<p>The networking field has become a core component for any company. All of the</p><p>businesses rely on the networking industry, due its vastness and significance. Every day</p><p>companies are planning and thinking to develop better strategies that can offer efficient</p><p>and reliable communication solutions between their employees and customers for</p><p>maximum revenue. The planning of a company’s network requires a lot of resources and</p><p>aspects to study, and to evaluate them carefully to build a comprehensive secure and</p><p>reliable platform. It is the job of a network administrator to take care of the company’s</p><p>network infrastructure and upgrade or update the required components and applications</p><p>from time-to-time that can follow new standards.</p><p>This thesis is a practical work aimed to evaluate a company network infrastructure in its</p><p>real environment. The purpose of this thesis is to evaluate different aspects of the</p><p>network infrastructure used such as VPN, WLAN, firewall and physical security and give</p><p>recommendations to make their performance better and to offer more advanced strategies.</p><p>This study will also provide an inclusive observation of the company’s needs and their</p><p>network infrastructure, and will provide a concept how to evaluate and fix small mistakes,</p><p>the kind of problems that can occur in an evolving company network. Lastly, this research</p><p>will make recommendations and suggest a possible implementation on the studied</p><p>network infrastructure.</p>

The networking field has become a core component for any company. All of the businesses rely on the networking industry, due its vastness and significance. Every day companies are planning and thinking to develop better strategies that can offer efficient and reliable communication solutions between their employees and customers for maximum revenue. The planning of a company’s network requires a lot of resources and aspects to study, and to evaluate them carefully to build a comprehensive secure and reliable platform. It is the job of a network administrator to take care of the company’s network infrastructure and upgrade or update the required components and applications from time-to-time that can follow new standards. This thesis is a practical work aimed to evaluate a company network infrastructure in its real environment. The purpose of this thesis is to evaluate different aspects of the network infrastructure used such as VPN, WLAN, firewall and physical security and give recommendations to make their performance better and to offer more advanced strategies. This study will also provide an inclusive observation of the company’s needs and their network infrastructure, and will provide a concept how to evaluate and fix small mistakes, the kind of problems that can occur in an evolving company network. Lastly, this research will make recommendations and suggest a possible implementation on the studied network infrastructure.

In this age, the internet has becoming more and more popular recently. How to manage and organize the network effectively is a very important issue.Therefore, the technology of VPN was born. Through the VPN, we can manage and organize the local netork which spread everywhere effectively.But the tunneling technology which VPN used has a security problem. If we also change the VPN¡¦s port number, it will have a big dangerous security problem. In this paper, we will analyze some basic technology of VPN, and introduce how to modify the VPN. Let VPN have ability to pass through the firewall. This problem will make the people who managed whole network or firewall hard to control and manage it. Another, this paper will bring up the solution which can solve the security problem effectively. The key of network security problem is to use another protocol¡¦s port number. The solution in this paper will through solve this problem, so hacks can¡¦t modify the TCP port number such as HTTP Port 80 at will. Our solution is to implement a packet filter which is based on ethernet device driver.We use the RFC document which are defined by IETF to make the packet check rule. This packet filter can reject the illegal packet and make sure the network is safe.

In this thesis, we present a content based packet filtering Architecture in Linux using Deterministic Finite Automata and iptables framework. New generation firewalls and intrusion detection systems not only filter or inspect network packets according to their header fields but also take into account the content of payload. These systems use a set of signatures in the form of regular expressions or plain strings to scan network packets. This scanning phase is a CPU intensive task which may degrade network performance. Currently, the Linux kernel firewall scans network packets separately for each signature in the signature set provided by the user. This approach constitutes a considerable bottleneck to network performance. We implement a content based packet filtering architecture and a multiple string matching extension for the Linux kernel firewall that matches all signatures at once, and show that we are able to filter network traffic by consuming constant bandwidth regardless of the number of signatures. Furthermore, we show that we can do packet filtering in multi-gigabit rates.

<p>With the possibility of connecting several computers and networks the necessity of protecting the whole data and machines from attackers (hackers) that try to get some confident information to use for their own benefit or just destroy or modify valuable information was born. At this point IDS appears to help users, companies or institutions to detect when they are getting compromised. This thesis will cover two main parts: the first one consists of an intense research study about the world of IDS and its environment. Subsequently, we will conclude this part with some points where IDS still needs to be questioned and show up desirable requirements for “the perfect” intrusion detection system. This “perfect” adjective can of course be discussed variously. The second part of the thesis approaches the implementation of the most used open source IDS: Snort. Some basic attacks on the machine where Snort is installed will be performed in order to make the future user see what kind of protection it ensures and the usability of this. There is a brief discussion about two of the main challenges in IDS will follow: analyzing big amounts of packets and encrypted traffic. Finally there are conclusions for a safe computer environment as well as the suggestion that some skilled programmer should give Snort a more friendly interface for every kind of users and a built in programme package which includes webserver, database and other libraries that are needed to run it properly with all its features.</p>

Dieser Vortrag gibt eine kleine Uebersicht ueber die Einsatzmoeglichkeiten von Linux im Netz - sowohl als Client als auch als Server.

Die vorliegende Arbeit entwickelt und implementiert ein System für die Bereitstellung von Internet-Diensten an öffentlichen Orten. Besonderer Wert wurde auf eine einfache Handhabung für den Nutzer, eine breite Unterstützung von Klienten und ein breites Spektrum möglicher Privilegien (von der vollen Internetkonnektivität bis zu einer Art Infoterminalstatus) gelegt.

This paper describes a solution which enables mobile devices to transparently access the campus network and the Internet. Different user classes are provided, and security issues are taken into account. The requirements for user machines are low, and the software is nearly maintenance-free for the network administrator after installation and configuration. / Diese Arbeit realisiert einen transparenten Zugang zum Campusnetz der TU Chemnitz und zum Internet für mobile Geräte. Dabei werden mehrere Nutzerklassen unterschieden und Sicherheitsaspekte berücksichtigt. Die Anforderungen an die Nutzerrechner sind gering, und der Aufwand für den Administrator beschränkt sich im wesentlichen auf die Installation und Konfiguration der Software.

Während sich der Chemnitzer Linux-Tag über die vergangenen fünf Jahre mit jedem Mal in der Zahl der Aussteller, Helfer und Gäste steigerte, wuchs auch in jedem Jahr das Tagungsnetzwerk. Den Informatikern wird häufig nachgesagt, daß sie wenig dokumentieren würden. Dieses Vorurteil traf auch für das Netzwerk der vergangenen Chemnitzer Linux-Tage zu. Unter anderem, um diesem Mißstand abzuhelfen, haben wir uns bemüht, möglichst detailliert Informationen über Konzept, eingesetzte Technologieen und konkrete Konfiguration des Tagungsnetzwerks des Chemnitzer Linux-Tags 2004 zusammenzutragen.

Creating and maintaining servers for hosting services in a secure and reliable way is an important but complex and time-consuming task. Misconfiguration and lack of server maintenance can potentially make the system vulnerable. Hackers can exploit these vul­nerabilities in order to penetrate into the system internals and cause damage. Having a standard architecture/configuration supporting the needed services saves time and re­sources while it reduces security risks. A server architecture protected by a security policy can secure the integrity and quality of the overall services. This research demon­strates building a secure server architecture protected by a security policy. To achieve this a security policy and a checklist was designed and combined with a host based IDPS, a NMS and a WAF.