Internetworking Design Issues - Research Paper Example

Full Paper Internetworking Design Issues During conducting a security audit of the network to identify vulnerabilities, thereis no sole application that will perform the overall task, as the combination of different applications will address specific functions. Likewise, the first task is to identify root causes that are creating issues on the network and degrading performance of network services along with bandwidth limitations. An open source tool (Chau, 2004) can be used for real time network monitoring called ‘nettest’.

Likewise, this tool is programmed to operate on LINUX operating systems for conducting different tests on various frameworks for identifying and detecting causes for network performance. Moreover, the tool is also compatible for multi-tasking and can monitor several hosts on the network. However, authorization is mandatory before installing it to multiple hosts. Likewise, after completing the network performance testing, network traffic analysis must be carried out, in order to analyze what type of traffic is flowing on the network.

However, to analyze live network traffic, ‘Wireshark’ that was, “previously called Ethereal, is an open source and popular network troubleshooting and packet snif?ng tool. Similar to tcpdump but with a well-designed GUI and many more information sorting and ?ltering options, Wireshark/Ethereal allows the user to see all traf?c being passed over the network by putting the network card into promiscuous mode” (Wireshark.2007). Likewise, ‘Wireshark’ or ‘ethereal’ will capture the packets and consolidate them into a file that can be analyzed at a later stage or at the current situation, it depends on organizational requirements.

The frequency of performing these tests is normally recommended every 24 hours, as this will highlight the peak hours and non-peak hours of business. The naming structure of network devices is essential for identifying or associating a device with relevant servers and its location. However, naming complete device names is not possible; instead abbreviated device names will be used. For instance, human resource can be identified as ‘hr’, administration ‘admin’, information technology ‘IT’, accounting ‘accounts’, sales can be used as it is, shipping ‘shp’ and corporate ‘cp’.

Moreover, network devices can be named as routers ‘R’, switches ‘Sw’, bridges ‘b’, workstation ‘ws’, and server ‘Sv’. If we combine all these named words together, the naming structure will look like HR-112-15-K-RII. The naming structure identifies a network device located in the human resource department that is residing in building 112, fifteenth floor in room ‘K’ and it is a router. For providing security mechanism to the internal data communication, Virtual local area network ‘VLAN’ will be implemented.

The ‘VLAN’ will separate the domain of the lecturers with the other. ‘VLAN’ uses encryption techniques for transmitting data over the network (Vlan.2011). Access policy list will be created in the ‘VLAN’ supported Cisco switches for defining the routes. The router processes the data packets on parameters. Internet protocol and subnet is the parameter for the router to process the routes on the destination. The ‘VLAN’ is considered as a broadcast domain. It concludes that the broadcast generates from one computer can only be received to the destination which is defined by some criteria in the broadcast domain.

The advantage of ‘VLAN’ implementation includes an efficient way of bandwidth utilization and eliminating the network from possible broadcast storms, which results in denial of service. By using VLANs, the capacity of switching technology is utilized to its full potential. VLAN also supports VLAN trunking protocol (Vlan.2011). The VLAN trunking protocol will significantly reduce administration for the switched network. Considering the future network expansion considerations of EOB Manufacturing, the requirement for creating new VLAN will be eliminated by using VLAN trunking protocol.

Moreover, firewall and Intrusion detection systems are also critical for securing the network to an extent. Firewall filters each packet that receives on the station, and decides whether to allow or deny the data packets as per criteria. Firewall analyzes headers of data packets associated with Internet protocol, Transmission Control Protocol and User Datagram Protocol. Firewall may use any combination of protocols in order to allow or deny packets. Moreover, IDS listens and monitor the network for any suspicious activity.

As mentioned before, IDS protects from software exploits and buffer overflows. IDS implements ‘intrusion signatures’ consisting of ping sweeps, port scanning, operating system fingerprinting, DoS endeavor, web server indexing and port scanning. 50 workstations are on the 36th floor, 150 workstations on the 35th floor, and 40 workstations are on both the 32nd and 33rd floors. 35th floor having 150 workstations have high bandwidth requirements as compared to other floors. For addressing network latency and security issues, separate VLAN’s can be created for each department with required bandwidth and to make the transmission secure for each department.

References Chau, F. (2004). NetTest's performance monitoring solutions. Telecom Asia, 15(7), 39. Vlan.(2011). Computer Desktop Encyclopedia, , 1. Wireshark.(2007). Network Dictionary, , 531-531.