------------------------

|                              ...                              |


LSA Header:

  0                   1                   2                   3

  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|            LS age             |    Options    |    LS type    |

-----------------------------------------------------------------

|                        Link State ID                          |

-----------------------------------------------------------------

|                     Advertising Router                        |

-----------------------------------------------------------------

|                     LS sequence number                        |

-----------------------------------------------------------------

|         LS checksum           |             length            |

-----------------------------------------------------------------

Router-LSAs:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|    0    |V|E|B|        0      |            # links            |

-----------------------------------------------------------------

|                          Link ID                              |

-----------------------------------------------------------------

|                         Link Data                             |

-----------------------------------------------------------------

|     Type      |     # TOS     |            metric             |

-----------------------------------------------------------------

|                              ...                              |

-----------------------------------------------------------------

|      TOS      |        0      |          TOS  metric          |

-----------------------------------------------------------------

|                          Link ID                              |

-----------------------------------------------------------------

|                         Link Data                             |

-----------------------------------------------------------------

|                              ...                              |

Network-LSAs:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                         Network Mask                          |

-----------------------------------------------------------------

|                        Attached Router                        |

-----------------------------------------------------------------

|                              ...                              |

Summary-LSAs:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                         Network Mask                          |

-----------------------------------------------------------------

|      0        |                  metric                       |

-----------------------------------------------------------------

|     TOS       |                TOS  metric                    |

-----------------------------------------------------------------

|                              ...                              |


AS-external-LSAs:

 0                   1                   2                   3

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

-----------------------------------------------------------------

|                         Network Mask                          |

-----------------------------------------------------------------

|E|     0       |                  metric                       |

-----------------------------------------------------------------

|                      Forwarding address                       |

-----------------------------------------------------------------

|                      External Route Tag                       |

-----------------------------------------------------------------

|E|    TOS      |                TOS  metric                    |

-----------------------------------------------------------------

|                      Forwarding address                       |

-----------------------------------------------------------------

|                      External Route Tag                       |

-----------------------------------------------------------------

|                              ...                              |

PROCESS:

1.When a router comes up initially: it send first Hello packet to the multicast
address 224.0.0.5, setting its Neighbor field empty.

2.It then looks for the Hello packets to discover Neighbors.

3.If it receives a Hello packet from another Router, it processes it and checks
the Neighbor field to find out if its Router-ID is mentioned in that field.
In case it’s mentioned there, 2-WayReceived event is triggered and it forms
2-WAY adjacency with that router. If not, it checks other fields like Area-ID,
Network-Mask or IP-Address (In case of Broadcast or NBMA network),
Authentication-Type, Authentication-Key, Hello-interval, Dead-interval.
If these field matches with the one that is configured on its own interface,
then it sends (unicast) an immediate Hello packet.

Receiving Hello packet triggers HelloReceived event. In this case, when
HelloReceived is triggered, Router changed its state from DOWN to INIT.
When the other Router received its immediate Hello packet, its state also
gets changed from DOWN to INIT.

4.In a Broadcast & Point-to-Point network Hello packets are multicast at every
10 seconds and Dead-interval is 10x4=40. In other networks, its 30 & 120
respectively. So, this time when it multicast the Hello packet, Neighbor field
contains the Router-ID of the newly discovered Neighbor. When the other router
checks and find out its own Router-ID in that Hello packet’s Neighbor field,
it changes its state from INIT to 2-WAY with that router.

   5.DR & BDR election takes place in Broadcast & NBMA networks. And it can only
  take place after 2-WAY state.

   6.A router can change its state from INIT to 2-WAY, if it receives a Hello packet
  which contains its Router-ID in the Neighbor field OR if it receives a DBD
  packet.

   7.After election, DR & BDR is selected. Election of DR & BDR is basically on
  Router-Priority field in Hello packet. If it’s same then Router-ID is the tie
  breaker.

   8.Once election is finished, Router changes its state to EXSTART. In networks
  where election is not required, routers can directly go to EXSTART state from
  INIT.

9.Negotiation is done in EXSTART state, which implies who will become MASTER to
initiate the EXCHANGE. Router with higher Router-ID becomes the MASTER. SLAVE
has to agree on the DD sequence no. set by MASTER. Only MASTER can increment
the DD sequence no. and retransmit DBD packets. Every time MASTER sends a DBD
packet it increments the DD sequence no. Every DBD packet sent by MASTER has
to be acknowledged by SLAVE through echoing with same DD sequence no. If a
reply is not received by SLAVE before RetransmissionInterval expires, DBD
packet is retransmitted my MASTER. If MASTER receives a DBD packet with
different DD sequence no. then SeqNumberMismatch  event is generated and
adjacency is started from EXSTART state once again.

        DR & BDR election is based on Router priority, however selection

of MASTER & Slave is purely based on Router-ID & is per neighbor basis.
Therefore, a DR can also become a Slave

10.In EXSTART state both the routers sends each other the DBD packet with Flag
set to 0x7 (I bit=1, M bit=1, MS bit=1), means this is the first DBD packet
I am sending, there are more DBD packets to come and I am MASTER. These DBDs
don’t contain any LSA Headers. A router with higher Router-ID becomes MASTER.
And SLAVE sends a DBD packet with flag set to 0x2 turning off the I and MS bit.
This is the confirmation packet from the SLAVE. SLAVE changes its state to
EXCHANGE (triggering NegotiationDone event) after sending this packet. SLAVE
also starts sending LSA Headers in DBDs now (as it’s in EXCHANGE state now).
When the other router receives this packet, a NegotiationDone event is
triggered there too. This changes the state of the receiving end to EXCHANGE
too. The MASTER now sends a DBD packet with flag set to 0x3 (just turning off
the I bit) and this DBD packet also contains LSA Headers. Flags remains to be
0x2 (for SLAVE) and 0x3 (for MASTER) until there are more LSA Headers to send.
When SLAVE has no more LSA Headers to send along with DBD packets, it echoes
back with flag set to 0x0. Then if MASTER has no more LSA Headers to send along
with DBD packets, it set flag to 0x1. At this stage any router whose flag is
set to either 0x0 or 0x1 will start sending LSA Request packets. This LSA
Request packets are sent based on comparison of there LSDB with the LSA Headers
that they received during EXCHANGE state. Both the routers may also receive LS
Update packets in this EXCHANGE state.

11.However, MASTER will still be waiting for the reply on its last DBD that it
sent. This implies that the last DBD is always sent by SLAVE. ExchangeDone
event is triggered on SLAVE router as soon as SLAVE sends the last DBD packet.
Once MASTER receives this DBD packet, ExchangeDone event is triggered there
too.

12.Once ExchangeDone event is triggered, router changes state from EXCHANGE to
LOADING (in case there are more out-dated links in the database to request) or
EXCHANGE to FULL.

13.In LOADING state, routers send and receive LS Request and LS Update packets
for any out-dated links. Once LS Request and LS Update packet is empty,
LoadingDone event is triggered, indicating that the LSDB is now synchronized
throughout the area.

14.Once LSDB of all the routers in an area is synchronized, state is changed from
LOADING to FULL, indicating full adjacency. SFP algorithm is then calculated
and routing table is build.

15.All the routers keep on sending and receiving Hello packets in specific
interval to maintain and keep watch on NeighborState changes.

The Neighbor Data Structure

State: The functional level of the neighbor conversation.

Inactivity Timer: A single shot timer whose firing indicates that no

Hello Packet has been seen from this neighbor recently.  The length of the
timer is RouterDeadInterval seconds.

Master/Slave:

When the two neighbors are exchanging databases, they form a master/slave
relationship.

DD Sequence Number:

      The DD Sequence number of the Database Description packet that

      is currently being sent to the neighbor.

