Networking Made Easy

ITSS Conference June 2005

John Ireland, IT Manager (Jesus College)

Presentation Running Order

Introduction

Network Basics

Clients

Summary

Design

Diagnostics

For maximum viewing

pleasure, please:-

set mobile phones to off / quiet;

save any questions for Q&A session after the summary.

Jesus College Network

Copper: Cat5e UTP with RJ45 Connectors

Cat5 is a basic cable standard – how many strands, how thick, what twisting, how to insulate. Cat3 is used for analogue telephone lines; Cat5 is for basic ethernet, Cat5e is better. Some people are using Cat6 or Cat7 now.

UTP: Unshielded Twisted Pair. 8 individual wires are twisted into 4 pairs and encased in a sheath. A superior (but expensive) alternative is STP: shielded twisted pair, where the pairs are wrapped in metal foil which is connected to earth at one end.

RJ45: a standard design of plug, a little like a large telephone plug.

RJ45 connector

RJ45 – Cat5e wiring

Cat5e leads w/ RJ45

terminators

Optical Fibre with ST Connector

Optical fibre is a glass fibre which can reflect light along a central tube.

Specify fibre as multimode or single mode; multimode is much cheaper to use but typically limited to 500m runs (single mode ~200km).

Also specify core diameter and external diameter, eg. 62.5/125.

Many different connectors, eg ST, SC, LC, MRTJ.

ST and SC connectors

ST connector

Optic fibre basics

A Wiring Closet

Optic fibre terminations

Copper terminations

Managed ethernet

switches

Data, Streams and Packets

We typically have a series of characters or bytes (‘data stream’) that we want to transmit.

This is broken down into chunks – for ethernet the max. is 1500B.

Add the source and destination addresses, and a checksum.

The resulting chunk of up to 1518B is a ‘packet’ and can be converted to electrical signals by the network interface card (NIC).

source

destination

data /

payload

checksum

Network Speeds

Optic fibre speeds:

10Mbps: 10base-FL

100Mbps: 100base-FX

1Gbps (short): 1000base-LX

1Gbps (long): 1000base-SX

Copper speeds:

10Mbps: 10Base-T

100Mbps: 100Base-TX

1Gbps: 1000Base-TX

(Non-ethernet speeds:

Dial-up: 0.056Mbps

Broadband: 1Mbps)

Trade-off between speed and distance. Faster connections are generally only reliable over short distances.

Repeaters: Hubs

Two port repeater

24 port repeater: a hub

HUB

A hub repeats packets on all ports

Repeaters: Switches and Media Converters

SWITCH

A switch only repeats the packet on the necessary port

24 port bridging repeater: a switch

Media converter

Wiring Closet Revisited

Optic fibre terminations

Copper terminations

Managed ethernet

switches

A Busier Wiring Closet!

Colour coordinated cables;

Order of panels:

Optic fibre at top,

then copper RJ45,

then switches,

then media convertors.

Beyond the Playpen: Routers

MAC src

MAC dest

data /

payload

checksum

IP src

IP dest

IP info

Jesus College

163.1.136.*

Trinity College

163.1.142.*

Oxford Uni

163.1.*.*

163.1.136.81

163.1.136.239

router

JANET

163.*.*.*

IP Addresses

IP addresses identify computers / systems anywhere on the internet.

Sequence of 4 bytes (0 – 255) separated by dots (163.1.136.11).

IP address + ‘network mask’ tells us which computers are on the same LAN. If two computers have different network addresses then they need to communicate via one or more routers.

Network Address:

Network Mask:

IP Address:

10100011.00000001.10001000.00000000

163.1.136.0

11111111.11111111.11111110.00000000

255.255.254.0

10100011.00000001.10001000.00001011

BOOLEAN AND

163.1.136.11

Network Address:

Network Mask:

IP Address:

10100011.00000001.10001000.00000000

163.1.136.0

11111111.11111111.11111110.00000000

255.255.254.0

10100011.00000001.10001001.01100001

BOOLEAN AND

163.1.137.97

SAME NETWORK!

PC1

PC2

Windows XP IP Configuration

IP address / subnet mask tell it which computers are on the local area network.

Default gateway = Router.

DNS: too much for one workshop, but essentially this allows you to take addresses like ‘www.website.com’ and find the corresponding IP address (eg. 197.32.9.131).

Beyond the Playpen: Firewalls and Proxies

It can protect you from unwanted attempts to connect to your computers.

Jesus College

163.1.136.*

Trinity College

163.1.142.*

Oxford Uni

163.1.*.*

163.1.136.81

163.1.136.239

router

firewall / proxy

Firewall sits between your network and the world.

