Syftet med den här rapporten är att beskriva ett antal olika tillvägagångssätt man kan använda sig av då man har behov av att dela in ett lokalt nätverk i olika segment och med det även kunna reglera trafikflödet mellan segmenten. De lösningar som presenteras i arbetet är inriktade mot mikro- och småföretag.Anledningen till att vi har valt att arbeta med det här området är att vi anser att det är viktigt för organisationer att har en strukturerad och segmenterad design på sitt interna datornätverk.Vi har arbetat genom att i förväg samla in information om olika tekniker som kan tänkas lösa vårt problem, och därefter testat olika scenarion med dessa tekniker. Data har samlats in efter varje genomfört scenario och sammanställts i statistisk form för att kunna avgöra vilken metod som var att föredra.Vi har testat lösningar där man segmenterar nätverket i en lager 2-switch medan man möjliggör och förhindrar trafikflöde mellan segmenten i en router. Även lösningar där man använder en lager 3-switch har testats. På så sätt kan routningen ske direkt i switchen och det blir betydligt mindre belastning i routern. Resultatet visar att då man vill segmentera ett nätverk så är det rekommenderat att man använder sig av VLAN och ACL:er och eventuellt i kombination med en brandvägg.Slutresultatet av rapporten är att en lösning med ”router on a stick” är den billigaste lösningen och troligen den som de flesta mindre företag skulle klara sig med. Vilken lösning man väljer beror dock helt på hur mycket pengar man vill lägga på sitt nätverk samt vad kraven är. / The purpose of this report is to describe a number of approaches that can be used when you are in need of dividing a local area network in a number of segments, and with that also be able to control how data traffic is allowed to traverse between the different segments. The solutions that are presented are focused towards micro and small companies.The reason that we have chosen to work with this matter is that we believe it is important for organizations to have a structured and segmented design of its internal computer network.We have been working by in advance collecting information about various techniques that might solve our problem, and then testing different scenarios using these techniques. Data have been collected after each tested scenario and compiled in statistical form in order to determine which method that was preferable.We have been testing solutions were you segment the network in a layer 2 switch while you allow or deny communication between the segments in a router, and also solutions were you use a layer 3 switch. In that way you can let the routing be performed in the switch, which leads to significantly lower load on the router. The result was that if you are about to segment a local area network it is recommended that you use VLAN and ACL:s, and possibly in combination with a firewall.The final result of this report is that a solution using the “router on a stick”-technique is the cheapest one, and probably the one that most small companies would get along with. However, the solution that you choose depends completely on how much money you want to spend on your network, and also what the needs are.

Our work focuses on wireless networks in general, but deals specifically with security in wireless sensor networks and energy consumption in IEEE 802.11 infrastructure WLANs. In the first part of our work, we focus on secure communication among sensor nodes in a wireless sensor network. These networks consists of large numbers of devices having limited energy and memory. Public key cryptography is too demanding for these resource-constrained devices because it requires high computation. So, we focus on symmetric key cryptography to achieve secure communication among nodes. For this cryptographic technique to work, two nodes have to agree upon a common key. To achieve this, many key distribution schemes have been proposed in the literature. Recently, several researchers have proposed schemes in which they have used group-based deployment models and assumed predeployment knowledge of the expected locations of nodes. They have shown that these schemes achieve better performance than the earlier schemes, in terms of connectivity, resilience against node capture and storage requirements. But in many situations expected locations of nodes are not available. We propose a solution which does not use the group-based deployment model and predeployment knowledge of the locations of nodes, and yet performs better than schemes which make the aforementioned assumptions. In our scheme, groups are formed after the deployment of sensor nodes on the basis of their physical locations. Nodes in different groups sample keys from disjoint key pools, so that compromise of a node affects secure links of its group only. Because of this reason, our scheme performs better than earlier schemes as well as the schemes using predeployment knowledge, in terms of connectivity, storage requirement, and security. Moreover, the post-deployment key generation process completes sooner than in schemes like LEAP+. In the second part of our work, we develop analytical models for estimating the energy spent by stations (STAs) in infrastructure WLANs when performing TCP-controlled file downloads. We focus on the energy spent in radio communication when the STAs are in the Continuously Active Mode (CAM), or in the static Power Save Mode (PSM). Our approach is to develop accurate models for obtaining the fractions of times the STA radios spend in idling, receiving and transmitting. We discuss two traffic models for each mode of operation: (i) each STA performs one large file download, and (ii) the STAs perform short file transfers with think times (short duration of inactivity)between two transfers. We evaluate the rate of STA energy expenditure with long file downloads, and show that static PSM is worse than using just CAM. For short file downloads, we compute the number of file downloads that can be completed with a given battery capacity, and show that PSM performs better than CAM for this case. We provide a validation of our analytical models using the NS-2 simulator. Although the PSM performs better than the CAM when the STAs download short files over TCP with think times, its performance degrades as the number of STAs associated to the access point (AP) increases. To address this problem, we propose an algorithm, which we call opportunistic PSM (OPSM). We show through simulations that OPSM performs better than PSM. The performance gain achieved by OPSM increases as the file size requested by the STAs or the number of STAs associated with the AP increases. We implemented OPSM in NS-2.33, and to compare the performance of OPSM and PSM, we evaluate the number of file downloads that can be completed with a given battery capacity and the average time taken to download a file.