Last received Database Description packet:

      The initialize(I), more (M) and master(MS) bits, Options field,

and DD sequence number contained in the last Database Description packet
received from the neighbor. Used to determine whether the next Database
Description packet received from the neighbor is a duplicate.

Neighbor ID:

      The OSPF Router ID of the neighboring router.

Neighbor Priority:

     The Router Priority of the neighboring router.

Neighbor IP address:

     The IP address of the neighboring router's interface to the

        attached network.

Neighbor Options:

     The optional OSPF capabilities supported by the neighbor.

Neighbor's Designated Router:

     The neighbor's idea of the Designated Router.

Neighbor's Backup Designated Router:

     The neighbor's idea of the Backup Designated Router.

Link state retransmission list:

     The list of LSAs that have been flooded but not acknowledged on

     this adjacency.  These will be retransmitted at intervals until

     they are acknowledged, or until the adjacency is destroyed.

Database summary list:

     The complete list of LSAs that make up the area link-state

     database, at the moment the neighbor goes into Database Exchange

     state. This list is sent to the neighbor in Database Description

     packets.

Link state request list:

     The list of LSAs that need to be received from this neighbor in

     order to synchronize the two neighbors' link-state databases.

     This list is created as Database Description packets are

     received, and is then sent to the neighbor in Link State Request

     packets. The list is depleted as appropriate Link State Update

     packets are received.

Neighbor states

DOWN

ATTEMPT – In NBMA

INIT - In this state, an Hello packet has recently been seen from

       the neighbor.  However, bidirectional communication has not

       yet been established with the neighbor

2-WAY: Router has seen either Hello packet consist of its own Router-ID

       in the neighbors field OR received DBD packet. The (Backup)

       Designated Router is selected from the set of neighbors in

       state 2-Way or greater.

EXSTART: This is the first step in creating an adjacency between the

         two neighboring routers.  The goal of this step is to decide

         which router is the master, and to decide upon the initial

         DD sequence number.  Neighbor conversations in this state or

         greater are called adjacencies.

EXCHANGE: Database summaries are exchanged, LS Request & LS Updates are

           also sent.

LOADING: In this state, Link State Request packets are sent to the

neighbor asking for the more recent LSAs that have been discovered
(but not yet received) in the Exchange state.

FULL: In this state, the neighboring routers are fully adjacent. These

        adjacencies will now appear in router-LSAs and network-LSAs.

Events

HelloReceived: An Hello packet has been received from the neighbor.

Start (NBMA): This is an indication that Hello Packets should now be

        sent to the neighbor at intervals of HelloInterval seconds.

2-WayReceived: Bidirectional communication has been realized between

the two neighboring routers.  This is indicated by the router seeing itself
in the neighbor's Hello packet.

NegotiationDone: The Master/Slave relationship has been negotiated, and

        DD sequence numbers have been exchanged.

ExchangeDone: Both routers have successfully transmitted a full

        sequence of Database Description packets.  Each router now knows

        what parts of its link state database are out of date.

BadLSReq: A Link State Request has been received for an LSA not

        contained in the database.  This indicates an error in the

        Database Exchange process.

LoadingDone: Link State Updates have been received for all out-of-date

            portions of the database.  This is indicated by the Link

            state request list becoming empty after the Database

            Exchange process has completed.

AdjOK?: A decision must be made as to whether an adjacency should be

        established/maintained with the neighbor.  This event will

        start some adjacencies forming, and destroy others.

The following events cause well developed neighbors to revert to lesser states.  
Unlike the above events, these events may occur when the neighbor conversation is
in any of a number of states.

SeqNumberMismatch: A Database Description packet has been received that

either a) has an unexpected DD sequence number, b) unexpectedly has the Init
bit set or c) has an Options field differing from the last Options field
received in a Database Description packet.  Any of these conditions indicate
that some error has occurred during adjacency establishment.

1-Way: An Hello packet has been received from the neighbor, in which

        the router is not mentioned.

 KillNbr: This  is  an  indication that  all  communication  with  the

          neighbor  is now  impossible,  forcing  the  neighbor  to

          revert  to  Down  state.

 InactivityTimer: The inactivity Timer has fired. This means that no

Hello packets have been seen recently from the neighbor. The neighbor reverts
to Down state.

 LLDown: This is an indication from the lower level protocols that the

neighbor is now unreachable.

Event SeqNumberMismatch forces ExStart state,

Event BadLSReq forces ExStart state,

Event 1-Way forces Init state,

Event KillNbr always forces Down State,

Event InactivityTimer always forces Down State,

Event LLDown always forces Down State,

Event AdjOK? leads to adjacency forming/breaking


EVENTS:

R3#debug ip ospf events

OSPF events debugging is on

R3 has just come up and sending Hello packets to multicast address 224.0.0.5 to all its interface. This Hello
packet’s Neighbor field is empty and DR/BDR field is set to 0.0.0.0

*Mar 1 00:00:29.635: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar 1 00:00:29.639: OSPF: Send hello to 224.0.0.5 area 1 on Serial0/0 from 192.168.10.1

*Mar 1 00:00:39.635: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

Dead Interval timer has expired (in this case it was 40 seconds) and InactivityTimer event is triggered, which in turn
triggered MAXAGE and deleted all LSAs from the database.

*Mar  1 00:00:42.347: OSPF: service_maxage: Trying to delete MAXAGE LSA

This is lead to the election of DR/BDR, electing itself to DR & BDR to none.

*Mar  1 00:00:49.635: OSPF: end of Wait on interface FastEthernet0/0

*Mar  1 00:00:49.635: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:00:49.635: OSPF: Elect BDR 0.0.0.255

*Mar  1 00:00:49.639: OSPF: Elect DR 0.0.0.255

*Mar  1 00:00:49.639: OSPF: Elect BDR 0.0.0.0

*Mar  1 00:00:49.639: OSPF: Elect DR 0.0.0.255

*Mar  1 00:00:49.643:        DR: 0.0.0.255 (Id)   BDR: none

Now it will keep sending hello packets until it discover any neighbors.

*Mar  1 00:00:49.643: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:00:59.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:09.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:19.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:29.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:39.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:49.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

It received first multicast Hello packet from R2. Now the state of R3 gets changed to INIT. However, this Hello
packet’s neighbor field is empty too. So, 2-WayReceived event won’t generate and it won’t form 2-WAY adjacency
as of now. But R3 will check other fields (Area-ID, Interface-IP, Auth-type, Auth-Key, Hello-Interval, Dead-Interval)
to find out if R2 is eligible to be its neighbor.

*Mar  1 00:01:52.655: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

Eligibility criteria matched, thus R3 sent an Immediate Hello to R2. This unicast Hello will bring R2 to INIT state.

*Mar  1 00:01:52.659: OSPF: Send immediate hello to nbr 0.0.0.254, src address 172.16.1.2, on FastEthernet0/0

*Mar  1 00:01:52.663: OSPF: Send hello to 172.16.1.2 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:52.667: OSPF: End of hello processing

Likewise, R3 also received Hello packet from R1 and processed it the same way as above.

*Mar  1 00:01:55.319: OSPF: Rcv hello from 0.0.0.1 area 0 from FastEthernet0/0 172.16.1.1

*Mar  1 00:01:55.323: OSPF: Send immediate hello to nbr 0.0.0.1, src address 172.16.1.1, on FastEthernet0/0

*Mar  1 00:01:55.327: OSPF: Send hello to 172.16.1.1 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:01:55.327: OSPF: End of hello processing

Now, when both the Hello packets are processed and Hello-Interval is reached, it’s sending a multicast Hello
packet setting its neighbor field with Router-ID of both R2 & R1. This will trigger 2-WayReceived event on both
R2 & R1, because they will find there respective Router-ID in this Hello packet’s Neighbor field.

