This content is old! It’s still useful, but it’s old, and there may be bit rot, newer/better tools or ways to do things. Sanity check and do your research.
This content is old! It’s still useful, but it’s old, and there may be bit rot, newer/better tools or ways to do things. Sanity check and do your research.
An IP (Internet Protocol) Address is a 32-bit number broken up into
“quads” of 1 byte each, separated by dots. 1 byte is 8 bits which in
decimal is a number in the range 0 to 255. For example, 10.234.56.71 is
an IP Address. There are only so many “real” IP addresses, and they are
(and have been) perpetually very close to being used up and thus are
very difficult to get.
One of the solutions to this problem is so-called “private” IP
Addresses. These are ranges of IP Addresses set aside expressly for use
by a company or other entity internally. Private IP Addresses cannot be
used to connect directly to the Internet–that is they are non-routable.
These are also often called
RFC1918 addresses.
Use
You use a Private IP Address when you wish to use TCP/IP on your LAN,
but do not wish to try and register enough legal or legitimate addresses
for all your devices. Even if you do wish to get than many, you will
not. Essentially all valid IP addresses are already owned, either by
very large corporations (like AT&T) or by ISPs. When you contract for
service from an ISP, you are allocated some number of legitimate IP
Addresses out of that ISP’s pool of addresses.
Advantages
Increased security (since private IP addresses are not routable
across the Internet).
You conserve the world-wide pool of IP Addresses.
You do not have to register or pay for these IP Addresses in any way
(internal independence from ISP IP addresses).
When you connect to the Internet via a Firewall and NAT (Network
Address Translation, AKA IP Masquerading) you will not block any
address ranges from yourself.
Little or no performance degradation (depending on your Firewall).
If you merge with a company that has chosen the same Private IP
Address, one or both of you will have to re-number. This can be
difficult and expensive.
Some applications don’t work with NAT.
Anything using NBT (UDP 138), i.e. NT Networking cannot communicate
behind a Firewall with NAT. See below for the reason.
Some applications needing encryption and key exchange (specifically
any application that embeds IPs in the datastream) may not work with
NAT.
Network Address Translation (NAT) AKA IP Masquerading
NAT, AKA IP Masquerading, is the process by which a “private,”
“illegal,” and non-routable IP Address is translated into a “legal,”
routable address. There are two kinds of NAT, often called static NAT
and Hide NAT. Static NAT provides a one to one correlation between the
illegal private address and the legal routable one. For example, the Web
Server on 192.168.1.10 may be statically mapped to 39.136.195.47. Hide
NAT is a many to one arrangement where the many illegal addresses behind
some device appear to the Internet as one single address (often the
legal address of the device itself). For example, the entire 172.25.1.0
network may hide behind the single valid IP address of the device at
38.111.56.96.
NAT Devices
There are three devices that typically perform NAT. They are routers,
firewalls and proxy servers.
Hide Mode NAT
In hide mode, the external address of the NAT device “hides” most or all
outgoing connections. To the Internet, it seems that all traffic
originates from this single address, when it really comes from all
different machines on the internal network. The traffic is
differentiated at the NAT device by a table of port numbers. For
example, the port used for Web Surfing is port 80 (http). If a client
computer at 192.168.1.37 surfs to
www.dell.com, the NAT device may assign that
to port 20,134. When the response comes back, the firewall knows that
anything directed to port 20,134 really goes to the client at
192.168.1.37. That way, more than one person can surf at the same time,
using the same external IP address, but everything goes to the correct
person.
Static Mode NAT
In static mode, there is a one to one correlation between internal
(illegal, non-routable) and external (legal, routable) addresses. The
must be the case if you wish top have an E-Mail server, Web server
or any other service that is accessible from the Internet. DNS (Domain
Name Service) published the IP Addresses of server (or services) that
are accessible. These published addresses must be legal, and routable.
