Table of Contents

< Day Day Up >
Next Section

LANs to WANs: The Complete Management Guide
LANs to WANs: The Complete Management Guide
by Nathan J. Muller ISBN:1580535720
Artech House © 2003 (466 pages)

This text addresses key network management challenges, showing professionals how to tie together incompatible LANs, meld legacy systems and LANs, extend the reach of LANs with wireless links, and protect information assets from various disaster scenarios.

Table of Contents
 | LANs to WANs—The Complete Management Guide
 | Preface
 | Chapter 1 | - | Local Area Networks
 | Chapter 2 | - | LAN Administration
 | Chapter 3 | - | LAN Restoration Planning
 | Chapter 4 | - | Storage Network Management
 | Chapter 5 | - | Managing Bridges, Routers, Gateways
 | Chapter 6 | - | Managing the Wireless Infrastructure
 | Chapter 7 | - | Managing Voice Systems
 | Chapter 8 | - | Managing the TDM Infrastructure
 | Chapter 9 | - | Managing Link Performance with CSU-DSUs
 | Chapter 10 | - | Managing High-Speed Packet Networks
 | Chapter 11 | - | Network Management Systems
 | Chapter 12 | - | Managing Service Quality
 | Chapter 13 | - | Managing Network Security
 | Chapter 14 | - | Network Planning and Design Tools
 | Chapter 15 | - | WAN Restoration Planning
 | Chapter 16 | - | Maintenance and Support Services
 | Acronyms
 | Index
 | List of Figures
 | List of Tables

 < Day Day Up >
Next Section


BackCover

Previous Section
< Day Day Up >
Next Section

Back Cover

Empowered by today’s high-performance computers interconnected over LANs and WANs, companies are faced with the daunting task of bringing workability to the diversity and complexity of today’s data communications landscape. This new, comprehensive resource addresses key network management challenges, showing you how to: tie together incompatible LANs, meld legacy systems and LANs, extend the reach of LANs with wireless links, protect information assets from various disaster scenarios, and consolidate multi-protocol traffic over a single WAN backbone in a way that guarantees appropriate service levels.

Moreover, this hands-on guide defines management system requirements for the enterprise, and identifies the tools and expertise companies need to manage systems and networks in wired and wireless environments. You will learn how to design and test networks before implementation, and harden systems and networks against internal and external attacks with effective security administration and the application of specific tools. Putting infrastructure issues into proper perspective, this book will help you succeed in managing advanced communications systems and networks.

About the Author

Nathan J. Muller is a managing partner and consultant at the Ascent Solutions Group, LLC in Sterling, VA. He is also the author of IP Convergence: The Next Revolution in Telecommunications, Desktop Encyclopedia of the Internet, Wireless Data Networking, and Intelligent Hubs (Artech House, 2000, 1999, 1995, 1994).

Previous Section


LANs to WANs-The Complete Management Guide

Previous Section
< Day Day Up >
Next Section

LANs to WANs—The Complete Management Guide

Nathan J. Muller

For a listing of recent titles in the Artech House Telecommunications Library, turn to the back of this book.

Artech House, Inc. Boston London www.artechhouse.com

Library of Congress Cataloging-in-Publication Data

Muller, Nathan J.

LANs to WANs: the complete management guide/Nathan J. Muller. p. cm. — (Artech House telecommunications library) ISBN 1-58053-572-0 (alk. paper) 1. Computer networks—Management. 2. Local area networks (Computer networks). 3. Wide area networks (Computer networks). I. Title. TK5105.5.M863 2003 004.6—dc21 2003049576

British Library Cataloguing in Publication Data

Muller, Nathan J.

LANs to WANs: the complete management guide.—(Artech House telecommunications library) 1. Local area networks (Computer networks)—Management 2. Wide area networks (Computer networks)—Management I. Title 004.6'8

ISBN 1-58053-572-0

Cover design by Igor Valdman

© 2003 ARTECH HOUSE, INC. 685 Canton Street Norwood, MA 02062

All rights reserved. Printed and bound in the United States of America. No part of this book may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.

All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Artech House cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

International Standard Book Number: 1-58053-572-0 Library of Congress Catalog Card Number: 2003049576

10 9 8 7 6 5 4 3 2 1

To my niece Bethany Muller in Richmond, Vermont

About the Author

Nathan J. Muller is cofounder and senior consultant of Ascent Solutions Group, which designs and executes innovative sales, marketing, and training support programs for technology providers and users. With more than 30 years of telecommunications industry experience, Mr. Muller has written extensively on many aspects of computers and communications, having published 25 books and more than 2,000 articles in over 60 publications worldwide. He is a frequent speaker at industry trade shows, association meetings, and customer events. He can be reached via e-mail at nmuller@ascent-llc.com.


Preface

Companies grappling with such issues as restructuring, technology implementation, and participation in the competitive global economy are faced with the necessity of managing a vast installed base of computers and local area networks (LANs) to facilitate the timely flow of information among business units over the wide area network (WAN), which may be the public-switched telephone network, a carrier’s fast packet network, or the public Internet. Given the vast installed base of computers and LANs, the need for management tools is imperative, as is the need for personnel with the skills to use them.

Empowered by today’s high-performance computers interconnected over LANs and WANs, companies are faced with the daunting task of bringing workability to the diversity and complexity of today’s data communications landscape. As enterprise networks continue to grow and expand to include mobile professionals, telecommuters, small branch offices and far-flung international locations, the need to extend management capabilities over public and private WANs becomes even more urgent. Among the key challenges facing network managers today is how to tie together incompatible LANs, meld legacy systems and LANs, extend the reach of LANs with wireless links, protect information assets from various disaster scenarios, and consolidate multiprotocol traffic over a single WAN backbone in such a way as to guarantee appropriate service levels. Furthermore, all this must be done securely, at minimum cost, and without inflicting performance penalties on end users as the existing infrastructure is reshaped.

This book is a practical guide that puts these and other important infrastructural issues into proper perspective to greatly increase the chances for success in managing advanced communications systems and networks. It is suited to both experienced and entry-level professionals, as well as college and university students who are preparing for careers in the field of telecommunications or information technology (IT) management. Interconnect vendors and service providers will find this book useful as a tutorial for new hires and salespeople and as an economical means of educating potential customers on various network issues that their products or services address.

The information contained in this book, especially as it relates to specific vendors and products, is believed to be accurate at the time it was written and is, of course, subject to change with continued advancements in technology and shifts in market forces. The mention of specific products, services, and vendors is intended for illustration purposes only and does not constitute an endorsement of any kind, expressed or implied, by the author or publisher.


Chapter 1: Local Area Networks

1.1 Introduction

Local area networks (LANs) were developed in the 1980s, starting with Ethernet and quickly followed by token ring and others. They enable members of an organization to share databases, applications, files, messages, and resources such as servers, printers, and Internet connections. The promised benefits of LANs are often too compelling to ignore: improved productivity, increased flexibility, and cost savings. These benefits sparked the initial move from mainframe-based data centers to a more distributed model of computing, which continues today. The impetus for this “downsizing” can come from several directions, including:

  • Senior management, who are continuously looking for ways to streamline operations to improve financial performance.

  • End users, who are becoming more technically proficient, resent the gatekeeper function of data center staff, and want immediate access to data that they perceive as belonging to them. In the process, they benefit from being more productive and in their ability to make better and faster decisions, which comes from increased job autonomy.

  • IT management, who are responding to budget cutbacks or scarce resources, and are looking for ways to do more using less powerful computers.

From their own perspectives, LANs represent the most feasible solution. With PCs now well entrenched in corporate offices, individuals, work groups, and departments have become acutely aware of the benefits of controlling information resources and of the need for data coordination. In becoming self-sufficient and being able to share resources via LANs, users have become empowered to better control their own destinies within the organization. For instance, they can increase the quality and timeliness of their decision making, execute transactions faster, and become more responsive to internal and external constituencies—all without the need to confront a gatekeeper in the data center.

In many cases, this arrangement has the potential of moving accountability to the lowest common point in the organization, where many end users think it properly belongs. This scenario also has the potential of peeling back layers of bureaucracy that have traditionally stood between users and centralized resources. IT professionals eventually discovered that it was in their best interest to gain control over LANs, enabling them to justify their existence within the organization by using their technical expertise to keep LANs secure and operating at peak performance. Further, there was the need to assist users, who were not technically savvy. Rendering assistance helped companies get the most out of their technology investments.


1.2 Ethernet

Ethernet is a type of LAN that uses a contention-based method of access to allow computers to share resources, send files, print documents, and transfer messages. The Ethernet LAN originated as a result of the experimental work done by Xerox Corporation at its Palo Alto Research Center (PARC) in the mid-1970s and quickly became a de facto standard with the backing of Digital Equipment Corp. (DEC) and Intel Corp. Xerox licensed Ethernet to other companies that developed products based on the specification issued by the three companies. Much of the original Ethernet design was incorporated into the 802.3 standard adopted in 1980 by the Institute of Electrical and Electronic Engineers (IEEE).

Ethernet is contention-based, meaning that stations compete with each other for access to the network, a process that is controlled by a statistical arbitration scheme. Each station “listens” to the network to determine if it is idle. Upon sensing that no traffic is currently on the line, the station is free to transmit. If the network is already in use, the station backs off and tries again. If multiple stations sense that the network is idle and transmit at the same time, a “collision” occurs and each station backs off to try again at staggered intervals. This media access control scheme is known as carrier sense multiple access with collision detection (CSMA/CD).

1.2.1 Frame Format

The IEEE 802.3 standard defines a multi-field frame format, which differs only slightly from that of the original version of Ethernet, known as “pure” Ethernet (see Figure 1.1):

  • Preamble. The frame begins with an 8-byte field called a preamble, which consists of 56 bits having alternating 1 and 0 values. These are used for synchronization and to mark the start of the frame. The same bit pattern used in the pure Ethernet preamble is used in the IEEE 802.3 preamble, which includes the 1-byte start frame delimiter field.

  • Start frame delimiter. The IEEE 802.3 standard specifies a start frame delimiter field, which is really a part of the preamble. This is used to indicate the start of a frame.

  • Address fields. The destination address field identifies the station(s) that are to receive the frame. The source address field identifies the station that sent the frame. If addresses are locally assigned, the address field can be either 2 bytes (16 bits) or 6 bytes (48 bits) in length. A destination address can refer to one station, a group of stations, or all stations. The original Ethernet specifies the use of 48-bit addresses, while IEEE 802.3 permits either 16- or 48-bit addresses.

  • Length count. The length of the data field is indicated by the 2-byte count field. This IEEE 802.3-specified field is used to determine the length of the information field when a pad field is included in the frame.

  • Pad field. To detect collisions properly, the frame that is transmitted must contain a certain number of bytes. The IEEE 802.3 standard specifies that if a frame being assembled for transmission does not meet this minimum length, a pad field must be added to bring it up to that length.

  • Type field. Pure Ethernet does not support length and pad fields, as does IEEE 802.3. Instead, 2 bytes are used for a type field. The value specified in the type field is only meaningful to the higher network layers and was not defined in the original Ethernet specification.

  • Data field. The data field of a frame is passed by the client layer to the data link layer in the form of 8-bit bytes. The minimum frame size is 72 bytes, while the maximum frame size is 1,526 bytes, including the preamble. If the data to be sent uses a frame that is smaller than 72 bytes, the pad field is used to stuff the frame with extra bytes. In defining a minimum frame size, there are less problems to contend with in handling collisions. If the data to be sent uses a frame that is larger than 1,526 bytes, it is the responsibility of the higher layers to break it into individual packets in a procedure called “fragmentation.” The maximum frame size reflects practical considerations related to adapter card buffer sizes and the need to limit the length of time the medium is tied up in transmitting a single frame.

  • Frame check sequence. A properly formatted frame ends with a frame check sequence, which provides the means to check for errors. When the sending station assembles a frame, it performs a cyclical redundancy check (CRC) calculation on the bits in the frame. The sending station stores the results of the calculation in the 4-byte frame check sequence field before sending the frame. At the receiving station, an identical CRC calculation is performed and a comparison made with the original value in the frame check sequence field. If the two values do not match, the receiving station assumes that a transmission error has occurred and requests that the frame be retransmitted. In pure Ethernet, there is no provision for error correction; if the two values do not match, notification that an error has occurred is simply passed to the client layer.

1.2.2 Media Access Control

Several key processes are involved in transmitting data across the network; among them, data encapsulation/decapsulation and media access management, which are performed by the media access control (MAC) sublayer of Open Systems Interconnection’s (OSI) data link layer.

Data Encapsulation/Decapsulation Data encapsulation is performed at the sending station. This process entails adding information to the beginning and end of the data unit to be transmitted. The data unit is received by the MAC sublayer from the logical link control (LLC) sublayer. The added information is used to perform the following tasks:

  • Synchronize the receiving station with the signal;

  • Indicate the start and end of the frame;

  • Identify the addresses of sending and receiving stations;

  • Detect transmission errors.

The data encapsulation function is responsible for constructing a transmission frame in the proper format. The destination address, source address, type and information fields are passed to the data link layer by the client layer in the form of a packet. Control information necessary for transmission is encapsulated into the offered packet. The CRC value for the frame check sequence field is calculated, and the frame is constructed.

When a frame is received, the data decapsulation function performed at the receiving station is responsible for recognizing the destination address, performing error checking, and then removing the control information that was added by the data encapsulation function at the sending station. If no errors are detected, the frame is passed up to the LLC sublayer.

Specific types of errors are checked in the decapsulation process, including whether the frame is a multiple of 8 bits or exceeds the maximum packet length. The address is also checked to determine whether the frame should be accepted and processed further. If it is, a CRC value is calculated and checked against the value in the frame check sequence field. If the values match, the destination address, source address, type and data fields are passed to the client layer. What is passed to the client station is the packet in its original form.

Media Access Management

The method used to control access to the transmission medium is known as media access management, which is responsible for several functions, starting with collision handling, which are defined by the IEEE 802.3 standard for contention networks. There are two collision handling schemes: one for detection and one for avoidance.

  • With detection (i.e., CSMA/CD), collisions occur when two or more frames are offered for transmission at the same time, which triggers the transmission of a sequence of bits called a “jam.” This is the means whereby all stations on the network recognize that a collision has occurred. At that point, all transmissions in progress are terminated. Retransmissions are attempted at calculated intervals. If there are repeated collisions, a process called “backing off” is used, which involves increasing the retransmission wait time following each successive collision.

  • With collision avoidance [i.e., carrier sense multiple access with collision avoidance (CSMA/CA)], the line is monitored for the presence or absence of a signal (carrier), as in CSMA/CD. But with collision avoidance, a broadcast is issued to the network notifying other stations that a data transmission is about to occur. While CSMA/CA is effective at avoiding collisions on a network, it has an additional overhead requirement that CSMA/CD does not. This results in CSMA/CA increasing network traffic because it has to broadcast the intent of the station to transmit before any real data is put onto the cable.

On the receiving side, the management function is responsible for recognizing and filtering out fragments of frames that resulted from a transmission that was interrupted by a collision. Any frame that is less than the minimum size is assumed to be a fragment that was caused by a collision.


1.3 10BaseT

The 10BaseT is the IEEE standard for providing 10-Mbps Ethernet performance and functionality over ubiquitously available unshielded twisted-pair (UTP) wiring. This standard is noteworthy in that it specifies a star topology, unlike traditional 10Base2 and 10Base5, which use coaxial cabling arranged in a bus (single cable with closed ends) or ring topology. The star topology, whereby individual segments of cable are attached to a hub, permits centralized network monitoring, which enhances fault isolation and bandwidth management. For new installations, twisted-pair wire is substantially less expensive as well as easier to install and maintain than Ethernet’s original “thick” coaxial cable (10Base5) or the “thin” coaxial alternative (10Base2).

1.3.1 Performance

Traditionally, Ethernet has relied on coaxial cable with multi-drop connections to a LAN backbone. Repeaters between the segments keep the signal strength at a consistent level across the Ethernet. The key disadvantage of this bus topology is that any disturbance to the continuity of the cable at any point renders the entire LAN inoperable.

In contrast, the star topology relies on a hub or switch to support a dedicated link to each user. If an individual link, port, or workstation were to fail, there would be no impact on the rest of the LAN. This is precisely the benefit promised by 10BaseT: Because the network can tolerate a malfunction of any end-user device or its physical link, the rest of the network will not be affected, resulting in improved network availability. This is made possible by the link test and auto-partition logic inherent in the port-level circuitry of a 10BaseT hub or switch.

A network management system can make problems even easier to identify. When a predefined error threshold is exceeded, for example, the network management system will alert the LAN administrator, enabling a technician to be dispatched before the user even realizes that a problem exists. Alarm notification is usually by a screen message or visual indicator; some systems can even notify the LAN administrator via pager.

The 10BaseT and traditional bus Ethernet LANs have different distance limitations: 10BaseT operates reliably over cable segments not exceeding 100 meters (330 feet), whereas traditional Ethernet LANs using thick coaxial cable operate reliably over segments of up to 500 meters (1,650 feet) in length, and 10Base2 Ethernets are effective at 200 meters (660 feet) using thin coax. The cable limitation of 10BaseT aside, its bit error rate performance is at least as good as 10Base2 and 10Base5 systems. The 10BaseT specification allows for bit error rates of no more than 1 in 100 million bits. The data-encoding scheme used for 10BaseT systems is the same as that used for coaxial-based Ethernets—self-clocking Manchester encoding.

The 10BaseT LANs are designed to support the same applications as traditional Ethernet LANs. The relatively short distance over which 10BaseT LANs operate is rarely a factor in its ability to support these applications. During the standardization process, a survey by AT&T revealed that over 99% of employee desktops are located within 100 meters of a telephone wire closet where all the connections meet at a patch panel.

1.3.2 Media

Most installed telephone wiring is of the type known as 24 American wire gauge (AWG). Even if existing telephone wiring follows the required star configuration and is within the roughly 100-meter distance limitation, it may still not be suitable to handle the 10-Mbps data rate. This is because no particular wire gauge or type is specified in the 10BaseT standard, although 24 AWG is what most equipment vendors have used in conformance tests to confirm that their products transmit reliably at up to 100 meters. Generally, the inside wiring installed in the last 20 years for telephone connections meets the 10BaseT specifications at cabling runs of up to 100 meters. Older wiring may not meet the standards, in which case, poor or erratic LAN performance could result and transmission distances could be considerably less than 100m.

The 10BaseT standard was designed to eliminate the requirement for shielded wiring. It relies on the twists in twisted-pair wire to hold down frequency loss, which, in turn, improves the integrity of the signal. The twists minimize the effects of this loss by canceling high-frequency signal energy to prevent signals from radiating to and corrupting the signal being carried over nearby twisted pairs (cross-talk). Even the individual wire pairs in 25-pair telephone cable are twisted for this purpose. This cable is widely used in large installations; it enables multiple 10BaseT segments to be neatly carried, separated, and patched to a panel for distribution to the hub.

1.3.3 Media Connections

Adapter cards, also known as network interface cards (NICs), are boards that insert into an expansion slot of PCs and servers. The adapter card connects the device’s bus directly to the LAN segment, eliminating the need for a separate transceiver. Depending on the type of adapter, it permits connections to thick or thin coaxial cable, as well as to unshielded twisted pairs. An adapter with an attachment unit interface (AUI) port will permit connection to a transceiver, allowing the card to be used with thick and thin coaxial cables and fiber-optic cables.

The 10BaseT adapters vary considerably in their capabilities and features for reporting link status. Some adapters notify the user of a miswired connection to the LAN. Many have light-emitting diodes (LEDs) that indicate link status after the connection is made to the hub, such as link, collision, transmit, and receive. Others provide minimal information, such as if the link is correctly wired and working, while some light only when something is wrong. Still other cards have no LEDs to display link information. Some cards feature a menu-driven diagnostic program to help the user isolate problems with the cards, such as finding out if the adapter is capable of responding to commands from the software.

Transceivers connect PCs and peripherals already equipped with legacy Ethernet-cards to 10BaseT wiring. Typically, it consists of a small external box with an RJ45 jack at one end for connecting to the UTP LAN segment and an AUI port at the other end for connecting to the Ethernet adapter card.

A medium access unit (MAU) terminates each end of the 10BaseT link. As such, it accommodates two wire pairs: one pair for transmitting the Ethernet signal and the other pair for receiving the signal. The 10BaseT standard describes seven basic functions performed by the MAU. Transmit, receive, collision detection, and loop-back functions direct data transfer through the MAU. The jabber detect, signal quality error test, and link integrity functions define ancillary services provided by the MAU.

The jabber function removes equipment from the network whenever it continuously transmits for periods significantly longer than required for a maximum-length packet, indicating a possible problem with the NIC. The signal quality error test detects silent failures in the circuitry, while the link integrity signal detects breaks in the wire pairs. Both assist in fault isolation.

1.3.4 Hubs

All 10BaseT stations are connected to the hub via two twisted-pair wire pairs—one two-wire path for transmitting and the other two-wire path for receiving—over a point-to-point link. In essence, the hub acts as a multiport repeater. It contains the circuitry to retime and regenerate the signal received from any of the wire segments that connect at the hub to each of the other segments. However, a 10BaseT hub is more than a simple repeater; it serves as an active filter that rejects damaged packets.

The multiport repeater provides packet steering, fragment extension, and automatic partitioning. The packet steering function broadcasts copies of packets received at one repeater port to all of its other ports. Fragment extension ensures that partially filled packets are sent to their proper destination. Automatic partitioning isolates a faulty or misconnected 10BaseT link to prevent it from disrupting traffic on the rest of the network.

There are several types of 10BaseT hubs, the most common being chassis-based solutions and stackable 10BaseT hubs that can be cascaded with appropriate cable connections. At the low end, hubs come in managed or unmanaged versions.

The chassis models are high-end devices that provide a variety of connections to the WAN, support multiple LAN topologies and media, and offer advanced network management, with Simple Network Management Protocol (SNMP) typically included as well. This type of 10BaseT hub is also the most expensive. Aside from enhancing their products with more interfaces and network management features to further differentiate them from competitive offerings, vendors are continually increasing the port capacity of these devices to bring down the price-per-port, making them more appealing to larger users.

Depending on port capacity, stackable hubs are used to link members of a workgroup or department. With a pass-through or crossover cable, additional units can be added in a cascading arrangement to meet growth requirements or to connect to a high-end hub.

1.3.5 Management

The promise of 10BaseT networks was not only that Ethernet would run over economical UTP wiring and offer unprecedented configuration flexibility, but that it would offer a superior approach to LAN management. Some of the most important management capabilities available through the hub include:

  • Support for the IEEE 802.3 repeater management standard and the Internet’s repeater management information base (MIB);

  • Remote site manageability from a central management station;

  • Provision of performance statistics, not only at the port level where such information has been traditionally available, but at the module and hub level as well;

  • Autopartitioning, which entails the ability to automatically remove disruptive ports from the network;

  • The ability to set performance thresholds that notify managers of a problem or automatically take action to address the problem;

  • Port address association features that connect the Ethernet media access control address of a device with the port to which it is attached;

  • Source/destination address information, which aids network redesign, traffic redistribution, troubleshooting, and security.

Overall, 10BaseT LANs offer a sound technical solution for most routine applications. In the office environment, packet throughput and error rates over twisted-pair wiring are the same as with coaxial systems, but the former is limited to shorter distances. The standard offers protection against equipment and media faults that can potentially disrupt the network, and the signaling method used is reasonably immune from most sources of electromagnetic interference commonly found in the office environment. As organizations have added more applications, more users, and more workstations, 10BaseT has been displaced by 100 Mbps (100BaseT) and 1,000 Mbps (1000BaseT) Ethernet LANs. To ease the migration, vendors support 10/100BaseT from the same network interface card, and some support 10/100/1,000BaseT from the same card.


