I've been told that it is bad practice to have two interfaces on the same device on the same subnet. i.e. two Ethernet ports on a switch should be on different subnets. Could somebody explain why this is the case? (preferably simply as possible as I'm new to networking)
Because routing in your OS normally sets one of Ethernet card as out gate to specified subnet and all traffic to this subnet will have only 1 output. Second route to same subnet will have bigger Metrik value and will use to send some data if first interface is down. Even if somebody will send request to second interface answer can have first Ip as sender.
If you try to increase throughput to subnet you must use aggregation of Ethernet link. you`ll have 2 physically link and 1 IP.
subnet is the logical division of the IP network based on the subnet-mask/netmask. So unless you plan to have two different separate networks, you need not to have two different subnets. This link explains most of the possible cases to explain what it means by subnetworks on a switch.
Whether two interfaces on the same subnet is good or bad depends entirely of what you're trying to accomplish.
If you need link redundancy or a simple way of load sharing (L2 or L3) it may the right way to go.
If you need network/uplink redundancy or a more complex way of load sharing (L3 only) you connect to two different networks (multi-homing). This is also the setup for a router connecting the two networks.
Related
I have some questions about vlan's. I know that this forum is more for programming than for networking but this is the best forum that I could think of.
So all my questions are about vlan's. Here they come:
Can one vlan have a different beginning of a ip adress as the other one's (e.g. vlan 1=192.168.2.xx, vlan 2=10.0.0.x)?
Can devices have the same ipadress when they're in different vlan's?
Can you make a "hole" between the vlan's so that a few devices (chosen by you, for example using static ip adresses) can still talk with each other (e.g. a file server on vlan 1 can still talk to the printer on vlan 2)?
Can you have different dns servers for different vlan's?
Can you have different firewall settings for different vlan's? How do you "choose" which firewall you want to change as an admin?
Can you have wifi vlan's (like a vlan for your home wifi and a vlan for your guest wifi)
Can you access the routers settings (192.168.1.1) from every vlan?
When I connect to a network, how do I get assigned to a vlan? Is there like a "If someone connects to the network, it automatically goes to vlan 1 until the admin moves them to a different vlan"?
Can you put a password on a vlan so that you have to put in a password to change vlan's?
Can a user (so not a network admin) choose to change from vlan's (because then question 8 would be relevant)?
How does portforwarding work with vlan's?
If you access the network from outside (e.g. a hacker or just someone else), do you automatically get "redirected" to the standard vlan (1) or do you end up in a "intersection" where you first have to choose the vlan you want to go to?
Can you make a port on a switch that has special access to every vlan at the same time (Only for the network admin)(So for that ethernet port, the network is just one big network instead of divided vlan's)(This would contradict question 2 as then you would have two devices with the same ip adress)?
Can you have a network port with a device attached to it, that will be accessable to every vlan (e.g. a printer)? Is that dangerous because than a hacker could probably access that device and use it to jump between vlan's?
That's it. I know that there are alot of questions but I hope you can help with a few at least. The thing is, youtube video's always just explain that vlan's are separate networks, but I want to know: "How separate are they?" You see that almost every question is about "How separate are they exactly?"
I hope you can help!
