In modern telecommunications networks, information (voice, video, data) is now transferred as packet data (termed packet switching) rather than previously in older telecommunications networks as analog signals such as in the (public switched telephone network) (PSTN) or analog TV/Radio networks. The processing of these packets has resulted in the creation of Integrated Circuits (IC) that are optimised to deal with this form of packet data. Network Processors have specific features or architectures that are provided to enhance and optimise packet processing within these networks.

Network processors have evolved into IC's with specific functions. This evolution has resulted in more complex and more flexible IC's being created. The newer circuits are programmable and thus allow a single hardware IC design to undertake a number of different functions, where the appropriate software is installed.

Network processors are used in the manufacture of many different types of network equipment such as:

* Routers and switches
* Firewalls
* Intrusion detection devices
* Intrusion prevention devices
* Network monitoring systems.

What Is Network Latency?
Bandwidth is just one element of what a person perceives as the speed of a network. Latency is another element that contributes to network speed. The term latency refers to any of several kinds of delays typically incurred in processing of network data. A so-called low latency network connection is one that generally experiences small delay times, while a high latency connection generally suffers from long delays.
Latency vs. Bandwidth
Although the theoretical peak bandwidth of a network connection is fixed according to the technology used, the actual bandwidth you will obtain varies over time and is affected by high latencies. Excessive latency creates bottlenecks that prevent data from filling the network pipe, thus decreasing effective bandwidth.
The impact of latency on network bandwidth can be temporary (lasting a few seconds) or persistent (constant) depending on the source of the delays.
Latency of Satellite Internet Service
Satellite Internet service illustrates the difference between latency and bandwidth on computer networks. Satellite Internet connections possess both high bandwidth and high latency. When loading a Web page, for example, most satellite users can observe a noticeable delay from the time they enter a Web address to the time the page begins loading. This high latency is due primarily to propagation delay as the request message travels at the speed of light to the distant satellite station and back to the home network. Once the messages arrive on Earth, however, the page loads quickly like on other high-bandwidth Internet connections (DSL or cable).

Besides propagation delays, latency also may also involve transmission delays (properties of the physical medium) and processing delays (such as passing through proxy servers or making network hops on the Internet).
Measuring Network Latency
Network tools like ping tests and traceroute measure latency by determining the time it takes a given network packet to travel from source to destination and back, the so-called round-trip time. Round-trip time is not the only way to specify latency, but it is the most common.

On DSL or cable Internet connections, latencies of less than 100 milliseconds (ms) are typical and less than 25 ms desired. Satellite Internet connections, on the other hand, average 500 ms or higher latency.
Summary
Two key elements of network performance are bandwidth and latency. The average person is more familiar with the concept of bandwidth as that is the one advertised by manufacturers of network equipment. However, latency matters equally to the end user experience as the behavior of satellite Internet connections illustrates. Businesses use the term Quality of Service (QoS) to refer to measuring and maintaining consistent performance on a network by managing both bandwidth and latency in a coordinated fashion.

If you've understood most of this document so far, the principles of Virtual private networking (VPN) will be easy to understand. The most confusing part of VPN is that many acronyms show up. This is partly because VPN requires data encryption to be "private" and there are many encryption techniques and terms. Also there are many complicated security issues relating to VPN concerning encryption and user authentication. This section will first explain the concept and methodology behind VPN, then explain some of the acronyms. I can't explain them all, there will be more tomorrow.

Purpose of VPN

The function of VPN is to allow two computers or networks to talk to each other over a transport media that is not secure. To do this VPN uses a computer at each of the two or more points on the various ends of the transport media such as the internet. Each point at the end of the transport media (internet) is called a point of presence (POP). In this example, the transport media is the internet. In the example below our company "Boats and More, Inc." has four offices. One in Boston, St Petersburg, Seattle, and San Diego. The owner wants a networking setup so he can access any of the 4 network locations at any time through the internet. He wants his data secure since some of it is confidential. His offices are set up on networks 10.1.x.x, 10.2.x.x, 10.3.x.x, and 10.4.x.x. Each of the four networks, when they need to send a data packet to one of the other networks, will route its data packet to its respective router, A, B, C, or D. For example if a computer on the 10.1.x.x network in Boston needs to send a packet to a computer with address 10.3.6.1 on the network in San Diego at 10.3.x.x, it will send its packet to its router, A. Since the network number, 10.x.x.x, is reserved for private use, the packet can't be sent going from computer A with 10.3.6.1 as its intended address. This is because the routers on the internet will not recognize this address as a valid destination. IP masquerading won't solve this problem since the computer on the other end would have no way of knowing that a packet that it didn't send was a masqueraded packet. Tunneling is the technique used to solve this problem.