1.4 Fast Ethernet

The 100BaseT is the IEEE standard for providing 100-Mbps Ethernet performance and functionality over ubiquitously available UTP wiring. Like 10BaseT Ethernet, this standard specifies a star topology. The need for 100 Mbps came about as a result of the emergence of data-intensive applications and technologies such as multimedia, groupware, imaging, and the explosive growth of high-performance database software packages on PC platforms. All of these tax today’s client-server environments and demand even greater bandwidth for improved response time.

1.4.1 Compatibility

Also known as Fast Ethernet, 100BaseT uses the same contention-based MAC method—CSMA/CD—that is at the core of IEEE 802.3 Ethernet. The Fast Ethernet MAC specification simply reduces the “bit time”—the time duration of each bit transmitted—by a factor of 10, enabling a 10-fold boost in speed over 10BaseT. Fast Ethernet’s scaled CSMA/CD MAC leaves the remainder of the MAC unchanged. The packet format, packet length, error control, and management information in 100BaseT are all identical to those used in 10BaseT.

Since no protocol translation is required, data can pass between 10BaseT and 100BaseT stations via a hub equipped with a 10/100-Mbps bridge module. Both technologies are also full-duplex capable, meaning that data can be sent and received at the same time. This compatibility enables existing LANs to be inexpensively upgraded to the higher speed as demand warrants.

1.4.2 Media Choices

To ease the migration from 10BaseT to 100BaseT, Fast Ethernet can run over Category 3, 4 or 5 UTP cables, while preserving the critical 100-meter (330-foot) segment length between hubs and end stations. The use of fiber allows even more flexibility with regard to distance. For example, the maximum distance from a 100BaseT repeater to a fiber-optic bridge, router, or switch using fiber-optic cable is 225 meters (742 feet). The maximum fiber distance between bridges, routers, or switches is 450 meters (1,485 feet). The maximum distance between a fiber bridge, router, or switch—when the network is configured for half-duplex—is 2 km (1.2 miles). By interconnecting repeaters with other internetworking devices, large well-structured networks can be easily created with 100BaseT. The type of media used to implement 100-Mbps Ethernets is summarized as follows:

  • 100BaseTX: A two-pair system for data grade (EIA 568 Category 5) UTP and shielded twisted-pair (STP) cabling.

  • 100BaseT4: A four-pair system for both voice and data grade (Category 3, 4, or 5) UTP cabling.

  • 100BaseFX: A multimode two-strand fiber system.

Together, the 100BaseTX and 100BaseT4 media specifications cover all cable types currently in use in 10BaseT networks. Since 100BaseTX, 100BaseT4, and 100BaseFX systems can be mixed and interconnected through a hub, users can retain their existing cabling infrastructure while migrating to Fast Ethernet.

The 100BaseT also includes a media-independent interface (MII) specification, which is similar to the 10-Mbps AUI. The MII provides a single interface, which can support external transceivers for any of the 100BaseT media specifications.

Unlike other high-speed technologies, Ethernet has been installed for over 20 years in business, government, and educational networks. The migration to 100-Mbps Ethernet is made easier by the compatibility of 10BaseT and 100BaseT technologies, making it unnecessary to alter existing applications for transport at the higher speed. This compatibility allows 10BaseT and 100BaseT segments to be combined in both shared and switched architectures, allowing network administrators to apply the right amount of bandwidth easily, precisely, and cost-effectively. Fast Ethernet is managed with the same tools as 10BaseT networks, and no changes to current applications are required to run them over the higher speed 100BaseT network.


1.5 Gigabit Ethernet

Ethernet is a highly scalable LAN technology. Long available in two versions—10-Mbps Ethernet and 100-Mbps Fast Ethernet—the next version standardized by the IEEE offer another order of magnitude increase in bandwidth. Offering a raw data rate of 1,000 Mbps or 1 Gbps, the so-called Gigabit Ethernet uses the same frame format and size as previous Ethernet technologies. It also maintains full compatibility with the huge installed base of Ethernet nodes through the use of LAN hubs, switches, and routers.

Gigabit Ethernet supports full-duplex operating modes for switch-to-switch and switch-to-end-station connections and half-duplex operating modes for shared connections using repeaters and the CSMA/CD access method. Figure 1.2 illustrates the functional elements of Gigabit Ethernet.

Click To expand
Figure 1.2: Functional elements of Gigabit Ethernet.

The initial efforts in the standards process drew heavily on the use of Fibre Channel and other high-speed networking components. Fibre Channel encoding/decoding integrated circuits and optical components were readily available and are specified and optimized for high performance at relatively low costs. The first implementations of Gigabit Ethernet employed Fibre Channel’s high-speed, 780-nm (short wavelength) optical components for signaling over optical fiber and 8B/10B encoding/decoding schemes for serialization and deserialization. Fibre Channel technology operating at 1.063 Gbps was enhanced to run at 1.250 Gbps, thus providing the full 1,000-Mbps data rate for Gigabit Ethernet. Link distances—up to 2 km over single-mode fiber and up to 550 meters over 62.5-micron multimode fiber—were specified as well.

In mid-1999, the IEEE and the Gigabit Ethernet Alliance formally ratified the standard for Gigabit Ethernet over copper. The IEEE 802.3ab standard defines Gigabit Ethernet operation over distances of up to 100 meters (330 feet) using four pairs of Category 5 balanced copper cabling. The standard adds a Gigabit Ethernet physical layer to the original 802.3 standard, allowing for the higher speed over the existing base of Category 5 UTP wiring. It also allows for auto-negotiation between 100-Mbps and 1,000-Mbps equipment. Table 1.1 summarizes Gigabit Ethernet standards for various media.

Table 1.1: A Summary of Gigabit Ethernet Standards for Various Media Specification Transmission Facility Purpose Source: IEEE 802.3z Gigabit Task Force.
Specification | Transmission Facility | Purpose
1000BaseLX | Long-wavelength laser transceivers | Support links of up to 550m of multimode fiber or 3,000m of single-mode fiber
1000BaseSX | Short-wavelength laser transceivers operating on multimode fiber | Support links of up to 300m using 62.5-micron multimode fiber or links of up to 550m using 50-micron multimode fiber
1000BaseCX | STP cable spanning no more than 25m | Support links among devices located within a single room or equipment rack
1000BaseT | UTP cable | Support links of up to 100m using four-pair Category 5 UTP

The initial applications for Gigabit Ethernet will be for campuses or buildings requiring greater bandwidth between routers, switches, hubs and repeaters, and servers. Examples include switch-to-router, switch-to-switch, switch-to-server, and repeater-to-switch links.


1.6 Token Ring

Token ring is a type of LAN that was introduced by IBM in 1985. It had a top speed of 4 Mbps and was developed in response to the commercial availability of Ethernet, which was developed jointly by Digital Equipment Corp. (DEC), Intel, and Xerox. When Ethernet was introduced, IBM did not endorse it, mainly because its equipment would not work in that environment. Later, in 1989, the speed of token ring was boosted to 16 Mbps.

The ring is essentially a closed loop, although various wiring configurations that employ a multistation access unit (MAU) and patch panel may cause it to resemble a star topology (see Figure 1.3). In addition, today’s intelligent wiring hubs and token ring switches can be used to create dedicated pipes between rings and provide switched connectivity between users on different rings.

Click To expand
Figure 1.3: Token ring configured in a star topology through the use of MAUs.

The cable distance of a 4-Mbps token ring is limited to 1,600 feet between stations, while the cable distance of a 16-Mbps token ring is 800 feet between stations. Because each node acts as a repeater in that data packets and the token are regenerated at their original signal strength, token-ring networks are not as limited by distance as are bus-type networks. Like its nearest rival, Ethernet, token-ring networks normally use twisted-pair wiring, shielded or unshielded.

1.6.1 Advantages of Token Ring

The ring topology offers several advantages:

  • Since access to the network is not determined by a contention scheme, as is Ethernet, a higher throughput rate is possible in heavily loaded situations, limited only by the slowest element—sender, receiver, or link speed.

  • With all messages following the same path, there are no routing problems to contend with. Logical addressing may be accommodated to permit message broadcasting to selected nodes.

  • Adding stations is easily accomplished—one connector is unplugged, the new node is inserted, and both nodes are plugged into the network. Other nodes are updated with the new address automatically.

  • Control is simple, requiring little in the way of additional hardware or software to implement.

  • The cost of network expansion is proportional to the number of nodes.

Another advantage of token ring is that the network can be configured to give high-priority traffic precedence over lower priority traffic. Only if a station has traffic equal to or higher in priority than the priority indicator embedded in the token can it transmit data onto the network.

The token ring in its pure configuration is not without liabilities, however. Failed nodes and links can break the ring, preventing all the other stations from using the network. At extra cost, a dual-ring configuration with redundant hardware and bypass circuitry is effective in isolating faulty nodes from the rest of the network, thereby increasing reliability. Through the use of bypass circuitry, physically adding or deleting stations to the token-ring network is accomplished without breaking the ring. Specific procedures must be used to ensure that the new station is recognized by the others and is granted a proportionate share of network time. The process for obtaining this identity is referred to as neighbor notification. This situation is handled quite efficiently, since each station becomes acquainted with the address of its predecessor and successor on the network upon initialization (power-up) or at periodic intervals thereafter.

1.6.2 Frame Format

The frame size used on 4-Mbps token rings is 4,048 bytes, while the frame size used on 16-Mbps token rings is 16,192 bytes. The IEEE 802.5 standard defines two data formats—tokens and frames (see Figure 1.4). The token, three octets in length, is the means by which the right to access the medium is passed from one station to another. The frame format of token ring differs only slightly from that of Ethernet. The following fields are specified for IEEE 802.5 token-ring frames:

Click To expand
Figure 1.4: Format of IEEE 802.5 token and frame.

  • Start delimiter (SD): Indicates the start of the frame.

  • Access control (AC): Contains information about the priority of the frame and a need to reserve future tokens, which other stations will grant if they have a lower priority.

  • Frame control (FC): Defines the type of frame, either MAC information or information for an end station. If the frame is a MAC frame, all stations on the ring read the address, but only the destination station can read the user data.

  • Destination address (DA): Contains the address of the station that is to receive the frame. The frame can be addressed to all stations on the ring.

  • Source address (SA): Contains the address of the station that sent the frame.

  • Data: Contains the data “payload.” If the frame is a MAC frame, this field may contain additional control information.

  • Frame check sequence (FCS): Contains error-checking information to ensure the integrity of the frame to the recipient.

  • End delimiter (ED): Indicates the end of the frame.

  • Frame status (FS): Provides indications of whether one or more stations on the ring recognized the frame, whether the frame was copied, or whether the destination station is not available.

1.6.3 Operation

A token is circulated around the ring, giving each station in sequence a chance to put information on the network. The station seizes the token, replacing it with an information frame. Only the addressee can claim the message. At the completion of the information transfer, the station reinserts the token on the ring. A token-holding timer regulates the maximum amount of time a station can occupy the network before passing the token to the next station.

A variation of this token-passing scheme allows stations to send data only during-specified time intervals. The ability to determine the time interval between messages is a major advantage over the contention-based access method used by Ethernet. This time-slot approach can support voice transmission and video conferencing, since latency is controllable.

To protect the token ring from potential disaster, one station is typically designated as the control station. This station supervises network operations and does important housecleaning chores, such as reinserting lost tokens, taking extra tokens off the network, and disposing of “lost” packets. To guard against the failure of the control station, every station is equipped with control circuitry so that the first station detecting the failure of the control station assumes responsibility for network supervision.

1.6.4 Dedicated Token Ring

Dedicated token ring (DTR), also known as full-duplex token ring, lets devices directly connected to a token-ring switch send and receive data simultaneously at 16 Mbps, effectively providing each station with 32 Mbps of throughput.

Under the IEEE 802.5r standard for DTR, which defines the requirements for end stations and concentrators that operate in full-duplex mode, all new devices will coexist with existing token-ring equipment and will adhere to the token-passing access protocol. The DTR concentrator consists of C-Ports and a data transfer unit (DTU). The C-Ports provide basic connectivity from the device to token-ring stations, traditional concentrators, or other DTR concentrators. The DTU is the switching fabric that connects the C-Ports within a DTR concentrator. In addition, DTR concentrators can be linked to each other over a LAN or WAN via data transfer services such as asynchronous transfer mode (ATM).

1.6.5 High-Speed Token Ring

With 16-Mbps token-ring connections between switches easily becoming congested at busy times and high-performance servers becoming less able to deliver their full bandwidth potential over a 16-Mbps token-ring connection, the need for a high-speed solution for token ring has become readily apparent in recent years. Other high-speed technologies are already available for inter-switch links and server connections— Fiber Distributed Data Interface (FDDI), Fast Ethernet and ATM—but they are inadequate for the token-ring environment.

In 1997, several token-ring vendors teamed up to address this situation by forming the High Speed Token Ring Alliance (HSTRA). A year later, the alliance issued a specification for high-speed token ring (HSTR), which offers 100 Mbps and preserves the native token-ring architecture. However, to keep costs to a minimum and to shorten its development time, HSTR is based on the IEEE 802.5r standard for dedicated token ring, adapted to run over the same 100-Mbps physical transmission scheme used by dedicated Fast Ethernet. HSTR links can be run in either half-duplex or full-duplex mode, just like dedicated token ring.

HSTR can be mixed with existing 4/16-Mbps switches, hubs, bridges, routers, NICs, and cabling. HSTR was implemented for greater throughput where the enterprise needed it most—at the server and backbone. Upgrading these connections with HSTR only required that an HSTR uplink be plugged into a token-ring switch and that the existing 16-Mbps server network NIC be replaced with a 100-Mbps HSTR NIC. To complete the upgrade, the two devices are connected with appropriate cabling. The 100-Mbps HSTR operates over both Category 5 UTP and IBM Type 1 STP cable, as well as multimode fiber-optic cabling.

It was also possible to connect desktop systems to token-ring switches on dedicated 100-Mbps HSTR connections. Token-ring vendors offer 4/16/100-Mbps adapter cards that enable companies to standardize on a single network adapter and prepare their infrastructure for the eventual move to HSTR. While the HSTR standard does not define an auto-negotiation algorithm, individual vendors have a number of ways to implement the feature while adhering to the standard. With this feature, HSTR products operate at the maximum connection speed, automatically determining whether to transmit at 4 Mbps, 16 Mbps, or 100 Mbps. Corporations could equip stations with auto-negotiating 4/16/100-Mbps NICs, even if there is no immediate need for 100 Mbps throughput to the desktop. When the hub or switch at the other end of the connection is later upgraded to 100 Mbps HSTR, the token ring station can automatically adjust transmission to 100 Mbps.

Since Ethernet packets can be carried over token-ring links, HSTR makes a good backbone medium for the mixed-technology LAN. With support for the maximum token-ring frame size, an HSTR backbone segment is able to handle Ethernet and token-ring frames on the same VLAN connection, which Fast Ethernet would not be able to do without a lot of processing to break down the larger token-ring frames.

Token ring is a stable technology with a proven capacity for handling even today’s high-bit-rate applications. At the same time, network managers can protect their current investments in token ring by understanding application performance and the capacity of the network, and tuning it accordingly. The DTR standard prolongs the useful life of token-ring networks, while meeting the increased bandwidth requirements of emerging applications such as document imaging, desktop videoconferencing, and multimedia. Nevertheless, token ring has been overtaken by Ethernet, in terms of both technology and market share. Not only is Ethernet cheap to implement, it offers a migration path to higher speeds that token-ring standards lack. While Ethernet has reached gigabit-per-second speeds, token ring has not been standardized beyond 100 Mbps. [1 ]

[1 ]Although some vendors like Cisco Systems offered a form of Gigabit Token Ring, critics claimed they were proprietary products and not authentic token ring.


1.7 Other LANs

There are other LANs that once showed promise, but have fallen out of favor for one reason or another. These include ARCnet, StarLAN, and the FDDI. Other LAN technologies came and went so quickly in the early 1990s that they are not worth further discussion. These include IBM’s 25-Mbps LAN technology based on ATM and Hewlett-Packard’s 100VG-AnyLAN, both of which were intended to support Ethernet and token-ring frames. An intriguing idea from National Semiconductor resulted in isochronous Ethernet, which essentially provided conventional Ethernet LANs with quality of service for multimedia applications via Integrated Services Digital Network (ISDN) to the desktop. All of these technologies elicited a big yawn from the marketplace.

1.7.1 ARCnet

The Attached Resource Computer network (ARCnet), introduced by Datapoint Corp. in 1977, is the first LAN technology. Over the years, ARCnet has been overshadowed by higher-speed LAN technologies, notably Ethernet and token ring. Today, ARCnet products are still available and embedded in many companies’ products, but they may not be advertised as ARCnet. Unlike other network technologies, there is no upward migration path for ARCnet to higher speeds that approach the Ethernet standard at 10 Gbps.

Currently, ARCnet products for the LAN are available that operate at 2.5 Mbps. Higher-speed ARCnet products are available at 5 Mbps and 10 Mbps, but these are used as general-purpose communications controllers for networking microcontrollers and intelligent peripherals in industrial, automotive, and embedded control environments using an ARCnet protocol engine. An ARCnet protocol engine is the ideal solution for embedded control applications because it provides a deterministic token-passing protocol, a highly reliable and proven networking scheme.

Most ARCnet products operate at 2.5 Mbps. When an ARCnet node receives the token, it is permitted to send packets of data to other stations. While the tokenring protocol passes its token around a physical cable ring, ARCnet passes its token from node to node in order of each node’s address.

Nodes could be located up to 2,000 feet from an ARCnet hub through the use of RG-62 coaxial cabling. The total end-to-end length of the network could be 20,000 feet—nearly 4 miles. With twisted-pair wiring, each node could be located up to 400 feet from an ARCnet hub. As many as 254 connections may be supported on a single ARCnet LAN via interconnected active hubs.

ARCnet was originally designed to operate in a distributed star configuration, which entailed each node being directly connected to a hub (see Figure 1.5), with several hubs connected to each other. This design suited organizations that terminated cables in centrally located wiring closets. Later, an Ethernet-like bus topology was introduced for ARCnet. This allowed nodes to be interconnected via a single run of cable. The two topologies could even be combined for maximum configuration flexibility. For example, instead of connecting a single ARCnet node to a port on an ARCnet hub, a bus cable with a maximum of eight nodes attached could be connected to the hub.

Click To expand
Figure 1.5: ARCnet configuration incorporating both passive and active hubs.

ARCnet makes use of two types of hubs: passive and active. Passive hubs are small, four-port devices (nonpowered) that support workstations at distances up to 100 feet using coaxial cabling. Active hubs are eight-port units that support workstations at distances up to 200 feet using coaxial cabling and up to 400 feet with twisted-pair wiring. By attaching passive hubs to each of an active hub’s eight ports, a single active hub can support 24 workstations.

The primary advantages of this distributed star arrangement include cost savings on cable installation and hub ports. A central active hub that uses twisted-pair wiring offers the best protection against network failure, since each station has its own dedicated connection to the active hub. Furthermore, the central hub approach makes all the wiring accessible at one point, which simplifies troubleshooting, fault isolation, and network expansion.

From the beginning, ARCnet used internal transceivers in its hubs. Under Datapoint’s concept of “conjoint networks,” there was no need for bridges and routers to interconnect multiple LANs. Selected workstations and/or file servers could be configured to participate directly in up to six LANs at the same time. Access to each LAN or group of LANs was effectively controlled through hardware.

Although ARCnet is rarely considered today by companies seeking LAN solutions, the technology is still employed for such niche applications as data acquisition, plant monitoring and control, closed-circuit cameras, commercial heating and air conditioning, waterway controls, automotive navigation systems, building automation, and motor drive communications. The vendors of these applications use ARCnet as the network for linking various system components.

1.7.2 StarLAN

AT&T developed StarLAN in the 1980s to satisfy the need for a low-cost, easy-to-install LAN that would offer more configuration flexibility than token ring and higher availability than Ethernet. The hub-based StarLAN was offered in two versions—1 Mbps and 10 Mbps. Since it was based on IEEE 802.3 standards, StarLAN offered interoperability with Ethernet and token ring through driver software.

The StarLAN architecture was based on the use of one or more hubs. Connectivity between PCs and hubs was achieved through the use of UTP wiring. In multi-hub networks, up to five levels of hubs could be cascaded, with one hub designated as the header to which one or more intermediate hubs were connected. The maximum distance between adjacent hubs was 250 meters. The maximum span of a five-level network was 2,500 meters.

In 1991, AT&T and NCR merged under the name AT&T Global Information Solutions, where responsibility for StarLAN resided until 1996. That year, AT&T Global Information Solutions changed its name back to NCR Corp. in anticipation of being spun off to AT&T shareholders as an independent, publicly traded company. Around that time, NCR discontinued the StarLAN product line.

1.7.3 Fiber Distributed Data Interface

Fiber distributed data interface (FDDI) is a 100-Mbps token-passing network that employs a dual counter-rotating ring topology for fault tolerance. Originally conceived to operate over multimode fiber-optic cable, the standard has evolved to embrace single-mode fiber-optic cable, STP copper, and even UTP copper wiring. It is designed to provide high-bandwidth, general-purpose interconnection between computers and peripherals, including the interconnection of LANs (see Figure 1.6) and other networks, within a building or campus environment.

Click To expand
Figure 1.6: Via encapsulation, FDDI can carry Ethernet and token-ring frames as data, providing a multiprotocol backbone network.

Operation

A timed token-passing access protocol is used to pass frames of up to 4,500 bytes in size, supporting up to 1,000 connections over a maximum multimode fiber path of 200 km (124 miles) in length. Each station along the path serves as the means for attaching and identifying devices on the network, regenerating and repeating frames sent to it. Unlike other types of LANs, FDDI allows both asynchronous (time-insensitive) and synchronous (time-sensitive) devices to share the network.

Synchronous services (e.g., voice and video) are intolerant of delays and must be guaranteed a fixed bandwidth or time slot. Synchronous traffic is therefore given priority over asynchronous traffic, which is better able to withstand delay. FDDI stresses reliability, and its architecture includes integral management capabilities, including automatic failure detection and network reconfiguration.

Any change in the network status—such as power-up or the addition of a new station—leads to a “claim” process during which all stations on the network bid for the right to initialize the network. Every station indicates how often it must see the token to support its synchronous service. The lowest bid represents the station that must see the token most frequently. That request is stored as the target token rotation time (TTRT). Every station is guaranteed to see the token within 2 × TTRT seconds of its last appearance.

This process is completed when a station receives its own claim token. The winning station issues the first unrestricted token, initializing the network on the first rotation. On the second rotation, synchronous devices may start transmitting. On the third and subsequent rotations, asynchronous devices may transmit, if there is available bandwidth. Errors are corrected automatically via a beacon-and-recovery process during which the individual stations seek to correct the situation.

Architecture

These processes are defined in a set of standards sanctioned by the American National Standards Institute (ANSI). The standards address the following four functional areas of the FDDI architecture (see Figure 1.7):

  • Physical media dependent (PMD): Data is transmitted between stations after converting the data bits into a series of optical pulses. The pulses are then transmitted over the cable linking the various stations. The PMD sublayer describes the optical transceivers—specifically, the minimum optical power and sensitivity levels over the optical data link. This layer also defines the connectors and media characteristics for point-to-point communications between stations on the FDDI network. The PMD sublayer is a subset of the physical layer of the OSI reference model, defining all of the services needed to transport a bit stream from station to station. It also specifies the cabling requirements for FDDI-compliant cable plant, including worst-case jitter and variations in cable attenuation.

  • Physical layer (PHY): The PHY protocol defines those portions of the physical layer that are media independent, describing data encoding/decoding, establishing clock synchronization, and defining the handshaking sequence used between adjacent stations to test link integrity. It also provides the synchronization of incoming and outgoing code-bit clocks and delineates octet boundaries as required for the transmission of information to or from higher layers. These processes allow the receiving station to synchronize its clock to the transmitting station.

