The Internet is running out of Internet Protocol Version 4 (IPv4) addresses. In 1998, the Internet Engineering Task Force (IETF), a standards body, created Internet Protocol Version 6 (IPv6) as a replacement to IPv4 with the goal to increase the Internet's address space. However, IPv6 also has some enhancements, including autoconfiguration, easier network renumbering and built-in security through the IPsec protocol. Transitioning to IPv6 enables the Internet to continue to grow and enables new, innovative services to be developed because more devices can connect to the Internet.
In contrast to IPv4, which defined an IP address as a 32-bit value, IPv6 addresses have a size of 128 bits. Therefore, IPv6 expands the number of available addresses (about 4 billion addresses as in IPv4)to 340 trillion trillion trillion (or, 340,000,000,000,000,000,000,000,000,000,000,000,000) addresses. With this number of available addresses, it will be able to accommodate devices that are online today and those that may be in the future. These may includes TVs, fridges, computers, phones and so on.
Many major websites and Internet Service Providers now support IPv6, but there are still many more who need to switch.
IPv6 Address representation
IPv6 addresses in long form are represented as eight sets of four hexadecimal digits separated by colons, but that makes for long addresses. Here is an example below:
2001:0db8:0000:0000:0000:0000:0002
The address above is using the hexadecimal colon notation. Every two bytes are written in hexa format with a colon separating them.
IPv6 addresses can be written in short hand using two conventions:
1. Zero Suppression
- all IPv6 address segments are 16 bits
- The leading zeroes in each segment can be left out of the address segment.
2. Zero Compression
- Since all addresses contain 8 segments, following sections of zeroes can be collapsed to a double colon.
- However this double colon can appear only once in the address representation.
Using these two rules, our example IPv6 address 2001:0db8:0000:0000:0000:0000:0002 collapses to 2001:db8::2.
IPv6 Prefix numbers
Prefixes for IPv6 subnet identifiers and routes are expressed in the same way as Classless Inter-Domain Routing (CIDR) notation for IPv4. An IPv6 prefix is written in address/prefix-length notation.
For example:
805B:2D9D:DC28::/48
805B:2D9D:DC28:0000:0000:FC57:D4C8:1FFF
In the above example the first 48 bits of the address represents the main prefix or network ID and the last 80 bits are used for individual host ID. The prefix notation will be found in routing tables and used to express main networks or subnets.
IPv6 Address Categories
Three categories of IP addresses are supported in IPv6:
Unicast Addresses: Unicast addresses assigned to hosts and router interfaces. Packets destined to unicast address are delivered to a single interface.
Multicast Addresses: These are addresses that represent various groups of IP devices. A packet sent to a multicast address is delivered to all interfaces identified by that address.
Anycast Addresses: Anycast addresse identifies multiple interfaces. A packet sent to an anycast address is delivered to the closest member of a group, according to the routing protocols' measure of distance. Anycast addressing is used when a message must be sent to any member of a group, but does not need to be sent to them all.
There are no broadcast addresses in IPv6. All broadcast types of IPv4 are performed using multicast address type of IPv6.
Thursday, January 10, 2013
Thursday, December 6, 2012
Securing network - using ACL
An Access Control Lists (ACLs) is a collection of sequential permit and deny conditions that applies to packets. It let you control whether network traffic is forwarded or blocked at interfaces on a router or switch. Typical criteria are the packet source address, the packet destination address, or the upper-layer protocol in the packet. For example, network users are allowed to access the Internet except using the Telnet program; ACLs allow you to do this.
Basically the ACL definitions provide criteria that are applied to packets that enter or exit a network interface. It provides a mechanism for defining security policies by grouping various access control entries (ACEs) together to form a set of rules. Access and security permission that one network device has to another network device are affected by the entries that make up the ACL. ACEs are not necessarily a negative restriction; in some cases, an ACE is a method of granting a person or device access to something.
Most of the Security Software, for example, Cisco IOS, tests a packet against each ACE in the order they are defined until a match is found. Thus, if a network packet matches the criteria of the first ACE, the switch will apply the specified action to the packet. Otherwise, the switch continues to compare the packet to subsequent ACEs. If there is no match in any of the ACEs, the switch will drop the packet. However, if there are no restrictions, the switch forwards the packet. Since switches process ACEs in order and stops testing conditions after the first match, ACLs should be designed with care to provide good performance. By studying traffic flow, you can design the list so that the most commonly matched conditions be listed first to minimize processing time. Fewer conditions to check per packet means better throughput. As such it is advisable to order the list with the most general statements at the top and the most specific statements at the bottom, with the last statement being the general, implicit deny-all statement.
Basically the ACL definitions provide criteria that are applied to packets that enter or exit a network interface. It provides a mechanism for defining security policies by grouping various access control entries (ACEs) together to form a set of rules. Access and security permission that one network device has to another network device are affected by the entries that make up the ACL. ACEs are not necessarily a negative restriction; in some cases, an ACE is a method of granting a person or device access to something.
