Virtual Router Redundancy Protocol (VRRP)

  

       Virtual Router Redundancy protocol

è         It is standard based alternative to HSRP defined in IETF standard RFC 2338.         

è         All VRRP operation is same as HSRP

è       VRRP provides one redundant gateway address from a group of routers. The active router is called the master router and another is backup state. The master router will is the one with the highest router priority in the VRRP group.

è      VRRP group numbers range from 0 to 255; router priorities range from 1 to 254 default is 100.

è      The virtual router MAC address is of the form 0000.5e00.01xx , where xx is a VRRp group no.

è    VRRP advertisement are sent at 1 second intervals. Backup router optionally can learn the advertisement interval from the master router.

è      By default, all VRRP routers configured to preempt the current master router if their priorities are greater.

VRRP send its advertisements to the multicast destination address 224.0.0.18 using IP protocol 112. It not support on switch platforms

Hot Standby Routing Protocol (HSRP)

è       HSRP is cisco proprietary protocol developed RFC 2281 to allow several router or multilayer switches to appear as a single gateway ip address.

è      Each and every routers to participate in HSRP assigned to a common HSRP group (0 to 255).

è      One router is elected as the primary or active HSRP router and another is elect as the standby HSRP router and all others are listen HSRP state. Primary or active router elected based on highest priority value (0 to 255) by default all router have HSRP priority 100.

If the all router’s priority is equal, then it elected HSRP active router based on highest IP address on the HSRP interface.

è      HSRP sends its hello message to the multicast destination 224.0.0.2 using UDP port 1985.

è      When HSRP is configured on an interface, the router progress through a series of states before becoming active. This forces a router to listen for others in a group and see where it fits into the pecking order. Device participating in HSRP must progress their interfaces through the following state sequence:

1.       Disabled

2.       Init

3.       Listen

4.       Speak

5.       Standby

6.       Active

è      Only the standby (second highest priority) router monitors the hello messages from the active router. By default, are sent every 3 second. If hellos are missed for the duration of the hold-down timer (default 10 second) the active router is presumed to be down. The standby router is then clear to assume the active role.

We can change hello timer (1 to 254 second or 15 to 999 milisecond) and hold down timer (1 to 255 second or 50 to 3000 millisecond).

Switch(config-if)# standby <group> timers msec <millisecond for hello timer> msec <millisecond for holdtime>

è         Each router has a common gateway IP address, the virtual router address. For the virtual router address, HSRP defines a special MAC address of the form 0000.0c07.acXX ,Where 0000.0c is CISCO vendor ID and 07.ac is HSRP ID and XX represent HSRP group no.

è       We can also configure a router to preempt or immediately take over the active role if its priority is the highest at any time.

Switch(config-if)# standby <group> preempt

è       Plaint-text HSRP Authentication

HSRP message are sent with a plain-text key string (up to eight characters) as a simple method to authenticate HSRP peers. If the key string in a message matches the key configured on an HSRP peer, the message is accepted.

Cisco device use default key string.

We can configure a plain text authentication key for an HSRP group with the following interface configuration command:

Switch(config-if)# standby <group> authentication <string>

Note : we can also use MD5 authentication for HSRP message, for using key-chain and key-string value.

Network Attacks

There are different types of network attacks aimed at three pillers o network security: Confidentially, Integrity and availability.

Network attacks against confidentially

Attacker can many methods to compromise confidentially. Following are some of the common methods:

1.      Packet capturing (Packet sniffing)

Packet capturing is a type of network attack where the attacker captures the data packet (typically Ethernet frame) in travel. Once the data is captured, the attacker can read the sensitive data like passwords or card numbers, if the network traffic is not encrypted. The most widely used packet capture software is Wireshark.

Note: Wireshark is not hacking tool; it is a well-known network protocol analyser used to troubleshoot network problems. But hacker misuse Wireshark with bad intentions.

2.      Password attacks

Password based attacks are used to hack the passwords of users of a target computer to gain access. Two types of password attacks are dictionary based attack (where an attacker tries each of the words in a dictionary or commonly used passwords to hack the user password) and brute force attack (where an attacker tries every single possible password combinations using brute force hacking tools to hack the user password).

3.      Port scanning and ping sweeps

Port scanning is a type of network attack, where the attacker tries to discover the services running on a target computer by scanning the TCP/UDP port. Here the attacker tries to establish connection to the TCP/UDP port to find out which ports are open on a target computer. Finally attacker can attack and hack the target computer negotiating vulnerability  in that software product.

A ping sweep in another kind of network attack where the intruder sends ping ICMP ECHO packets to a range of IP address to find out which one respond with an ICMP ECHO REPLAY.  Thus the attacker can identify which computers are up and which compute are down.

4.      Dumpster diving

Dumpster diving is searching through company dumpsters for any information that can be useful for an attacker for attacking the network. Example: searching for employee names, software application product information, network infrastructure device make and models etc.

5.      Wiretapping

Wiretapping is type of network attack where the attacker hacks the telecommunication devices listen to the phone calls of others.

6.      Keylogger

A keylogger is a program that runs in the background of a computer, loging the user’s keystrokes. After a user enters a password, it is stored in the log created by the keylogger and forward to the hacker.

7.      Phishing and  Pharming

Phishing is an attempt to hack sensitive information (usually financial information like bank usrid/password credit card details etc), by sending unsolicited emails with faks URLs. Pharming is another network attack aimed at redirecting the traffic of one website to another website.

8.      Social Engineering

Social Engineering is type of attack in which someone with very good interactive skills manipulates other into revaling information about network that can be used to  steal data.