  • MAC: FDDI’s data link layer is divided into two sublayers. The MAC sublayer governs access to the medium. It describes the frame format, interpretation of frame content, generates and repeats frames, issues and captures tokens, controls timers, monitors the ring, and interfaces with station management. The LLC sublayer is required for proper ring operation and is part of the IEEE 802.2 standard.

    Click To expand
    Figure 1.7: FDDI layers and their relationship to the seven-layer OSI reference model.

In keeping with the IEEE model, the FDDI MAC is fully compatible with the IEEE 802.2 LLC standard. Applications that interface to the LLC and operate over existing LANs, such as IEEE 802.3 CSMA/CD or 802.5 token ring, are able to operate over an FDDI network. The FDDI MAC, like the 802.5 token-ring MAC, has two types of protocol data units, a frame and a token. Frames are used to carry data (such as LLC frames), while tokens are used to control a station’s access to the network. At the MAC layer, data is transmitted in 4-bit blocks called 4B/5B symbols. The symbol coding is such that four bits of data are converted to a 5-bit pattern; thus, the 100-Mbps FDDI rate is provided at 125 million signals per second on the medium. This signaling type is employed to maintain signal synchronization on the fiber.

  • Station management (SMT): The SMT facility provides the system management services for the FDDI protocol suite, detailing control requirements for the proper operation and interoperability of stations on the FDDI ring. It acts in concert with the PMD, PHY, and MAC layers. The SMT facility is used to manage connections, configurations, and interfaces. It defines such services as ring and station initialization, fault isolation and recovery, and error control. SMT is also used for statistics gathering, address administration, and ring partitioning.

Topology

FDDI is a token-passing ring network. Like all rings, it consists of a set of stations connected by point-to-point links to form a closed loop. Each station receives signals on its input side and regenerates them for transmission on the output side. Any number of stations, theoretically, can be attached to the network, although default values in the FDDI standard assume no more than 1,000 physical attachments and a 200-km path.

FDDI uses two counter-rotating rings: a primary ring and a secondary ring. Data traffic usually travels on the primary ring. The secondary ring operates in the opposite direction and is available for fault tolerance. If appropriately configured, stations may transmit simultaneously on both rings, thereby doubling the bandwidth of the network to 200 Mbps.

Three classes of equipment are used in the FDDI environment: single-attached stations (SASs), dual-attached stations (DASs), and concentrators (CONs).

A DAS physically connects to both rings, while a SAS connects only to the primary ring via a wiring concentrator. In the case of a link failure, the internal circuitry of a DAS can heal the network using a combination of the primary and secondary rings. If a link failure occurs between a concentrator and a SAS, the SAS becomes isolated from the network.

These equipment types may be arranged in any of three topologies: dual ring, tree, and dual ring of trees (see Figure 1.8). In the dual-ring topology, DASs form a physical loop, in which case all the stations are dual attached. In a tree topology, remote SASs are linked to a concentrator, which is connected to another concentrator on the main ring.

Click To expand
Figure 1.8: FDDI dual-ring topology with three types of interconnecting devices.

Any DAS connected to a concentrator performs as a SAS. Concentrators may be used to create a network hierarchy, which is known as a dual ring of trees. This topology offers a flexible hierarchical system design that is efficient and economical. Devices requiring highly reliable communications attach to the main ring, while those less critical attach to branches off the main ring. Thus, SAS devices can communicate with the main ring, but without the added cost of equipping them with a dual-ring interface or a loop-around capability that would otherwise be required to ensure the reliability of the ring in the event of a station failure.

Failure Protection

FDDI provides an optional bypass switch at each node to overcome a failure anywhere on the network. In the event of a node failure, it is bypassed optically, removing it from the network. Up to three nodes in sequence may be bypassed; enough optical power will remain to support the operable portions of the network.

In the event of a cable break, the dual counter-rotating ring topology of FDDI allows use of the redundant cable to handle normal 100 Mbps traffic. If both the primary and secondary cables fail, the stations adjacent to the failures automatically loop the data around and between rings (see Figure 1.9), thus forming a new C-shaped ring from the operational portions of the original two rings. When the fault is healed, the network will reconfigure itself again.

Click To expand
Figure 1.9: Self-healing capability of FDDI’s dual-ring topology.

Normally, FDDI concentrators offer two buses, which correspond to the two FDDI backbone rings. Fault tolerance is also provided for stations that are connected to the ring via a concentrator because the concentrator provides the looparound function for attached stations.


1.8 Conclusion

ARCnet was the first LAN technology to fall by the wayside, with StarLAN to follow soon after. Ethernet and token ring vied for market share throughout the mid-1980s and 1990s before Ethernet pulled ahead. Upon reaching 100 Mbps, it became apparent that token ring would have to either meet that speed or ultimately be abandoned. But by the time token ring reached 100 Mbps, Ethernet advocates had already been looking forward to gigabit speeds. By 2000, Ethernet clearly emerged as the network of choice for most organizations.

Today, Ethernet at the SONET OC-192 rate of 10 Gbps is being deployed by carriers for metropolitan-area networks (MANs) and fat-pipe access to the Internet, while Ethernet at the OC-768 rate of 40 Gbps is in the offing. In Ethernet, service providers are looking for the same things as corporations—a familiar, low-cost, high-speed technology to support networked applications, such as virtual private networks, Internet Protocol (IP) telephony, transparent LAN services and e-commerce. Ethernet running at 10 Gbps offers all that and more. It reduces operational costs because it is the one technology that can be used from LAN to MAN to WAN. Because there is no need for ancillary equipment, such as protocol translators, equipment and operational costs can be greatly reduced.

The seamless connectivity to the installed base of 10-Mbps and 100-Mbps equipment, combined with Ethernet’s scalability and flexibility to handle new applications and data types over a variety of media, makes Gigabit Ethernet a practical choice for high-speed, high-bandwidth networking. The 1000BaseT enables the deployment of Gigabit Ethernet into the large installed base of Category 5 cabling, preserving the investment organizations have made in existing cable infrastructure.

Token ring has held up well for a long time, but under today’s heavy traffic loads, these networks are experiencing congestion problems and must be replaced. For several years, there has been a move within IT organizations to migrate away from obsolete technology, especially since IBM itself has walked away from token ring and has lost interest in high-speed token ring and gigabit token ring. The IEEE has periodically raised the issue of standardizing gigabit token ring, but lack of interest has always discouraged the effort. Even third-party vendors that had specialized in token ring, such as Madge Networks, now sell Ethernet and wireless solutions, while paying lip service to the idea of protecting existing investments in token-ring infrastructure.

Once considered a promising technology, FDDI is also considered a legacy technology and is being replaced with more economical and scaleable alternatives. An extension of FDDI, called FDDI-2, uses portions of its 100-Mbps bandwidth to carry voice and video. FDDI full-duplex technology (FFDT) uses the same network infrastructure but can potentially support data rates up to 200 Mbps. However, neither technology has been widely accepted. Furthermore, FDDI is limited by distance and is expensive to implement. Although FDDI offers high reliability and fault tolerance for mission-critical applications, it has been overtaken by more scaleable technologies such as Gigabit Ethernet, Fibre Channel, and, more recently, Infiniband, which is discussed in Chapter 4 within the context of storage area network (SAN).


Chapter 2: LAN Administration

2.1 Introduction

The LAN administrator’s main focus is usually on keeping the network operating properly and making sure the needs of users are addressed in a timely manner, including hardware and software upgrades. To meet the needs of all users, the LAN administrator must have appropriate tools to accomplish a number of specific tasks. Many of these tasks can be automated to enable the LAN administrator to take care of multiple networks that may consist of hundreds of servers, desktop computers and peripherals—the configurations of which may change on a daily basis to meet the varying needs of mobile professionals, telecommuters, workgroups, departments, or the organization as a whole. Many of these tools may come bundled with the LAN vendor’s network management system. Some are bundled with help desk software. Others are available from third-party vendors as standalone products that can be launched from the network management system or help desk. All of these different management and administration systems and tools can even share data via application programming interfaces (APIs).

Whether bundled with other products or used separately, the right tools help the LAN administrator monitor, analyze, and adapt the LAN to changing organizational needs. The tools themselves are applications and utilities based on NetWare, Windows, or UNIX. In large heterogeneous environments, the LAN administrator will have occasion to use tools that work with multiple network operating systems. With the right tools, the LAN administrator can access multiple functions and client operating systems through a consistent graphical user interface, which can greatly improve personal performance.


2.2 Console and Agents

The key concepts in LAN administration are the console and agents. The console is the workstation that is set up to view information collected by the agents. The agents are special programs that are designed to retrieve specific information from the network. An application agent, for example, works on each workstation to log application usage. Workstation users are not aware of the agent and it has no effect on the performance of the workstation or the applications running on it. The collected information is organized into data sets and stored in a relational database, where it can be retrieved for viewing on the LAN administrator’s console.

Information from multiple sets of data can be displayed in several ways—cells, charts, text—and analyzed for such purposes as license management or inventory management, and printed as a detail or summary report. The entire process is illustrated in Figure 2.1. A comprehensive tool set allows the LAN administrator to perform the following main functions:

  • View and manipulate network data;

  • Automate file distribution;

  • Maintain hardware inventory;

  • Manage installed software, including application usage;

  • Receive notification of network events;

  • Establish and manage network printer support;

  • Automate network processes, such as backup and virus detection;

  • Monitor disk and file usage;

  • Create task lists;

  • Work with text files;

  • Establish and maintain security;

  • Manage storage.

    Click To expand
    Figure 2.1: Information flow between console and agent.

All of the agents that collect information in support of these functions are configured at the console using commands selected from the menu bar. Once configured, each type of agent can be assigned an icon that launches its associated viewer for displaying collected information.

With LANs increasingly being interconnected over wider geographical areas, network administrators can make use of agents to monitor WAN links as well. The agents play a role similar to the one monitors and protocol analyzers play in hardware. Although the agents collect the same information as the monitors, they also process the packets to provide detailed and high-level information regarding network traffic. In this way, they resemble protocol analyzers.

Hardware-based monitors and software-based agents can be used together distributed throughout a LAN, as well as geographically dispersed via the WAN. Their packet capture with filtering and decoding capabilities allows early detection of suspect traffic patterns and identification of faulty network devices. Since agents use the network only when information is requested from the network management system, they do not burden the network with unnecessary overhead.

2.2.1 Intelligent Agents

A critical tool in the IT department’s arsenal of management tools is the “ intelligent” agent, which is an autonomous and adaptive software program that accomplishes its tasks by executing commands remotely. System administrators, network managers, and software developers can create and use intelligent agents to execute critical processes, including performance monitoring, fault detection and restoration, hardware and software asset management, virus protection, and information search and retrieval. One of the latest applications of intelligent agents is intrusion detection, in which the agent reports security breaches at a router or firewall and takes appropriate steps to prevent further attacks. With the agent concept enjoying increasing acceptance, vendors are offering integrated development environments for creating agents, agent managers for deploying and managing agents across a network, and sample intelligent agents that are ready-to-run and can be customized for particular needs without requiring any programming skills.

What makes these agents so smart is the addition of programming code that tells them exactly what to do, how to do it, and when to do it. In essence, the intelligent agent plays the dual role of manager and agent. Under this scheme, polling is localized, events and alarms are collected and correlated, various tasks and trouble responses are automated, and only the most relevant information is forwarded to the central management station. In the process, network traffic is greatly reduced, as is the time for problem resolution.

2.2.2 Agent Behavior

The behavior of intelligent agents can be modified in two ways: templates and programs. The choice will depend on the level of an organization’s in-house network and systems management expertise.

Template Solutions

Some vendors, such as Hewlett-Packard, offer rules-based templates to modify the behavior of intelligent agents without the need for native-language programming. The role of the agent is defined in a template that tells the network management system what to do with the information collected by the agent. A network manager can bring up a representation of the template used for monitoring a particular application, for example, and edit the rules concerning responses to various alerts.

For instance, when a firewall issues an error message, under the rules described in its template, it sends all alerts to a particular system administrator. The network manager can change the rule so that an automated response is initiated instead, allowing agents to resolve problems and perform routine tasks (e.g., backups, batch jobs, file maintenance) locally. This prevents the system administrator from being overwhelmed by warning and informational messages, so he or she can focus only on potential service-disrupting conditions that cannot be resolved locally.

In a similar manner, responsibilities can be assigned to specific people. For instance, an operator can be assigned a particular group of Internet servers according to subsidiary company, department, or location. Likewise, responsibilities also can be assigned by type of application, such as electronic commerce implemented by various publicly accessible Web servers, or by the expertise of various site personnel [e.g., Webmaster, Common Gateway Interface (CGI) programmer, Java application developer, certified security engineer]. The advantage of templates is that they can alter the reporting behavior of agents without the need to rewrite the agents themselves.

Programmatic Solutions

For programmers, many vendors offer tool kits that accelerate the development of the agent and manager components, which is normally a significant and time-consuming activity. Without a tool kit, each agent must be hand-coded, that is built from scratch—a process that can take days or weeks. The use of tool kits can reduce development time to only minutes, allowing developers to spend more time on the value-added components of their application, such as processing data gathered by the agent or communicating with, and controlling, external devices.

The agent-creation process is further simplified because developers now can use an intuitive C++ interface that insulates them from the complexities of APIs. For example, without using a tool kit, a developer might have to write more than 200 lines of code to create a simple “get” request. With a tool kit, such agent development can take as few as four lines of code, with the rest of the code being generated automatically. By drastically reducing the amount of manual coding, developer errors are reduced, and quality and productivity are increased. In addition, the code-generation process provides greater code consistency, thus improving code quality and maintainability as well.

Likewise, manager development is also enhanced through a convenient C++ interface that insulates the developer from complex object manipulations. This interface may result in as much as a tenfold reduction in the lines of code for writing manager requests and defining agent responses, for example.

Some tool kits are actually elements of an integrated suite of tools and platforms that facilitate and accelerate the development and deployment of agent- or manager-based network management solutions. These tools are targeted at various phases of the software development life cycle: requirements analysis, high-level design, detailed design, test, and implementation.

It is not enough to have agent-manager development tool kits—there must be a means to test the results before implementation in the live environment. For this task, there are test tool kits that automatically create a suite of tests and provide automated and interactive methods to send those tests to an agent and receive performance reports that aid in further development.

Through the use of interactive and regression tests, the agent tester tool kit fully exercises the agent during customization and testing. The interactive test method provides the ability to incrementally test the customization of the agent, while the regression-testing method allows for a complete suite of tests to be executed, with the results being verified against the expected results. The agent tester tool kit also gives developers the flexibility to customize generated test programs, incorporating event-handling and response, error-handling, and complex MIB definitions.

This level of automation means that developers can completely test their agents without ever writing code, enabling rapid deployment of effective and reliable management solutions, while reducing development costs, improving quality, and shortening the development cycle.

Agents can be built with Java and used to monitor and report on key performance metrics of systems, services, and applications. Since Java is a cross-platform development tool, agents built with Java can provide a single, unified management system to support any mix of IP-based desktop, server, and network resources that also run Java—including hubs, switches, and routers. In addition to relieving the burden of front-line managers, who usually must cope with a collection of unrelated tools while demands on them are accelerating, the Java agents can self-populate through the network to add new resource support and functionality enhancements.

The agents can also collaborate to resolve problems directly—and without alarm generation—rather than escalating them to a higher-level manager in the traditional way. This intelligence reduces management traffic on the network, enables faster response to events, and reduces administration costs. In addition, the agents can be managed directly via a basic Web browser or through an existing SNMP management application.

2.2.3 Agent Applications

Agent technology has been available for several years and still represents one of the fastest growing areas in network management—and for good reason. In a global economy that encourages the expansion of networks to reach new markets and discourages the addition of personnel to minimize operating costs, it simply makes sense to automate as many management tasks as possible through the use of intelligent agents. In recognition of these new business realities, the list of tasks that are being handled by agents is continually growing.

Performance Management

Network performance monitoring can help determine network service-level objectives by providing measurements to help managers understand typical network behavior and normal periods. The challenge is defining “typical” and “ normal.” Intelligent agents can help define the network’s behavior and gather the information for documenting achieved performance levels. The following capabilities of intelligent agents are particularly useful for building a network performance profile:

  • Baselining and network trending: Identifies the true operating envelope of the network by defining typical and normal behavior that can be used to compare performance at some time in the future, perhaps to see if service level objectives are still being met and reveal out-of-norm conditions, which, if left unchecked, may have drastic consequences on the productivity of users.

  • Application usage and analysis: Identifies the overall load of network traffic, what times of the day certain applications load the network, which applications are running between critical servers and clients, and what their load is throughout the day, week, and month. Application usage and analysis allows the network manager to discover important performance information on a real-time or historical basis.

  • Client-server performance analysis: Identifies which servers may be over utilized, which clients are hogging server resources, and what applications or protocols they are running. Such performance analyses help the network manager define and adhere to client-server performance objectives.

  • Internetwork perspective: Identifies traffic rates between subnets so the network manager can find out which nodes are using WAN-links to communicate. This information can be used to define typical rates between interconnect devices. This perspective can show how certain applications use the critical interconnect paths and define normal WAN use for applications.

  • Data correlation: Allows peak network usage intervals to be selected throughout the day to determine which nodes are contributing to the network load at that peak point in time. Traffic source and associated destinations can be determined with seven-layer protocol identification.

Applications Management

There are client-side agents that continuously monitor the performance and availability of applications from the end user’s perspective. A just-in-time applications performance management capability captures detailed diagnostic information at the precise moment when a problem or performance degradation occurs, pinpointing the source of the problem so it can be resolved immediately.

Such agents are installed on clients as well as application servers. They monitor every transaction that crosses the user desktop, traversing networks, application servers, and database servers. They monitor all distributed applications and environmental conditions in real-time, comparing actual availability and performance with service-level thresholds.

This analysis enables network and application managers to understand the source of application response time problems by breaking down response times into network, application, and server components. As a result, troubleshooting that sometimes takes weeks can be accomplished in a matter of minutes.

Fault Management

When faults on the network occur, it is imperative that problems be resolved quickly to decrease the negative impact on user productivity. Network managers must be able to respond quickly and have procedures in place to reestablish lost service and maintain beneficial service levels. The following capabilities of intelligent agents can be used to gather and sort the data needed to quickly identify the cause of faults and errors on the network:

  • Packet interrogation: Isolates the actual conversation that is causing the network problem, allowing the network manager to get to the heart of the problem quickly.

  • Data correlation: Since managers cannot always be on constant watch for network faults, it is imperative to have historical data available that provides views of key network metrics at the time of the fault. What was the overall error/packet rate and the types of errors that occurred? What applications were running at the time of the fault? Which servers were most active? Which clients were accessing these active servers, and which applications were they running? Data correlation can help answer these questions.

  • Identification of top error generators: Identifies the network nodes that are generating the faults and contributing to problems such as bottlenecks caused by errors and network down time.

  • Immediate fault notification: With immediate notification of network faults, managers can instantly learn when a problem is occurring before users do. Proactive alarms help detect and solve the problem as it is happening.

  • Automated resolution procedures: Intelligent agents can be configured to automatically fix the problem when it occurs. The agent can even be programmed to automatically e-mail or notify help desk personnel with instructions on how to solve the problem, thus saving time and money.

Capacity Planning and Reporting

Capacity planning and reporting services play a significant role in delivering sustainable network service levels to end users. They also provide documented proof to management and other organizations that pay for services to help ensure that network service levels are consistently achieved. Capacity planning and reporting allows for the collection and evaluation of information to make informed decisions about future network configurations, accommodating growth in client-server computing environments. The following capabilities of intelligent agents can be used to assist in managing network growth:

  • Baselining: Allows the network manager to determine the true operating performance of the network by comparing performance at various times, perhaps on a monthly basis, which can identify business cycle deviations.

  • Load balancing: Allows the network manager to compare inter-network service objectives from multiple sites at once to determine which subnets are overor underutilized. It also helps the network manager discover which subnets can sustain increased growth and which require immediate attention.

  • Protocol/application distribution: Helps the network manager understand which applications have outgrown which domains or subnets. For example, these capabilities can find out if certain applications are continuously taking up more precious bandwidth and resources throughout the enterprise. With this kind of information, the network manager can better plan for the future.

  • Host load balancing: Allows the network manager to obtain a list of the top network-wide servers and clients using mission-critical applications. For example, the information collected from intelligent agents might reveal if specific servers always dominate precious LAN or WAN bandwidth, or spot when a central processing unit (CPU) is becoming overloaded. In either case, an agent on the LAN segment, WAN device, or host can initiate load balancing automatically when predefined performance thresholds are met. The information gathered by the agent can be used for resource planning.

  • Traffic profile optimization: To best guarantee service-level performance, the ability of network managers to compare actual network configurations against proposed configurations is crucial. From the information gathered and reported by intelligent agents, traffic profiles can be developed that allow what-if scenarios to be put together and tested before incurring the cost of physically redesigning the network. This takes the guesswork out of determining the best placement of client/server nodes and applications, for example.

Web Traffic Management

To build Web sites for electronic commerce and other mission-critical applications, administrators are mirroring site content at additional points of presence (PoPs). This provides redundancy in case one site goes down, and enables traffic to be routed between the sites to increase overall response time. Flow management software determines which Web server to send a request so the fastest service can be provided to the clients.

Resonate Inc.’s Global Dispatch, for example, integrates multiple PoPs into a single Web site resource. The company’s flow management software uses three factors to determine where to send a request: PoP availability, PoP load, and the Internet latency between the client and each PoP.

As requests are received, the Global Dispatch scheduler instructs the agents installed at each Web server to measure the latency between the PoP and the client’s local domain name system (DNS). Results are sent back to the Global Dispatch scheduler and combined with current load and availability information to return to the client the IP address (or virtual IP address) of the PoP best suited to respond. Global Dispatch stores this information in cache to enable faster response to future requests.

A single PoP can also have multiple agents, each performing a share of the triangulation work, which minimizes scheduling overhead. The use of multiple agents is especially useful in large Web site environments, since each server eventually must be taken offline for repairs or upgrades. Flow control scheduler/agent software allows a machine to be removed from the server mix and have the traffic routed to other Web servers so users can continue to access various services.

Security Management

A properly functioning and secure corporate network plays a key role in maintaining an organization’s competitive advantage. Setting up security objectives related to network access must be considered before mission-critical applications are put in potentially compromising networked environments. Intelligent agents can help discover holes in network security by continuously monitoring network access with the following capabilities:

  • Monitor effects of firewall configurations: By monitoring post firewall traffic, the network manager can determine if the firewall is functioning properly. For example, if the firewall was just programmed to disallow access of a specific protocol or external site, but the program’s syntax was wrong, the intelligent agent will report it immediately.

  • Show access to and from secure subnets: By monitoring access from internal and external sites to secure data centers or subnets, the network manager can set up security service-level objectives and firewall configurations based on the findings. For example, the information reported by the intelligent agent can be used to determine whether external sites should have access to the company’s database servers.

  • Trigger packet capture of network security signatures: Intelligent agents can be set up to issue alarms and automatically capture packets upon the occurrence of external intrusions or unauthorized application access. This information can be used to track down the source of security breaches. Some intelligent agents even have the capability to initiate a trace procedure to discover a breach’s point of origination.

  • Show access to secure servers and nodes with data correlation: This capability reveals which external or internal nodes are accessing potentially secure servers or nodes and identifies which applications they are running.

  • Show applications running on secure nets with application monitoring: This capability evaluates applications and protocol use on secure networks or traffic components to and from secure nodes.

  • Watch protocol and application use throughout the enterprise: This capability allows the network manager to select applications or protocols for monitoring by the intelligent agent so that the flow of information throughout the enterprise can be viewed. For example, this information can identify who is browsing the Web, accessing database client-server applications, or using the e-mail system.