Most of the Security Software, for example, Cisco IOS, tests a packet against each ACE in the order they are defined until a match is found. Thus, if a network packet matches the criteria of the first ACE, the switch will apply the specified action to the packet. Otherwise, the switch continues to compare the packet to subsequent ACEs. If there is no match in any of the ACEs, the switch will drop the packet. However, if there are no restrictions, the switch forwards the packet. Since switches process ACEs in order and stops testing conditions after the first match, ACLs should be designed with care to provide good performance. By studying traffic flow, you can design the list so that the most commonly matched conditions be listed first to minimize processing time. Fewer conditions to check per packet means better throughput. As such it is advisable to order the list with the most general statements at the top and the most specific statements at the bottom, with the last statement being the general, implicit deny-all statement.
Tuesday, November 20, 2012
How to Add a Google Sitemap for Blogger Blog
Sitemaps are a way to tell search engines such as Google and Bing about pages on your site which the search engines might not otherwise discover. It lists pages on your website. Creating and submitting a Sitemap helps make sure that search engines knows about all the pages on your site, including URLs that may not be discoverable by them in normal crawling process.
The default XML sitemap file of any Blogger blog will have only the 26 most recent blog posts. This is a limitation because some of your older blog pages, that are missing in the default XML sitemap file, may never get indexed in search engines. There’s however a simple solution to fix this problem.
Open the Sitemap Generator at http://ctrlq.org/blogger/ and type the full address of your blogspot blog (or your self-hosted Blogger blog). Click the Create Sitemap button and this tool will generate a complete XML sitemap of your Blogger blog that mentions all your blog posts and not just the recently published blog posts.
The default XML sitemap file of any Blogger blog will have only the 26 most recent blog posts. This is a limitation because some of your older blog pages, that are missing in the default XML sitemap file, may never get indexed in search engines. There’s however a simple solution to fix this problem.
Open the Sitemap Generator at http://ctrlq.org/blogger/ and type the full address of your blogspot blog (or your self-hosted Blogger blog). Click the Create Sitemap button and this tool will generate a complete XML sitemap of your Blogger blog that mentions all your blog posts and not just the recently published blog posts.
Monday, November 19, 2012
SkyDrive
Found this service from Microsoft the other day. Like Google toolbar that save my bookmark which I can use whenever access to the Internet, SkyDrive offer free disk space for me to access from anywhere of the Internet using web browser!
What is really cool is 7GB of free online storage! On top of that, maximum file size can be up to 2GB per file. This is really nice feature! User can also configure their file private or share it with contacts or make it to be public.
This is really nice service! See SkyDrive homepage to subscribe for it!
What is really cool is 7GB of free online storage! On top of that, maximum file size can be up to 2GB per file. This is really nice feature! User can also configure their file private or share it with contacts or make it to be public.
This is really nice service! See SkyDrive homepage to subscribe for it!
Sunday, November 18, 2012
How to access web page without Chrome, Internet Explorer, Firefox or Safari
In networking, sometime while performing network trouble shooting, you may like to quickly test if the connection to a website is available. Without using a web browser, you also can use the telnet command that is available in most of the login terminal like Command prompt, unix login shell or Cisco login terminal.
To test a connection to a website like www.abc.com just key in
To test a connection to a website like www.abc.com just key in
Tuesday, November 6, 2012
How to solve GoDaddy Joomla .htaccess problem
Recently we migrate one of our sites into GoDaddy hosting server. The site used Joomla. However, when uploading all files and creating database in GoDaddy, we faced the .htaccess problem.
Following are summary of solution to Joomla .htaccess problem in GoDaddy hosting plan:
1. Delete .htaccess file if already created. Use the original htaccess.txt file from Joomla distribution and rename it to .htaccess
2. Add the following lines at the top of the .htaccess file
Following are summary of solution to Joomla .htaccess problem in GoDaddy hosting plan:
1. Delete .htaccess file if already created. Use the original htaccess.txt file from Joomla distribution and rename it to .htaccess
2. Add the following lines at the top of the .htaccess file
Sunday, October 28, 2012
Remove unnecessary services on your PC or server
Whether it is a Windows PC, Cisco router, switches, Linux machine or network enable device, it is recommended to stop unnecessary services that are run by default. Every running, but unused, service on your system maybe a possible means of attack. Users may not even be aware that many of these services are running.
It is important to know the security implication of any network service before enabling it in. For example, a telnet client running on another device on the network can easily establish a telnet session to a system where telnet service is enabled; it needs only the IP address of the system and the port or socket number of the network service running on the system. The rule of thumb for TCP and UDP ports is: Turn off any services or listeners that you do not need for your application to function. One way to check the list of ports running on your system is to go to one of the many web sites that can run a remote scan of your system and tell you how secure the system.
It is important to know the security implication of any network service before enabling it in. For example, a telnet client running on another device on the network can easily establish a telnet session to a system where telnet service is enabled; it needs only the IP address of the system and the port or socket number of the network service running on the system. The rule of thumb for TCP and UDP ports is: Turn off any services or listeners that you do not need for your application to function. One way to check the list of ports running on your system is to go to one of the many web sites that can run a remote scan of your system and tell you how secure the system.
Subscribe to:
Posts (Atom)