*Mar  1 00:01:59.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

After 2-WayReceived event triggered on both parties, both R2 & R1 are now in 2-WAY state and are allowed to
conduct election. As election is also finished on R2, it’s in EXSTART state by sending its first DBD packet, claiming
it as a Master setting flag to 0x7 and generating a DD sequence no.

*Mar  1 00:01:59.771: OSPF: Rcv DBD from 0.0.0.254 on FastEthernet0/0 seq 0x264 opt 0x52 flag 0x7 len 32  mtu
1500 state INIT

Once R3 received this DBD packet, it will change its state to 2-WAY and will conduct election.

*Mar  1 00:01:59.771: OSPF: 2 Way Communication to 0.0.0.254 on FastEthernet0/0, state 2WAY

*Mar  1 00:01:59.775: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:01:59.775: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:01:59.775: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:01:59.775: OSPF: Elect DR 0.0.0.255

*Mar  1 00:01:59.775:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

DR & BDR is selected, which will appear in the next Hello packet that R3 will send.

Now, as elction is finished R3 will change its state to EXSTART sending the first DBD packet claiming it to be
Master.

*Mar  1 00:01:59.775: OSPF: Send DBD to 0.0.0.254 on FastEthernet0/0 seq 0xDAE opt 0x52 flag 0x7 len 32

*Mar  1 00:01:59.775: OSPF: First DBD and we are not SLAVE

Now, we can see R3 has received a multicast Hello packet from R2. This Hello packet contains R2’s discovery
of R1 in its Neighbor field. This triggered Neighbor change event on R3 and led to election again (one for each
neighbor).

*Mar  1 00:01:59.799: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

*Mar  1 00:01:59.799: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:01:59.799: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:01:59.799: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:01:59.799: OSPF: Elect DR 0.0.0.255

*Mar  1 00:01:59.799:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:01:59.799: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:01:59.799: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:01:59.799: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:01:59.799: OSPF: Elect DR 0.0.0.255

*Mar  1 00:01:59.799:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:01:59.799: OSPF: End of hello processing

R3 now received DBD packet echoed by R2. This DBD packet contains same DD sequence no. that R3 has
set and flag is also set to 0x2, which tells that R2 has agreed itself to be a Slave. This packet also contains LSA
Header, therefore M bit is set to 1. This will trigger NegotiationDone event on R3 too.

*Mar  1 00:01:59.847: OSPF: Rcv DBD from 0.0.0.254 on FastEthernet0/0 seq 0xDAE opt 0x52 flag 0x2 len 52  mtu
1500 state EXSTART

*Mar  1 00:01:59.851: OSPF: NBR Negotiation Done. We are the MASTER

Now both R3 & R2 are in EXCHANGE state. R3 is sending its second DBD packet incrementing the DD sequence
no.. Flag 0x3 tells that this packet contains LSA Header.

*Mar  1 00:01:59.855: OSPF: Send DBD to 0.0.0.254 on FastEthernet0/0 seq 0xDAF opt 0x52 flag 0x3 len 52

R3 received echoed DBD packet from R2. Flag is set to 0x0, which means this packet don’t contain any LSA
Header. Thus M bit is cleared indicating it has no more data to send. Now, as R2 has no more LSA Headers to
send it can now compare its own LSDB against the LSA Headers that it received during EXCHANGE state and
can start sending LS Request packets if any.

*Mar  1 00:02:00.063: OSPF: Rcv DBD from 0.0.0.254 on FastEthernet0/0 seq 0xDAF opt 0x52 flag 0x0 len 32  mtu
1500 state EXCHANGE

R3 sends its last DBD incrementing the DD sequence no. and with flag setting to 0x1, that indicates it has no more
data to send. However, it will still expect a DBD echoed reply packet from Slave. As R3 has no more LSA Headers
to send, it can also now send LS Request packets if any.

*Mar  1 00:02:00.063: OSPF: Send DBD to 0.0.0.254 on FastEthernet0/0 seq 0xDB0 opt 0x52 flag 0x1 len 32

*Mar  1 00:02:00.063: OSPF: Send LS REQ to 0.0.0.254 length 12 LSA count 1

R3 received DBD packet from R1. This is the first DBD packet from R1 changing the state of R3 to 2-WAY with R1.
Rest of the process will be same as described earlier.

*Mar  1 00:02:00.063: OSPF: Rcv DBD from 0.0.0.1 on FastEthernet0/0 seq 0x18BD opt 0x52 flag 0x7 len 32  mtu
1500 state INIT

*Mar  1 00:02:00.063: OSPF: 2 Way Communication to 0.0.0.1 on FastEthernet0/0, state 2WAY

*Mar  1 00:02:00.063: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:02:00.063: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:02:00.063: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:02:00.063: OSPF: Elect DR 0.0.0.255

*Mar  1 00:02:00.063:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:02:00.063: OSPF: Send DBD to 0.0.0.1 on FastEthernet0/0 seq 0x1B0 opt 0x52 flag 0x7 len 32

*Mar  1 00:02:00.063: OSPF: First DBD and we are not SLAVE

*Mar  1 00:02:00.063: OSPF: Rcv hello from 0.0.0.1 area 0 from FastEthernet0/0 172.16.1.1

*Mar  1 00:02:00.067: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:02:00.067: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:02:00.071: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:02:00.071: OSPF: Elect DR 0.0.0.255

*Mar  1 00:02:00.071:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:02:00.075: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:02:00.075: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:02:00.079: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:02:00.079: OSPF: Elect DR 0.0.0.255

*Mar  1 00:02:00.079:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:02:00.083: OSPF: End of hello processing

R3 received LS Request packet from R2 and sending LS Update packet thereafter.

*Mar  1 00:02:00.163: OSPF: Rcv LS REQ from 0.0.0.254 on FastEthernet0/0 length 36 LSA count 1

*Mar  1 00:02:00.167: OSPF: Send UPD to 172.16.1.2 on FastEthernet0/0 length 40 LSA count 1

R3 now received echoed DBD packet from R2 that it was expecting and that triggers ExchangeDone event. R2
changed its state to LOADING (triggering ExchangeDone event ) soon after sending this DBD packet.

*Mar  1 00:02:00.207: OSPF: Rcv DBD from 0.0.0.254 on FastEthernet0/0 seq 0xDB0 opt 0x52 flag 0x0 len 32  mtu
1500 state EXCHANGE

*Mar  1 00:02:00.207: OSPF: Exchange Done with 0.0.0.254 on FastEthernet0/0

R3’s EXSTART state continues with R1

*Mar  1 00:02:00.207: OSPF: Rcv DBD from 0.0.0.1 on FastEthernet0/0 seq 0x1B0 opt 0x52 flag 0x2 len 52  mtu 1500
state EXSTART

*Mar  1 00:02:00.207: OSPF: NBR Negotiation Done. We are the MASTER

R3’s EXCHANGE state continues with R1

*Mar  1 00:02:00.207: OSPF: Send DBD to 0.0.0.1 on FastEthernet0/0 seq 0x1B1 opt 0x52 flag 0x3 len 52

R3 in LOADING state received LS Update packet from R2 and sent LS Ack packet acknowledging the update.

*Mar  1 00:02:00.207: OSPF: Rcv LS UPD from 0.0.0.254 on FastEthernet0/0 length 64 LSA count 1

R3 expects no more LS Update packets. Thus, triggering the LoadingDone event. R3’s LSDB is now synchronized
with R2, changing the state of R3 to FULL with R2.