Some agents are capable of taking action based on the nature of the security threat. Symantec, for example, offers its Intruder Alert, which uses a real-time, manager-agent architecture to monitor the audit trails of distributed systems for “footprints” that indicate suspicious or unauthorized activity on all major operating systems, Web servers, firewalls, routers, applications, databases, and SNMP traps from other network devices. Instead of reporting suspicious activity hours or even days after it occurs, Intruder Alert instantly takes action to alert IT managers, shut systems down, terminate offending sessions, and other steps to stop intrusions before they damage critical systems.

Typically, an organization would use either a network-based intrusion detection system to monitor only a handful of key facilities that transport sensitive information, or use a host-based solution that places monitoring agents on the systems that host critical applications and store vital data. By adding a host-based manager-agent component called NetProwler to Intruder Alert, Symantec is able to offer a combined approach to intrusion detection. From within Intruder Alert’s management interface, administrators can view multiple NetProwler events and hundreds of Intruder Alert agents, enabling them to react to either network- or host-based violations from a single console.


2.3 Automating Software Distribution

With a growing population of PC and workstation users deployed across widely dispersed geographical locations—each potentially using different combinations of operating systems, applications, databases, and network protocols—software has become more complex and difficult to install and maintain. The ability to perform these tasks over a network from a central administration point can leverage investments in software, enforce vendor license agreements, qualify the organization for discounts on network licenses, and greatly reduce network support costs.

The complexity of managing the distribution and implementation of software at the desktop requires that IT managers make use of automated file distribution tools. By assisting a network administrator with tasks like packaging applications, checking for dependencies, and offering links to event and fault management platforms, these tools reduce installation time, lower costs, and speed problem resolution.

One of these tools is a programmable file distribution agent. It is used to automate the process of distributing files to particular groups or workstations. A file distribution job can be defined as software installations and upgrades, start-up file updates, or file deletions. Using a file distribution agent, these types of changes can be applied to each workstation or group automatically.

The agent can be set up to collect file distribution status information. The network administrator can view this information at the console to determine if files were distributed successfully. The console allows the administrator to review status data, such as which workstations are set up for file distributions, the stations to which files have been distributed, and the number of stations waiting for distributions.

Because users can be authorized to log on to the network at one or more workstations, the file distribution agent determines where to distribute files based on the primary user (owner) of the workstation. The owner is established the first time that a hardware or software inventory is taken of the workstation. Before automated file distributions are run, the hardware inventory agent is usually run to check for resource availability, including memory and hard disk space. Distributions are made only if the required resources are available to run the software.

Via scripts, the network administrator can define distribution criteria, including the group or station to receive files and the day or days on which the files are to be distributed. Scripts usually identify the files for distribution and the hardware requirements needed to run the file distribution job successfully. Many vendors provide templates to ease script creation. The templates are displayed as a preset list of common file tasks. Using the templates, the network administrator can outline a file distribution script, and then use the outline to actually generate the script.

To help network administrators prepare for a major software distribution, some products offer routines called “wizards” that walk administrators through the steps required to assemble a “package.” A package is a complete set of scripts, files, and recipients necessary to successfully complete a distribution and install the software. To reduce network traffic associated with software distributions, some products automatically compress packages before they are sent to another server or workstation. At the destination, the package is automatically decompressed when accessed. When a file distribution job is about to run, target users receive a message indicating that files are about to be sent and requesting that they choose to either continue or cancel the job, or postpone it for a more convenient time.

Periodically, a scan is performed on all disk drives to maintain an accurate inventory of software, enforce vendor license agreements, and check for unauthorized copies of software. By tracking software usage, a company can reduce its software acquisition costs, since accurate usage information can be used to determine which applications are run most before deciding on upgrades and how many copies to buy. The network administrator can choose to be notified of the times when users are denied access to particular applications because all available copies are in use. This may identify the need to purchase additional copies of the software or pay an additional license charge to the vendor so more users can access the application simultaneously.


2.4 Monitoring File Use

A file agent is a tool that is used to collect data about file access, such as which files are being accessed and by whom. Tracking file access is important during situations such as the following:

  • Recording file access to a sensitive file or group of files;

  • Diagnosing file access problems;

  • Reviewing access times for application bottlenecks.

Staying aware of file access data also helps the LAN administrator maintain network security. The file agent monitors access to specified files and provides the following information:

  • Who accessed the files;

  • The complete path for the file;

  • When the files were accessed and for how long;

  • What operations were performed;

  • The ID of the person accessing the files.

The LAN administrator sets up the file agent to automatically collect this kind of information, after which it can be viewed and analyzed at the console.


2.5 Virus Scanning

Viruses on computers can result in the destruction of important data and cause days of lost productivity. According to industry reports, most companies have experienced damage caused by computer viruses. Virus protection can be purchased as a separate utility or it can come bundled with other LAN administration tools. Some products provide high levels of flexibility, allowing LAN administrators to tune how it detects viruses and what drives, directories, and files to scan. Scheduling capabilities enable the LAN administrator to set up scans to run automatically when the console is not being used. This prevents critical system resources from being tied up while a scan is in progress. An activity log keeps track of the results of all scans performed.

Some antivirus products are server based, which means that virus protection can be extended to every workstation. Depending on the product, virus definitions can be automatically synchronized throughout the enterprise so that all servers have the most up-to-date virus information. If a new virus is detected in one server, the virus profile is relayed to the other servers, safeguarding the entire LAN.

This information can also be passed to remote servers via Transmission Control Protocol/Internet Protocol (TCP/IP) connections, extending virus protection enterprise-wide.


2.6 Printer Management

Establishing and maintaining printer support for network users can be a time-consuming part of LAN administration. Likewise, selecting from a long list of network printers and resetting print specifications can make requesting an output destination cumbersome to users, especially those who frequently visit other office locations. Maintaining central printer support can also significantly reduce the amount of time required for users to enter printer settings and select an output destination.

There are two tasks associated with providing network printer support. One is the print manager data viewer, which is used by the LAN administrator to establish and maintain printer support. The other is print manager queue management, which automates the process of printer setup and selection for all network users.

Before users can select a print destination, the LAN administrator must enter information about each network printer into the printer catalog. The printer catalog identifies all of the printers attached to the network, including specific information about each printer, such as server name, queue name, and print driver. Printer information is then saved in a console database. Maintaining a printer catalog at the console also allows the LAN administrator to restrict printer use based on such criteria as login ID and workstation ID. In addition, the printer catalog is the maintenance tool for updating printer settings whenever they change. Once the catalog is established, the LAN administrator has a single source for printer information. When printer support is established through a printer catalog, an icon can be assigned to each printer—a process that facilitates printer selection among users.

Through the print manager catalog, the LAN administrator can exercise full control over printer use. Printers can be made available to all users or assigned to specific users based on such criteria as hardware, station, users, or groups. Users select printers from a pull-down list or a set of icons that includes only those which the LAN administrator has authorized them to access. Since printer access is tied to a user’s group and user rights, users only see the printers they are authorized to use.

This kind of flexibility is helpful when a printer is used for only certain print jobs. For example, a printer might be used solely for printing accounting forms, and the paper tray is stocked with forms numbered sequentially. Submitting a print request for a document other than this form would disrupt the numbering system.

The LAN administrator can also manage printers to facilitate document distribution. For each report, a recipient profile can be created, which describes how it will be handled. A report can go to the sales department’s printer, for example, or be delivered to specific users via electronic mail. E-mail is useful when the report requires further manipulation or integration into another file. Since various recipients may need only a few pages of a large report, the specific pages or portions of pages can be selected for print or electronic delivery via page selection profiles. The printer management tools track report delivery and maintain an audit trail of all reports.


2.7 Storage Management

The need for storage management tools stems from the explosive growth of corporate computer networks in recent years, which not only generate more information than ever before but encourage its use over longer periods of time, requiring ever-larger storage capacity. Databases among large companies have surpassed the terabyte range and are now well into the petabyte range. This growth means that IT managers must be extra vigilant on protecting databases and ensuring their availability. Companies that have kept their storage practices up to pace with the growth of their networks have integrated storage management procedures into network management schemes and are giving due consideration to new distribution and protection methods, including hierarchical storage management, storage area networks, and outsourcing arrangements offered by storage service providers.

2.7.1 Monitoring Disk Use

To remain productive, network users must have an adequate amount of disk space for storing programs and data. To help the LAN administrator meet user demands, a disk monitor agent is used to report volume capacity and manage disk space use. Having current disk use information helps the LAN administrator make decisions about reallocating resources or purchasing additional drives or servers.

The disk monitor agent scans the server volumes to collect disk use information. The collected information includes a list of volumes that were scanned, total volume capacity, and space used. In addition, the time and date disk data was collected is recorded for comparing disk use over a period of time. Some vendors’ disk monitoring tools also record disk usage data based on directory and file owner.

Depending on the product selected, one or more of the following categories of information can be collected by a disk monitor agent and displayed at the console:

  • Volumes: Date and time data was collected; server name; volumes scanned, capacity; and total space used and available.

  • Directories: Date and time data was collected; server volume and directory names; creation date and time; file count; directory size (in bytes); owner name; and groups to which the owner is a member.

  • Directory and file owners: Date and time data was collected; server and volume names; owner name; groups to which the owner is a member; total number of files; and total space used (in bytes).

A disk monitor agent provides automatic notification if disk usage reaches a specified level. Notification can be sent to the person responsible for responding to the situation through a console, network, pager, or e-mail message. The console provides view formats and types that allow the LAN administrator to analyze current disk use as well as disk use patterns over a period of time.

Usually, the disk monitor agent can process data in the background while other programs are running. It also can be made to run interactively, with progress displayed in a status window of the console as volumes are being scanned. The scheduler agent, previously discussed, can be tasked to run the disk monitor automatically in batch mode to collect data at night. This feature is particularly helpful because collecting data from some volumes can take a significant amount of time. Using a scheduler agent, the LAN administrator can regularly collect data each night, once a week, or once a month, depending on organizational requirements. This process ensures that information is collected consistently.

2.7.2 Hierarchical Storage Management

The LAN environment, especially those based on UNIX, are not very friendly when it comes to managing data on disks and tapes. In the UNIX environment, when disk space is exhausted or a job needs an archived file, work stops. Local backups are often so time-consuming that operators often do not bother with them, while remote backups tend to clog the network. Furthermore, tapes are not protected against overwrites, which can result in the loss of important data.

A variety of tools are now available to properly manage storage in the UNIX environment, ensuring that files are backed up at the right time and that tapes are properly labeled and write-protected to prevent data loss. On-line, backup, and archive versions of UNIX files can now be tracked, regardless of the medium on which they reside.

Some tools track file residency, providing for the seamless movement of files from backup to archive and back to the system when needed. Through the common file catalog, the archive facility can locate and initiate a restore of an archived file without the involvement of the LAN administrator. Any user request, process, or program attempting to access an archived file is suspended until the file is restored and then allowed to continue without failure.

With the right storage management tools, users are assured of having enough disk space to accommodate new files. When a file system reaches a predefined threshold of X percent full, automated procedures are initiated that determine which files are eligible for archive and are currently backed up. The file catalog is then simply updated to indicate that the files have been archived and deletes them from the disk file system, freeing up needed disk space.

Files backed up or archived to tape can be assigned an expiration date. Each tape has an internal label that is validated each time it is mounted. File location information, stored in a common file catalog, is compared with the tape label to determine whether the tape may be overwritten. If so, it is considered expired and may be removed from the tape backup or archive pool for reuse. Tapes removed in error cannot be overwritten, and new retention criteria are established for expired tapes when they are reused.

In the movement of files for backup and archival storage, today’s management tools overcome many of the limitations of the UNIX tar program. For example, they offer file compression of 30% to 70% and an encryption scheme to prevent loss of data resulting from tampering. And whereas tar is limited to writing data in 5K blocks, today’s tools optimize performance based on media type and available memory.

2.7.3 Storage Area Networks

With the rapidly increasing volume of mission-critical information being accumulated in today’s business environment, companies are demanding better performance, availability, manageability, and security of their data storage assets. To meet these needs, many companies are implementing SANs. Essentially, a SAN is a specialized network that enables fast, reliable access among servers and external or independent storage resources, regardless of physical location. These resources may be linked via Fibre Channel, Gigabit Ethernet, and emerging Infiniband technologies.

By decoupling storage from computers, workstations, and servers and taking storage traffic off the operations network, organizations gain a high-performance storage network and improve the performance of the LAN. These features reduce network downtime and productivity losses while extending current storage resources. In effect, the SAN does in a network environment what traditionally has been done in a back-end input/ output (I/O) environment between a server and its own storage subsystem. The result is high speed, high availability, and high reliability.

The move to SANs provides organizations with a new level of scalability, and new tools have become available for centralized administration, allowing a much greater degree of flexibility than the traditional network-attached storage paradigm. Because SANs entail an entirely different way of implementing and managing storage, however, it is a good idea to begin with a simple installation, where the need is immediate, and expand its use throughout the rest of the organization as needs justify.

SANs need not be local or regional. Over the wide area, IP can be used in situations where cost containment is a vital concern. For maximum scalability, however, fiber-based ATM networks can be used to extend the range of SANs to any corporate location across the WAN without jeopardizing the integrity of remote data replication or database image transfer operations. If an organization runs multiple types of traffic over the WAN, then ATM is the clear choice. For example, if the organization has separate data networks for IP, SNA, and frame relay—and then wants to add a SAN—all of this traffic can be combined over ATM. With ATM’s quality-of-service and priority-queuing features, there would be no service degradation among the different traffic types.

2.7.4 Outsourcing Storage Management

For most organizations, data storage and management are not core competencies. Emerging Internet-related businesses are especially challenged, given their skyrocketing data storage requirements, combined with limited capital and human resources. Not only is the procurement of hardware, bandwidth, and management tools costly, but even when experienced IT professionals with storage and networking expertise are found, these things are increasingly expensive and difficult to retain. For these and other reasons, there is a growing movement to outsource storage and associated management requirements to a new class of supplier called the storage service provider (SSP).

An SSP sells storage capacity as a pay-per-use utility. The SSP offers companies the means to store and access data without the expense of buying and maintaining hardware and software. The SSP also performs crucial functions such as easy expansion, data backup and restoration, security, disaster recovery, and capacity planning. The monthly cost of going with an SSP is ostensibly more attractive than establishing an in-house storage infrastructure, which can entail hundreds of thousands of dollars to establish a multisite installation, plus the ongoing cost of staff to manage the operation on a 24/7 basis.

SSPs leverage SAN architectures to establish enterprise-wide networked storage. This widely accepted approach allows data to be delivered across the enterprise from a remote location that is managed by an SSP. Users can then implement new technologies as needed, as opposed to limited upgrades because of distributed architectural and management complexity.

SSPs also leverage connectivity capabilities resulting from Fibre Channel and new Infiniband protocols. These architectures currently allow gigabit-per-second transmission rates across metro-area distances, allowing “local” storage performance levels from remotely administered facilities. With SSPs operating their own WANs, storage facilities are linked up to enable seamless access to enterprise data from any corporate location.

SSPs address a variety of basic enterprise storage needs, starting with advising customers on enterprise storage strategies. Most SSPs have a consulting capability or professional services unit that performs needs assessment and recommendations for on-campus storage needs, as well as remote facility implementations. In addition to providing storage space, SSPs also provide customers with backup, disaster recovery, vaulting, migration, and hierarchical storage management offerings. For organizations with very high up-time requirements or multisite demand for data, SSPs provide a cost-effective alternative for heterogeneous data sharing, data replication, multisite data consolidation, and synchronization.

The use of SSPs can also offer cost savings in storage itself. It is estimated that the average cost to manage primary disk storage in-house is $140 per gigabyte per month. In contrast, SSPs offer SAN-based disk storage for rates starting at $40 per gigabyte per month. Also, SSPs allow users to procure storage without large upfront capital costs.

SSPs allow companies to scale their storage needs on demand, to virtually limitless-levels. This offers a solution for companies that find it difficult to obtain storage and hire new personnel as quickly as their storage needs expand. Industry surveys of IT professionals indicate that as much as 85% of companies are currently experiencing a problem with finding qualified storage staff. Outsourcing storage requirements to an SSP solves this problem.

Many SSPs have developed monitoring software to provide customers with several-key capabilities, including the ability to monitor their storage environment around the clock without a large dedicated staff to keep an eye on various performance metrics. SSPs provide comprehensive reporting and analysis of the entire storage environment. Of course, the availability of such tools means that companies do not have to buy their own monitoring tools and hardware platforms, network them together, and hire experienced staff to use them and keep the whole infrastructure running smoothly.


2.8 Reporting Bindery Data

Servers on many LANs have a bindery or registry, which is used for security and accounting. It contains the names and passwords of users and groups of users authorized to log in to a particular server or set of servers. It also holds information about other services provided by the server to the client, such as printers, modems, and gateways. On a NetWare LAN, for example, a bindery agent allows the administrator to monitor information stored in the NetWare bindery. The information reported includes the following:

  • Server identifiers (names) and type;

  • User login IDs and full names;

  • User access rights such as read, write, open, create, delete;

  • Maximum connections allowed per server;

  • Maximum volumes per server.

By tracking this information, the LAN administrator can determine such things as the times of peak use for each server and the login locations of users. The following types of bindery information can be displayed at the NetWare administrator’s console:

  • Servers: Identifies each server, server revision and version number, number of connections supported, maximum number of volumes, and system fault tolerance (SFT) and transaction tracking service (TTS) levels.

  • Users: Displays user information, such as login status and maximum number of connections and disk space allowed.

  • Groups: Lists groups and users on each server.

  • Group supervisors: Lists supervisors for groups on each server.

  • Trustees: Lists server users, the directory to which the user or group has rights, and the rights assigned to each user.

  • Login locations: Lists users restricted to logging in at particular stations and the stations allowed.

When the LAN administrator chooses a view, the bindery agent begins scanning the type of bindery information specified. A progress message shows the type of data that is currently being scanned. When the agent has scanned all the attached servers, the information is displayed on the console. Data is only displayed for servers to which the LAN administrator’s console is attached. If more than one person is administering the network, administrator rights can be assigned for their areas of responsibility at the time of system configuration. The information they view is determined by their administrator rights on each server. For example, an administrator on Server 2 can view the users and their file access rights on that server. But, if the administrator browses user information on Server 1, user IDs are displayed, but not file access rights.


2.9 Process Scheduling

A scheduler agent is an application used to organize and run jobs. A typical job can be running a command for network backup or sending a broadcast message to users before the backup begins. Instead of having to keep a written log of jobs and remembering to run them, the LAN administrator can use a scheduler agent to specify that they run automatically at a certain time. For example, the LAN administrator could schedule the system backup process for 2:00 a.m.—a time when the system most likely is not being heavily used. At the specified time, the scheduler agent automatically starts the job unattended. The job definitions can be saved, updated, or deleted whenever necessary.

The scheduler agent can also provide job completion information, such as whether or not the job ran successfully, when it ran, and the next time it is scheduled to run. The following are some examples of routine jobs a scheduler agent can automate:

  • Perform network backup;

  • Run a computer virus scan;

  • Process overnight mailings;

  • Perform file copying and distribution;

  • Print and process reports;

  • Send network messages.

A scheduler agent can implement jobs that run once or at the following intervals:

  • Hourly;

  • Daily;

  • Weekdays (Monday through Friday);

  • Weekly (once a week);

  • Monthly (once a month).

Jobs can be grouped to accomplish multiple tasks, instead of having to run them individually. An entry can be posted in the event log after jobs complete, telling the LAN administrator when the job started and ended. For example, with regard to scheduling the network virus scan process, the scheduler agent can automatically add a record to the log of network events available through the event agent.


2.10 Console Text Viewer

Another tool available to the LAN administrator is the text viewer, which is used to display and review text files at the console. While working at the console, the LAN administrator might want to review textual information, such as network event or error logs, or Windows configuration files. Rather than exit the console, the LAN administrator can use the text viewer to display the information. If a log is selected for viewing, the console automatically displays the most current log each time it is selected. Using the text viewer, the LAN administrator can perform the following functions:

  • Set automatic display of data: Using the console’s startup file feature, the LAN administrator can set files, such as error logs, to be displayed automatically with the most current data each time the console is run.

  • Display and work with ASCII text files: The LAN administrator can open files created using the DOS redirect command, whereupon a DOS screen display is sent to a file. With this feature, the LAN administrator can, for example, save a directory listing to a file for sorting or adding to other information.

  • Change the font style and size: This allows the LAN administrator to reformat displayed data.

  • Search: The LAN administrator can search for particular text to quickly locate needed information.

  • Print: This allows the LAN administrator to print out the displayed text.


2.11 Tracking Network Activity

The ability to monitor network activity allows the LAN administrator to ensure the effectiveness and efficiency of network services. An event manager agent is used to track network activity (events), log network activity, and automatically alert the person responsible for responding to certain network occurrences. The following network occurrences are considered events:

  • Running jobs, such as network backup or a virus scan;

  • Recording the status of completed jobs;

  • Recording changes to the hardware inventory;

  • Logging in and out of the network;

  • Accessing applications;

  • Starting programs—successfully or unsuccessfully.

The LAN administrator can specify the network activity to be tracked, such as the times when users log in and out of the network or when programs are run. Network activities that may require immediate attention also can be specified. A notification feature can be set to alert the LAN administrator of the times when these events occur. The following methods of event notification typically are available:

  • Console messages: Text messages display the name of the event and color-coded views indicate the priority level of the event. Some products use event icons to display events.

  • E-mail messages: The event level and name is sent in an e-mail message.

  • Pager messages: A phone number, the event name, or both, is sent to a pager.

Different notification methods can be set as appropriate for each network event. Event notifications can be processed based on priority level. For example, if three network events occur simultaneously, notification of the event with the highest priority is sent first. A priority level may be a number from 1 to 9—with 1 indicating the lowest and 9 indicating the highest priority. When the LAN administrator specifies the network activity to monitor, a priority level for each event is assigned based on how critical the activity is and whether or not someone has to be notified when the event occurs.

The LAN administrator can choose one or more contacts to receive notification of each event level. For example, a technician can be specified to receive a pager message when high-priority events occur, and that an e-mail message be sent to a help desk operator when routine application-related events occur. An acknowledgment of receipt for event data can be sent to the console to help ensure a proper response to events.

Some network monitoring tools use intelligent agents to gather protocol and activity data on LANs. The data gathered by the agents is stored in a relational database, where it is correlated for traffic analysis, billing, and report generation. With the ability to identify traffic loads, including which nodes are generating the most traffic, the resulting information can be used to charge departments for their share of the resources, including dial-out connections.

Even if such information is not used for charge-back, the network monitoring tool can still be used to reduce costs and help administrators determine policies for more efficient network use. In addition, monitoring the network for predefined traffic thresholds on a particular LAN segment or ring gives administrators the means to identify traffic patterns that could cause the network to crash. Traffic reports can even identify the need to change the network. If too many users on one or more network segments are logging in to different servers or using resources in another building, for example, a lot of backbone traffic can be created. With the aid of traffic reports, the network can be redesigned to alleviate backbone traffic and make sure bottlenecks do not occur.

Managing various tasks and ensuring they are completed can be a time-consuming part of LAN administration. However, using a task manager agent allows the LAN administrator to create and maintain a centralized list of tasks at the console, thereby streamlining their management. A task manager agent can track the following task information on-line:

  • Description;

  • Person requesting service;

  • Station ID;

  • Status;

  • Origination, due, start, and completion dates;

  • Person assigned the task.

The task manager agent also can be used for keeping track of what information is contained in various data sets. A data set is several related files that hold information collected by one or more agents. The kind of information stored in a data set could include the status of application metering, software inventory, hardware inventory, and the status of network activities (events). When setting up the agents, the LAN administrator specifies a data set in which to store this kind of information. After defining task and data set information using the task manager, the LAN administrator can view the information in a browse or report format at the console.

The task manager allows the LAN administrator to add, edit, and delete task information in one or more data sets. After creating a task list, the LAN administrator can choose to display the items in the list by priority, due date, status, or alphabetically by description at the console.