The IP network of addresses available for this use is termed the “moat”
network, below. A typical “moat” network looks like this:
IP Address
Description
209.146.2.40
Network Name
209.146.2.41
Available IP Address (usually assigned to the internal router interface)
209.146.2.42
Available IP Address (usually assigned to the external firewall interface)
209.146.2.43
Available IP Address (may be Web server?)
209.146.2.44
Available IP Address (may be E-Mail server?)
209.146.2.45
Available IP Address
209.146.2.46
Available IP Address
209.146.2.47
Broadcast Address
A very interesting thing happens with static NAT, however. Since the
router is at IP address 209.146.2.41, when it sees a packet destined for
209.146.2.43, it “arps” for the Web server. Since the router knows that
it is on network 209.146.2.40/29 and the Web server address is
209.146.2.43 they should be on the same network. But they really aren’t.
So when the router “arps” (uses the Address Resolution Protocol to find
the Web server), the Web server will not answer, since it is really
on network 192.168.1.0/24. To solve this problem, devices that perform
static NAT also perform “proxy arp”.
Any device configured to do static NAT has a list of servers it will
“answer for” when it hears an arp request. IT will essentially lie and
say, “yes, I am that server, please send me the packet.” When it get the
packet, it forwards it to the real server.
A Typical Internet Connection Scenario
A very common small business-class (as opposed to home use) Internet
connection looks like this following:
Figure 1: Common Firewalled Network Diagram–With Router
Figure 2: Common Firewalled Network Diagram–With Bridge
Description
Network
IP Range
Company LAN
192.168.1.0/24
192.168.1.1 to 192.168.1.254
Service Network (DMZ)
192.168.200.1/24
192.168.200.1 to 192.168.200.254
Moat
10.146.2.40/29
10.146.2.41 to 10.146.2.46
Link Network
10.146.37.28/30
10.146.37.29 to 10.146.37.30
Network or Device
Default Gateway
Company LAN
192.168.1.1
Service Network (DMZ)
192.200.1.1
Firewall
10.146.2.41
ISP Router
10.146.37.29
The Company LAN uses the private (RFC1918) address of
192.168.1.0/24.
There is a “Service Network” (AKA DMZ) for hosting Web Servers, FTP
Servers, extranet (partner) connections, etc.
The Firewall is performing both hide NAT and Static NAT.
Hide NAT is that all outgoing connections from the 192.168.1.0
network are hidden behind the firewall’s address of 10.146.2.42.
Static NAT is that the E-Mail server on the company LAN has a
“routable,” external IP address of 10.146.2.44, but an internal
IP Address of 192.168.1.15.
The “Moat” network is the network between the external interface of
the firewall and the internal interface of the router.
There is confusion about the term DMZ. Originally, the term DMZ was
used to denote the “moat” network. Recently, however, the common
usage has been that the DMZ is the “Service Network”. I have used
“Service Network” and “Moat Network” to avoid confusion. The term
“Moat Network” is not in common usage, however.
Service
Internal Address
External Address
NAT Mode
Hide NAT
192.168.1.0/24
209.146.2.42
Hide
E-Mail Server
192.168.1.15
209.146.2.44
Static
Web Server
192.168.1.10
209.146.2.43
Static
Appendixes
Subnet Masks: Decimal and CIDR
CIDR
Decimal Mask
Old
A Subnets
B Subnets
C Subnets
# Useable
# Hosts
8
255.0.0.0
A
1
16,777,214
16,777,216
9
255.128.0.0
A
2
8,388,606
8,388,608
10
255.192.0.0
A
4
4,194,302
4,194,304
11
255.224.0.0
A
8
2,097,150
2,097,152
12
255.240.0.0
A
16
1,048,574
1,048,576
13
255.248.0.0
A
32
524,286
524,288
14
255.252.0.0
A
64
262,142
262,144
15
255.254.0.0
A
128
131,070
131,072
16
255.255.0.0
B
256
1
65,534
65,536
17
255.255.128.0
B
512
2
32,766
32,768
18
255.255.192.0
B
1,024
4
16,382
16,384
19
255.255.224.0
B
2,048
8
8,190
8,192
20
255.255.240.0
B
4,096
16
4,094
4,096
21
255.255.248.0
B
8,192
32
2,046
2,048
22
255.255.252.0
B
16,384
64
1,022
1,024
23
255.255.254.0
B
32,768
128
510
512
24
255.255.255.0
C
65,536
256
1
254
256
25
255.255.255.128
C
131,072
512
2
126
128
26
255.255.255.192
C
262,144
1,024
4
62
64
27
255.255.255.224
C
524,288
2,048
8
30
32
28
255.255.255.240
C
1,048,576
4,096
16
14
16
29
255.255.255.248
C
2,097,152
8,192
32
6
8
30
255.255.255.252
C
4,194,304
16,384
64
2
4
31
255.255.255.254
C
N/A
N/A
N/A
N/A
N/A
32
255.255.255.255
C
BC
BC
BC
Broadcast
Broadcast
Notes:
The “# Useable” series can be derived by “previous # Useable x 2 +
2”.