*Mar  1 00:02:00.207: OSPF: Synchronized with 0.0.0.254 on FastEthernet0/0, state FULL

*Mar  1 00:02:00.207: %OSPF-5-ADJCHG: Process 100, Nbr 0.0.0.254 on FastEthernet0/0 from LOADING to FULL,
Loading Done

R3’s EXCHANGE state continues with R1

*Mar  1 00:02:00.307: OSPF: Rcv DBD from 0.0.0.1 on FastEthernet0/0 seq 0x1B1 opt 0x52 flag 0x0 len 32  mtu 1500
state EXCHANGE

*Mar  1 00:02:00.311: OSPF: Send DBD to 0.0.0.1 on FastEthernet0/0 seq 0x1B2 opt 0x52 flag 0x1 len 32

*Mar  1 00:02:00.311: OSPF: Send LS REQ to 0.0.0.1 length 12 LSA count 1

*Mar  1 00:02:00.379: OSPF: Rcv DBD from 0.0.0.1 on FastEthernet0/0 seq 0x1B2 opt 0x52 flag 0x0 len 32  mtu 1500
state EXCHANGE

*Mar  1 00:02:00.379: OSPF: Exchange Done with 0.0.0.1 on FastEthernet0/0

R3’s LOADING state continues with R1

*Mar  1 00:02:00.383: OSPF: Rcv LS UPD from 0.0.0.1 on FastEthernet0/0 length 64 LSA count 1

R3’s state is FULL with R1

*Mar  1 00:02:00.387: OSPF: Synchronized with 0.0.0.1 on FastEthernet0/0, state FULL

*Mar  1 00:02:00.387: %OSPF-5-ADJCHG: Process 100, Nbr 0.0.0.1 on FastEthernet0/0 from LOADING to FULL,
Loading Done

Now, whenever there will be any update in the network, DR & BDR will multicast LS Update packets to 224.0.0.5 &
DROTHER will multicast at 224.0.0.6 (which will be received by only DR & BDR). LS Update packets will always be
acknowledged by LS Ack packet by the recipients.

*Mar  1 00:02:00.659: OSPF: Rcv LS UPD from 0.0.0.254 on FastEthernet0/0 length 64 LSA count 1

*Mar  1 00:02:00.755: OSPF: Rcv LS UPD from 0.0.0.1 on FastEthernet0/0 length 64 LSA count 1

Regular multicast Hello packets will be sent and received to keep track of any neighbor changes.

*Mar  1 00:02:00.919: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

*Mar  1 00:02:00.923: OSPF: End of hello processing

*Mar  1 00:02:01.263: OSPF: Rcv hello from 0.0.0.1 area 0 from FastEthernet0/0 172.16.1.1

*Mar  1 00:02:01.263: OSPF: Neighbor change Event on interface FastEthernet0/0

*Mar  1 00:02:01.267: OSPF: DR/BDR election on FastEthernet0/0

*Mar  1 00:02:01.267: OSPF: Elect BDR 0.0.0.254

*Mar  1 00:02:01.267: OSPF: Elect DR 0.0.0.255

*Mar  1 00:02:01.271:        DR: 0.0.0.255 (Id)   BDR: 0.0.0.254 (Id)

*Mar  1 00:02:01.271: OSPF: End of hello processing

*Mar  1 00:02:04.631: OSPF: Rcv LS UPD from 0.0.0.1 on FastEthernet0/0 length 64 LSA count 1

*Mar  1 00:02:04.711: OSPF: Rcv LS UPD from 0.0.0.254 on FastEthernet0/0 length 64 LSA count 1

*Mar  1 00:02:05.287: OSPF: Rcv LS UPD from 0.0.0.1 on FastEthernet0/0 length 64 LSA count 1

*Mar  1 00:02:09.507: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

*Mar  1 00:02:09.511: OSPF: End of hello processing

*Mar  1 00:02:09.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:02:09.975: OSPF: Rcv hello from 0.0.0.1 area 0 from FastEthernet0/0 172.16.1.1

*Mar  1 00:02:09.975: OSPF: End of hello processing

*Mar  1 00:02:18.895: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

*Mar  1 00:02:18.899: OSPF: End of hello processing

*Mar  1 00:02:19.231: OSPF: Rcv hello from 0.0.0.1 area 0 from FastEthernet0/0 172.16.1.1

*Mar  1 00:02:19.231: OSPF: End of hello processing

*Mar  1 00:02:19.647: OSPF: Send hello to 224.0.0.5 area 0 on FastEthernet0/0 from 172.16.1.3

*Mar  1 00:02:27.967: OSPF: Rcv hello from 0.0.0.254 area 0 from FastEthernet0/0 172.16.1.2

*Mar  1 00:02:27.967: OSPF: End of hello processing

R3#u all

All possible debugging has been turned off

R3#

IP Addressing & Subnetting

2009-03-22T10:44:00.000-07:00

IP v4 addresses are made of four octets as below, where each x can either be 0 or 1
xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx

for. eg
01101010.11001101.11101000.11111000

As it’s very difficult to remember IP address in a binary form as above, we convert it to decimal for our convenience.

Like:-

So, 01101010.11001101.11101000.11111000 = 106.205.232.248

Classes of IP address:

There are 5 classes of Public IP addresses. Each class has it’s defined no. of higher order octet(s) set, that increments by 1 down the classes. These octets are fixed and don’t change.

Like:-
Class A has 1 higher order octet fixed, i.e. 00101100
Class B has 2 higher order octet fixed, i.e. 10110011
Class C has 3 higher order octet fixed, i.e. 11001010
Class D has 4 higher order octet fixed, i.e. 11101111
Class D has 4 higher order octet fixed, i.e. 11110101

With this representation you will always find that:-

Class A IP addresses start with 0 (Binary 00000000 = Decimal 0)
Class B IP addresses start with 128 (Binary 10000000 = Decimal 128)
Class C IP addresses start with 192 (Binary 11000000 = Decimal 192)
Class D IP addresses start with (Binary 11100000 = Decimal 224)
Class E IP addresses start with (Binary 11110000 = Decimal 240)

Further, you can notice that starting address of
Class A = 0
Class B = Class A + 128
Class C = Class B + 64
Class D = Class C + 32
Class E = Class D + 16

Class A – 0.0.0.0 to 127.255.255.255
Class B – 128.0.0.0 to 191.255.255.255
Class C – 192.0.0.0 to 223.255.255.255
Class D – 224.0.0.0 to 239.255.255.255
Class E – 240.0.0.0 to 254.255.255.255

In Class A, only first octet is used for Networks and other 3 octets are used for Hosts. Therefore, it’s used where larger no. of hosts are required.

In Class B, only first 2 octets are used for networks and other 2 for hosts.

In Class C, first 3 octets are used for networks and last one for hosts.

Networks and Hosts are not defined for Class D and E.

Therefore, representation is as below:

                        Network                Host
Class A         Xxxxxxxx xxxxxxxx . xxxxxxxx . xxxxxxxx
Class B         XXxxxxxx . xxxxxxxx xxxxxxxx . xxxxxxxx
Class C         XXXxxxxx . xxxxxxxx . xxxxxxxx xxxxxxxx

Formula for calculating no. of Networks = 2n-a ,where -------------------(i)

n is the no. of bits reserved for Networks.
a is the no. of leading bit (higher order bit) set.

For e.g:-

Class A has first octet reserved for Networks. One octet has 8 bits. Therefore, n = 8. Also, Class A has 1 higher order bit set, so a = 1
Now, putting the respective values in (i), we get
28-1=128
Note: There are two IP addresses that are reserved, 0.H.H.H and 127.H.H.H, therefore there are 126 valid networks possible.

Similarly,
Class B has 216-2=16,384
Class C has 232-3=2,097,152

Formula for calculating no. of Hosts = 2n-2 ,where -----------------------(ii)

n is the no. of bits reserved of Hosts

Note: We have subtracted 2 because one IP will be used to represent network and one for broadcast.
For e.g:-

Class A has last 3 octets reserved for Hosts. One octet has 8 bits. Therefore, n = 8x3 =24.
Now, putting the respective values in (ii), we get
224-2=16,777,214

Similarly,

Class B has 216-2=65,534
Class C has 28-2=254

However, we know that these amount of Networks and Hosts are not enough to cover the whole world and may get exhausted. Therefore, the concept of Private addressing came into picture.