ITC/USA 2006 Conference Proceedings / The Forty-Second Annual International Telemetering Conference and Technical Exhibition / October 23-26, 2006 / Town and Country Resort & Convention Center, San Diego, California / The Central Test and Evaluation Investment Program (CTEIP) Integrated Network Enhanced Telemetry (iNET) program is currently testing a wireless local area networking (WLAN) in an L-band telemetry (TM) channel to evaluate the feasibility and capabilities of enhancing traditional TM methods in a seamless wide area network (WAN). Several advantages of networking are real-time command and control of instrumentation formats, quick-look acquisition, data retransmission and recovery (gapless TM) and test point real-time verification. These networking functions, and all others, need to be tested and evaluated. The iNET team is developing a WLAN based on 802.x technologies to test the feasibility of the enhanced telemetry implementation for flight testing.

The idea of a free network is a myth of the past. Networking costs are expected to remain a burden to future IT budgets, no doubt raising questions regarding the payment of such services. Users do not normally pay to use local area networks, as companies tend to own their LANs. However, when wide area or international networks are considered, the situation is different. It is argued that in these cases the invoicing and payment system should be integral to the network's communication protocol. This implies changes to the networking protocol (to handle invoicing) as well as a new look at customary ideas of representing currency (to handle payment). In this dissertation, an invoicing and payment scheme that uses electronic cash and is implemented as part of the basic ATM protocols is discussed. The main advantages of this scheme can be summarized as a low administrative overhead and user privacy. / Computer Science / M. Sc. (Computer Science)

published_or_final_version / abstract / Electrical and Electronic Engineering / Doctoral / Doctor of Philosophy

Approved for public release; distribution is unlimited. / The purpose of this thesis is to discuss the new features and enhancements of Windows Server 2003. Windows NT and Windows 2000 were known to have numerous security vulnerabilities; hence Microsoft focused on improving security by making Windows Server 2003 "secure by design, secure by default, secure in deployment." This thesis examines the differences between the five unique editions of the Windows Server 2003 family. Some of the pros and cons of migrating to Windows Server 2003 are highlighted. The author hopes this study will assist information technology professionals with their decision on whether or not to upgrade to this latest version of Microsoft's flagship network operating system. / Lieutenant Commander, United States Navy

Approved for public release; distribution in unlimited. / Complex multilevel secure (MLS) architectures are emerging that require user identification and authentication services not only from multilevel connections, but from pre-existing single level networks. The XTS-400 can be used as a server in such environments. Trusted devices are required for user login via multilevel connections; however, single level remote login facilities do not require such client-side devices. Instead, a more lightweight mechanism is possible. Remote login capabilities do not exist on the XTS-400 for use over the single level networks and this capability is a desired feature for use in complex multilevel architectures. OpenSSH is an application, developed for OpenBSD, that uses the SSH protocol to provide secure remote logins and an interactive command interface. A secure remote login application, OpenSSH, was ported to the XTS-400 in order to provide remote login capabilities. The porting process identified differences between the original development platform for OpenSSH and the XTS- 400. Solutions, in the form of source code modifications, were made to overcome problems resulting from the compatibility differences encountered during the port. Testing was conducted to ensure that the port was successful and did not violate any security policies enforced by the XTS-400. / Civilian, Naval Postgraduate School

M.Comm. / This study was conducted with the intent of understanding and evaluating the commercial use and possibilities that the Internet offers, as well as the strategic approach businesses should take when commencing with electronic commerce on the Internet. The potential value of Intranets and Extranets has also been examined briefly. The Internet is a very useful mechanism for marketing as well as sales of products or services on a domestic or international basis. Various other commercial possibilities and uses exist for the Internet, as well as for its derivatives — the Intranet and Extranet. In the fiercely competitive market of today, companies research, develop and invest resources in various methods and tools in the hope to gain competitive advantage over their rivals. The Internet, Intranet and Extranet, used in isolation or conjunction, pose an extremely attractive alternative to gaining competitive advantage in a specific sector or market niche.The success of the Internet as a business tool depends directly on the overall business strategy that is driving the approach. For optimum success the main business strategy must be aligned with the Information Technology Strategy, and especially include thorough consideration as well as planning when implementing the Internet or one of its derivatives as a business tool.

