Network Terminology Review
For those of you who have experience with IP networks, this document may serve as a reminder of the current lexicon of terms used in our industry. If you’re new to it or specialized in some other field such as business management or accounting, it might serve as a frightening reminder of just how fast our world is hurtling around the sun. If you find yourself in the latter group, our advice is “Don’t Panic”. Remain calm. We’re going to make this easy for you, and you will come away from your training with the high‐level knowledge you need in order to manage the Home Cyber Shield process within your company.
During your training, we’ll ‘literally’ be exploring the world of the IP Network. We’ll ‘literally’ be looking under the hood of the Internet. And we can assure you that the concepts behind everything you’ll experience are easily explained and easily understood. We can also assure you that you will in no way be harmed or feel any pain. It is our intention that your experience will enlighten and embolden you to create more harmonic networks and achieve world peace. Please read over the terms and make note of ones that you feel you don’t understand. We will be using them in the training fairly liberally. If at any time we mention a term and you find you’re not remembering or understanding it, please interrupt and let us know. We’ll stop and tell you what it is and what it does. Be of good cheer. Soon, you’ll be spouting acronyms and meaningless groups of numbers like a pro!
The terms are arranged for you by functional group. You may or may not use all of these.
Your IP Enabled Machine – Your Computer Hardware
Internet Protocol (IP) is the protocol for communication over the internet. (the language the internet speaks)
Network Interface Controller (NIC or NIC Card) is the piece of hardware in your computer that physically connects you to the Internet. You typically plug your RJ45 connector here. A wireless connection is also considered a NIC.
Media Access Control Address (MAC Address) is a unique number hard‐coded onto most network interfaces that is manufacturer specific. This is the address that is really being routed by a router and is a way to identify unique devices. There are no two MAC Addresses that are the same on the planet. (in theory…) Each NIC in your machine has a unique MAC Address.
IP Address is an address given to all computers on the Internet. It is how one machine sends a message to another. Each message is prefaced with the address it wants to send the message to. If you computer is connected by an Ethernet cable to a switch/router, it is on a network. A computer is given an IP Address by the person who sets up the computer typically. It can be typed in manually or set up to go looking for an address. (DHCP – Dynamic Host Configuration Protocol) There are currently two forms this address can be. (IPv4 and IPv6) For our discussion we’ll stick to IPv4 (version 4), as IPv6 is relatively new.
An IPv4 address is a series of 4 numbers separated by dots (.) The numbers are actually expressed in binary, but we translate them into decimal for easy reading. The address might look something like 192.168.1.105 Like postal mail, you need to send and receive data with the correct address. Otherwise your message won’t go to the correct place. The numbers can range from 0 to 255.
IP Networking – Wiring It Together
Network Switch is basically a hub for your network. Typically, all devices are connected to a switch to create the network. Think of a central hub (the switch) with spokes radiating out to the devices on the network (computers, printers, wireless access points, routers, etc.). This device is what creates an IP Network.
Network Router is a specialized device that moves data from one network to another and is typically used to manage a LAN (Local Area Network) and traffic in and out of the LAN.
Dynamic Host Configuration Protocol (DHCP) This is the communication method used by computers or other IP devices to ask for an IP Address. If you set your machine’s IP address setup to ‘DHCP’ upon boot‐up or network connection it will send out a request to any listening DHCP server and ask for an acceptable IP address. The DHCP server will respond by giving you an open address. You typically only want one DHCP server on your local network. This server makes sure your IP address is unique on the local network. That way no two computers will be sending/receiving information on the same address. Other important information is typically sent to your machine with this request as well. Such as:
→ Where your main route to the outside world is (Gateway Address)
→ Where you are to get your domain names translated and routed
(Example: DNS Server ‐ converts www.att.com to 144.160.103.104)
Static IP is when you manually set your machine’s Internet settings, such as IP address, Subnet Mask, Gateway IP address, DNS server(s) IP addresses, etc…
Local Area Network (LAN) is your local network. (the computer network immediately around you. Such as a home or small business.) The LAN is usually managed by a single router and switch(es) but can be larger.
Wide Area Network (WAN) is the larger network outside your LAN. In a larger company you may be part of a smaller LAN (ex: the accounting department) which is part of the WAN of your overall company. The Internet in general is the ultimate WAN. This is the world‐wide computer network of which we are all a part. The WAN can be a dangerous place if you’re not careful. Gateway is the device that routes WAN network traffic to and from your LAN network.
Firewalls come in more forms then we can possible cover in this training; fundamentally a firewall is intended to prevent or permit access to a network, network segment, or network service. They are built into most routers now but the quality and speed at which they work can vary greatly based on the quality of device being used. A Firewall is what protects your LAN from the WAN. It also can be used to permit or deny certain types of traffic on the LAN.
Bandwidth there are several definitions for this, but for our purposes this is the measurement of data moving through a device interface. This is usually broken down into upload/download. This is not a measurement of available bandwidth, but of current usage.
The Lower‐Level Internet
Simple Network Management Protocol (SNMP) is a network protocol designed to help IT people manage IP networks. We use it to monitor network‐attached devices for conditions that have changed and need our attention. SNMP is one of the most important features that we can look for in networking equipment that might not be familiar to everyone. This is part of what can separate a 30 dollar router from a 200 dollar router. If a device supports SNMP, we can tell a tremendous amount of information about it, such as data throughput, system uptime, internal temperature, etc. A router or a switch can also tell us information about the devices attached to them.