Tunneling means that the complete IP packet to be sent from Boston to San Diego must be encapsulated into another IP packet. This new packet will have a legal internet IP address. Therefore, machine A will take the packet it needs to route (already has destination address 10.3.6.1) and roughly the following will happen:

Machine A will extract the IP packet.

Machine A will encrypt the packet.

Machine A will wrap the original IP packet in a new IP packet with destination address 201.47.98.101, which is machine C's true internet address.

Machine A will wrap the new IP packet in an ethernet packet and send it to the network.

The packet will be routed through the internet until it reaches machine C.

Machine C will extract the outer IP packet.

Machine C will determine that the IP packet contains another IP packet and extract it.

Machine C will decrypt the packet.

Machine C will examine the destination address of the inner IP packet, wrap it in an ethernet packet with the correct ethernet address, and send it to the internal network on its port 10.3.1.1.

This description is simplistic, but it is essentially what happens. This did not account for authentication and being sure machine C had the authority or ability to decrypt the packet. Therefore VPN can be examined in two main functional areas which are the tunneling mechanism and the security mechanisms.

VPN tunneling Protocols

The list below describes the tunneling protocols which may be used for VPN.

L2F - Layer2 Forwarding, works at the link layer of the OSI model. It has no encryption. Being replaced by L2TP.

PPTP - Point-to-Point Tunneling Protocol (RFC 2637) works at the link layer. No encryption or key management included in specifications.

L2TP - Layer2 Tunneling Protocol. (RFC 2661) Combines features of L2F and PPTP and works at the link layer. No encryption or key management included in specifications.

IPSec - Internet protocol security, developed by IETF, implemented at layer 3. it is a collection of security measures that address data privacy, integrity, authentication, and key management, in addition to tunneling. Does not cover key management.

Socks - handled at the application layer
VPN Security

In addition ot tunneling, VPN needs to provide for authentification, confidentiality, data integrity and key management. This is important if you need to keep your data going across the transmission media, secret. The capability of sending the data is easy, but the security measures necessary make VPN a much more complex subject. Security functions that must be covered are:

Authentification - Making sure the data is from where it is supposed to be from.

Confidentiality - Keeping any third parties from reading or understanding the data.

Data integrity - Being sure the data received was not changed by a third party and that it is correct.

Access control - Keeping third parties without authorization from getting access to your data or network.

Essentially the part of the system that must make the data secure, must encrypt the data and provide a method to decrypt the data. There are many different encryption formulas, but typically handling of decryption is usually done by providing a "key" to the party that must decrypt the data. Keys are secrets shared between two parties, that allow one party to pass encrypted information from one to the other without third parties being able to read it. It is similar to a house or car key that allows only members of your family to enter the house or use the car. Keys are a digital code that will allow the second party to decrypt the data. The digital code must be long enough to keep any third parties from being able to break the code by guessing. Key management can be a complex subject since there are many ways to implement it, but it needs to be secure so no third party gets, intercepts, or guesses the key.

There are many different protocols used to support each of the above functions. Each have various advantages and disadvantages including the fact that some are more secure than others. If you are going to use VPN as a data exchange method, and you want secure data, you or someone on your staff had better know what they're doing (Knowledge of the strengths and weaknesses of the protocols and how to implement them properly), or sooner or later, you may get burned.
Managing user access rights and Key Management or Authentification Systems

Two key management protocols are:

RADIUS - Remote Authentication Dial-In User Service is used for dial in clients to connect to other computers or a network. It provides authentication and accounting when using PPTP or L2TP tunneling.
ISAKMP/Oakley - Internet Security Association and Key Management Protocol Authentication uses one of the following three attributes to authenticate users.
Something you have such as a key.
Something you know such as a secret.
Something you are such as your fingerprint.

More than one means of authentification is recommended for stronger security.
VPN terms

VPN Protocols:
PPTP - Point to point tunneling protocol (RFC 2637)
L2TP - Layer 2 tunneling protocol (RFC 2661)
IPIP tunneling - Tunneling IP packets in IP packets.

Encryption protocols, methods and terms:
CIPE - Crypto IP Encapsulation
SSL - Secure sockets layer
IPSEC - Internet protocol security

Authentication Protocols:
PAP - Password Authentification Protocol is a two way handshake protocol designed for use with PPP.
CHAP - Challenge Handshake Authentication Protocol is a three way handshake protocol which is considered more secure than PAP.
TACACS - Offers authentication, accounting, and authorization.
S/Key - A one time password system, secure against replays. RFC 2289.

Projects and software:
SWAN - Secure wide area network
PoPToP Point to point tunneling protocol server.