Com o objetivo de auxiliar o projetista na fase de projeto físico, são especificadas duas ferramentas: ferramenta de cabeamento estruturado e ferramenta de seleção de equipamentos. A primeira opera como um sistema de CAD/CAE permitindo que o projetista elabore as plantas civil, de instalação elétrica e da infra-estrutura de comunicação de andares de um prédio ou de um campus e desenvolva o seu projeto de cabeamento estruturado. Para tanto, essa ferramenta verifica as regras de projeto para cada ação executada pelo projetista, implementa tais regras, quando estiver operando em modo automático, e auxilia o projetista na seleção dos componentes de distribuição mais adequados ao projeto. A segunda ferramenta implementa um driver da metodologia proposta. Permite que o projetista especifique as sub-redes do ambiente de redes a ser projetado e o auxilia na seleção da tecnologia e dos equipamentos mais apropriados para cada uma dessas sub-redes. No caso especifico da seleção da tecnologia e equipamentos de rede, essa ferramenta determina o conjunto de tecnologias e equipamentos que podem ser empregados em cada sub-rede, aplicando regras de projeto e utilizando informações sobre tecnologias e equipamentos de rede cadastrados na sua base de dados sobre as características do ambiente de informática considerado e os requisitos de projeto fornecidos pelo próprio projetista. / Today, networks are assuming an increasing importance in all kinds of companies, like bureau of services, bank organizations, shopping stores, educational institutions and hospitals, among others. As a consequence, it\'s becoming more important to offer to these companies high quality network designs, that could warranty the return of the investments made. A high quality design should fulfil the company needs, the addition of new services as the information system evolves and be capable of implementation according to the company budget and time constraints. To achieve this goal it is important to count with a powerful local network design methodology and with designers with strong theoretical and practical knowledge. The designer should apply such methodology and the corresponding designing rules to define the most appropriate network technology and equipments. Inside this context, the purpose of this work is to propose a local network design methodology for environments spanning from a few floors of a building comprising a campus and the supporting software tools for its applications. The proposed methodology consists of various phases: collecting all the information concerning the needs and characteristics of the company\'s present computing environment, their future trends and the development of the physical and logical network design. With exception of the logical networks design, that is out of the scope of this work, this methodology specifies the inputs, the procedure and the expected results for each phase. With the purpose of helping the designer during the physical network design phase two software tools are speciufied: structured cabling tool and equipment selection tool. The first one run like a CAD/CAE the electrical installation and the communication infrastructure for the building and campus and todevelop of the structured cabling solution. In order to accomplish these objectives, this tool verifies the designing rules for each action, implements these rules when operating in the automatic mode, and helps the designer in the selection of the most suited distribution components. The second tool implements a driver of the proposed methodology. It allows the designer to specify the sub-networks (workgroups and backbone networks) and helps with the selection of the most suited technology and network equipments for each sub-network. This tool also chooses the set of technologies and network equipments the could be used in each sub-network. It provides these choices based on the designing rules, on a database of technologies and equipments and on the characteristic of the computing environment and the design requirements provide by the designer. The use of the proposed methodology and its supporting tool\'s warranties the targeted quality and precision for any network design, organize its applications and give the necessary information allowing the designer to specify the desired solution.

The world of computers experienced an explosive period of growth toward the end of the 20th century with the widespread availability of the Internet and the development of the World Wide Web. As people began using computer networks for everything from research and communication to banking and commerce, network failures became a greater concern because of the potential to interrupt critical applications. Fault tolerance systems were developed to detect and correct network failures within minutes and eventually within seconds of the failure, but time-critical applications such as military communications, video conferencing, and Web-based sales require better response time than any previous systems could provide. The goal of this thesis was the development and implementation of a Network Fault Tolerance (NFT) system that can detect and recover from failures of network interface cards, network cables, switches, and routers in much less than one second from the time of failure. The problem was divided into two parts: fault tolerance within a single local area network (LAN), and fault tolerance across many local area networks. The first part involves the network interface cards, network cables, and switches within a LAN, which the second part involves the routers that connect LANs into larger internetworks. Both parts of the NFT solution were implemented on Windows NT 4.0 PC's connected by a switched Fast Ethernet network. The NFT system was found to correct system failures within 300 milliseconds of the failure.