Thanks
hopefully this will answer your questions
VLANs are like separated cables inside cable and they do not mix or intefer between themselfs
Answers:
Yes. As mentioned above
Yes but it's not good practice because you can make mistake durring VLANs settings causing sec flaws or IP collisions
Not directly but this can be done via gateway/router between VLANs and all traffic have to go thru GW (easy way)
Yes and usually you do. For example you have:
VLAN 10: Subnet 192.168.10.0/24; GW 192.168.10.1; DNS 192.168.10.1
VLAN 20: Subnet 192.168.20.0/24; GW 192.168.20.1; DNS 192.168.20.1
Yes it is common/required behavior. It is done by filtering firewall rule by incoming interface (eg vnet7), incoming subnet or incoming IP
Yes. But there are two ways setting VLANs:
ACCESS (untag): VLAN is ended at output interface thus client device dont have to support/setup VLAN. Actualy client device even don't know that there is some VLAN
TRUNK (tag): VLAN (or multiple VLANs) are routed thru access point and client device has to be configured same way on incoming interface
Access is what you need in this case
Yes if you setup firewall that way (routing between subnes)
As explained in point 6
No. VLAN is just number. To protect your vlans you have to setup network devices in way that every port (unless needed - eg switches bond interconnection) is set in ACCESS mode so only admin with access to network device can change VLAN for client device. Or implement NAC such as packetfence
As points 6. and 8. Only when your setup allows
Inside VLAN no portforward is needed because all devices in same VLAN are at same L2 network
No simple answer here, it all depends on your VLAN and firewall settings
Can not be done with VLANs only. Common practice is to setup specific VLAN (lets call it management VLAN) which is ended in ACCESS mode on some physicaly secured switch ethernet port and then using firewall and routings on GW to setup access across all VLANS (well .. not all but required ones)
Yes you can as mentioned above but again using firewall and routing settings on gateway
This one is long :) ... fell free to continue in chat
I understand that it's different than a hub in that instead of packets being broadcasted to all devices connected to the device, it knows exactly who requested the packet by looking at the MAC layer.
However, is it still possible to use a packet sniffer like Wireshark to intercept packets meant for other users of the switch? Or is this only a problem with ethernet hubs that doesn't affect switches due to the nature of how a switch works?
On a slightly off topic side note, what exactly is classified as a LAN? For example, imagine two separate ethernet switches are hooked up to a router. Would each switch be considered a separate LAN? What is the significance of having multiple LAN's within the same network?
it knows exactly who requested the packet by looking at the MAC layer.
More exactly, the switch uses the MAC destination address to forward a frame to the port associated with that address. Addresses are automatically learned by looking at the MAC source address on received frames.
A switch is stateless, ie. is has no memory who requested which data. A layer-2 switch also has no understanding of IP packets, addresses or protocols. All a basic switch does is learn source addresses and forward by destination address.
is it still possible to use a packet sniffer like Wireshark to intercept packets meant for other users of the switch?
Yes. You'll need a managed switch supporting port mirroring or SPANning. This doesn't intercept frames, it just copies them to the mirror port. If you need to actually intercept frames you have to put your interceptor in between the nodes (physically or logically).
With a repeater hub, every bit is repeated to every node in the collision domain, making monitoring effortless.
what exactly is classified as a LAN?
This depends on who you ask and on the context. A LAN can be a layer-1 segment/bus aka collision domain (obsolete), a layer-2 segment (broadcast domain), a layer-3 subnet (mostly identical with an L2 segment) or a complete local network installation (when contrasted with SAN or WAN).
Adding to #Zac67:
Regarding this question:
is it still possible to use a packet sniffer like Wireshark to
intercept packets meant for other users of the switch?
There are also active ways in which you can trick the Switch into sending you data that is meant for other machines. By exploiting the Switch's mechanism, one can send a frame with a spoofed source MAC, and then the Switch will transfer frames destined to this MAC - to the sender's port (until someone else sends a frame with that MAC address).
This video discusses this in detail:
https://www.youtube.com/watch?v=YVcBShtWFmo&list=PL9lx0DXCC4BMS7dB7vsrKI5wzFyVIk2Kg&index=18
In general, I recommend the following video that explains this in detail and in a visual way:
https://www.youtube.com/watch?v=Youk8eUjkgQ&list=PL9lx0DXCC4BMS7dB7vsrKI5wzFyVIk2Kg&index=17
what exactly is classified as a LAN?
So indeed this is one of the least-well-defined terms in Computer Networks. With regards to the Data Link Layer, a LAN can be defined as a segment, that is - a broadcast domain. In this case, two devices are regarded as part of the same segment iff they are one hop away from one another - that is, they can switch frames in the second layer.
I ask myself that for some days now, and couldn't find a clear answer.
Imagine a network with several rooms, each room with it's own (Layer 2) Switch.
Those are then connected in star topology to another switch which is then connected to the router.
All Clients get IPs from the same range, all clients are in the same subnet and in the same VLAN.
Do you know a way how to determine, which client is connected to which switch, without involving the switch. E.g only with technologies and mechanisms taking place on the client.
The goal would be to be able to draw automated maps of the client distribution in the network, but, as I said, without involving the switch (for example access it's API or somethign like that).