2.12 Integrated Help Desk

Some LAN administration packages include a help desk, but many do not. Some products support help desk functions through add-in modules that must be purchased separately. With the integrated approach, users can generate their own trouble tickets and send them directly to the help desk via e-mail. Trouble tickets can also be generated automatically when certain events occur. For example, if a general protection fault occurs under Windows, the station can lock up, forcing the user to reboot. When the general protection fault occurs, a trouble ticket is automatically generated and sent to the help desk along with such relevant information as the win.ini autoexec.bat configuration files.

At the console, the LAN administrator has access to all trouble tickets, call histories, and support procedure documents. With all staff and equipment profiles also available on-line, the LAN administrator can assign specific personnel to specific problems and route the trouble tickets to appropriate support technicians accompanied by the latest hardware and software configuration information.

The ready availability and distribution of all this information can greatly reduce system downtime. With consolidated data on every help desk activity, the LAN administrator can analyze departmental and staff performance, while identifying recurring problem areas. An analysis of support time reports can justify the need for user training. The tight integration of help desk functions to the LAN administrator’s console can also effectively reduce the cost of network support, which can account for 50% of the total cost of LAN ownership over 5 years, according to some industry analysts.


2.13 Conclusion

Whether bundled with other products or purchased separately, the right tools help the LAN administrator monitor, analyze, and adapt the LAN to the changing needs of users, workgroups, departments, and the organization by providing the means to centrally view and administer the network and automate many routine tasks. Such tools enable LAN administrators to be responsive to the fairly routine needs of users without becoming unduly burdened in the process and diverting attention from the main focus of keeping the network operating smoothly for the benefit of all.


Chapter 3: LAN Restoration Planning

3.1 Introduction

Over the years, corporate computing has moved from the centralized mainframe model toward a distributed model that facilitates information sharing, enhances decision-making at all levels in the organization, and improves response time to market conditions. The growing reliance specifically on LANs has its advantages. Primarily, it empowers individuals to be productive and responsive, which shows up in corporate profitability and competitiveness. At the same time, the distributed computing environment brings with it a new set of challenges.

With data and applications residing in many more places and linked together via LANs, it becomes harder to protect vital information from loss, damage, or theft. It is also more difficult to monitor network performance, isolate problems, and implement corrective measures. Failing to give adequate attention to LAN restoral planning can result in poor performance, data loss, more frequent outages, and prolonged network downtime. Fortunately, a number of solutions are available to address these problems.


3.2 Network Reliability

A network or resource is reliable when it continues to operate despite the failure of a critical element. The critical elements are different for each network topology: star, ring, and bus. Thus, each topology can be evaluated in terms of its reliability, as well as its suitability for specific applications.

3.2.1 Star Topology

When it comes to link availability, the star topology is highly reliable. In the star topology, all network devices (i.e., nodes) or LAN segments connect to a central hub. Although the loss of a link prevents communication between the hub and the affected node, all other nodes will continue to operate as before unless the hub itself suffers a catastrophic failure.

To ensure a high degree of reliability, the hub has redundant subsystems at critical-points: the control logic, backplane, and power supply. The hub’s management system can enhance the fault tolerance of these redundant subsystems by continuously monitoring their operation and reporting any anomalies. With the power supply, for example, monitoring may include hotspot detection and fan operation to detect trouble before it disrupts hub operation. Upon the failure of the main power supply, the redundant unit switches over automatically or manually under the network manager’s control without disrupting the network.

The flexibility of the hub architecture lends itself to varying degrees of fault tolerance, depending on the criticality of the applications. For example, workstations running non-critical applications may share a link to the same LAN module at the hub. Although this configuration might seem economical, it is disadvantageous in that a failure in the LAN module will put all of the workstations on that link out of commission. A slightly higher degree of fault tolerance may be achieved by distributing the workstations among two LAN modules and links. That way, the failure of one module would affect only half the number of workstations. A one-to-one correspondence of workstations to modules offers an even greater level of fault tolerance, because the failure of one module impacts only the workstation connected to it. However, this configuration is also a more expensive solution than the others.

A critical application may demand the highest level of fault tolerance. This can be achieved by connecting the workstation to two LAN modules at the hub with separate links. The ultimate in fault tolerance would be achieved by connecting one of those links to a different hub. In this arrangement, a transceiver is used to split the links from the application’s host computer, enabling each link to connect with a different module in the hub or to a different hub. All of these levels of fault tolerance are summarized in Figure 3.1.

Click To expand
Figure 3.1: A fault tolerant hub-based network.

3.2.2 Ring Topology

In its pure form, the ring topology offers poor reliability to both node and link failures. The ring uses link segments to connect adjacent nodes together. Each node is actively involved in the transmissions of other nodes through token passing. The token is received by each node, at which time it can transmit data before passing the token to the adjacent node. The loss of a link not only results in the loss of a node but brings down the entire network as well. Enhancing the reliability of the ring topology requires adding redundant links between nodes as well as bypass circuitry. Adding such components, however, makes implementing the ring topology more expensive.

3.2.3 Bus Topology

The bus topology also provides poor reliability. If the link fails, that entire segment of the network is rendered useless. A redundant link for each segment will increase the reliability of the bus topology, but at extra cost. Unlike the ring topology, where each node is dependent on the others adjacent to it, the nodes in a bus topology are independent and contend for access to the LAN. If a node fails, the rest of the network continues to operate.


3.3 Network Availability

Availability is a measure of performance dealing with the LAN’s ability to support all users who wish to access it. A network that is highly available provides services immediately to users, whereas a network that suffers from low availability typically forces users to wait for access. The topology of the LAN influences availability.

Availability on the bus topology is dependent on load, the access control protocol-used, and length of the bus. With a light load, availability is virtually assured for any user who wishes to access the network. As the load increases, however, so does the chance of collisions. When a collision occurs, the transmitting nodes back off and try again after a short interval. The chance of collisions also increases with bus length.

A network based on a star topology can only support what the central hub can handle. In any case, each LAN module in the hub can handle only one request at a time, which can impact other users on that segment during heavy load conditions. Hubs equipped with multiple processors and LAN modules can alleviate this situation somewhat, but even with multiple processors, there will not usually be a one-to-one correspondence between users and processors. Such a system would be cost-prohibitive.

In terms of network availability, the ring topology scores higher than either the bus or star topology. This is because each node on the ring has an equal chance at accessing the network, which is governed by the token. However, since each node on the ring must wait for the token before transmitting data, the time interval allotted for transmission decreases as the number of nodes on the ring increases.


3.4 Recovery Options

The LAN is a data-intensive environment requiring special precautions to safeguard one of the organization’s most valuable assets—information. The procedural aspect of minimizing data loss entails the implementation of manual or automated methods for backing up all data on the LAN to avoid the tedious and costly process of recreating vast amounts of information. The equipment aspect of minimizing data loss entails the use of redundant circuitry, as well as components and subsystems that are activated automatically upon the failure of various LAN devices to prevent data loss and maintain network availability.

In addition to the ability to respond to errors in transmissions by detection and correction, other important aspects of LAN operation are recovery and reconfiguration. Recovery deals with bringing the LAN back to a stable condition after an error, and reconfiguration is the mechanism by which the network is restored to its previous condition after a failure.

LAN reconfigurations involve mechanisms to restore service upon loss of a link or network interface unit. To recover or reconfigure the network after failures or faults requires that the network possess mechanisms to detect that an error or fault has occurred and to determine how to minimize the effect on the system’s performance. Generally, these mechanisms provide the following:

  • Performance monitoring;

  • Fault location;

  • Network management;

  • System availability management;

  • Configuration management.

These mechanisms work in concert to detect and isolate faults, determine their effects on the system, and remedy these conditions to bring the network to a stable state with minimal impact on network availability.

Reconfiguration is a fault management scheme used to bypass major failures of network components. This process entails detecting that a fault condition has occurred that cannot be corrected by merely restarting the equipment. Once it is determined that a fault has occurred, its impact on the network is assessed so that an appropriate reconfiguration can be formulated and implemented. In this way, normal operations can continue under a new configuration until the problem can be fixed and the network restored to its primary configuration.

Fault detection is augmented by logging systems that keep track of failures over a period of time. This information is examined to determine trends that adversely affect network performance. This information, for example, might reveal that a particular component is continually causing problems on the network, or the monitoring system might detect that a component on the network has a higher-than-normal failure rate.

The configuration assessment component of the reconfiguration system uses information about the current system configuration—including connectivity, component placement, paths, and traffic flows—and maps it against the failed component. This information is analyzed to indicate how that particular failure is affecting the system and to isolate the cause of the failure. Once this assessment has been performed, a solution can be worked out and implemented.

The solution may consist of reconfiguring most of the operational processes to avoid the source of the fault. The solution determination component examines the configuration and the affected hardware or software components, determines how to move resources around to bring the network back to an operational state or indicates what must be eliminated because of the failure, and identifies network components that must be serviced.

Determining the most effective course of action is based on the criticality of keeping certain functions of the network operating and maintaining the resources available to do this. In some environments, nothing can be done to restore service because of device limitations (e.g., lack of redundant subsystems) or the lack of spare bandwidth. In such cases, about all that can be done is to indicate to the servicing agent what must be corrected and keep users informed of the situation.

Once an alternate configuration has been determined, the reconfiguration system-implements it. In most cases, this means rerouting transmissions, moving and restarting processes from failed devices, or reinitializing software that has failed because of some intermittent error condition. In some cases, nothing may need to be done except notify affected users that the failure is not severe enough to warrant system reconfiguration.

Geographically distributed LANs can be inter-networked over the WAN using such devices as bridges and routers connected to leased lines and/or switched services. An advantage of using routers for this purpose is that they permit the building of large mesh networks. With mesh networks, the routers can steer traffic around points of congestion or failure and balance the traffic load across the remaining links. In addition, routers have flow control and more comprehensive error protection than bridges.

Bridges are useful for reducing the size of sprawling LANs into discrete subnetworks that are easier to control and manage. Through the use of bridges, similar devices, protocols, and transmission media can be grouped together into communities of interest. Such partitioning can yield many advantages, such as eliminating congestion and improving the response time of the entire network. Subnetworks are also useful for testing new applications before making them available over the enterprise network.


3.5 Server Restoration Capabilities

Sharing resources distributed over the LAN can better protect users against the loss of information and unnecessary downtime than a network with all of its resources centralized at a single location. The vehicle for resource sharing is the server, which constitutes the heart of the LAN. The server gives the LAN its features, including those for security and data protection, as well as those for network management and resource accounting.

The server determines the friendliness of the user interface and governs the number of users that share the network at one time. It resides in one or more networking cards that are typically added to desktop or rack-mounted computers and which vary in processing power, memory, and interface capacity. However, servers are more than just hardware; they are also defined by the programs that provide services to clients. Aside from file servers and application servers, there are image and fax servers, e-mail servers, printer servers, structured query language (SQL) servers, and a variety of other specialized servers, including those for videoconferencing over the LAN.

The addition of multiple special-purpose servers provides the capability, connectivity, and processing power not provided by the network operating system and file server alone. A single multiprocessor server, combined with a network operating system designed to exploit its capabilities, such as UNIX, provides enough throughput to support five to ten times the number of users and applications as an ordinary PC that is used as a server. Bus and cache designs make it possible for the server to make full use of several processors at once, without the usual performance bottlenecks that slow application speed.

Distributing resources in this way minimizes the disruption to productivity that would result if all the resources were centralized and a failure were to occur.

Moreover, the use of specialized devices as servers permits the integration of diagnostic and maintenance capabilities not found in general-purpose PCs. Among these capabilities are error detection and correction, soft controller error detection and correction, and automatic shutdown in case of catastrophic error. Some servers include integral management functions (e.g., remote console management). The multiprocessing capabilities of specialized servers provide the power necessary to support the system overhead that all these sophisticated capabilities require.

Aside from physical faults on the network, there are various causes for erroneous-data. A software failure on the host, for example, can cause write errors to the user or server disk. Application software errors may generate bad values, or faults, on the disk itself. Power surges can corrupt data and application programs, while power outages can shut down sessions, wiping out data that has not yet been written to disk. Viruses and worms that are brought into the LAN from the Internet, external bulletin boards, shareware, and careless user uploads are another concern. User mistakes can also introduce errors into data or eliminate entire files. Although careful system administration and strict adherence to security procedures are usually sufficient to minimize most of these problems, they do not eliminate the need for backup and archival storage.

Many organizations follow traditional file backup procedures that can be implemented across the LAN. Some of these procedures include performing file backups at night—full backups if possible, incremental backups otherwise. Archival backups of all disk drives are typically done at least monthly; multiple daily saves of critical databases may be warranted in some cases. The more data users already have stored on their hard disks, the longer it takes to save. For this reason, LAN managers encourage users to off-load unneeded files and consolidate file fragments with utility software to conserve disk space, as well as to improve overall system performance during backups. Some LAN managers have installed automatic archiving facilities that will move files from users’ hard disks to a backup database if they have not been opened in the last 90 days.

As the amount of stored information increases, there is the need for LAN backup systems that address such strategic concerns as tape administration, disaster recovery, and the automatic movement of files up and down a hierarchy of network storage devices. Such capabilities are referred to as system storage management or hierarchical storage management.

Protecting data at the server has become a critical concern for most network managers; after all, a failure at the server can result in lost or destroyed data. Considering that some servers are capable of holding vast quantities of data in the terabyte range, loss or damage can have disastrous consequences for an information-intensive organization.

Because huge amounts of corporate data may be located at the server, the server must be able to implement recovery procedures in the event of a program, operating system, or hardware failure. For example, when a transaction terminates abnormally, the server must have the capability to detect an incomplete transaction so that the database is not left in an inconsistent state. The server’s rollback facility is invoked automatically, which backs out of the partially updated database. The transaction can then be resubmitted by the program or user. A roll-forward facility recovers completed transactions and updates in the event of a disk failure by reading a transaction journal that contains a record of all updates.


3.6 Data Protection

The rise of powerful workstations interconnected by high-bandwidth networks and enterprise applications that must be extended to users regardless of location have generated vast amounts of data that must be protected. Often, the amount of data that needs to be manipulated exceeds the capacity of a single workstation (or available network bandwidth) to handle. This has given rise to the client-server model of computing where the client initiates requests and the server assumes much of the data processing load. Of note is that mainframes and midrange computers have also taken on the role of servers.

Although protecting the vast amount of information being stored on computer systems and networks has always been a concern of IT managers, it is even more pressing in the client-server environment, where terabytes of data may be stored at one or more servers that comprise a data warehouse. Losing access to this data, much of it mission-critical, could put a company at a severe competitive disadvantage. Even not being able to gain access to requested data in a timely fashion can adversely impact productivity and response to dynamic market conditions.

The server is the most vulnerable resource on a LAN. When a server crashes, it can take with it not only the availability of crucial data, but also corrupt or destroy the data. For this reason, fault tolerance is becoming an increasingly important issue in the LAN world. As LANs take on crucial tasks that were once tasked to mainframes, restoral mechanisms that keep the server and its data alive through disk crashes and power outages are becoming a requirement. While there are some software-only and hardware-only solutions to choose from, the most effective way to achieve a high degree of fault tolerance is with a combination of both.

3.6.1 Hardware Solutions

Hardware in a fault-tolerant server must be duplicated so that there is an alternate hardware component that can carry on after a failure. Such redundancy extends to the server’s CPUs, ports, network interfaces, memory, disks, tapes, and I/O channels. This duplication is often implemented via a “hot-standby” solution, where a complete duplicate systems is used. The secondary system does nothing but monitor the tasks of the primary system, in most cases duplicating its processing. That way, when a component in the primary system fails, the secondary system is prepared to take over where the primary system left off.

There are obvious disadvantages to this method: twice the amount of hardware must be purchased, with half of it remaining idle at any given time. The only way to cost-justify such a purchase may be to think of it as an insurance policy.

Another way to achieve fault tolerance is to have all hardware components function all the time, but with a load-balancing mechanism that reallocates the work to surviving components when a failure occurs. This arrangement requires a sophisticated operating system that continually monitors the system for errors and dynamically reconfigures the system upon sensing performance problems.

3.6.2 Software Solutions

For complete fault tolerance, software must react to hardware component failures. This allows the system to take advantage of duplicated hardware in order to keep the server running. It also ensures that the data is always available and uncorrupted.

The software monitors the system for failures and, in the event of failure, switches active primary components. The extent to which control is switched depends on whether the system is a hot-standby or a load-balancing system. With a hot-standby system, complete control is given to the standby system when a fatal error is detected, regardless of the component that failed.

With a load-balancing system, control is given to the backup just for the element that failed. Software designed for load-balancing fault-tolerant systems must be highly sophisticated, with the ability to orchestrate complex switching of control in the event of failure—with complete reliability. If the CPU fails, a secondary CPU gains control, but the primary I/O controller, disk controller, and disk drive remain in control. In the event of a CPU failure, the software must reallocate processes (such as the file server software) to active processors. When an I/O channel fails, the software must reroute disk access and communication I/O to an alternate channel. If the bus connecting the processors together fails, it must reroute inter-CPU communications to another bus. If a disk crashes, it must be able to switch to a backup disk drive.

Software has another function: to assure that files remain available and uncorrupted during a failure and that the server can pick up where it left off upon system recovery. Several mechanisms are available to provide optimum data availability and integrity, including the following:

  • Disk mirroring provides constant availability despite media failures. Disk mirroring allows all file updates to be written to two disks at the same time. If one disk (or the I/O channel to it) fails, the information can be read and written to the other disk.

  • To maintain constant file availability, mirroring mechanisms provide the capability for tape backup of disk data to be made while updates continue. After a failure, users should have disk access during data rebuilds.

  • Disk recovery after a failure requires the ability to bring the new secondary disk to the current state of the primary disk, so that the data is once again protected. To maintain availability, disk recovery should be performable on-line, without taking the system down and depriving users of access.

Depending on the level of fault tolerance desired and the price the organization is willing to pay, the server may be configured in several ways: unmirrored, mirrored, or duplexed.

Unmirrored Servers

An unmirrored server configuration entails the use of one disk drive, channel, controller, power supply, and interface cabling. This is the basic configuration of most servers. The advantage is chiefly one of cost: the user pays only for one storage system. The disadvantage of this configuration is that a failure in either the drive or any associated component could cause temporary or permanent loss of the stored data.

Mirrored Servers

The mirrored server configuration entails the use of two hard disks of similar size. There is also a single channel over which the two disks can be mirrored together. In this configuration, all data written to one disk is then automatically copied onto the other disk. If one of the disks fails, the other takes over, thus protecting the data and assuring all users of access to the data. The server’s operating system issues an alarm notifying the network manager that one of the mirrored disks is in need of replacement.

The disadvantage of this configuration is that both disks use the same channel and controller. If a failure occurs on the channel or controller, both disks become inoperative. Because the same disk channel and controller are shared, the writes to the disks must be performed sequentially—that is, after the write is made to one disk, a write is made to the other disk. This can degrade overall server performance under heavy loads.

Disk Duplexing

In disk duplexing, multiple disk drives are installed with separate channels for each set of drives. If a malfunction occurs anywhere along a channel, normal operation continues on the remaining channels and drives. Because each disk uses a separate channel, write operations are performed simultaneously, offering a performance advantage over servers using disk mirroring.

Disk duplexing also offers a performance advantage in read operations. Read requests are given to both drives. The drive that is closest to the information will respond and answer the request. The second request given to the other drive is canceled. In addition, the duplexed disks share multiple read requests for concurrent access.

The disadvantage of disk duplexing is the extra cost for multiple disks drives (also required for disk mirroring), as well as for the additional disk channels and controller hardware. However, the added cost for these components must be weighed against the replacement cost of lost information plus costs that accrue from the interruption of critical operations and lost business opportunities. Faced with these consequences, an organization might discover that the investment of a few hundred or even a few thousand dollars to safeguard valuable data is negligible.

3.6.3 Redundant Arrays of Inexpensive Disks

One method of data protection is growing in popularity: redundant arrays of inexpensive disks (RAIDs). Instead of risking all of its data on one high-capacity disk, the organization distributes the data across multiple smaller disks, offering protection from a crash that could wipe out all data on a single, shared disk. Other benefits of RAID include the following:

  • Increased storage capacity per logical disk volume;

  • High data transfer or I/O rates that improve information throughput;

  • Lower cost per megabyte of storage;

  • Improved use of data center floor space.

RAID products can be grouped into the following categories:

  • RAID Level 0. These products are technically not RAID products at all, since they do not offer parity or error correction data to provide redundancy in the event of system failure. Although data striping is performed, it is accomplished without fault tolerance. Data is simply striped (written) block-by-block across all the drives in the array. Since all disks seek in parallel, seek performance is greatly improved, but there is no way to reconstruct data if one of the drives fails.

  • RAID Level 1. These products duplicate data that is stored on separate disk drives. Also called mirroring, this approach ensures that critical files will be available in case of individual disk drive failures. Each disk in the array has a corresponding mirror disk and the pairs run in parallel. Blocks of data are sent to both disks at the same time. While highly reliable, Level 1 is costly because every drive requires its own mirror drive, which doubles the hardware cost of the system.

  • RAID Level 2. These products distribute the code used for error detection and correction across additional disk drives. The controller includes an error-correction algorithm, which enables the array to reconstruct lost data if a single disk fails. As a result, no expensive mirroring is required. But the code requires that multiple disks be set aside to do the error-correction function. Data is sent to the array one disk at a time.

  • RAID Level 3. These products store user data in parallel across multiple disks. The entire array functions as one large logical drive. Its parallel operation is ideally suited to supporting imaging applications that require high data transfer rates when reading and writing large files. RAID Level 3 is configured with one parity (error-correction) drive. The controller determines which disk has failed by using additional check information recorded at the end of each sector. However, because the drives do not operate independently, every time an image file must be retrieved all of the drives in the array are used to fulfill that request. Other users are put into a queue.

  • RAID Level 4. These products store and retrieve data using independent writes and reads to several drives. Error correction data is stored on a dedicated parity drive. In RAID Level 4, data striping is accomplished in sectors, not bytes (or blocks). Sector-striping offers parallel operation in that reads can be performed simultaneously on independent drives, which allows multiple users to retrieve image files at the same time. While multiple reads are possible, multiple writes are not because the parity drive must be read and written to for each write operation.

  • RAID Level 5. These products interleave user data and parity data, which are then distributed across several disks. Because data and parity codes are striped across all the drives, there is no need for a dedicated parity drive. This configuration is suited for applications that require a high number of I/O operations per second, such as transaction processing tasks that involve writing and reading large numbers of small data blocks at random disk locations. Multiple writes to each disk group are possible because write operations do not have to access a single common parity drive.

  • RAID Level 6. These products improve reliability by implementing drive mirroring at the block level so that data is mirrored on two drives instead of just one. This means that up to two drives in the five-drive disk array can fail without loss of data. If a drive in the array fails with RAID 5, for instance, data must be rebuilt from the parity information spanned across the drives. With RAID 6, however, the data is simply read from the mirrored copy of the blocks found on the various striped drives—no rebuilding is required. Although this results in a slight performance advantage, it requires at least 50% more disk capacity to implement.

  • RAID Level 10. Some vendors offer hybrid products that combine the performance advantages of RAID 0 with the data availability and consistent high performance of RAID 1 (also referred to as striping over a set of mirrors). This method offers high performance and high availability for mission-critical data.

There are other hybrid RAID solutions. RAID Level 30, for example, is achieved by striping across a number of RAID Level 3 subarrays. RAID 30 generally provides better performance than RAID 3 due to the addition of RAID 0 striping, but is not as efficient as RAID Level 0. RAID Level 50 is achieved by striping across a number of RAID Level 5 subarrays. RAID 50 generally provides performance better than RAID 5 due to the addition of RAID 0 striping. Although not as efficient as RAID Level 0, it provides better fault tolerance than the single RAID Level 5.

