Common and Cisco-Specific Tools
A variety of tools are available under different platforms. It is worthwhile to explore each of them, and to create a set of pros and cons for each one. This type of research is worth a separate book. One possible approach to classify all tools is the following: • Network monitoring tools such as local-area network (LAN) and wide-area network (WAN) analyzers and sniffers, such as Sniffer Pro from Network Associates or EtherPeek. • Remote control software, such as..
The TCP intercept and unicast reverse path forwarding features of the IOS enable you to configure some basic security against two types of denial-of-service attacks: TCP SYN flooding and source IP address forgery. A denial-of-service (DoS) attack is one in which a hacker overwhelms a network resource with traffic intended not to harm data, but to utilize enough resources on the network resource so that it cannot perform its intended function. For example, a TCP SYN (synchron..
Adaptive Shaping, FECN, and BECN
To react to congestion that occurs somewhere inside the FR cloud, the router must receive some form of notice that the congestion is occurring. So, the FR LAPF header includes the Forward Explicit Congestion Notification (FECN) and Backward Explicit Congestion Notification (BECN) bits for signaling congestion on a particular VC. FR switches use FECN and BECN to inform a router that a particular VC has experienced congestion. To do so, when a switch notices congestion caused..
The first major deployment of RSVP technology came with Multiprotocol Label Switching (MPLS) traffic engineering (TE). MPLS traffic engineering automatically establishes and maintains label-switched paths (LSPs) across the backbone by using RSVP to establish and guarantee "tunnels" of predictable bandwidth. RSVP operates at each LSP hop and is used to signal and maintain LSPs based on the MPLS TE calculated path. MPLS TE uses principles from RFC 2205 (basic RSVP) and RFC 3209..
Plain-Text HSRP Authentication
HSRP messages are sent with a plain-text key string (up to eight characters) as a simple method to authenticate HSRP peers. If the key string in a message matches the key configured on an HSRP peer, the message is accepted. When keys are sent in the clear, they can be easily intercepted and used to impersonate legitimate peers. Plain-text authentication is intended only to prevent peers with a default configuration from participating in HSRP. Cisco devices use cisco as the d..