It’s like a house with a telephone no. (Public address) assigned and each room has it’s own extension no. (Private address)

There are 3 Classes of Private IP addresses, they are as below:

Class A – 10.0.0.0 to 10.255.255.255
Class B – 172.16.0.0 to 172.31.255.255
Class C – 192.168.0.0 to 192.168.255.255

Once again octets are reserved for Network and Host part, class-wise as described above.

For Class A, there is one network (with default subnet) and it starts with 10, rest there are 224 Hosts.
For Class B, there are 16 networks (with default subnet), rest 216 are host.
For Class C, there are 254 networks, rest 28 are host.

Subnetting is dividing a network into sub-networks. For eg. A company has various departments like HR, Production, Accounts, Marketing, IT. Where IT department has sub departments like Hardware, Systems, Networking. And Production on other hand also has sub departments like QA, Testing, Coding etc.

As you can see, having one network for all the departments and sub departments doesn’t actually solve the purpose and may become ambiguous. Therefore, segregating the Networks department wise is very important.

Every Classes (Either Public or Private) has default Subnets.

Class A (Both Public and Private) has default subnet 255.0.0.0 or /8
Class B (Both Public and Private) has default subnet 255.255.0.0 or /16
Class C (Both Public and Private) has default subnet 255.255.255.0 or /24

Subnetting is done by borrowing the bits from the host part.

Valid subnets are:-
/4 = 22
/6 = 23-2
/14 = 24-2
/30 = 25-2
/62 = 26-2
/126 = 27-2

Now say, we are told to divide a network 172.16.0.0 /16 (10101100.00010000.HHHHHHHH.HHHHHHHH) into 9 subnetworks. How we will derive the subnet mask? Below is how we can do it.

Determine how many H bits you need to borrow to create nine valid subnets.2N - 2 > 9
N comes out to be 4, so as to make it 14 which > 9. There no. of H bits = 8 –N = 4
It can now be visualized as below:
10101100.00010000.NNNNHHHH.HHHHHHHH

Now we know that there will be 14 subnets

10101100.00010000.00000000.00000000 = 172.16.0.0 (invalid)
10101100.00010000.00010000.00000000 = 172.16.16.0
10101100.00010000.00100000.00000000 = 172.16.32.0
10101100.00010000.00110000.00000000 = 172.16.48.0
10101100.00010000.01000000.00000000 = 172.16.64.0
10101100.00010000.01010000.00000000 = 172.16.80.0
10101100.00010000.01100000.00000000 = 172.16.96.0
10101100.00010000.01110000.00000000 = 172.16.112.0
10101100.00010000.10000000.00000000 = 172.16.128.0
10101100.00010000.10010000.00000000 = 172.16.144.0
10101100.00010000.10100000.00000000 = 172.16.160.0
10101100.00010000.10110000.00000000 = 172.16.176.0
10101100.00010000.11000000.00000000 = 172.16.192.0
10101100.00010000.11010000.00000000 = 172.16.208.0
10101100.00010000.11100000.00000000 = 172.16.224.0
10101100.00010000.11110000.00000000 = 172.16.240.0 (invalid)

Finish IP plan table.

The default subnet mask for a Class B network is as follows:
Decimal Binary
255.255.0.0 11111111.11111111.00000000.00000000

1 = Network or subnetwork bit
0 = Host bit

You borrowed 4 bits; therefore, the new subnet mask is the following:
11111111.11111111.11110000.00000000 255.255.240.0

The Enhanced Bob Maneuver for Subnetting:

On the bottom line (Number of Valid Subnets), move from right to left and find the closest number that is bigger than or equal to what you need:
Nine subnets move to 14.

From that number (14), move up to the line called Bit Place.
Above 14 is bit place 4.

The dark line is called the high-order line. If you cross the line, you have to reverse direction.
You were moving right to left; now you have to move from left to right.

Go to the line called Target Number. Counting from the left, move over the number of spaces that the bit place number tells you.
Starting on 128, moving 4 places takes you to 16.

This target number is what you need to count by, starting at 0, and going until you hit 255 or greater. Stop before you get to 256:

0
16
32
48
64
80
96
112
128
144
160
176
192
208
224
240
256Stoptoo far!

Go back to the Enhanced Bob Maneuver chart and look above your target number to the top line. The number above your target number is your subnet mask.

Above 16 is 240. Because you started with a Class C network, the new subnet mask is 255.255.255.240.

OSI Model

2009-03-10T02:45:00.000-07:00

Application Layer: Developer creates application that can plug into network socket – means they can use the services of networking components defined by the Application layer. Main job defined in Application layer is identifying partners, look for resources & synchronization. For eg. Email client. There are various type of Applications that may require different kind of networking services. For. eg. File & Print, Database, Email, Name resolution, Internet access, Terminal emulation, and Management services (like SNMP)

Presentation Layer: Data Encoding/Decoding & Conversion is it’s primary job. For e.g ASCII to EBCDIC, IBM world to LAN PC vise versa. It’s also responsible for Encryption / Decryption for eg. SSL/TLS (Secure Socket Layer/Transport Layer Services used by web based application for security), Certificates, Compression & Decompression.

Session Layer: It establishes a session between client and server or two hosts, so that they can communicate over the protocol stack. It’s primary job is to Setup Dialog (establish connection), Dialog control (manages connection), Termination of connection.
Note:- Setting up Dialog means identifying a type of connection, like – Full Duplex, Half Duplex, Simplex. A Dialog is written within the application itself.

Transport Layer: It’s primary job is Data transport Reliability; Establishing, Managing & Terminating Virtual Circuit; Fault Detection & Recovery; Flow Control
Now it’s the time to talk about the protocol TCP (Transmission Control Protocol), which has its major impact in the world of networking.

There are two reliable protocols that comes under Transport Layer, they are:-

TCP (Transmission Control Protocol) – It’s a connection oriented protocol, that means it establishes virtual circuit to make sure data is verified and acknowledged, so that data is guaranteed reliable. As every segment is acknowledged, Overhead is more in TCP. Therefore, to minimize this overhead, TCP has come out with couple Flow Control mechanism. One is Buffering (with Source Quench message) and other is Sliding Window. FTP, HTTP, SMTP, DNS uses the services of TCP.

Buffering: A buffer is predefined in both source and destination host. Once the buffer is full, it starts discarding packets and send source quench message to source host to slow down. Transmission is stopped until the discarded packets are transmitted again and receiving host is unable to process even the available packets. Therefore, this mechanism doesn’t seems to be efficient and thus we basically use Sliding Window concept.

Sliding Window: In this type of mechanism, every host has a predefined send & receive Window. It’s usually 8 segments of size but may vary from hosts to hosts, and that’s why 3-Way Handshake is necessary.

Sliding Window idea is to keep data streaming with less overhead

UDP (User Datagram Protocol): It is a connection less protocol, that means it doesn’t look out for acknowledgement after sending the segments, thus no Overhead. It follows a best effort delivery for reliable data transfer. DNS and TFTP uses the services of UDP.

Ports are also implemented at Transport Layer to identify application. Every application has a port defined. IANA (Internet Assigned Numbers Authority) has assigned port numbers in three categories.

Public Application (Well Known) – 1 -255
HTTP : 80
FTP : 21
FTP DATA : 20
TELNET : 23
SMTP : 25
DNS (Zone
Transfer/TCP) : 53
DNS (Name
Lookup/UDP) : 53
TFTP : 69
SNMP : 161
SNMP Trap : 162
Private Application - 256-1023
Eg. Microsoft Applications
Dynamic Client (Higher Order) – 1024-65535
For e.g Target port of FTP client back from server

Network Layer: Addressing, Actual connectivity and Path Detection is the main job of Network Layer. It’s the layer where routing starts.