Businesses today have multiple data storage requirements. Depending on the application, performance may be valued more than availability; other times, the reverse may be true. Today, it is possible to have different data structures (text, image, audio) in different parts of the same application, making performance more valued than availability. Until recently, the choice among specific RAID solutions involved trade-offs between cost, performance, and availability—once installed, they cannot be changed to take into account the different storage needs of applications that may arise in the future. Vendors have responded with storage solutions that support a mix of RAID levels (hybrids) simultaneously.

Individual disk drives or groups of drives can now be configured via a PC-based resource manager for high performance, high availability, or as an optimized combination of both. This solves a classic data storage dilemma: meeting the exacting requirements of multiple current applications, while staying flexible enough to adapt to changing needs.

3.6.4 Server Blades

Some applications require the deployment of hundreds of servers in a coordinated manner, which can be quite expensive using conventional chassis-based server configurations. The now-familiar process of rack-mounting servers has been the most common approach to assembling large numbers of servers. Newer “blade” technology extends the concept of rack-mounting to allow hundreds of ultra-thin servers to be vertically mounted into a single rack. The blades are comprehensive computing systems that include processor, memory, network connections, and associated electronics—all on a single motherboard called a blade. Each blade can be configured to support a different operating system or application accessible from the LAN or WAN.

The blades slide into slots on a specially designed rack. While the server blade consists of essential processing and sometimes storage components, the rack unit provides for network and external storage connections, significantly reducing cabling and space requirements. Over 300 blades can fit into a standard-sized rack. And if a blade fails, it can be easily replaced by simply pulling and replacing it.

Server blades have a lot of appeal for IT organizations looking for space-efficient solutions with higher levels of serviceability, scalability, and manageability. Installing, servicing, and removing blades is much easier than working with chassis-mounted servers. Shared power supply, cabling, fans, and storage reduce the number of redundant and “failable” components in the environment. Instead of equipping each server with redundant power supplies, for example, a single set of power supplies is shared by all the rack-mounted blades. Management tools allow IT managers to readily monitor, configure, and troubleshoot systems.

The ability to add and remove components quickly not only allows IT managers to deal with outages more efficiently than in a traditional network setup, but adjust to fluctuations in traffic as well. For example, the management interface allows server blades to be set up to handle transaction software that is heavily used during the business day and then perform other tasks during other periods of the day. In addition, all blades in the system can be managed as a whole, or they can be assigned to different users, customers, or partners and managed separately.

3.6.5 Automated Operations

With the right management tools, network backup can be automated under centralized control. Such tools are a virtual necessity for mixed-vendor environments. They can go a long way toward lowering operating and resource costs by reducing time spent on backup and recovery. Some tools even implement unattended network backup, eliminating operator intervention and further reducing costs.

These tools enhance media management by providing overwrite protection, log file analysis, media labeling, and the ability to recycle backup media. In addition, the scheduling capabilities of some tools relieve the operator of the time-consuming tasks of tracking, logging, and rescheduling network and system backups. Another tool is journaling, which is the capability of a system to keep a history of database transactions. In the event of a disk failure or unscheduled interrupt, the system administrator can replay the transaction journal in an attempt to isolate the cause of the problem. Another useful tool is data compression, which reduces media costs by increasing media capacity. This feature also increases backup performance across a network by reducing the traffic load.

When these tools are integrated with high-level management platforms, such as Hewlett-Packard’s OpenView, problems or errors that occur during automated network backup are reported to the OpenView management console. The console operator is notified of the problem or error via a color change in the respective backup application symbol on the OpenView map. By clicking on the symbol, the operator can directly access the network backup application to determine the cause of the problem or correct the error, enabling the backup operation to resume.

The trend in backup systems is toward increasing their levels of intelligence. Backup systems must not only ensure that files are backed up, but that they are easily located and restored. Systems intelligence has already progressed to the point where the user need not know the tape, the location on the tape, or even the name of a lost file in order to restore it.

Increasing levels of automation are facilitating the backup of very large networks. From expert software that determines what files to back up, to automated tape changers that select, load, and unload tapes without operator intervention, backup is becoming as transparent and easily manageable as file sharing. Backup software is also supporting more types of applications, including on-line processing. As LAN backup systems move forward in intelligence, automation, application diversity, and media options, LANs can fulfill their potential as the primary means of corporate data management.

3.6.6 Off-Site Data Storage

Mission-critical data should be backed up daily or weekly and stored off site. There are numerous services that provide off-site storage, often in combination with hierarchical storage management techniques. In the IBM environment, for example, this might entail storing frequently used data on a direct access storage device (DASD) for immediate usage, whereas data only used occasionally might go to optical drives, and data that has not been used in several months would be archived to a tape library.

Carriers, computer vendors, and third-party service firms offer vault storage for secure, off-site data storage of critical applications. Small companies need not employ such elaborate methods. They can back up their own data and have it delivered by overnight courier for storage at a secure location, or bring it to a bank safety deposit box. The typical bank vault can survive even a direct hit by a tornado.

In addition to backing up critical data, it is advisable to register all applications software with the manufacturer and keep the original program disks in a safe place at a different location. This minimizes the possibility of both copies being destroyed in the same catastrophe. Manuals and supplementary documentation should also be protected, as should the software licenses.

For companies that can afford it, a mirror site is a good alternative to a backup tape system. It contains copies of applications and data, perhaps located at the other end of a leased line that runs miles away from the main site, so a natural or manmade disaster is unlikely to strike both sites simultaneously. If one site goes down, the other site takes over. Mirror sites are becoming more popular with high-volume e-commerce sites that cannot risk even a few minutes of downtime. The mirror site can be as large as a data center, or merely a rack-mounted server at a carrier’s collocation facility.

Both carrier-neutral and carrier-specific collocation facilities are commonplace. It is simply a secure environment that brings together the equipment and lines of multiple service providers and customers. Space is leased in the form of cages, cabinets, and racks into which customers place their own equipment. Customers pay a fixed monthly charge for the space. For small companies, this arrangement is often more economical than having to set up and maintain their own secure environment.

Some service providers offer site recovery options. This type of service is meant to deal with the loss of a primary data center that runs mission-critical applications. If an organization’s data center suffers from a catastrophic fire or natural disaster, for example, traffic will be quickly rerouted to another comparably equipped site. When disaster strikes, the customer calls the carrier and requests activation of links to the alternate site, a process that may take about two hours to complete and which may entail the uploading of new routing tables to each router to reflect the changes. This service is far more economical than having to set up and maintain a live data center and supporting infrastructure.


3.7 Servers on the WAN

The continued growth of business-critical Internet applications, corporate intranets, storage services, conferencing, and e-commerce has prompted the need for innovations to improve traffic flow between servers on WAN. Increasingly, organizations of all types and sizes are turning to management products that allocate bandwidth according to various application performance criteria in an effort to reduce congestion, ensure delivery of priority messages, and support real-time multimedia traffic. The use of bandwidth management products can especially improve the performance of IP networks through such means as load balancing, caching, and queuing.

3.7.1 Load Balancing

By applying load balancing to the servers on the WAN, the performance of various services can be greatly improved. Through the use of bandwidth management tools, traffic can be directed to the best server available to handle a job. In a load-balanced network, incoming traffic is distributed among replicated servers, thus permitting server clusters to share the processing load, provide fail-back capability, and speed response time for users.

With advanced load-balancing tools, policies can be defined that reflect the capabilities of individual servers on the network. For example, all requests for video clips can be redirected to a video server that is specifically equipped to handle multiple streams, all routine information requests can be redirected to a Web server, and all employees in marketing can be redirected to the data warehouse server. The load-balancing tool continuously adjusts both the flow and prioritization of applications through the network and the distribution of those applications to servers.

Traffic can be balanced between available servers using algorithms such as:

  • Round robin: Each server is treated with equal priority.

  • Weighted round: Each server is given an individual weight or priority based on its ability to deliver specific applications.

  • Maintenance rerouting: Traffic is rerouted to another server when an originally targeted server becomes unavailable.

Selecting the right load-balancing approach results in efficient utilization of bandwidth and other resources and improves traffic flow throughout the organization.

3.7.2 Caching

A cache is temporary storage of frequently accessed information. Caching has long been used in computer systems to increase performance. A cache can be found in nearly every computer today, from mainframes to PCs. More recently, caching is used to improve the performance of corporate intranets. Many vendors of bandwidth management products offer network caching as well. Instead of users accessing the same information over the WAN, it is stored locally on a server. This arrangement gives users the information they need quickly, while freeing the WAN of unnecessary traffic, which improves its performance for all users.

Caching is frequently applied to the Web, especially for e-commerce applications. When users visit the same Web site, the browser first looks to see if a copy of the requested page is already in the computer’s hard disk cache. If it is, the load time is virtually instantaneous; if not, the request goes out over the Internet.

At the backbone level, lack of sufficient bandwidth is a global problem. Internet-telephony, videoconferencing, and multimedia applications are consuming even greater amounts of bandwidth. Network caching offers an effective and economical way to offload some of the massive bandwidth demand. This allows Internet service providers (ISPs) and corporations with their own intranets to maintain an active cache of the most-often visited Web sites so that when these pages are requested again, the download occurs from the locally maintained cache server instead of the request being routed to the actual server. The result is a faster download speed.

Caches can reside at various points in the network. For enterprises, caches can be deployed on servers throughout campus networks and in remote and branch offices. Within enterprise networks, caches are on the way to becoming as ubiquitous as IP routers. Just about every large company now depends on Web caches to keep their intranets running smoothly. There are two types of caching:

  • Passive caching: The cache waits until a user requests the object again, then sends a refresh request to the server. If the object has not changed, the cached object is served to the requesting user. If the object has changed, the cache retrieves the new object and serves it to the requesting user. However, this approach forces the end user to wait for the refresh request, which can take as long as the object retrieval itself. It also consumes bandwidth for unnecessary refresh requests.

  • Active caching: The cache performs the refresh request before the next user request—if the object is likely to be requested again and the object is likely to have changed on the server. This automatic and selective approach keeps the cache up to date so the next request can be served immediately. Network traffic does not increase because an object in cache is refreshed only if it has a high probability of being requested again, and only if there is a statistically high probability that it has changed on the source server.

Active caches can achieve hit ratios of up to 75%, meaning a greater percentage of user requests can be served by the cache. If the requested data is in the cache and is up to date, the cache can serve it to the user immediately upon request. If not, the user must wait while the cache retrieves the requested data from the network.

Passive caches, on the other hand, typically achieve hit rates of only 30%. This means users are forced to go to the network 2.5 times more often to get the information they need.

3.7.3 Queuing

Queuing techniques may be used separately or with rate control on IP networks. Queuing types include priority, weighted, and class-based. Priority queuing sets queues for high and low priority and empties high-priority queues first. Cisco’s weighted fair queuing (WFQ), for example, assigns traffic to priority queues and also apportions a bandwidth share. Its class-based queuing (CBQ) guarantees a transmission rate to a queue, and other queues can borrow from unused bandwidth.

WFQ classifies traffic into “conversations” and applies priority (or weights) to identified traffic to determine how much bandwidth each conversation is allowed relative to other conversations. Conversations are broken into two categories: those requiring large amounts of bandwidth and those requiring a smaller amount of bandwidth. The goal is to always have bandwidth available for the small bandwidth conversations and allow the large bandwidth conversations to split the rest proportionally to their weights.

WFQ provides consistent response time to heavy and light network users alike without adding excessive bandwidth. It is a flow-based queuing algorithm that schedules interactive traffic to the front of the queue to reduce response time and fairly shares the remaining bandwidth between other high-bandwidth flows. Low-volume traffic streams—which comprise the majority of traffic—receive preferential service, transmitting their entire offered loads in a timely fashion.

High-volume traffic streams share the remaining capacity proportionally between them.


3.8 Storage Area Networks

The best way to protect data and applications is to distribute them, rather than centralize them. This can be accomplished with a SAN, which provides fast, reliable access to servers and external or independent storage resources, regardless of physical location. Fibre Channel or Gigabit Ethernet links can provide high-speed transfers of data between systems distributed within a building, campus, or metropolitan area. For longer distances, ATM and IP technologies can be used to transport data over the WAN. Graphical user interface (GUI)-based management systems, as well as SNMP, play a key role in configuring and maintaining SANs. This important topic is covered in more detail in Chapter 4.


3.9 Other Considerations

As more businesses interconnect their computers at remote locations and run critical applications over WANs, they are discovering that financial and operational losses can mount quickly in the event of internetwork downtime. Businesses of all types and sizes are recognizing that disaster recovery plans are essential, regardless of the particular computing environment. The disaster recovery plan should be a formal document that has been signed off by senior management, information systems (IS) management, and all department heads. The following items should be addressed in any disaster recovery plan.

3.9.1 Uninterruptible Power Supplies

Uninterruptible power supplies (UPSs) are designed to provide temporary power so that attached computer systems and servers can be shut down properly to prevent data loss. UPSs are especially important in WANs. Because the distance between links can be thousands of miles, WANs are more susceptible to power problems than LAN segments. Therefore, using battery backups to protect against fluctuations and outages should always be the first line of defense.

While most data centers have UPSs, many remote sites typically do not, usually as a cost-saving measure. However, battery backup can be very inexpensive, costing only a few hundred dollars, which is cheap compared to the cost of indeterminate network downtime. Moreover, some UPSs have SNMP capabilities, which lets network managers monitor battery backup from the central management console. For instance, via SNMP, every UPS can be instructed to test itself once a week and report back if the test fails. The network manager can even be notified if the temperature levels in wiring closets rise above established thresholds.

3.9.2 Generators

To keep computers operating during a prolonged loss of power, a generator is required. The difference between a UPS and a generator is that the generator is capable of supplying much more power for longer periods of time. Using a fuel source such as oil, a generator can supply power indefinitely to keep data centers cool and computers running. Because generators can cost tens of thousands of dollars, many companies unwisely decide to skip this important component of the disaster recovery plan.

Unless an organization has experienced a lengthy outage that has disrupted daily business operations, this level of protection is often hard to justify. However, many office buildings already have generators to power lighting and elevators during electrical outages. For a fee, tenants can patch into the generator to keep data centers and networks operating.

3.9.3 Surge Suppressors

In storm-prone areas like the southeast, frequent electrical storms can put spikes or surges on telephone lines. Sudden bursts of electricity can destroy router links and cause adapters and modems to fail. To protect equipment attached to telephone lines, surge-suppression devices can be installed between the telephone line and the communications device. Surge suppressors condition the power lines to ensure a constant voltage level. Many modems and other network devices such as channel service units/data service units (CSU/DSUs) have surge suppressors built in. The disaster recovery plan should specify the use of surge suppressors wherever possible and they should be checked periodically to ensure proper operation.

3.9.4 Spare Parts Pooling

Most companies can afford to stockpile spare cables and cards, but not spare multiplexer and router components that are typically too expensive to inventory. Pooling these items with another area business that uses the same equipment can be an economical form of protection should disaster strike. Such businesses can be identified through user group and association meetings. The equipment vendor is another good source for this information.

After each party becomes familiar with the disaster recovery needs of the other, an agreement can be drawn up to pledge mutual assistance. Each party stocks half the necessary spare parts. The pool is drawn from as needed and restocked after the faulty parts come back from the vendor’s repair facilities.


3.10 Conclusion

A variety of LAN restoral and data protection methods can provide effective ways to meet the diverse requirements of today’s information-intensive corporations that are both efficient and economical. Choosing wisely from among the available alternatives ensures that companies are not forced into making cost-benefit trade-offs that jeopardize their information networks, productivity levels and, ultimately, their competitive positions in dynamic markets.


Chapter 4: Storage Network Management

4.1 Introduction

With the rapidly increasing volume of mission-critical information being accumulated in today’s business environment, companies are demanding better performance, availability, manageability, and security of their data storage assets. To meet these needs, companies are implementing specialized networks that are capable of helping them realize operational efficiencies and maximize revenue-generating opportunities. These objectives can be achieved with a combination of transport technologies and distributed storage resources, which together comprise a separate high-performance SAN. While most of today’s SAN offerings are proprietary, standards are beginning to emerge to facilitate multi-vendor interoperability and management.

The need to balance the cost, capacity, and efficiency of different storage media according to the frequency of data usage became apparent in the mid-1990s. Hierarchical storage management (HSM) solutions were introduced to provide all clients and servers with expanded on-line storage through the migration of files between hard disks, magnetic tape, and optical media, according to predefined rules.

HSM solutions use two or more levels of storage (three is typical: on-line, offline, and near-line) to provide a cost-effective and efficient solution to meet the demand for increased storage space and appropriate data retrieval response time. HSM came about because of the need to move low-volume and infrequently accessed files from disk, thus freeing up valuable on-line storage space.

Although more disks can be added to file servers to keep up with storage needs, budget constraints often limit the long-term viability of this solution. In an HSM scheme, data can be categorized according to its frequency of usage and stored appropriately: on-line, near-line, or offline. Different storage media come into play for each of these categories, and migration operations are under control of a storage management system (see Figure 4.1).

Click To expand
Figure 4.1: Hierarchical data storage spanning magnetic disk, optical disk, and tape options.

Frequently used files are stored on-line on local disk drives installed in a server or workstation. Occasionally used files are stored near-line on secondary storage devices such as optical disks installed in a server-like device called an auto-changer or jukebox. Infrequently used files are usually migrated off line to tape cartridges that are stored in a tape jukebox or a library facility capable of holding hundreds or thousands of tapes. The library facility uses sophisticated robotics to retrieve individual bar-coded cartridges and inserts them into a tape drive so the data can be moved to local storage media. The exchange time can be several minutes.

For organizations with mixed needs for on-line and offline storage, a near-time automated tape library offers the best compromise between price and performance. These systems bridge the gap between fast, expensive on-line disk storage and slow, high-capacity offline tape libraries. The exchange time is about 30 seconds.

A management system determines when a file should be transferred or retrieved, initiates the transfer, and keeps track of its new location. As files are moved from one type of medium to another, they are put into the proper directory for user access. The management system automatically optimizes storage utilization across different media types by removing files from one to the other until they are permanently archived in the most economical way, usually a tape library. At the same time, individual files or whole directories can be excluded from migration.

Data migration can be controlled according to such criteria as file size and last date of access. Files can also be migrated when the hard disk reaches a specified capacity threshold. When a disk reaches the threshold of 80% full, for example, files are migrated automatically to tape storage, freeing space on the hard disk until it reaches another specified threshold, say, 60%. When files are no longer needed but must be stored permanently, they can be migrated off the tape drive to optical media.

HSM concepts have been incorporated into both SANs and storage virtualization solutions, both of which offer organizations even more flexibility in how storage is used and managed.


4.2 Storage Area Networks

Essentially, a SAN is a specialized network that enables fast, reliable access among servers and external or independent storage resources, regardless of physical location. Fibre Channel or Gigabit Ethernet links can provide high-speed transfers of data between systems distributed within a building, campus, or metropolitan area. When dense wave division multiplexed (DWDM) fiber is used, the individual wavelengths provide enough bandwidth to support any mix of Gigabit Ethernet, Fibre Channel, and enterprise systems connection (ESCON) for IBM data center connectivity, as well as synchronous optical network (SONET) traffic.

For longer distances, ATM and IP technologies can be used to transport data over the WAN (see Figure 4.2). ATM would be adept at connecting heterogeneous storage resources over the wide area, since it slices and dices different protocol traffic into standardized packets called “cells” for high-speed, jitter-free transmission between distributed storage nodes. With ATM, data availability can be maintained through integral quality of service (QoS) mechanisms that give such traffic higher priority over routine traffic. Data integrity can be maintained through the use of TCP/IP over ATM, in which case TCP handles retransmission requests for errored or missing IP frames. Proprietary mechanisms can be used to ensure data integrity. Bandwidth can even be reserved, so that storage updates occur during non-peak or non-business hours, when more bandwidth is available.

Click To expand
Figure 4.2: A simple SAN spanning the WAN under the supervision of a centralized management system. The access links at each location can be multiples of T1 at 1.544 Mbps (NxT1), a T3 at 45 Mbps or an optical carrier link at 155 Mbps (OC-3). Carrier-provided Ethernet services between 10 Mbps and 1 Gbps can be used as well.

In a SAN, a storage device is not the exclusive property of any one server. Rather, storage devices are shared among all networked servers as peer resources. Just as a LAN can be used to connect clients to servers, a SAN can be used to connect servers to storage, servers to each other, and storage to storage for load balancing and protection.

4.2.1 SAN Advantages

Redundancy is an inherent part of the SAN architecture, making for high availability. The “pluggable” nature of SAN resources—storage, nodes, and clients— enables much easier scalability, while preserving ubiquitous data access. And under centralized management, there is more efficiency in carrying out tasks such as optimization, reconfiguration, and backup/restore operations. While these advantages are somewhat generic and readily apply to networking in general, they are fairly new to data storage environments where different operating systems and multi-vendor products must coexist.

SANs are particularly useful for backups. Previously, there were only two choices: either a tape drive had to be installed on every server and someone went around changing the tapes, or a backup server was created and the data moved across the network, which consumed bandwidth. Performing backup over the LAN can be excruciatingly disruptive and slow. A daily backup can suddenly introduce gigabytes of data into the normal LAN traffic. With SANs, organizations can have the best of both worlds: high-speed backups managed from a central location.

Instead of dedicating a specific kind of storage to one or more servers, a SAN allows different kinds of storage—mainframe disk, tape, and RAID—to be shared by different kinds of servers, such as Windows NT/2000, UNIX, and OS/390. With this shared capacity, organizations can acquire, deploy, and use storage devices more efficiently and cost-effectively. SANs also let users with heterogeneous storage platforms use all available storage resources. This means that within a SAN, users can back up or archive data from different servers to the same storage system. They can also allow stored information to be accessed by all servers, create and store a mirror image of data as it is created, and share data between different environments.

By decoupling storage from computers, workstations, and servers, and taking storage traffic off the operations network, organizations gain a high-performance storage network and improve the performance of the LAN. Of course, each network—SAN and LAN—is still subject to resource contention from among its respective users, but the performance of both is improved by keeping them separate. In effect, the SAN does in a network environment what traditionally has been done in a back-end I/O environment between a server and its own storage subsystem. The result is high speed, high availability, and high reliability.

While a physically separate network to handle storage and archival traffic is often desirable, it is by no means necessary. This is because the SAN can function as a virtual subnet that operates on a shared network infrastructure. For this to work, however, different priorities or classes of service must be established so that all users and applications obtain their fair share of available bandwidth. Both Fibre Channel and ATM provide the means to set different classes of service, and this capability can be added to IP for a more economical approach to storage area networking.

SANs also promise easier and less-expensive network administration. Today, administrative functions are labor-intensive and time-consuming, and IT organizations typically have to replicate management tools across multiple server environments. With a SAN, only one set of tools is needed, which eliminates the need for their replication and associated costs. While these advantages apply to networks in general, they are relatively new for data storage environments.

All of this makes SANs highly suited for data-intensive environments like those used for video editing, prepress, on-line transaction processing (OLTP), data warehousing, storage management, and server clustering applications. For the enterprise, SANs constitute an essential ingredient in any business continuity plan.

4.2.2 SAN Evolution

SANs have existed for years in the mainframe environment in the form of ESCON. In mid-range environments, the high-speed data connection was primarily small computer system interface (SCSI)—a point-to-point connection that is severely limited in terms of the number of connected devices it can support, as well as the distance between devices.

An alternative to network attached storage (NAS) was developed in 1997 by Michael Peterson, president of Strategic Research in Santa Barbara, Calif. He believed NAS was too limiting because it relied on network protocols that did not guarantee delivery. He proposed SANs that could be interconnected using network protocols such as Ethernet, and that the storage devices themselves could be linked via non-network protocols.

According to Peterson, SANs have three major components: the interfaces, including SCSI, IBM Serial Storage Architecture (SSA) or Fibre Channel; interconnects, such as extenders, multiplexers, hubs, switches, and routers; and the switching fabric. In a traditional storage environment, a server controls the storage devices and administers requests and backup. With a SAN, instead of being involved in the storage process, the server simply monitors it. By optimizing the box at the head of the SAN to do only file transfers, users are able to get much higher transfer rates. This is where Fibre Channel comes in.