The “# Useable” series can be derived by “# Hosts - 2”.
The “# Hosts” series can be derived by “previous # Hosts * 2”.
The “# Hosts” series can be derived by “# Useable + 2”.
The number of subnets is only correct under CIDR. Using the old
classfull numbers it is “# CIDR Subnets - 2”.
3. Private Address Space
The Internet Assigned Numbers Authority (IANA) has reserved the
following three blocks of the IP address space for private internets:
10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
We will refer to the first block as "24-bit block", the second as
"20-bit block", and to the third as "16-bit" block. Note that (in
pre-CIDR notation) the first block is nothing but a single class A
network number, while the second block is a set of 16 contiguous
class B network numbers, and third block is a set of 256 contiguous
class C network numbers.
An enterprise that decides to use IP addresses out of the address
space defined in this document can do so without any coordination
with IANA or an Internet registry. The address space can thus be used
by many enterprises. Addresses within this private address space will
only be unique within the enterprise, or the set of enterprises which
choose to cooperate over this space so they may communicate with each
other in their own private internet.
This content is old! It’s still useful, but it’s old, and there may be bit rot, newer/better tools or ways to do things. Sanity check and do your research.
Daylight Saving Time Switch
In 2007, the US and Canada, as well as others, changed the rules for when
Daylight Saving Time begins and ends. In my opinion this is sheer idiocy,
but then, they didn’t ask me.
Anyway, it really screwed up quite a lot of things, many of
which are not in our power to easily fix (GPS, car GPS, VCRs, embedded
systems like cheap routers, and much more). Here are some resources:
ISO/IEC 17799:2000(E) (AKA BS7799),
clause 9.7.3 specifies “Clock synchronization:”
“[…]Where a computer or communications device has the capability
to operate a real-time clock, it should be set to an agreed
standard, e.g. Universal Coordinated Time (UCT) or local standard
time. As some clocks are known to drift with time, there should be a
procedure that checks for and corrects any significant variation.”
Event Logging, Auditing or Intrusion Detection across different
systems becomes very difficult.
Many cryptographic functions, especially those involving key
creation, exchange and expiration, as well as “ticketing” functions
such as used by Kerberos require precise time synchronization.
Event or program scheduling may not work as expected.
Client/Server transactions may not work as expected (transaction
precedence is incorrect).
There may be legal issues when submitting logs or other material as
evidence if the time is not known to be
correct. 1
Security certificates, WWW Cookies, DHCP and WINS leases may not
work as expected.
High Availability or clustering solutions may depend on members
clocks being exactly synchronized.
File creation and access times will be wrong across different
computers, thus:
Differential, Incremental or other backups may not work as
expected.
Revision control systems (such as CVS) may not work properly.
E-Mail Message time stamps may be wrong, leading to unexpected
transmission issues.
NetWare NDS will not work right unless all NDS servers have the same
time.