Routed protocols: (IP, IPX, AppleTalk) – Determines the best path based on routing table. It performs routing function and carries data through network.

Routing protocols: (RIP, IGRP, EIGRP, OSPF, IS-IS, BGP4) – Determines distance, cost and populates routing table. It does the route selection. These protocols run exclusively on routers.

Determining the Switching method (Circuit {Telephone}/ Message {Store & Forward} / Packet {Frame Relay & T1}) is also one of the tasks of Network Layer.

This Layer has 2 supporting protocols:- ICMP, ARP

ICMP: The Internet Control Message Protocol is one of the core protocols of the Internet Protocol Suite. It is chiefly used by networked computers' operating systems to send error messages—indicating, for instance, that a requested service is not available or that a host or router could not be reached. For e.g. Ping. It send source quench message for buffering, thus do the flow control.

ARP: Address Resolution Protocol is the method for finding a host's link layer (hardware) address when only its Internet Layer (IP) or some other Network Layer address is known.

Data link Layer – Its main job is Framing (or Encapsulation) and physical addressing (48 bit MAC address). It’s the layer where the actual encapsulation takes place. It has two sub layers – LLC and MAC. Earlier there was no layers of abstraction between Layer 3 protocols and Layer 2 MAC addresses, because of which we could only use one NIC per machine and could bind only one protocol per NIC. To eliminate this drawback, LLC & MAC sublayers were introduced to provide layers of abstraction between upper layer protocols and underlying interface hardware. This layer also provides access to the topology.

It has support protocol RARP: Reverse Address Resolution Protocol is a Link layer networking protocol used by a host computer to obtain its IPv4 address given only its link-layer address (such as an Ethernet address).

Other standards and protocols of Data-link Layer are as below:

HDLC: High-Level Data Link Control is a bit oriented synchronous protocol developed by ISO. It provided both connection-less and connection-oriented services. It is used for point to multipoint connection. A WAN technology. A serial interface on every CISCO router.

SDLC: Synchronous Data Link Control is created by IBM to facilitate interconnectivity between IBM mainframes hosts. It’s exclusively used in SNA networks.

X.25 / LAPB: It’s a standard for packet switched networks. Good in encapsulation. Provides built-in error correction. Understand circuit and packet switching technology as it is developed by telephone company. It’s a WAN technology and is predecessor to Frame Relay. It defines the DTE (Data Terminal Equipment) /DCE device (Data Communication Equipment). X.25 uses LAPB (Link Access Procedure Balanced) protocol, which provides maintenance component for X.25 like sequencing and retransmit.

Frame Relay: It’s successor of X.25 and is much faster (upto 45 Mbps). It’s used for high quality digital technology and has acknowledgment function, hence guaranteed reliable.

SLIP: Serial Line Internet Protocol is an original standard for TCP/IP transmission over low speed serial links upto 64 Kbps. It was used by Unix systems for Shell connectivity over dial-up.

PPP: Point to Point Protocol is a new standard and is a successor of SLIP. It is used by Dialup as well as T1 connections. It supports both synchronous and asynchronous transmission. It adds multiple protocol support, encryption & error correction.

ISDN: Integrated Services Digital Network connected telephone systems to transfer digital voice & data over these modified analog lines. It’s defined by 802.9

Physical Layer: It’s responsible for binary transmission, clocking (i.e., setting the rate at which data samples are passed across the wire), and determining physical topology (i.e., identifying how devices connect to the network physically)

There are five topologies:-

Bus: It’s a LAN topology, also called Ethernet with CSMA/CD. It’s both half and full duplex capable. The popular standards for Ethernet are:-

Ring: One directional data transmission, hence no collision. It’s once again a LAN topology. It uses UTP, STP or Fiber cables. Examples are:- IBM Token Ring and FDDI.

IBM Token ring: Available in two speeds, 4Mbps & 16Mbps. Token is passed around a logical ring of network devices. System must acquire token to transmit data. Data travel in single direction, hence no collision takes place. Each host is connected with a relay connector called MAU (Multistation Access Unit), which then knows both it’s upstream and downstream. If a problem appears, the upstream sends a beacon towards opposite direction that determines the failure and that failed host is eliminated from the ring. MAU then updates itself with new upstream and downstream again.

Source Wikipedia under creative commons license

FDDI: Fiber Distributed Data Interface uses optical fiber as primary transmission medium. The FDDI LAN can range upto 200Km and offers 100Mbps speed. It contains two token rings, one for possible backup in case the primary ring fails. It also falls under Fast Ethernet category.

Star: It’s primarily a LAN topology but is also a WAN topology.
E.g. ARCnet –LAN
Frame Relay – Logical WAN (Main office & Branch Office)

Point-to-Point: It’s a WAN topology, used by switched network such as X.25 & Frame Relay or Leases line connection such as T1

Full mesh / Partial Mesh: It’s a WAN topology used by Packet Switched networks.

Standards of Physical Layer:

EIA/TIA-232 (= RS-232) – Supports connection speed upto 64 Kbps.
EIA/TIA-449 (= RS-449) – Supports connection speed upto 2Mbps
V.24/V.35 – ITU-T (International Telecommunication Unit) standard, very similar to RS-232

All of the above standards define serial communication and are all the standards of WAN topology.

History of Networking

2009-03-10T02:24:00.000-07:00

History of Networking:

Early in 1960’s, there were standalone mainframe computers with unintelligent terminals attached. It was an age of centralized processing, where terminals could only avail the services that its mainframe was providing. Every mainframe vendors used to provide different kind of services and there were no standards. It led to Island of Automation, where one mainframe (of say Vendor 1) couldn’t exchange services with other mainframe (of Vendor 2). Department of Defense being a major customer thought of having a kind of standard and thus commenced ARPA (Advanced Research Project Agency) network called ARPAnet. The first protocol developed in 1969, called NCP (Network Connection Protocol), which was however capable of doing only simple file exchange. Therefore, TCP/IP research began at Stanford in 1969 funded by Department of Defense. It was published in a public domain RFC that led to its popularity. At this point the concept of Internetworking was born.

In 1970, ISO (International Organization of Standardization) started it’s work on OSI (Open System Interconnection) 7 layer model, which came into picture not before 1984. Hence there was only D2D 4 layer model till that time.
Also, in 1970, DIX (Digital, Intel and Xerox) together developed a standard called Ethernet II, which was used by ARPAnet, hence also called ARPA Ethernet.

1980s, was the time when transition from Centralized processing to Distributed processing took place. Terminals became intelligent with there own processing components and traditional hosts then evolved as file servers. For eg. Novell Netware, which was very popular at that time. It was the time when actual LAN and WAN definition came into picture.

Also, in 1980s, IEEE took 802 project.
802.1 was the original standard whose responsibility was High-level internetworking protocols and management.
802.2 is the standard for LLC (Logical Link Control), which was created to do Upper layer 7-3 abstraction from Layer 2 Data link. This abstraction was necessary otherwise we wouldn’t be able to use multiple NIC (Network Interface Card) in a machine and bind multiple protocols to a single NIC.
802.3 is the standard for Ethernet
802.4 is the standard for Token bus (Burroughs, Honeywell etc.)
802.5 is the standard for Token ring (IBM)
802.6 is the standard for MAN (Metropolitan Area Networks)
802.7 is the standard for Broadband LAN using Coaxial Cable
802.8 is the standard for Fiber Optic.
802.9 is the standard for Integrated Services LAN (ISDN)
802.10 is the standard for Interoperable LAN Security
802.11 is the standard for Wi-Fi

Today there are different kind of Networks, namely:-

PAN - Personal Area Network is a computer network used for communication among computer devices close to one person

LAN - Local Area Network is a computer network covering a small physical area, like a home, office, or small group of buildings, such as a school, or an airport.

CAN - Campus Area Network is a computer network made up of an interconnection of local area networks (LANs) within a limited geographical area. It can be considered one form of a metropolitan area network, specific to an academic setting.