Using Fibre Channel as the connection between storage devices increases the distance options. While traditional SCSI allows only a 25-meter (about 82 feet) distance between machines and Ultra2 SCSI allows only a 12-meter distance (about 40 feet), Fibre Channel supports spans of 10 km (about 6.2 miles), making it suited to building campus-wide storage networks. SCSI can only connect up to 16 devices, whereas Fibre Channel can link as many as 126. By combining LAN networking models with the core building blocks of server performance and mass storage capacity, SAN eliminates the bandwidth bottlenecks and scalability limitations imposed by previous SCSI bus-based architectures.

More recently, vendors have pushed the speed of Fibre Channel from 1 Gbps to 2 Gbps and increased the distance beyond the original 6.2 miles to about 75 miles. As the SAN concept has evolved, it has moved beyond association with any single technology. In fact, just as LANs and WANs use a diverse mix of technologies, so can SANs. This mix can include FDDI, ATM, and IBM’s SSA, as well as Fibre Channel. More recently, SONET and DWDM have been added to the mix to extend the operating range of storage networks. Infiniband has come along to offer massive amounts of bandwidth and improvements in I/O performance. And now that broadband connections are becoming more available, even the TCP/IP suite of Internet protocols is being used for a more economic implementation of storage networks.

Although early implementations of SANs have been local or campus-based, there is no technological reason why they cannot be extended much farther with such proven technologies such as SONET and ATM. With its 50-ms recovery time, SONET also offers the benefit of extremely high resiliency. This capability is also available with some DWDM systems. In either case, data travels to its destination in opposite directions over a dual-ring architecture (see Figure 4.3). If one of the fibers is cut or a node fails, protection mechanisms kick in to ensure that data gets to its destination with little or no loss. ATM’s QoS capabilities and priority queuing techniques allow the SAN to be extended over a much wider area—perhaps globally—with little or no performance fatigue. Running TCP/IP over SONET/DWDM or ATM provides for the retransmission of errored or missing frames, ensuring data integrity.

Click To expand
Figure 4.3: For metro-area SANs, SONET/DWDM systems offer the highest resiliency of any transport technology. Even if a fiber gets cut or a node on the ring fails, data gets to its proper destination with very little loss. Data integrity is ensured using higher-level protocols like TCP/IP.

Infiniband is emerging as a viable high-speed interconnect technology that provides the basis for an I/O fabric designed to increase the aggregate data rate between servers and storage devices over copper or fiber media at distances of up to 17 meters and 10 km, respectively. This point-to-point linking technology is intended to replace current interconnect technologies such as the peripheral component interconnect (PCI) and its successor, PCI-X. The I/O fabric of the Infiniband architecture takes on a role similar to that of the traditional mainframe-based channel architecture, which uses point-to-point cabling to maximize overall I/O throughput by handling multiple I/O streams simultaneously. With Infiniband’s ability to act as a server’s I/O external from the server chassis, independent scaling of processing and I/O capacity is possible, creating more flexibility for data center managers. Unlike today’s servers, which contain a defined number of I/O connections per box, Infiniband servers can share I/O resources across the fabric.

PCI supports up to 133 Mbps, providing shared bandwidth of up to 566 Mbps, while PCI-X permits a maximum bandwidth of 1 Gbps. While Fibre Channel offers bandwidth up to 2 Gbps, Infiniband uses a 2.5-Gbps wire-speed connection with multi-wire link widths. With a four-wire link width, for example, Infiniband offers 10 Gbps of bandwidth. The move to Infiniband means that I/O subsystems need no longer be the bottleneck to improving overall data throughput for server systems.

Infiniband technology works by connecting host-channel adapters to target channel adapters. The host-channel adapters tend to be located near the servers’ CPUs and memory, while the target channel adapters tend to be located near the systems’ storage and peripherals. A switch located between the two types of adapters directs data packets to the appropriate destination based on information that is bundled into the data packets themselves.

The connection between the host-channel and target-channel adapters is the Infiniband switch, which allows the links to create a uniform fabric environment. One of the key features of this switch is that it allows data to be managed based on variables such as service level agreements and a destination identifier. In addition, Infiniband devices support both packet and connection protocols to provide a seamless transition between the SAN and external networks. Infiniband fabrics will be managed via Infiniband consoles, and Infiniband fabric management is expected to snap into existing enterprise management solutions.

Infiniband will coexist with the wide variety of existing I/O standards that are already widely deployed in user sites. The key advantage of the Infiniband architecture, however, is that it offers a new approach to I/O efficiency. Specifically, it replaces the traditional system bus with an I/O fabric that supports parallel data transfers along multiple I/O links. Furthermore, the Infiniband architecture offloads CPU cycles for I/O processing, delivers faster memory pipes and higher aggregate data-transfer rates, and reduces management overhead for the server system.

Infiniband started out as a proprietary technology, with a formal specification issued in 2000, and may become the de facto standard for communication between processing nodes and I/O devices, as well as for interprocessor communication. More than 100 companies are supporting the technology through the Infiniband Trade Association.

4.2.3 SAN Components

Several components are required to implement a Fibre Channel SAN. A Fibre Channel adapter is installed in each server. These are connected via the server’s personal computer interface (PCI) bus to the server’s operating system and applications. Because Fibre Channel’s transport-level protocol wraps easily around SCSI frames, the adapter appears to be an SCSI device. The adapters are connected to a single Fibre Channel hub, running over fiber-optic cable or copper coaxial cable. Category 5, the UTP wiring rated for 10/100/1,000 Mbps Fast Ethernet, can also be used.

A LAN-free backup architecture may include some type of automated tape library that attaches to the hub via Fibre Channel. This machine typically includes a mechanism capable of feeding data to multiple tape drives and may be bundled with a front-end Fibre Channel controller. Existing SCSI-based tape drives can be used through the addition of a Fibre Channel-to-SCSI bridge.

Storage management software running in the servers performs contention management by communicating with other servers via a control protocol to synchronize access to the tape library. The control protocol maintains a master index and uses data maps and time stamps to establish the server-to-hub connections. At this writing, control protocols and other management elements are specific to the software vendors. Eventually, the storage industry will standardize on CIM-SAN-1, which has been approved by the Storage Network Industry Association (SNIA) and is supported by key vendors (see Section 4.2.8).

From the hub, a standard Fibre Channel protocol, Fibre Channel-Arbitrated Loop (FC-AL), functions similarly to token ring to ensure collision-free data transfers to the storage devices. The hub also contains an embedded SNMP agent for reporting events to network management software.

4.2.4 Role of Hubs and Switches

Much like Ethernet hubs in LAN environments, Fibre Channel hubs provide a degree of fault tolerance in SAN environments in addition to more convenient wiring and cable management. On a Fibre Channel-Arbitrated Loop, each node acts as a repeater for all other nodes on the loop, so if one node goes down, the entire loop goes down. For this reason, hubs are an essential source of fault isolation in Fibre Channel SANs. The hub’s port bypass functionality will automatically circumvent a problem port and avoid most faults. Stations can be powered off or added to the loop without impacting the rest of the SAN. Storage management software is used to mediate contention and synchronize data—activities necessary for moving backup data from multiple servers to multiple storage devices.

To achieve full redundancy in a Fibre Channel SAN, two fully independent, redundant loops must be cabled. This scheme provides two independent paths for data with fully redundant hardware. Most disk drives and disk arrays targeted for high availability environments have dual ports specifically for that purpose. Wiring each loop through a hub provides higher-availability port-bypass functionality to each of the loops.

Some organizations will need multiple levels of hubs. Hubs can be cascaded up to the Fibre Channel-Arbitrated Loop limit of 126 nodes [127 nodes with a Fabric Loop (FL) or switch port]. Normally, the distance limitation between Fibre Channel hubs is 3 km. Several vendors, however, have found ways to extend the distance between hubs to 10 km, allowing organizations to link servers situated on either side of a campus, or even spanning a metropolitan area.

Hubs replace the mess of cables in the loop. This simplifies cable management, but bandwidth is still shared between all the devices. With switches, the bandwidth is no longer shared; private loops are established between pairs of devices that wish to communicate with each other. This means that every link between two devices (server or storage) has access to the full 1 Gbps or 2 Gbps of bandwidth. When a device fails or is removed from the loop, the switch bypasses the port so communication around the loop can be maintained.

Linking hubs with a switch provides complementary SAN services such as allowing departmental hubs to be connected with a backup link for higher availability. In the event that one of the primary links between departments has problems, the alternate link can be used to provide improved availability. In addition, a switch allows a longer-distance connection, up to 10 km between two nodes, which allows the SAN to span greater distances for increased disaster tolerance. The performance (concurrency) and department segmentation that are provided with a switch allow the departments to share valuable storage resources and develop common management of the storage resource.

Another type of switch in the SAN environment is the fabric switch, which used frame switching to allow up to 16 million devices to be connected to a single SAN. The fabric switch can support hundreds of switches in a cascade configuration and allow distances of more than 100 km.

4.2.5 Zoning

A key feature of a SAN is zoning, a term used to denote the division of a SAN to provide different levels of connectivity between specific hosts and devices on the network. This gives IT managers the flexibility to support the needs of different groups and technologies without compromising data security. A zone may include multiple subnets and is established by cooperative consent of the hosts or can be enforced at the switch level. In the former case, hosts are responsible for communicating with the switch to determine if they have the right to access a device. There are several ways to implement zoning: hard zones, name server zones, and broadcast zones. Defining a zone or adding or changing devices within a zone is performed via management software that comes with the SAN switch.

Hard Zones

With this method of zoning, the IT manager programs zone assignments into the flash memory of the hub or switch. This ensures that no data traffic can move between devices in different zones, making for the highest degree of security. In cases where more than one switch is assigned to the same zone, a dedicated interswitch link (ISL) guarantees the I/O bandwidth and gives the IT manager the means to balance bandwidth across all hard zones for maximum overall performance. The number of hard zones a SAN switch can support depends on manufacturer and equipment model. Each hard zone can be further subdivided via the name server, segmented loop, or broadcast zone features. This enables the larger fabric to be carved into separate fabrics for specific uses, maximizing switch port efficiency and reducing the number of switches required.

Name Server Zones

This method of zoning allows the IT manager to create zones using either switch ports or world wide names (WWNs) to assign zones. Name server zones can overlap, and all ISLs within a hard zone are available to all the name server zones, providing load balancing for maximum data throughput under heavy loads.

The easiest way to physically map all the devices to a SAN is to define a name server zone that correlates with switch ports. With this method of zoning, all devices are connected to a particular port on a specific switch. But zones based on switch ports can create other problems. First, all devices on the port must be included in the zone; second, if a device is moved from one port to another it may end up in a different zone.

With the WWN method of zoning, a device is assigned to a zone according to its unique name, giving the IT manager the flexibility to install a device, host, or storage unit anywhere within the SAN fabric. A device assigned by WWN will stay in its assigned zone regardless of the physical port that serves as its connection. This type of zoning also eases troubleshooting by allowing the IT manager to move the device at the suspect port location to another port location to verify if the problem is with the port, or if it follows the device to the other port without reconfiguring the zone.

Broadcast Zones

This method of zoning is based on traffic type. Broadcast zones are assigned to separate different types of traffic, such as network traffic (e.g., TCP/IP) from storage traffic (e.g., SCSI), in the SAN environment. By eliminating unnecessary message processing by host and storage connections, broadcast zones reduce traffic on the fabric. Broadcast zones can overlap name server zones, but not hard zones.

4.2.6 Security

Generally, a SAN has the same security needs as a file server network. Fortunately, the application server shields the SAN from end users, so there is no direct desktop access to the contents of the SAN. The application server(s) must provide the security mechanisms to prevent unauthorized access or denial of service attacks. In a heterogeneous server environment, this is a particularly difficult challenge because of the inherent difference of security levels between platforms and the administrator’s experience with server security.

If an attacker does manage to compromise a server, the entire SAN is vulnerable to intrusion, since the breached server may be used as the springboard to all of the logical storage units on the network. There are a few techniques to counter such attacks. The easiest is to use switch zoning in an intelligent way to prevent the whole SAN from being accessible to all servers. Breaking the SAN into subnets with traffic strictly partitioned between servers and storage prevents global access to the SAN.

Logical unit number (LUN) masking is another technique that can thwart an intruder. This technique is implemented on the storage servers by setting permissions for visibility and access to specific devices.

Outside the SAN itself, the IT manager must take reasonable precautions to shield the LAN from eavesdropping or “man-in-the-middle” hacks that replay or alter traffic as it traverses the LAN. This is primarily important only when the data contains sensitive financial, medical, or proprietary information. The servers running the SAN management agents would also be of particular interest to a network interloper. Physical access restrictions can play a key role in minimizing intrusions that originate from within the organization.

4.2.7 SAN Management

The basic tools needed to manage systems on a Fibre Channel fabric are available through the familiar SNMP interface. The Fibre Channel–Arbitrated Loop (FC-AL) MIB approved by the Internet Engineering Task Force (IETF) extends SNMP management capabilities to the multi-vendor SAN environment. Other vendor-specific MIBs will emerge as products are developed with new management features. Switches, hubs, and other central networking hardware provide a natural point for network management. Of course, GUI-based management systems will play a key role in managing storage networks.

One of these GUI-based management solutions comes from Tivoli Systems. The company’s Tivoli Storage Network Manager simplifies the complexity of managing information across the multiple platform and operating environments typical in a SAN. Policy-based automation and expansion capabilities help administrators ensure the availability of mission-critical applications, thereby providing higher storage resource utilization.

Once the SAN elements have been discovered, storage resources assigned, and policies established for monitoring file systems, administrators can then do the following:

  • Continually monitor all the components within the discovered SAN topology;

  • Capture data to be used for reporting on performance, capacity, and service-level planning;

  • Automatically extend supported file systems that are becoming full;

  • Receive automatic notification when file systems exceed a predetermined threshold.

Tivoli Storage Network Manager also generates SNMP traps and Tivoli Enterprise Console (TEC) events to report on all activities that it monitors. These events can then be sent to the designated management console or the designated administrator. Tivoli Storage Network Manager can also be configured to send SNMP traps or TEC events to one or more locations (see Figure 4.4). This is done by entering information in the following fields:

  • IP Address: IP address of a host or device that can receive SNMP traps.

  • Port: Port number that the host or device will use to listen for SNMP traps. The default is 162.

  • Community: Name of the community to which the SNMP host or device is assigned. The default is Public.

    Click To expand
    Figure 4.4: Tivoli Storage Network Manager’s event destinations screen.

Events and data from the SAN are continuously captured and processed, providing information, alerts, and notification to the administrator for problem resolution. The administrator can then launch specific SAN management software from within Tivoli Storage Network Manager to assist in problem closure.

Among the other companies that offer SAN management solutions is EMC, which offers the VisualSAN software suite. One component of the suite is Visual-SAN Network Manager, which automatically discovers, manages, and monitors multi-vendor SAN devices, generating a topology map that depicts the SAN network elements, servers, storage systems, and their interconnects.

By drilling down through the map, the administrator can view which devices and interconnects are active and which need attention. An event correlator collects and consolidates faults, events, and alerts and presents this information in real time. All events are logged and user-defined alerts are generated. The system can be configured to notify the system administrator of fault conditions via e-mail, page, or SNMP trap. This real-time alerting allows the administrator to quickly and effectively manage the entire SAN.

Performance Manager, another component of the Visual SAN software suite, is a module that monitors real-time performance of SANs and renders this data in an intuitive visual format with alert generation. The collected data is used for historical and trending analysis.

Hewlett-Packard also offers a SAN management solution. The company’s OpenView Storage Node Manager offers the following SAN management capabilities:

  • Automatic discovery of devices connected to a SAN.

  • Multidimensional graphical representations of the network.

  • Problem tracking using the topology map and other technologies.

  • Management of Fibre Channel arbitrated loop configurations, as well as fabrics.

Users are also able to set basic levels of service in the SAN and use tools such as SNMP, so that if a storage device or disk is in danger of failing, an alarm will be triggered on the OpenView screen. Also, users are able to set thresholds for storage disks and could receive a warning when the disk is approaching its data saturation point.

A relatively new trend in storage management is the ability of administrators to access NAS and SAN information through a secure Web portal, eliminating the need to jump from console to console to manage different aspects of storage. Instead, they can view all management information and initiate management actions through their browser at the portal. On logging into the portal, administrators can perform a number of critical tasks, including the following:

  • Consolidate information into an enterprise-wide view;

  • Integrate different storage management functions and applications;

  • Collect data from disparate tools and devices to provide a consistent, uniform view of the enterprise storage environment;

  • View only the information an administrator needs to know to perform a given task, such as backup or storage allocation.

Among the storage management vendors that offer such portals is Computer Associates. Its BrightStor product combines storage management access through a single portal and the ability to decouple functional storage needs from the details of storage execution and implementation. Through its instrumentation capabilities, BrightStor learns about the storage environment—configuration, data access patterns, storage utilization, and allocation. Using rules defined by the administrator, the management tool responds to changes in the storage environment, performing automatic, dynamic storage provisioning and other high-level storage management tasks without the administrator needing to know about the details of where capacity is physically located or how it is configured for a specific device.

For example, when new storage capacity in the form of a NAS device on the network or another disk array on the SAN is added to the environment, BrightStor will automatically find the new capacity and apply its policies to appropriately configure the new capacity and migrate the data volumes to it for purposes of load balancing, data protection, or performance management. It will then update the backup processes and policies to ensure the data is properly backed up in its new location.

By decoupling functional storage needs from the details of storage execution and implementation, the addition of new capacity is facilitated, since the labor-intensive task of manually configuring the storage, migrating data, and updating backup scripts is eliminated. This decoupling also enables administrators to define policies to automate storage operations and manage workflow without having to manually execute those operations and processes on diverse, individual storage systems and devices. These capabilities can dramatically increase personnel efficiencies while reducing the opportunities for potentially disastrous human error.

BrightStor instrumentation relies on agents that collect and process data from the elements of the storage management system, normalize the data, analyze it, and use it as the basis for initiating intelligent, automated actions. Two types of instrumentation agents are used. An XML-based sponsor agent collects data from applications and devices. Once a storage element has been instrumented, the agent can be redirected to serve a variety of other management needs.

A gateway agent handles data communication required to support management services, offering transport (e.g., Hypertext Transfer Protocol), providing management control, and minimizing network traffic loads. For example, an administrator may need to know the status of all backup jobs across the enterprise. Typically, this would require the administrator to launch the management console for each backup product in use. With BrightStor, however, the administrator working at the portal simply invokes a method that collects the information from instrumentation for BrightStor and numerous other storage solutions from different vendors. The information is aggregated and normalized and presented to the administrator, who can now see backup status across the enterprise at a glance. In another scenario, the administrator may want to look at disk utilization across the enterprise. Again, instead of launching management consoles for the different disk storage systems, the administrator simply invokes a method that reports capacity utilization data.

4.2.8 Management Interoperability

While standards have been developed for Fibre Channel technology, different interpretations of the standards by vendors have resulted in products that may not work together on the same network. As a result, interoperability problems still plague the SAN industry, particularly in the area of management. Many vendors are now working on standards through organizations such as the SNIA, the Distributed Management Task Force (DMTF), the Fibre Channel Industry Association (FCIA), the Fibre Alliance, and the Open System Fabric Initiative (OSFI).

SNIA’s storage management initiative started with CIM-SAN-1, an approach that manages multi-vendor SANs through a single management backbone built on the DMTF’s Common Information Model (CIM) and Web-Based Enterprise Management (WBEM) technologies. In integrating multiple management clients with storage networking devices that comprise a multi-vendor SAN configuration, CIM-SAN-1 simplifies storage management for users.

The CIM-SAN-1 provides security, locking, and discovery features for SAN management. It provides enterprises with a standard for managing devices such as disk arrays, switches, and hosts in a SAN by specifying a common model of device behavior and a common language to read and set control information. Large management vendors, including IBM, are already supporting CIM-SAN-1. IBM supports it in its SAN-wide file system and storage virtualization engine to extend the concept of SAN interoperability beyond basic system identification and monitoring to more comprehensive and efficient management capabilities. The company’s storage management software products from Tivoli are expected to integrate COM-SAN-1 as well.

The success of COM-SAN-1 resulted in SNIA’s Storage Management Initiative (SMI), which is driving the first common and interoperable management backbone for large scale, multi-vendor storage networks. Version 1.0 of the SMI specification was released for formal SNIA review in December 2002. Its development is expected to result in more powerful management applications that reduce the cost of management and allow storage networking vendors to ship management interface technology with reduced costs and faster time-to-market. SNIA members are being encouraged to join the new Storage Management Forum to accelerate the SMI program so that all storage can be managed by the SMI in 2005.


4.3 Emerging Role of IP

One of the hottest new trends in building storage networks is the use of the ubiquitous IP. Nishan Systems, for example, has launched a development effort that it claims is the definitive convergence of storage and networking. The company’s Storage over Internet Protocol (SoIP) connects storage devices and servers more economically than Fibre Channel and ATM. Along with its strategic partners, Nishan intends to offer fully interoperable products that allow organizations to access and share stored data in a high-performance, manageable, and scalable SAN. And since the products are based on the worldwide standard IP and Gigabit Ethernet, they will be fully compatible with the vast installed base of routers and switches that IT professionals are already familiar with.

Another protocol, IP SAN, also known as iSCSI for Internet protocol small computer system interface, uses the IP networking infrastructure to transport large amounts of block storage data over existing LANs and WANs. Among the companies with IP SAN solutions is IBM. The company’s IP Storage 200i provides storage that is directly attachable to an Ethernet LAN. This solution supports heterogeneous Windows NT, Windows 2000, and Linux clients, enabling users to take advantage of many SAN-like capabilities without the infrastructure and support cost of Fibre Channel SAN environments.

With the potential to support all major networking protocols, IP SAN can unify network architecture across an entire enterprise, reducing the overall network cost and complexity, while ensuring widespread availability. To facilitate administration, IP SAN can use known network management tools and utilities that have been developed for IP networks. IBM’s IP Storage 200i, for example, comes with a browser-based interface that allows system administrators to easily configure the system, set permissions, and implement changes from anywhere on the network.

To meet an organization’s diverse connectivity requirements, there are single-product solutions that address the challenges of connecting multiple SAN islands across a variety of network topologies. Entrada Networks, for example, offers a SAN over IP switch called Silverline. The switch features an assortment of network connection options that include T3 for today’s ATM-based WANs, OC-3 and higher feeds for WAN/MAN networks, and Gigabit Ethernet for implementing SANs over existing high-speed IP networks. In supporting connectivity for the most commonly used WAN services, this solution meets today’s current and emerging storage needs, while allowing for future technology migration, bandwidth scalability, and convergence.

Another IP-based storage solution comes from StoneFly, which offers the benefitsof SANs through inexpensive, easy-to-maintain IP SAN appliances called storage-concentrators. The units combine the functionality of an iSCSI-based storage router, bridge, and extensible logical volume manager to provide organizations with an end-to-end storage provisioning solution and a simple way to manage storage assets, increase administrative productivity, and reduce network complexity. Through a Web browser, administrators can manage storage operations, including controlling distributed storage concentrators, centrally and securely from anywhere on the Internet.

Storage concentrators consolidate SAN block data to move intelligence to the network core to allow easy management of storage assets, as well as interoperability and scalability, to reduce the complexity and total cost of ownership of SANs. The concentrators provide in-band iSCSI block-level storage pooling to enable administrators to access storage without the need to know where the devices are located on the network or how they are configured. Virtual volumes are delivered to hosts connected over existing Ethernet networks, without the need for host-based agents or a separate metadata out-of-band storage management device.