It can stop people on your network connecting to things they shouldn’t.

Detection: wait for a user to complain, or actively seek out trouble?

Bottom-up approach:

Cables

Computer

Configuration

Local area network

Internet

Start with IP addresses and then move to names.

How to check each part?

Indicator LEDs

Local ‘ping’ tests

Network ‘ping’ tests

Traceroute

Connect to service with IP

Check DNS

Connect to service with name

Diagnostics

Design

Considerations when building a new network:

Number of users

Speed requirements

Ease of repair

Ease of extension

Where will your cables run

Where will your equipment live: security, heat, noise

How will it link up to the rest of your network

What type of cable (copper / fibre) will you use

What distances are your cables covering

Building regulations (listed buildings!)

What features do you want on your equipment

Different kit manufacturers (3COM, HP, Cisco, Allied Telesyn, …)

Costs and options

Spare equipment / cables

Design: Drawing it Out

Summary

We have looked at:

Network infrastructure

Cabling

Hubs, switches, media converters

Routers, firewalls, proxys, gateways

Basic diagnosis of network problems

Design considerations

Go and see how it works on your own network!

Thank you for listening.

john.ireland@jesus.ox.ac.uk

Networks add a whole new layer of excitement to computers - email, shared electronic diaries, the web, online learning, multiplayer games, distributed calculation systems. The great news is that the majority of these applications, especially within an environment like Oxford, are all based on the same, simple networking ideas. We will be looking at a typical college network setup that is suitable for all these systems.

In this workshop we are going to talk about real networks. This will include the mechanics of building a network, pretty much every piece of equipment you are likely to meet, how computers communicate over a network, how to diagnose basic network problems and some things to consider when you are designing a network. There will be lots of words that you might not be completely familiar with, so I have added some information onto the slides, and there is a quick-help index at the end. You should have a copy of the notes from this presentation.

Oh - one other thing. There isn't any black magic in networking - not that I have ever found. This is good.

Right, lets start with a birds eye view of Jesus College and look at where the network sits. The wobbly green lines show the connections from individual student rooms to cupboards called wiring closets. These connections are typically made using wire, a bit like telephone wire, called Cat5e UTP – we’ll look at what this means shortly. The straight red lines form a backbone through the college, connecting the wiring closets together. Without these, each section of college would be an isolated network that couldn't communicate with any other part. It would be like having a city center and ring road without any roads connecting to other places. Backbone connections are typically made using optic fiber. Again, we’ll look at this in a bit more detail shortly. Why fiber for backbone? Ruggedness, termination costs, interface costs.

Okay. Hopefully you'll see that drilling holes and installing the wires is going to be pretty tedious - especially with 24" walls - and that the exciting stuff happens in the wiring closet. So let’s see what a wiring closet looks like.

This thing connects all the wires together, and does whatever is necessary to make computers connected up at the other end to talk to each other. To understand how this works we need to think about how computers send and receive data, and about something called a repeater.

The source and destination addresses that we are referring to here are MAC addresses (media access control). This is essentially hardwired into the NIC and is unique to the NIC. This means that we have uniquely specified the recipient of the packet, which will need to know the sender in order to properly address any response.

So we have taken our logical data stream and sent it onto the network in packets. How does it get to the destination?

Many modern switches can auto-detect the speed of a particular connection and configure themselves automatically.

Back on the slides about copper and fibre connections I mentioned that there is a limitation on distance. This is because the signal gradually degrades as it travels. However, we can extend the overall length by using repeaters – devices that receive a weak signal from one wire and send out a boosted-up version on another wire.

This doesn’t sound particularly exciting, but imagine that instead of just sending the signal out on one wire, we actually send it out on, say, 24 wires. Now the data that was received from one computer can be sent to 23 other computers. This is called a HUB. Each packet that it receives is simply repeated on all the other ports. This is enough to join computers together in a network.

Okay, now we mentioned that each packet has the source MAC address in it. Suppose our repeater remembers which source MAC addresses have arrived on each port. Obviously this is a bit more complicated as it will need to store a table of which port corresponds to each MAC address it sees, but this is quite possible. Now, when a packet arrives the repeater can check the destination MAC address, and then only needs to send the packet out on the right port. This is called packet switching, and this type of repeater is a switch.

A special kind of two port repeater is one that takes different types of connector, such as the fibre – copper device shown above. These are called media converters.