MAN - Metropolitan Area Network is a network that connects two or more local area networks or campus area networks together but does not extend beyond the boundaries of the immediate town/city.

WAN - Wide Area Network is a computer network that covers a broad area (i.e. any network whose communications links cross metropolitan, regional, or national boundaries.

GAN - Global Area Networks specification is in development by several groups, and there is no common definition. In general, however, a GAN is a model for supporting mobile communications across an arbitrary number of wireless LANs, satellite coverage areas, etc.

SAN - Storage Are Network is a network designed to attach computer storage devices. It is an architecture to attach remote computer storage devices (such as disk arrays, tape libraries, and optical jukeboxes) to servers in such a way that the devices appear as locally attached to the operating system.

CDN - Content Delivery Network, a system of computers on the Internet that deliver content transparently to end users. It facilitates copying pages of a web site to different geographical areas so that they can be accessed quickly by the closest server.

Internetworking - It involves connecting two or more distinct computer networks or network segments via a common routing technology. It has three variants:-

Extranet – It’s for partner or affiliate companies to access organization’s private LAN, though not has full access.

Intranet – It is the internal network of an organization, using the Internet Protocol and IP-based tools such as web browsers and file transfer applications, that is under the control of a single administrative entity.

Internet - It consists of a worldwide interconnection of governmental, academic, public, and private networks based upon the networking technologies of the Internet Protocol Suite. It is the successor of the Advanced Research Projects Agency Network (ARPANET). The Internet is also the communications backbone underlying the World Wide Web (WWW).

VPN –Virtual Private Networks establishes a virtual circuit enabling remote access of organization’s private LAN to employees through Internet.

Know your Cables & Connectors

2009-02-05T06:26:00.001-08:00

Today, I’m writing to share my knowledge about kind of cables we basically use or see often. Let’s start with Twisted Pair cables. There are four types of Twisted Pair cables.

UTP (Unshielded Twisted Pair)
FTP (Foiled Twisted Pair) also known as S/UTP (Screened Unshielded Twisted Pair)
STP (Shielded Twisted Pair)
S/STP (Screened Shielded Twisted Pair) also known as S/FTP

UTP: These kinds of cables are basically seen in Ethernet and Telephone systems. These are available in different pairs (upto 25). Below is a picture of 4 pair UTP.

CAT 1, 2, 3 are truly UTP. CAT 5 to 6A can be both UTP, FTP & STP

FTP: In this kind of cable all the pairs together are foiled or screened by a metallic shield. Therefore, it’s also know as S/UTP (Screened UTP). Because the shielding is made of metal, it may also serve as a ground. However, usually a shielded or a screened twisted pair cable has a special grounding wire added called a drain wire. Some outdoor FTP cable has a ripcord (as you can see below) that allows the cable jacket to be removed quickly.

STP: This kind of cable has metal shielding over each pair.

S/STP: These kinds of cables are both individually shielded like STP and also have outer metal shielding like FTP.

Both Shielded and Unshielded Twisted Pair cables are categorized by various cabling standards.

CAT 1: Cables in this category was previously used for POTS telephone communications, ISDN and doorbell wiring. It has a data rate of 1Mbps.

CAT 2: It was used in 4 Mbps Token rings and ARCnet.

CAT 3: It is designed to reliably carry data up to 10 Mbps, with a possible bandwidth of 16 MHz. It falls under 10Base-T standard. It’s used in Ethernet (10Mbps, LAN cable) and Token Ring. Our telephone wires are also

CAT 3.

Note: Basic funda that differentiate CAT 3,4,5 is how tightly or loosely the pairs are twisted. CAT 5 is more tightly twisted than CAT 4 and CAT 4 in turn more tightly twisted than CAT 3.

CAT 4: Provided performance of up to 20 MHz, and was frequently used on 16 Mbps token ring networks. It falls under standard 10BASE-T, 100BASE-T4. It’s used in Token Ring (16Mbps).

CAT 5: It falls under 100Base-TX standard, which means it can carry 100 MHz baseband frequency (or 100 MBits of data per second). It is used in Ethernet (10Mbps), Fast Ethernet (100Mbps), Token Ring (16Mbps).

CAT 5E: It is an enhanced version of CAT 5. It falls under 1000Base-T standard and can carry 100 MHz to 1000MHz of baseband frequency (or 1000 Mbits of data per second). Baseband reminds us that it can be used as Ethernet cable only and T tells us that it’s a twisted pair cable. This kind of cable is used in Gigabit Ethernet.

CAT 6: It falls under 10GBase-T category. The standard defines that it can perform between 250 MHz to 10 GHz frequency (ideally suitable for 10GBits data transfer). There is a non-metallic cross separator inside the cable that ensures the best crosstalk elimination between individual pairs. This kind of cable is used in Gigabit Ethernet.

CAT 6A: It is an enhanced version of CAT 6 can carry upto 550 Mhz. It can support 10 Gbps applications (especially 10GBaseT)

CAT 7: It specifies STP and carry upto 600 Mhz. It can carry 10 to 100 Gbps. 100 Gbps can be achieved over 70 meters.

CAT 7A: Once again an enhanced version on CAT 7 operates at frequencies up to 1000 MHz.

If we are talking about Ethernet cables through out this blog, we should also know about various Ethernet standards. There are four kind of Ethernets. (10, 100, 1000 stands for Mbps respectively, BASE stands for Baseband, words in bold tells the meaning of the alphabets in respective standards)

I Ethernet:

10BASE2 (also called ThinNet or Cheapernet): Coaxial cable connects machines together, each machine using a T-adaptor to connect to its NIC. Requires terminators at each end. For many years this was the dominant Ethernet standard 10 Mbps
10BASE-T: runs over four wires (two twisted pairs) on a CAT 3 or CAT 5 cable. A hub or switch sits in the middle and has a port for each node. This is also the configuration used for 100BASE-T and gigabit Ethernet. 10 Mbps.
FOIRL: Fiber-optic inter-repeater link. The original standard for Ethernet over fibre.
10BASE-F: A generic term for the new family of 10 Mbps Ethernet standards: 10BASE-FL, 10BASE-FB and 10BASE-FP. Of these only 10BASE-FL is in widespread use.

10BASE-FL: An updated version of the FOIRL standard.
10BASE-FB: Intended for backbones connecting a number of hubs or switches, it is now obsolete.
10BASE-FP: A passive star network that required no repeater, it was never implemented

II Fast Ethernet: (Length=100 meters)

100BASE-T: A term for any of the three standard for 100 Mbps Ethernet over twisted pair cable. Includes 100BASE-TX, 100BASE-T4 and 100BASE-T2.

100BASE-TX: Uses two pairs, but requires Category 5 cable. Similar star-shaped configuration to 10BASE-T. 100 Mbps.
100BASE-T4: 100 Mbps Ethernet over Category 3 cabling (as used for 10BASE-T installations). Uses all four pairs in the cable. Now obsolete, as Category 5 cabling is the norm. Limited to half-duplex.
100BASE-T2: No products exist. 100 Mbit/s Ethernet over Category 3 cabling. Supports full-duplex, and uses only two pairs. It is functionally equivalent to 100BASE-TX, but supports old cable.

100BASE-FX: 100 Mbit/s Ethernet over fibre.