Regards
Me
I am afraid that you are right: In general, in a "normal" Network (which means: In a Network with just Standard Switches and Routers), there is no way to do so.
Only if the Switches were managed, you could write a script which polls the arp-tables from the Switches, but of course this doesn't work with unmanaged Switches.
I realised that there is no way to do this.
The problem is, that a normal network switch, which works on Layer 2 of the OSI model, is not "visible" for tools like traceroute or such.
If you want to traceroute to, lets say: google.com, your traceroute application sends a packet with a TTL of 1 to your default gateway. Your default gateway then decreases the TTL and discards the package, because it has reached a TTL of 0.
Because of that, it answers to your computer and your computer can record, from where it received the first answer.
It then sends again a package to google.com, but this time with a TTL of 2, and the process begins from start.
Now you can't do with switches what you can do with routers, because (normal layer 2) switches do not know about IP...
Cisco offers a layer2 traceroute utility, but this is limited to the cisco ecosystem and only works with cisco hardware.
So, I fear the answer is, that it is not possible in general.
I am learning about MPLS VPN networks. From my understanding an IGP runs on all core routers (P and PE), while BGP runs on all PE routers. Once the IGP has conveyed reachability information to all routers, and all routers have converged, the exact labels to be used to transfer packets are assigned using LDP.
My doubt is, how are BGP control packets transmitted between PEs.
There are two options.
1. To use the Label switched paths between PEs.
2. To use normal IP forwarding through the P routers.
Which of these two methods is actually used?
If both can be used how does the PE router make a decision on which one to use?
Do we have to manually configure it in the router?
Do these answers vary for different routers like Juniper, Cisco etc. ?
My doubt is, how are BGP control packets transmitted between PEs.
There are two options:
To use the Label switched paths between PEs.
To use normal IP forwarding through the P routers.
If both can be used how does the PE router make a decision on which one to use?
LSPs are preferred over per-hop IP forwarding, if an LSP is available.
Do we have to manually configure it in the router?
By 'it', do you mean configure use of the LSP for BGP control-plane information? It happens automatically on a Cisco IOS box
Do these answers vary for different routers like Juniper, Cisco etc. ?
Cisco will send BGP information through an LDP LSP, as long as the BGP endpoint prefix has an label binding.
I can't remember Juniper's behavior off-hand, they offer somewhat more granular control over LSP behavior.
BGP uses TCP te setup its connection and to send their packets to his neighbors.
This means that your neighbors need to see each other on layer 3 (ip) level.
I hope this is the info that you needed.
see: http://en.wikipedia.org/wiki/Border_Gateway_Protocol
section "operation" for more details on this matter.
For a classification project I'm trying to generate a large list of dynamic IP addresses from a single wireless network. However, the only way I've been able to generate these addresses is by connecting a physically new machine to the network, as the wireless network remembers each machine (and so, whenever one machine rejoins the network the IP address remains the same).
For the sake of brevity, I've been looking for a way of automating the process; technically, all I need to do is find a way to simulate being a "new" machine. This way, it would be far easier to generate a list of IP addresses assigned by a single wireless network.
I've had a great deal of trouble finding out how to do this, and it is very possible I may misunderstand how a wireless network assigns IP addresses, etc.
Thanks!
(continuing from the comments above...)
As it turns out, there's no fancy machine learning necessary at all. You can get all the information you need by connecting just once. When you connect to an IP network and are assigned an address, you get both an address and a subnet mask (look it up if you're not familiar with the terms). Given these, a straightforward snippet of bitwise arithmetic will show you whether another address is part of the same network or not:
if ((my_address & subnet_mask) == (unknown_address & subnet_mask)) { ...
where unknown_address is the address you're testing. (This expression can be simplified a bit by applying boolean simplification rules, but this is a form where it's obvious what is happening.)
For example, if you are assigned:
address: 192.168.11.22
subnet: 255.255.255.0
then any other address is part of the same network if it starts with 192.168.11.. Again, the person who set up the network has very deliberately made these choices.
This very much reminds me of the so-called Barometer question, where one of the possible answers is "trading the barometer to the building's superintendent in return for the information wanted".