Redundant Array of Inexpensive disks (RAID)::

RAID is a fault tolerant method of storing data, meaning that a failure can occur and the system will still function. The various RAID categories are:
0 - Disk striping - Data is written across multiple drives in parallel. Different parts of the data is written at the same time to more than one drive. If there are two drives, half the data is written to one drive, while the rest of the data is written to the other drive. All partitions on striped drives must be the same size. No fault tolerance is provided with RAID-0.
1 - Disk mirroring - All the data is written to two drives so each drive has a complete of all stored data. If one drive fails, the other can be used to get a copy of the data. To be more fault tolerant, more than one controller card may be used to control the mirrored hard drives. This is called disk duplexing and will allow the system to keep functioning if one controller card fails.
2 - Disk striping with error correction codes (ECC).
3 - Disk striping with ECC parity information stored on a separate drive.
4 - Disk striping with blocks with parity information stored on a separate drive.
5 - Disk striping with blocks with parity information stored using multiple drives. Uses five disks with one fifth of each one to store parity information.
Sector Sparing

Sector sparing will detect when data is going to be read from or written to a bad sector on the hard drive and will move the data to a good sector. The bad sector is marked as not available so it is not used again.
Windows NT support

Supports RAID-0,1, and 5 along with sector sparing.

Terms:
DAT - Digital Audio Tape
Sector Sparing - A method of fault tolerance that automatically identifies and marks bad sectors as not available. It is also called hot-fixing.
SLED - Single Large Inexpensive disk - The concept that a large disk costs less per amount of storage than several smaller ones. Somehow this concept is used as a means of fault tolerance.

Bus, ring, star, and other types of network topology

In networking, the term "topology" refers to the layout of connected devices on a network. This article introduces the standard topologies of computer networking.
Topology in Network Design
One can think of a topology as a network's virtual shape or structure. This shape does not necessarily correspond to the actual physical layout of the devices on the network. For example, the computers on a home LAN may be arranged in a circle in a family room, but it would be highly unlikely to find an actual ring topology there.

Network topologies are categorized into the following basic types:

bus
ring
star
tree
mesh
More complex networks can be built as hybrids of two or more of the above basic topologies.
Bus Topology
Bus networks (not to be confused with the system bus of a computer) use a common backbone to connect all devices. A single cable, the backbone functions as a shared communication medium that devices attach or tap into with an interface connector. A device wanting to communicate with another device on the network sends a broadcast message onto the wire that all other devices see, but only the intended recipient actually accepts and processes the message.

Ethernet bus topologies are relatively easy to install and don't require much cabling compared to the alternatives. 10Base-2 ("ThinNet") and 10Base-5 ("ThickNet") both were popular Ethernet cabling options many years ago for bus topologies. However, bus networks work best with a limited number of devices. If more than a few dozen computers are added to a network bus, performance problems will likely result. In addition, if the backbone cable fails, the entire network effectively becomes unusable.

Ring Topology:

In a ring network, every device has exactly two neighbors for communication purposes. All messages travel through a ring in the same direction (either "clockwise" or "counterclockwise"). A failure in any cable or device breaks the loop and can take down the entire network.

To implement a ring network, one typically uses FDDI, SONET, or Token Ring technology. Ring topologies are found in some office buildings or school campuses.

Star Topology:

Many home networks use the star topology. A star network features a central connection point called a "hub" that may be a hub, switch or router. Devices typically connect to the hub with Unshielded Twisted Pair (UTP) Ethernet.

Compared to the bus topology, a star network generally requires more cable, but a failure in any star network cable will only take down one computer's network access and not the entire LAN. (If the hub fails, however, the entire network also fails.)

Tree Topology:

Tree topologies integrate multiple star topologies together onto a bus. In its simplest form, only hub devices connect directly to the tree bus, and each hub functions as the "root" of a tree of devices. This bus/star hybrid approach supports future expandability of the network much better than a bus (limited in the number of devices due to the broadcast traffic it generates) or a star (limited by the number of hub connection points) alone.

Mesh Topology:

Mesh topologies involve the concept of routes. Unlike each of the previous topologies, messages sent on a mesh network can take any of several possible paths from source to destination. (Recall that even in a ring, although two cable paths exist, messages can only travel in one direction.) Some WANs, most notably the Internet, employ mesh routing.

A mesh network in which every device connects to every other is called a full mesh. As shown in the illustration below, partial mesh networks also exist in which some devices connect only indirectly to others.