100BASE-FX ( 2 strands, Maximum length is 400 metres (1,310 ft) for half-duplex connections (to ensure collisions are detected) or 2 kilometres (6,600 ft) for full-duplex over multimode optical fiber.)
100BASE-SX (Single direction, hence 2 strands, Multimode, uses short wavelength, operates at distances up to 300 metres (980 ft). )
100BASE-BX (Bi-direction, hence 1 strand, Single-mode)

III Gigabit Ethernet:

1000BASE-X

1000BASE-CX (Copper (special), 25 meters, Predates 1000BASE-T, now obsolete)
1000BASE-LX (Longer distance on Fibre cable, 5 km on Single-mode)
1000BASE-SX (Shorter distance, Single direction, Multimode)
1000BASE-LH
1000BASE-ZX
1000BASE-BX10

1000BASE-T (Twisted pair, CAT 5E, 4 pairs, Bi-directional communication)

1000BASE-TX (Twisted pair, CAT 6, 2 pairs in each direction)

III 100 Gigabit Ethernet:

10GBASE-R (Fibre)

10GBASE-SR (Short range, designed to support short distances over deployed multi-mode fiber cabling, it has a range of between 26 m and 82 m depending on cable type. It also supports 300 m operation over a new 2000 MHz·km multi-mode fiber.)
10GBASE-LR (Long range, 25 Km on Single-mode)
10GBASE-LRM (Long reach multimode, 260 meters)
10GBASE-ER (Extended range, 40 Km on Single-mode)
10GBASE-ZR (80 Km on Single-mode)
10GBASE-LX4 (300 meters, multimode with 4 lasers)

10GBASE-X/10GBASE-T (Copper)

10GBASE-CX4 (transmits over 4-lanes in each direction over copper cabling, 15 meters)
10GBASE-KX4 and 10GBASE-KR (Backplane Ethernet, 1 meter, on copper printed circuit board with two connectors)
10GBASE-T (Over STP or UTP, 100 meters)

Fiber optics: There are various types of Fiber optics cables. They are basically categorized by Mode (single-mode or multi-mode), Design (Loose Tube Fiber, Tight Buffer Fiber), Index (Step-Index, Graded-Index), Structure (Glass Optical Fiber, Plastic Optical Fiber, Plastic Coated Sillica Cable)

Common types are: Breakout, Armored Multi Loose-Tube, Outdoor Multi Loose-Tube, Indoor Armored Single Loose, Outdoor Single Loose-Tube, Indoor/Outdoor Armored, Indoor/Outdoor

For more information, visit http://fiberoptic-cable.blogspot.com/

S-Video (Separate Video) carries only the analog Video signals (no Audio). It carries two type of video signals (Y=Luma and C=Chroma). Luma stands for Luminance and Chroma stands for Color. It basically uses 4-pin mini-DIN connector and sometimes 7-pin too.

Composite video carries only analog Television picture. Composite video is often designated by the CVBS acronym, meaning any of "Color, Video, Blank and Sync", "Composite Video Baseband Signal", "Composite Video Burst Signal", or "Composite Video with Burst and Sync". It carries three signals (Y=Luma, (U=Hue, V=Saturation) of Chroma). It typically uses RCA connector.

Note: Y is a baseband signal

VGA: Video Graphics Adapter are basically seen in PCs and Laptops today. Per standard, it supports maximum of 640×480 resolution in 16 colors, but several higher resolution is possible with good algorithm and video RAM.

Some commonly know Connectors:

DIN: Commonly used in Analog audio, digital signals, computing uses.

5 pin DIN (Show below), used in AT Keyboards

PS/2 keyboard/mouse connector use 6 pin DIN

4 Pin DIN (Show below) are basically used in S-Video.

DIN 8 pin (Show below) is used VGA connector. One side DIN 8 pin and other side VGA.

Power Mini-DIN or Power DIN:

These connectors look similar to Mini-DIN connectors, but have either 3 or 4 thicker pins and a slightly larger mating shell. Because of this they do not mate with any of the Mini-DIN connectors. They can usually be identified by an engraved symbol on the backs of the plug, consisting of two wide arrows pointing in opposite directions, but parallel to each other.

DC Power connectors:

Molex: It is used to supply DC power, most frequently on personal computers, for supplying power to drives and other peripherals.

D-subminiature: It is a common type of electrical connector used particularly in computers.

Common types are DA-15, DB-25, DC-37, DD-50, DE-9

Below is the picture of DE-9 male basically used with Serial Port on computers. For connect devices now-a-days, it is replaced by USB and Firewire, and in networking, it is replaced by Ethernet. For console like terminals, it’s replaced by VGA. It is still found in some network equipments like Routers and Switches. It falls under RS-232 standard.

DE-15, It is also known as VGA connector, found in PCs, Laptops, External TV tuner cards. Below is the picture of DE-15 or VGA male connector.

DB-25 are now basically used in recording industries. It’s also a RS-232 standard. Show below - Left: DE9M & Right: DB25F

DD-50 were sometimes used in SCSI devices (Like Harddisk, CD ROMs etc.) that’s why also called SCSI connector. SCSI connector were basically used in SATA. (Ribbon like cables) They include 40 pins. However, DD-50 has 50 pins.

BLC or TV aerial plug:

BNC: It’s used in Coaxial and Triaxial cables.

RJ (Registered Jack): Left to right, RJ connectors: an eight-pin RJ-45 plug, six-pin RJ-25 or RJ-12 plug, four-pin RJ-11 or RJ-14 plug, and a four-pin RJ-22 (RJ-10 or RJ-9) handset plug. The middle two plug into the same standard six-pin jack, pictured. The RJ11 standard dictates a 2-wire connection, while RJ14 uses a 4-wire configuration, and RJ25 uses all six wires. RJ 45 is used in Ethernet.

RCA: Used in Composite video and Stereo Audio.

Catch the Spywares

2009-01-18T12:05:00.000-08:00

We all know about the Virus, Worms, Trojans, Malwares, Spywares etc. and in one way or other we all have had our machines infected once with these threats. We have various products in market to fight against these threats, but if we don’t have a general knowledge about these devils, then it could leave us high and dry for that moment. And obviously we don’t want to spend much time/efforts/money fighting against these threats, as we have other important works to do. That I guess you will say, if I don’t share few concise steps that I did when I found myself as a victim of these unwanted guests on my machine.

C:\>netstat –oa | find /I “Established”

I’m a very stingy person and I don’t want any Spywares or Spybots to waste any bytes of my broadband connection. After all I’m not paying for all the crap they are doing.

So, I tried the above command to see what is coming and going through the opened ports. And I found a huge no. of unwanted TCP/UDP established connections through SMTP port 25. Hmm!! they are passing on the important information from my cookies. (My credit card no.?) ;-)

To know which process is responsible, I noted down the PIDs that was known through the Netstat command and searched those through Tasklist as below:

C:\>tasklist /FI “PID eq 672”

Here 672 is the PID value that I retrieved through the Netstat command earlier.

The worst thing is that those are running by the windows legitimate Services.exe, (stopping this process will just lead to shutdown, no help), closing the connection through TCPView software didn’t help either, as new connections automatically establish of there own.

Note: You can also check through the services (Run->Services.msc) to see anything that surprise you. I bet you won’t find any.

In simple word, Services.exe is injected with a Spybot. So, my next step should move towards Windows Firewall to check which exceptions are allowed. Nothing surprised again. All is good.

Time and bytes were running out in Seconds and MiBs. Therefore, I quickly blocked the opened ports in my TCP/IP connection properties.

(Network connection->Right click the active connection->Select “Internet Protocol TCP/IP”->Properties->Click “Advanced” button->”Options” tab->Select TCP/IP filtering->Properties->Permit only->Add the port(s) that you want to block.)

Then I must check the registry (Run->Regedit) to find out the entries that Services.exe is picking up during startup. (HKEY_LOCAL_MACHINE->SYSTEMS->Services)

Oh god, so many entries, that’s chaotic. But you always have options. I downloaded RegistryBooster 2.0 and quickly repaired my registry to get rid of the problem for a time being.

I had few Anti Virus, Anti Spyware and more importantly Anti Rootkit, but those were all in vain. I realized I should have Internet Security with Firewall inbuilt to fight against these threats. My choices are Zone Alarm and AVG Internet Security. It’s working !!!!