Why would we use a switch though? Hubs repeat the traffic all over the place – this is clearly a security nightmare, but it also means that we are using up network connectivity that we could save. The problem with switches is that they have to keep the table of MAC addresses and ports upto date. Once you start getting a lot of computers this doesn’t work very well.

Now that we have seen some of the equipment used in networks this photo should make more sense. Note that here the switches actually have a fibre port built in, so we don’t need to use a media converter. Manufacturer options give you a lot of choice on this sort of thing.

This is the top level of our network – the incoming fibre from OUCS is in the silver fibre panel, and all other staircases in the college have a backbone connection to here.

Now it’s time for a quick demo of what we have covered. DEMO.

And that’s how you build your local area network (LAN).

LANs are great, but typically you want to connect outwards – in our case to the university and to the internet. This is called Wide Area Networking and requires us to deal with a problem that I alluded to earlier.

Remember that we have been working with MAC addresses? How can you tell whereabouts in the world a particular MAC address is located? You can’t – it’s pretty random, and network interface cards can move (eg. laptops). However, if we want to start sending packets all over the world then we need to be able to get round this hitch. This is done using internet protocol addresses – IP addresses.

You can imagine these as being a little bit like a postal address. The postal address has a country, then a postal town, then a street and finally a house number. Each part refines the location a bit more until you end up with a unique building to deliver to. Of course, computers being computers, we use numbers instead of country names, towns and streets. For example, two computers on my network have the addresses 163.1.136.81 and 163.1.136.239. You’ll notice that the first part of the address is the same – 163.1.136.X means ‘on the Jesus College network’: this is called the network address, and the last bit (81 and 239) in this case, is called the host address. Trinity College will have a different network address – theirs is 163.1.142.X. Those of you who are following closely will have noticed that both of these networks start with 163.1.X.X – this denotes the Oxford University network. And so on.

This means that if you are trying to send a packet to 163.1.136.81 then you don’t need to know exactly where that machine lives, you can just send it to the Oxford Uni network (since it starts with 163.1) and their systems will take care of sending it to the right place. The orange box is where the packet is directed to the correct network. The orange box is called a router – because it selects the correct route for packets, according to the IP address they are trying to reach. If a computer on the Jesus College network is trying to contact a web server in Japan, then all it needs to do it pop on the correct IP address and send the packet to the router, which will then pass it to the JANET router that connects OUCS to JANET, and that will pass it around various parts of the UK, and eventually out to Japan.

You may be wondering how these IP addresses co-exist with MAC addresses. Trust me – they do. The MAC address still has to be there, on the outside, so we use up part of the data section to store the IP source address and IP destination address.

Looking at the diagram above, you might say that the router is a gateway between the college networks and the university network. It is indeed, so we often call a router a gateway instead. Technically speaking, gateway is a little more general as there are situations where a gateway does not actually do any routing.

Now let’s look quickly at the configuration of a Windows XP computer for use on the Jesus College network.

DNS: It’s nice to have a name rather than a number! Also IP addresses have to be geographically related / hierarchy, but many organisations are spread over the world and would still like to be able to have a naming structure that reflects their unity.

Firewalls – often implemented using ‘packet filters’ - sit between your network and the rest of the world. They receive packets on one side, have a look at them, and then decide whether to pass the packet on it’s way at the other side, or to ignore the packet, or to tell the sender that the packet was not passed on. You can do some very clever things with a firewall including

disguising the identity of computers on your network (to prevent attackers from being able to target their efforts),

changing the destination of a packet (eg. re-routing all web connections to a content filtering system),

logging connections permitted / denied.

Suppose you wanted to make all of your users get their web pages via a web cache – a system that remembers pages that have been viewed, and when possible, supplies web pages from this local cache rather than fetching them over the internet again. This is called a caching-proxy – it makes the connections on behalf of other computers (sometimes they don’t actually bother with caching but serve some other purpose such as content filtering). You could configure a computer to do this, and configure your firewall to *only* allow outgoing web connections from your proxy.

Traceroute

Ping

Nslookup

Route print

Capacity

Resilience

Distances

Cost of termination and transceivers

Flexibility

Management

It’s a good idea to draw out a plan of your network with the cables (and the type, speed, number of fibre cores), patch panels, repeaters, media converters and so on it a wise idea. You can give this to a contractor to make sure they do the right thing, and it helps to make sure that you haven’t forgotten anything. Even if you are only making a small change to an existing network, it is a good idea to record it pictorially so that you have something to refer back to if there is a problem, or if you need to explain to a colleague how it works.

PowerPoint Presentation

The Home Bursar

2003-05-16T19:12:53

John Ireland