ICMP Ping (PING) for the purposes of this training we will always refer to this as just Ping. Further more, we will assume that Ping means an ICMP (Internet Control Message Protocol) echo request, as there is more then one type of ping. So quite simply, a ping is a message that is sent to a device with a request for a response. If a device responds, we can note how long it took to respond and what percentage of times it was asked for a response. This is the most basic form of monitoring. If a device does not support SNMP, this “might” be the only way we can get information about it.
Management Information Base (MIB) this is the database that stores all of the device‐specific variables that are checked via SNMP.
Intrusion Detection Systems (IDS) are built into some routers or can be a stand alone service or device. They scan network traffic in real time, in an attempt to detect malicious behavior. They send messages to the Home Cyber Shield system via SNMP traps.
Intrusion Prevention Systems (IPS) are built into some routers or can be stand alone network devices. They are similar to IDS systems, except they go a step further and try and block malicious traffic from the network. It is important to note that neither of these systems are 100% accurate nor foolproof cyber solutions.
Remote Desktop Protocol (RDP) is a Microsoft proprietary network protocol that provides a means of remote control for computers. RDP in and of itself is not a secure protocol; however it can be run across other secure protocols. It is one possible method for connecting to a Home Cyber Shield system.
Network Monitoring Terminology
To give you context in order to understand these terms, let us create a scenario with you. A client has a network that you are monitoring and has a network camera that is not showing up online. You get an email that alerts you to the situation. In this scenario, the IP Camera is the network element (it would have a device classification of “camera”). We would be checking the availability of the camera via a ping poller. This poller would have a preset rule that says, “if the ping takes longer the 100ms do XYZ”. The XYZ event that happens is an action (in this case, email John Doe). With the Home Cyber Shield system, you are able to customize the preset rule and the actionable event if the rule is broken.The World Wide Web – The Upper Level Of The Internet
Hypertext Transfer Protocol (HTTP) is one of the fundamental protocols that the Internet and connected devices use to provide information to an end user or to each other. Everyone uses this any time you connect to a web page. The reason this is important is because HTTP is a common way to connect to a network device for activating it or configuring it. It also provides a method of checking to see if a device is operating normally.
Domain Name System (DNS) is what allows us to type www.google.com instead of http://74.125.65.147. There are several DNS servers that do this, depending on which one a given website is registered with.
Dynamic DNS (DDNS) allows us to provide a client with a Dynamic IP address with a URL or web address that never changes. For instance, if your client uses Comcast for their Internet service provider and Comcast changed your client’s IP randomly once a week, you would have trouble knowing where to go to if you needed to connect to a device on their network using the Home Cyber Shield system. So, you would simply install a DDNS updater register with a DDNS server and choose a URL www.myclientshouseishere.org and now even if your client’s IP address changes, you can always go to that same web address to access their network. We have built a
DDNS updater into the Home Cyber Shield system to help you if a client does not have a static or non‐changing IP address. Pretty cool, huh?
File Transfer Protocol (FTP) is a protocol for transferring files between two network devices. Integrators use it primarily to upload programs to Control systems.
Simple Mail Transfer Protocol (SMTP) is a protocol to transfer mail across IP networks.
Post Office Protocol (POP3) (with the three standing for the 3 versions) is used by a local email client to get email from a mail server.
Telnet is a network protocol that provides bidirectional connectivity to a network device and is usually used to set up network enabled devices via a virtual terminal. Control systems are often configured this way, as are some routers. Usually one ‘telnets’ into a device with a terminal (such as Hyperterminal) and types commands.
Home Cyber Shield (Powered by dopplerVUE) Specific Terms
Network Elements This is another name for any network device or service that is being monitored by the network monitoring software.
Alerts / Alarms happen when a preset threshold is reached by any of the network elements. For example, a device ping response time is outside a given range. An alarm would trigger an action; one of which would be to create a system alert and one of which would be to send an email or text message. Alarms are what allow you to be notified of a problem. They are depicted visually and can also trigger a number of actions (email alert, auto‐power cycle, etc). Device Classifications are broad categories that devices fit into. Router, WAP, Camera, etc. They can be user‐defined, but we have put some common ones together already in the software which we review in our training sessions.
Poller These are jobs that are checking or “polling” individual network elements. So, if you are pinging a device, you are running a ping poller. They are run automatically at preset intervals. You can change how often these jobs run on any given device. The default is once every 5 minutes – meaning, Home Cyber Shield looks to see if every device is responding every 5 minutes, 24/7/365.
Network Discovery is the process of having the network monitoring software look for network devices it wishes to monitor. This is done by the Home Cyber Shield software package. Neat. Rules are preset ranges of variables that can trigger actions if a device falls outside the preset variables range. For example, a rules exists that triggers an action if a device takes longer than 100ms to respond to a ping.
Events are similar to rules. Except they are not polled, but are sent to the network monitoring software by an SNMP enabled device.
Actions are triggered by rules. An action can create an alarm or send an email. Peer Node is the name of each client’s Home Cyber Shield server.
Groups are a way to organize your inventory across multiple client networks. Items may be grouped by location, type, etc. in order to allow for quick access to information about specific inventory items. (Cameras, WAPs, Touch Panels, etc)