Neither will Active Directory, even though it says it will. If you
have an object collision (two objects are modified at the same time
by different people on different masters) the time stamp is used to
help resolve the conflict. If time is not synchronized, the results
will not be as expected.
For more uses or requirements for time synchronization, search the RFCs
for other RFCs that specify the use of NTP.
Why is UTC used as the acronym for Coordinated Universal Time
instead of
CUT?
In 1970 the Coordinated Universal Time system was devised by an
international advisory group of technical experts within the
International Telecommunication Union (ITU). The ITU felt it was
best to designate a single abbreviation for use in all languages in
order to minimize confusion. Since unanimous agreement could not be
achieved on using either the English word order, CUT, or the French
word order, TUC, the acronym UTC was chosen as a compromise.
Which is correct, UTC or GMT? Does GMT have summer time?
From http://wwp.greenwichmeantime.com/home.htm
During the Summer the UK is on British Summer Time which is 1 hour
ahead of GMT (GMT+1).
[…]
GMT is fixed all year and does not switch to daylight savings
time.
[…]
Although GMT has been replaced by atomic time (UTC) it is still
widely regarded as the correct time for every international time
zone. Greenwich Mean Time is international time, the basis of the
world time clock. Marks precision time and military time (sometimes
called Zulu Time).
[…]
The following articles from Sun are an excellent introduction to NTP
concepts and implementation, while from a Solaris perspective, they
are probably useful to anyone interested in time synchronization.
A list of Windows Time Sync Tools (in Excel format,
originally researched by me in 1999 and 2000, last updated May 2003
by Jason Mathews <mathews@mitre.org>)
By far the best NTP client and server that I found is
Tardis. It runs as an NTP client
and NTP server. There is one version that is an NT4/Win2K service,
and another that runs as a normal application under Win9x/ME. It has
only one minor problem – it’s not free. It runs from $20 to $2,000
USD, see the web site
for details.
The next best is the “official”
NTP package from David Mills.
Only the source is available from the Time Server site, but compiled
binaries for Windows are available.
There is also a Windows NT port
Maintained by Terje Mathisen.
NTP for Windows NT/2000/XP/2003/Vista is an NTP for
Windows binary port and
installer, along with a cool monitoring
GUI.
If you own the NT Resource
Kit
(or a newer ResKit), you should look into the NTRK TimeServ utility.
While you can only get the TimeServ tool from the NTRK, you can find
more information about it, and time in general at Doug Hogarth’s
Niceties site, specifically
the TimeServ page. Also
see other built-in Windows options below.
Tom Horsley’s NTP
Time for Windows is
a nice NTP client program. It is free, but is a client only, and can
be configured to talk to only one NTP server at a time. NTP works
much better when referencing a pool of servers.
I have also used the very cool
AboutTime
program, which is a Daytime/TCP, Time/TCP, Time/UDP and SNTP client
and server. It runs under any Windows version, but does not run as a
service. It is free!
I’ve used
Dimension4, which
is a free client for Time and NTP.
There are also Tardis/K9, which
are excellent shareware tools.
And for a minimalistic web site but neat sounding tool, see Graham
Mainwaring’s NetTime, at
Sourceforge.
The Microsoft Networking “Net Time” Command
Displays the time on or synchronizes your computer’s clock with the
shared clock on a Microsoft Windows for Workgroups, Windows NT, Windows
95, or NetWare time server.
NET TIME [\\computer | /WORKGROUP:wgname] [/SET] [/YES]
computer Specifies the name of the computer (time
server) whose time you want to check or
synchronize your computer's clock with.
/WORKGROUP Specifies that you want to use the clock on a
computer (time server) in another workgroup.
wgname Specifies the name of the workgroup containing
a computer whose clock you want to check or
synchronize your computer's clock with. If
there are multiple time servers in that
workgroup, NET TIME uses the first one it
finds.
/SET Synchronizes your computer's clock with the
clock on the computer or workgroup you
specify.
/YES Carries out the NET TIME command without
first prompting you to provide information or
confirm actions.
