Welcome to the course devoted to sudden netting and its bearing on the security of the whole computer
infrastructure
let's start from the very beginning.
For to host to be able to communicate in computer networks IP networks.
They must have unique IP addresses.
If two hosts are in the same network that can communicate with each other directly if two hosts are
located in remote networks all communication between them takes place through routers devices that are
responsible for connecting individual networks.
This means that by dividing the company into smaller subnets you gain the ability to control the packets
transmitted between hosts.
The first advantage of this solution is that the packets will always be sent by rodders that you manage
yourself.
You don't need to use routers when you divide the network into subnets.
Instead you'll use a special kind of routers namely firewalls the router forward's packets.
It must reject erroneous packets or those that exceeded their lifetime firewalls on the other hand are
routers that filter forward data this enables you to improve not only the efficiency but also the security
in a direct way.
If you remember lecture's devoted to the consumerization of I.T. you will know that our corporate network
encompasses more than just devices in the company's headquarters
at present a corporate computer network can include users temporary whereabouts.
These are very often users homes because they communicate with the network through mobile devices.
Such a network can hardly be regarded as trusted.
Not all administrators know what devices are connected to their networks.
When a local corporate network included six hosts and two servers only the distinction between the secure
corporate network and a dangerous Internet was reasonable.
Right now our corporate network encompasses every single device that any given user connects to it.
Therefore the security level of such a network is similar to the one of an external network it needs
to be divided into smaller segments.
It will allow us to monitor packets sent over a network and in particular to control the availability
of selected hosts.
If you use firewalls to create subnets and computers and subnet will be available only for trusted hosts
located in subnets B and C
using firewalls instead of routers you gain the ability to detect and prevent attacks such as those
that you see in the picture below.
What we see there is a network communication between two clients first intercepted and then reassembled.
If we reassemble such communication that is what data was sent in the TCAP connection it will turn out
that it was a computer trying to connect to a web server in order to download a file root see.
You wouldn't like your computer to download and run such a file the application layer firewalls offer
the ability to monitor the network these firewalls employ more than just simple rules.
Such as a computer from network can communicate with the computer from Network B on port 80 there are
firewalls that examined only protocol headers but also data transferred by these protocols.
Let's focus again on the IP protocol on its fourth version.
The simplest method of sudden netting is classful addressing as you can see in the picture above.
Three classes are used a B and C Class D is used for multicasting addresses are reserved for future
use classful addressing is very simple to distinguish a network address from a host address.
You look at the first bits of the most significant byte This is the first part of the IP version 4 address.
If the first bit of the octet is 0 then this is a Class A address in decimal notation.
These would be values ranging from 0 to 126 the value 127 is the loopback and any address starting with
one to 7 points out to your local computer the same method applies to higher classes.
If the address belongs to class B the value of the oldest bit must be 1 and the next one minus zero.
This means that the first two octets constitute the network address and the next to the host address.
If the first two bits of the last octet are set to 1 and the third one is set to zero then the IP address
belongs to class C in such a situation the first three octets constitute network address and the fourth
one is the host address.
It's a clear and simple principle.
Unfortunately such address thing is very inefficient.
Many addresses are wasted in the case of IP version 4 protocol.
You cannot purchase just any address if you want to achieve proper routing.
You always have to have a network address even if your network includes six computers.
You still have to buy a whole class C network address.
You have to pay for all of the 256 addresses even though you'll use only 8 of them.
The solution to this problem is classless in her domain routing.
See your utilizes the fact that the network address and the host address don't need to be divided into
individual octets one part of an actor can define the network address and the other the host address.
To allocate these bits a CD-R mask is needed.
I'm sure you remember from the previous lectures to see IDR addressing scheme the complete network address
must come before the host address.
The only correct masks are shown in the table below.
Zeros and ones cannot appear interchangeably in a mask.
Ones indicate the network address and zeros indicate the host address.