Port scanners are used to help increase the security of your network. Ports are mapped to specific services. By running a software program that tests to see what ports a specific computer responds on, a network administrator (or potential hacker) can get some indication about the types of services running on a particular machine. Port scanning can be done inside your network to test various servers and workstation or it can be done from outside your network to determine what services can be accessed from the internet through your firewall.
Goals of Port Scanning
To determine services that a computer is running and shut down services not being used to increase the security of the computer being scanned.
To determine the vulnerabilities of the services that are being run in the computer being scanned. The vulnerabilities can then be patched once they are identified.
Internal and External Port Scanning

There are some security service providers that will scan your network from the internet to test for open ports and vulnerabilities on your servers. They may provide a printed or electronic report on the results outlining your vulnerabilities and giving recommendations about how to fix them. Many of these services are very useful especially since they stay current with current vulnerability information and update their software regularly to test for new vulnerabilities.

Even if you hire someone to scan your network from the outside, you should still scan your network with your own scanning tools from the inside. Please note that before scanning or sniffing your network, even as a network administrator, you should always get written permission from your management first up to the level of your CIO. This to avoid prosecution should someone decide they do not like information being scanned. Also be sure you do not scan when system crashes due to scans could cause loss of data or interfere with work.

If you scan your network, you should scan specific parts of your network rather than the whole network at one time. I would recommend that you scan and secure your servers first, but do not do this during normal business hours when your server usage is at a peak. Also you may want to warn your users before a scan is done that some service interruption may occur due to system preventative maintenance.
Port Scanners

There are many port scanner types some of which may identify vulnerabilities along with ports that are being serviced. Links to port scanners can be found at
http://www.techtutorials.info/nsectools.html

In order to find the capacity of bandwidth on the international network, we have to find:Ø Total number of Internet subscribers - As there are 1,25,000 Internet users at present in PakistanØ Elementary Internet Traffic of one subscriber i.e.,20m Earlang (Standard)Ø User Activity Rate (UAR= Duration of effective transmission/Holding time)Ø Mean rate of effective user “on line” (The rate of 1Earlang) As we know that data received is greater than the data send in case of Internet. Also it has been calculatedafter number of trials that the effective duration of Internet usage is 1.2 minutes out of 12 minutes. For example while the request for the download of picture on Internet, it takes only 1.2 minutes to send a request and receive the information and the remaining of 12 minutes are only wasted in seeing the picture. During seeing/observing the picture there will be no transmission takes place. So UAR becomes:User Activity Rate = UAR= 1.2/12 = 10%Let the Modem speed is 32 Kbps (which is taken on average) for an ISP. It is also supposed that there is only one Internet access provider having 125000 subscribers. This done in order to calculate the international bandwidth required for Pakistan.The mean rate of an effective user “on line” = Modemspeed/capacity (Kbps) x UAR = 32Kbps x 10% = 3.2 KbpsIt means that during one Earlang of traffic (full utilization) the computer uses 3.2 Kbps.Let if the access provider receives many calls at a time. Let 20E traffic is received from the area having 30 circuits. Then the rate used (for 1 PCM for one Earlang) = Internet traffic x rate of one earlang /Efficiency.Let the efficiency is 70%, and the internet traffic is equal to the product of elementary traffic one Internet subscriber and total number of subscribers, which comes out 2500 earlang (20x10-3 x 125000)So the rate (used) = 2500 x 3.2Kbps / 0.7 =11.5Mbps It means that we have to carry 11.5 Mbps traffic from the 30 circuits. We have to determine the quality of service before the access provider circuits, so we have to find the failure rate.Capacity required to carry 11.5 Mbps:Consider there is only one processor and software is running on the computer and one user to use the link at the same time. We know that the frame length of IP frame is 320 bits. Then the transmission time ‘T’ of frame to transmit at the rate of 32 Kbps is 10-m sec. (320bits/32 Kbps). As we know that we have to share the capacity because there are large number of otherframes are coming from other places also. It means that we have to wait for 10 m sec. x no. Of frames which are ahead of us.As T = Length of frame (b)/capacity(c)There are two quality factors, which are involved inthis case:· Satellite delay which is of 250 m sec.· Mean holding time of equipmentIf these factors are taken into account, then the value of ‘T’ becomes:T = b/c (1-r), where r is similar to UAR, which is equal to the ratio of used rate/Physical rate orcapacity. For example the capacity of 64 Kbps and used rate of 32 Kbps, Then r=0.5.When we are going to use free link then r=0. It meansthat we have not to wait to transmit our frame and T = b/c. If the link is busy then r=1, this cause T = ¥. It is clear from the graph that it is dangerous to use the r (Charge) higher than 0.5 because quality decreases abruptly after 0.5. For an ordinary Internet user we use the value of r equal to 40%. Then for 11.5 Mbps the capacity required is determined as:r = Used rate / Capacity =11.5 Mpbs/ 0.4 = 28.75 Mbps@ 30 MbpsAt present total bandwidth requirement for Internetusers of Pakistan is 30 Mbps.