For example, if your PCD is named MYPDC, the following command in a
shortcut in your Startup Group, or in a logon script will synchronize a
client PC’s time at logon. Note, if your clients never log off, this
will not work. Of course, that’s very bad for other reasons. This works
for any system that runs Microsoft Networking. You can even sync again a
Linux server running Samba with this command,
if you’d like!
“net time \\MYPDC /set/ yes”
Win2K NTP Time Service
Win2K has a very simple SNTP facility built in: “net time /setsntp[:NTP
server list]”. See the following for more information:
Here is the batch file I use, since I find the documentation lacking and
the usage statement obscure:
@echo off
REM Win2k-SNTP.bat -- Set Win2K SNTP serviceREM v1.0 25-May-2001 JP Vossen JPATjpsdomainDOTorgREM v1.1 22-Jun-2001 JPV Changed to use home NTP time source onlyrem NOTE: The Win2K "Windows Time" service is manual by default, so you have torem set it to automatic and start it. Also, it will attempt to use all specifiedrem time sources and get an "average" so only specify servers that will berem available at all times. Do not use the list as a set of sequentialrem "failover" servers (as I did in v1.0 of this).rem NET TIME /SETSNTP:"192.168.1.11 172.16.1.1 10.1.1. 10.1.1.2"NET TIME /SETSNTP:"192.168.1.11"
You can see how it’s currently set by using this command: “net time
/querysntp” which will return something like:
The current SNTP value is: 192.168.1.11
The command completed successfully.
NTP Tools for Netware
For a small network with one or more NetWare servers, but no WAN links or remote sites:
Set one NetWare server as the REFERENCE server. This server will
sync itself to the NTP time.
Load MONITOR.NLM | Server Parameters | Time, change the
following parameters
Default Time Server Type = REFERENCE
Time Server Type = REFERENCE
TIMESYNC Configured Sources = ON
TIMESYNC Time Sources = <At least one PRIMARY
server>;<2-4 NTP time sources>:123;
Set one other NetWare server at the main site, and one NetWare
server at each remote site as a PRIMARY server.
Load MONITOR.NLM | Server Parameters | Time, change the
following parameters
Default Time Server Type = PRIMARY
Time Server Type = PRIMARY
TIMESYNC Configured Sources = ON
TIMESYNC Time Sources = <Your REFERENCE server from step
2>;
Set all other NetWare servers as SECONDARY.
Load MONITOR.NLM | Server Parameters | Time, change the
following parameters
Default Time Server Type = SECONDARY
Time Server Type = SECONDARY
TIMESYNC Configured Sources = ON
TIMESYNC Time Sources = <The closest PRIMARY server from
step 3>;
Note: usually, the REFERENCE server does not ever change it’s own time,
it just serves the time. However, when using NTP, the REFERENCE server
will adjust its local clock to synchronize with the NTP time source. See
the middle of TID
10050215.
Periodically set calendar from an NTP server. Supported by 7000, 7200, 4500.
ntp server {insert your favorite NTP server here}
NTP server from which to get the time
NTP for Nokia IPSO
IPSO comes with xNTP, but you can’t change the default polling, which is
something like every minute and a half. Until Voyager is enhanced to
provide this capability, there is no easy way to do it. You could edit
the ntp.conf file, but Voyager will overwrite it at bootup.
A list of Windows Time Sync Tools (in Excel format,
originally researched by me in 1999 and 2000, last updated May 2003
by Jason Mathews <mathews@mitre.org>)
Returns the number of seconds since 00:00 (midnight) 1 January 1900 GMT, such that the time 1 is 2:00:01 am on 1 January 1900 GMT. No accounting for different time zones, daylight savings, etc. Very inaccurate.
Protocols marked with
(RFC1700) are listed, but
not defined in the RFC.
Protocols marked with GnatBox Admin Tool
are listed in the services list in the executable.
Old Content
This content is old! It’s still useful, but it’s old, and there may be bit rot, newer/better tools or ways to do things. Sanity check and do your research.