4.4 Storage Virtualization

Virtualization fulfills a role for storage similar to what an operating system does for a computer system; it makes programming and operation simpler by automating resource management housekeeping functions. The abstraction of storage enables organizations to pool a wide range of storage technologies from different vendors and to easily add capacity and automatically move data among devices, independent of operating systems or network infrastructure. In separating the representation of storage to the server operating system from actual physical storage, a centrally managed storage resource can be created whereby vast amounts of physical capacity can be pooled across the enterprise for dependable presentation to application servers, wherever they may be.

The virtualization technology allows disks of different capacities and data protection levels to be created from a set of physical disks. Virtualization occurs within the storage pool, which contains all the storage assets that an organization chooses to deploy, regardless of vendor. Initially, the pool scales to satisfy the needs of a modest number of application servers, but over time, long-distance extension technologies can be used to scale the pool to a global dimension.

The goal of virtualization is to standardize and centralize storage management in a heterogeneous storage and/or host environment. This includes such functionality as LUN masking, LUN mapping, disk pooling, dynamic multi-pathing (DMP), and imaging. It could even include data replication. Virtualization decouples the relationship between physical disk and logical volumes, allowing customized logical volume sizes to be presented to the applications based on need rather than physical limitations. There are several approaches to virtualization, depending on where the virtualization is implemented: host, storage unit, or appliance.

Host

This method of virtualization is either packaged with the operating system or made available as an add-on product. It allows administrators to put one or more physical disks into a logical group and then split that group into one or more logical volumes. From there, data can be stored on those logical volumes as though they were physical disks of a specified size. Host-based virtualization also allows administrators to access advanced storage management functions such as mirroring, RAID sets, redundant paths, and hot backups (by using mirror splits or images).

Management of the virtualization must be done on a host-by-host basis, however, which eliminates the opportunity for centralized global storage management.

Storage

This approach allows for movement between different RAID groups without data loss, as well as automatic migration of data from one RAID group to another based on the frequency of data access. This method of virtualization also permits the creation of multiple data mirrors, which provide additional availability when one of the mirrors is split for hot backups. In moving these functions off the host and onto the storage subsystem, the host is relieved of the overhead burden. Storage-based virtualization also takes the availability of storage beyond what host-based virtualization provides, offers the flexibility to modify LUN size, and enables multiple hosts to see the same LUNs, which is particularly critical with high availability clustering and remote replication.

Appliance

This scheme provides virtualization between hosts and the storage, providing administrators with the same level of control and centralization across the storage architecture. There are two kinds of appliance-based virtualization products: in-band and out-of-band. With in-band, the appliance is physically located between the host and the storage. The appliance takes the disk requests from the host and fulfills the host’s request from the storage attached to the other side of the appliance. This functionality is transparent to the host because the appliance presents itself as disk. In-band virtualization reduces the amount of administrative time needed to load drivers onto each operating system platform. Since in-band virtualization’s presentation of storage to the host is indistinguishable from that of a normal disk drive, drivers need not be loaded on each host. However, there is a risk of overloading the appliance if several hosts make simultaneous disk requests, so the implementation of redundant appliances should be considered.

Out-of-band appliances logically present themselves as if they are located between the host and storage, but they actually reside elsewhere. A special driver is installed under the host’s disk driver so that the appliance driver receives logical-to-physical block mappings from the appliance. When the disk driver accesses the disk, it is actually accessing the appliance’s driver. The appliance driver then translates the block information and accesses the correct storage blocks. The virtualization appliances use pointers to manage the disk pool. Because it has no direct interaction with the host or the storage during I/O operations, the system delivers nearly the original disk performance.

Virtualization appliances are the management platform. They treat hosts and storage subsystems as commodities and perform all functions as a third-party overseer. They eliminate vendor-specific management by handling RAID levels, point-in-time backups, remote replication, LUN masking, and security.

Some vendors claim that SANs and virtualization are the same thing. But SANs do not include software to handle all storage media types and accommodate secondary storage. On the other hand, most virtualization products are limited to disk subsystems, and hard disks only address part of the storage equation. True storage virtualization software encompasses all devices and media types, as well as the ability to incorporate secondary storage devices such as tape and optical libraries, where data is stored away from the primary environment.


4.5 Testing

Until recently, SAN test solutions were typically developed in-house, using real servers, storage equipment, and internally developed software. With the increasing scale of SAN infrastructures, however, even Fibre Channel SAN equipment manufacturers and SAN solution integrators needed a way to perform interoperability and scalability testing that is less resource-intensive and physically challenging.

Off-the-shelf test platforms have become available that enable the realistic characterization of fabric performance. One of these test platforms is Agilent’s 1730 SAN test system, which provides the controlled environment necessary for efficiently testing complex SANs before they are deployed. Using a combination of hardware and software, the Agilent 1730 SAN test system enables Fibre Channel traffic generation at wire speeds of 1 or 2 Gbps, with allowances for any combination of data, error, link, fabric control, and fabric server traffic.

The system’s test controls can be used to set a number of variables that simulate specific traffic conditions in the target SAN under test. These variables include port behavior, frame level parameters, specific error types, interframe gap size, traffic topology, buffer-to-buffer credit, and burst mode traffic.

Live measurement results can be monitored while a test is running so observations can be made on how the fabric handles various traffic conditions and recovers from unexpected disruptions, such as a link down at multiple ports. Traffic loads can also be changed while the test is running, which provides insight into network performance. Customized test suites can be developed using TCL/CK scripting language, and all SAN test system features and capabilities are accessible through APIs.


4.6 Conclusion

Companies faced with a continuous bombardment of information are turning to SANs to house, manage, and protect this vital asset. While NAS is intended for data access at the file level, SANs are optimized for high-volume block-oriented data transfers. Although both solutions address the need to remove direct storage-to-server connections to facilitate more flexible storage access, SANs provide a higher-performance and more scalable storage environment. They achieve this by enabling many direct connections between servers and storage devices—such as disk storage systems and tape libraries—over a variety of transports. The choice between Fibre Channel, Gigabit Ethernet, IP, or ATM will hinge on such factors as the distance between storage locations, the presence of other types of traffic, and the organization’s budget constraints.

But different physical storage types on the network can create a significant management dilemma. A single logical view of storage using virtualization techniques can streamline data access and management. Within an organization, storage devices or resources of different types can be located either in different locations or be centrally located within a controlled environment. This kind of media blending, or virtualization, can facilitate a more efficient storage network and provide a scalable solution that is more cost-efficient to manage.

When hiring new IT people to administer the SAN, it is recommended that the job description include and that preference be given to individuals who have taken SNIA’s Storage Networking Certification Program (SNCP). This is the storage industry’s leading vendor-independent certification program for storage networking, which was developed to establish standards and expectations for measuring the storage networking expertise of IT professionals. The program allows IT professionals to demonstrate their storage networking skill level to current and future employers by equipping them with the expertise required to successfully complete the SNIA certification process and exams.


Chapter 5: Managing Bridges, Routers, Gateways

5.1 Introduction

LANs have become the primary means of moving data between computers and accessing applications and services. The largest companies may have hundreds of LANs among their locations worldwide—at the headquarters, research facilities, manufacturing plants, sales branches, and service centers—interconnecting tens of thousands of employees. Even many of their employees may have LANs at home for sharing computer peripherals, applications, and a broadband Internet connection. Depending on the specific situation, interconnectivity between locations is accomplished through the use of repeaters, bridges, routers, and gateways. Although the functionality of each is often embedded into a single device, the differences are best illustrated by discussing their relationship to the seven-layer OSI reference model.

  • Layer 1 (Physical). In the digital environment of LANs, repeaters can be used to boost incoming signals for transmission over longer distances. But they also amplify noise. A better device is a regenerator, which reissues incoming 1s and 0s. On the output side, this eliminates noise from the transmission, ensuring consistent signal quality end-to-end. Repeaters and regenerators lack the intelligence to distinguish between frames, but they effectively increase the distances of Ethernet or token-ring networks. There is a limit on the number of repeaters and regenerators that can be used to extend the LAN before delay becomes a problem. But this can be overcome by using fiber-optic extenders, which are also Layer 1 devices.

  • Layer 2 (Data Link). A bridge connects LANs at a relatively low level, the data link layer (DLL); specifically the LLC sublayer. The bridge moves traffic between LAN segments by filtering the source and destination addresses of the packets offered to it. Since it only reads addresses and looks no further into the packets, it does not care what protocol is used. This means that a bridge can interconnect DECnet, TCP/IP, or Xerox Network System (XNS) networks, for example, without being concerned about higher level protocols. These devices can also be used to bridge data between different media types, such as Ethernet and FDDI or token ring to Ethernet. Another DLL sublayer is the MAC, which regulates access to the LAN. All bridges attach to the LAN at this sublayer, just like a computer does via a NIC.

  • Layer 3 (Network). A router selects the optimal path for packets offered to it based on such metrics as destination, QoS, and traffic type. Since the router looks deeper into the packets, it is protocol sensitive. For instance, a router could be used to connect a LAN running IP over Ethernet with a WAN running IP over frame relay.

  • Layer 4 (Transport). The transport layer is an end-to-end process that complements Layer 3. If IP packets, for example, do not arrive at their destination or arrive as errored packets, TCP operating in the client device requests a retransmission. TCP also puts IP packets arriving out of sequence into the proper order before passing them to the higher layers.

  • Layers 5–7 (Session, Presentation, and Application). A gateway employs protocol conversion and other translations to connect different types of networks, such as voice over IP (VoIP) to the public-switched telephone network (PSTN). In essence, the facilities of one network must be converted to the equivalent facilities of the second type of network. Because of the amount of processing that must be done, gateways are much slower compared to bridges and routers in terms of the common performance metric— packets per second (pps).

A specified protocol may be either routed or bridged on a given interface, but not both. In other words, while the same device can handle both bridging and routing functions, routed traffic is confined to the routed interfaces and bridged traffic is confined to bridged interfaces. Whether used for bridging or routing, or both, the device is configured by the vendor or IT staff using an extensive array of commands.

Repeaters, bridges, routers, and gateways are manageable with the SNMP or the element management system (EMS) supplied by the vendor. The difference is that SNMP uses a text-oriented command line interface to implement basic functions, whereas the EMS is a GUI that makes the SNMP functions easier to implement. Vendors may also provide their EMSs with proprietary features. Chapter 11 discusses network management in more detail.


5.2 Bridges

Depending on the situation facing network managers, bridges can be used to either extend or segment LANs. At one level, bridges can be used for segmenting LANs into smaller subnets to improve performance, control access, and facilitate fault isolation and testing without impacting the overall user population. At another level, they are used to create an extended network that greatly expands the number of devices that can be supported and the services available to each user. Bridges may even offer additional features such as data compression, which has the effect of providing greater throughput over low-speed lines. Compression ratios of 2:1 all the way down to 6:1 may be selected by the network manager, depending on what the vendor offers with a specific product.

As noted, bridging occurs at the data link layer (see Figure 5.1), which provides physical addressing, manages access to the physical medium, controls data flow, and handles transmission errors. Bridges analyze incoming frames, make forwarding decisions based on the source and destination addresses of those frames, and then forward the frames to their destinations. Sometimes, as in source-route bridging, the frame contains the entire path to the destination. In other cases, as in transparent bridging, frames are forwarded one hop at a time toward the destination.

Click To expand
Figure 5.1: Bridge functionality in reference to the OSI model.

Bridges can be either local or remote. Local bridges provide direct connections between many LAN segments in the same area. Remote bridges connect LAN segments in different areas, usually over telecommunication lines. There are several kinds of bridging and all may be supported in the same device:

  • Transparent bridging —used mostly in Ethernet environments that have the same media types, these bridges keep a table of destination addresses and outbound interfaces.

  • Source-route bridging —used mostly in token-ring environments, these bridges only forward frames based on the routing indicator contained in the frame. End stations are responsible for determining and maintaining the table of destination addresses and routing indicators.

  • Translation bridging —used to bridge data between different media types, these devices typically go between Ethernet and FDDI or token ring to Ethernet.

  • Source-route translation bridging —this is a combination of source-route bridging and transparent bridging that allows communication in mixed Ethernet and token-ring environments. (Translation bridging without routing indicators between token ring and Ethernet is also called source-route transparent bridging.)

5.2.1 Transparent Bridging

The engine for transparent bridging is the spanning tree algorithm (STA), which dynamically discovers a loop-free subset of the network’s topology. The STA accomplishes this by placing active bridge ports that create loops into a standby or blocked condition. A blocked port can provide redundancy in that if the primary port fails, it can be activated to take the traffic load.

The spanning tree calculation is triggered when the bridge is powered up and whenever a change in topology is detected. A topology change might occur when a forwarding port is going down (blocking) or when a port transitions to forwarding and the bridge has a designated port, which also indicates that the bridge is not standalone. Configuration messages known as bridge protocol data units (BPDUs) actually trigger the spanning tree calculation. These messages are exchanged between bridges at regular intervals set by the network manager, usually 1 to 4 seconds.

Once a change in topology is detected, this information must be shared with all bridges on the network. This is a two-step process that starts when a bridge notifies the root bridge of the spanning tree by sending it a special BPDU known as a topology change notification (TCN). The bridge sends the TCN out over its root port. The root bridge acknowledges the message by sending back a normal configuration BPDU with the topology change acknowledgment (TCA) bit set. The second step in the topology update process entails the root bridge sending out configuration BPDUs with the topology change (TC) bit set. These BPDUs are relayed by every bridge, so they can become aware of the changed topology.

There are some problems associated with spanning tree. The more hosts on the network, the higher the probability of topology changes. For example, a directly attached host, such as a client or server, will trigger a topology change when powered off, then go on to clear an operating system problem. In a large, flat network, the point can be reached when it is continually in topology change status. The resulting high level of flooding can lead to an unstable STP environment. To deal with this problem, vendors have come up with ways to avoid TCN generation for certain events. For example, the network manager can configure the bridge so that it issues a TCN when a server is power cycled, but not when client devices are power cycled. If a bridge port going up or down is not deemed an important event, this event too can be programmed not to issue a TCN.

5.2.2 Source-Route Bridging

Source-route bridging (SRB) is used in the token-ring environment as the method by which a station establishes a route through a multiple-ring network to its destination. The first step for a station to reach another is to create a packet called an explorer. This packet is copied by all bridges in the network, with each of them adding information about itself before passing it on. The explorer packet’s routing information field (RIF) contains the information of where it has traversed through the network and within the RIF; a route descriptor stores the path it has taken through the network.

As the explorer packet is constructed on its way through the network, the destination station will start receiving data packets from the originating station. Based on the contents of the explorer packet, the destination station will then decide which route to use to send data packets back to the originating station. Or it will send its own explorer packet so that the originating station can determine its own route.

The explorer packet is limited in terms of how many rings it can hold in the routing information field. Although the RIF can hold a total of 14 rings, IBM long ago limited this to seven. Other vendors also adopted this limitation. Consequently, an explorer packet that has traversed seven rings will be dropped in the network. To control traffic in the network with more precision, parameters can be set in the bridge to decrease this number even further, so that packets that reach X number of rings (any number below seven) will be dropped.

While explorers are limited to traversing only seven rings, in a meshed ring environment, one explorer can finish being copied by many bridges, which can cause too many explorers. Explorer storms can be prevented in redundant network topologies by setting the bridge to filter out explorers that have already been forwarded once. Since explorer traffic can be distinguished from regular source route traffic, the network manager can issue commands that check the bridge for various parameters, such as the number of explorers that were dropped outbound on that interface.

5.2.3 Translation Bridging

While Ethernet has become the network of choice for new installations, there is still a good amount of token ring in use, making it necessary to mix the two environments for data exchange. Doing so is complicated because some very fundamental differences between Ethernet and token ring must be reconciled. Token ring has functional addresses, while Ethernet primarily relies on broadcasts.

Furthermore, MAC addresses on the Ethernet are different from MAC addresses on the token ring. Ethernet does not have a source-route bridging capability and token ring has a routing information field. Finally, token ring and Ethernet use different methods to read the bits into their adapters.

To unify the two environments, vendors have come up with various methods such as translation bridging. This is a type of bridging that is implemented on networks that use different MAC sublayer protocols, providing a method of resolving differences in header formats and protocol specifications. Since there are no real standards in how communication between two media types should occur, however, no single translation implementation can be called correct. The only consideration for network managers is to select a method of translation and implement it uniformly throughout the network.

Essentially, the bridges reorder source and destination address bits when translating between Ethernet and token-ring frame formats. The problem of embedded MAC-addresses can be resolved by programming the bridge to look for various types of MAC addresses. Some translation-bridges simply check for the most popular embedded addresses. If others are used, the bridge must be programmed to look for them as well. But if translation-bridging software runs in a multi-protocol router, which is very common today, these protocols can be routed and the problem avoided entirely.

Token ring’s RIF field has a component that indicates the largest frame size that can be accepted by a particular source-route bridging implementation. Translation bridges that send frames from the transparent-bridging domain to the SRB domain usually set the maximum transfer unit (MTU) field to 1,500 bytes to limit the size of token-ring frames entering the transparent-bridging domain, because this is the maximum size of Ethernet frames. Some hosts cannot process this field correctly, in which case translation bridges are forced to drop the frames that exceed Ethernet’s MTU size.

Bits representing token-ring functions that are absent in Ethernet are discarded by translation bridges. For example, token ring’s priority, reservation, and monitor bits are discarded during translation. And token ring’s frame status bits are treated differently, depending on the bridge manufacturer; the products of some manufacturers may even ignore these bits.

Sometimes, the bridge will have the C bit set, indicating that the frame has been copied, but not the A bit set, indicating that the destination station recognizes the address. In the former case, a token-ring source node determines if the frame it sent has become lost. Advocates of this approach claim that reliability mechanisms, such as the tracking of lost frames, are better left for implementation in Layer 4 of the OSI model. Advocates of setting the C bit argue that this bit must be set to track lost frames, but that the A bit cannot be set because the bridge is not the final destination.

Translation bridges also can be used to create a software gateway between the token ring and Ethernet domains. To the SRB end stations, the translation bridge has a ring number and a bridge number associated with it, so it looks like a standard source-route bridge. In this case, the ring number reflects the entire transparent-bridging domain. To the transparent-bridging domain, the translation bridge is just another transparent bridge.

When bridging from the SRB domain to the transparent-bridging domain, SRB information is removed. Token ring’s routing information fields usually are cached for use by any subsequent return traffic. When bridging from the transparent bridging to the SRB domain, the translation bridge checks the frame to see if it has a multicast or unicast destination. If the frame has a multicast or broadcast destination, it is sent into the SRB domain as a spanning-tree explorer. If the frame has a unicast address, the translation bridge looks up the destination in the RIF cache. If a path is found, it is used and the RIF information is added to the frame; otherwise, the frame is sent as a spanning-tree explorer.

5.2.4 Source-Route Translation Bridging

Another solution to unify the Ethernet and token-ring environments is source-route translation bridging (SRTLB). This entails the addition of bridge groups to the interfaces of both the token ring and Ethernet bridges to create a transparent bridge domain between the two environments. The bridges at each end are responsible for establishing the path through the network. When a bridge on a token ring receives a packet from an Ethernet, for example, path establishment is handled as follows (see Figure 5.2):

Click To expand
Figure 5.2: Source-route translation bridging, from token ring to Ethernet.

  1. Bridge-1 receives a packet from the Ethernet. This is from PC-1 to the host.

  2. Bridge-1 needs a RIF to reach the host, so it creates an explorer to learn the path to reach the host.

  3. After Bridge-1 receives the response, it sends the response (without a RIF) to the Ethernet station.

  4. PC-1 sends an exchange identifier (XID) to the host MAC address.

  5. Bridge-1 gets the Ethernet packet, attaches the RIF to the host, and sends the packet on its way.

As far as the host is concerned, the Ethernet is sitting on a pseudo ring. This is configured with the source-bridge transparent command on the bridge. The pseudo ring makes the host treat the Ethernet as if it were a token ring.


5.3 Routers

Routers are similar to bridges in that both provide filtering and bridging functions across the network. But while bridges operate at the physical and data link layers of the OSI reference model, routers join LANs at the network layer (see Figure 5.3). Routers convey LAN protocols over the WAN to remote locations. Routers distinguish among network layer protocols—such as IP, Internet package exchange (IPX), and AppleTalk—and make intelligent packet delivery decisions using an appropriate routing protocol. They can be used to segment a network with the goals of limiting broadcast traffic and providing QoS and redundant paths. Some routers can perform packet filtering to control the kind of traffic that is allowed to pass through them, providing a firewall that enforces security policy.

Click To expand
Figure 5.3: Routers operate at the network layer of the OSI reference model.

Routers may be deployed in mesh as well as point-to-point networks and can perform bridging over separate interfaces. A router can also provide multiple types of interfaces, including those for T-carrier and optical carrier, frame relay, ISDN, ATM, cable networks and digital subscriber line (DSL) services, among others.

Although routers include the functionality of bridges, they differ from bridges in the following other ways: they generally offer more embedded intelligence and, consequently, more sophisticated network management and traffic prioritization capabilities than bridges. Unlike bridges, routers also offer flow control and error protection capabilities. Perhaps the most significant distinction between a router and a bridge is that a bridge delivers packets of data on a best-effort basis, whereas a router takes a more intelligent approach to getting packets to their destination—by selecting the most economical path (i.e., least number of hops) based on its knowledge of the overall network topology, as defined by its internal routing table.

5.3.1 Types of Routing

There are two types of routing: static and dynamic. In static routing, the network manager configures the routing table to set fixed paths between two routers. Unless reconfigured, the paths on the network never change. Although a static router will recognize that a link has gone down and report the event, it will not automatically reroute traffic. A dynamic router, on the other hand, reconfigures the routing table automatically and recalculates the most efficient path in terms of offered traffic load, available bandwidth, and number of hops (routers) to the destination.

Some routers balance the traffic load across multiple access links, providing an N × T1 inverse multiplexer function. This allows multiple T1 access lines operating at 1.544 Mbps each to be used as a single higher bandwidth facility. If one of the links fails, the other links remain in place to handle the offered traffic. As soon as the failed link is restored to service, traffic is spread across the entire group of lines per the original configuration. If all the available bandwidth is in use, additional traffic will be held back until bandwidth is freed. Applications will get the bandwidth based on their priority designations.

5.3.2 Types of Routers

Routers span the gamut from relatively simple products for home and small-office use, to more complex products for the enterprise, to the largest routers used on WAN backbones that may be metropolitan, regional, or national in scope. Today’s routers are highly modular and upgradeable via software to provide more features and handle more protocols.

Consumer-Class Routers

At the low end is a consumer class of routers that provides shared access to the Internet over cable or DSL. These fixed-configuration devices include network address translation (NAT), which provides a basic level of protection for the home network by hiding internally used IP addresses from the public Internet. (This is different from a true firewall, which uses rules to determine whether traffic is allowed to pass into or out of the home network.) Acting as a Dynamic Host Configuration Protocol (DHCP) server for the network, the cable/DSL router is the only externally recognized Internet device on the internal network. All the users given an IP address by the router are hidden behind the NAT mechanism, which filters incoming and outgoing requests, helping to keep unwanted traffic off the LAN. The router can also be set up to block internal users’ access to the Internet. And while a typical router may have to rely on an external hub or switch to share its Internet connection, today’s cable/DSL routers also include the functions of a switch, allowing each port to provide the full duplex speed of 10/100 Mbps.

Some of these products are growing in sophistication to support telecommuting environments through the creation of virtual private networks (VPNs) that allow users to access the corporate network over secure connections through the Internet. At the same time, such routers can be configured so that one or more of the private IP addresses can be dissembled from the rest of the address block to become a public IP address so outside users can access an internal user without getting blocked by the firewall. An example of when this configuration might be necessary is to support a user who wants to run an audio or video application like Microsoft’s NetMeeting and needs to be able to place calls and accept calls via the PC. Normally, such traffic would be blocked by the firewall. Another way to run such applications is to configure the firewall so that the ports used by NetMeeting and similar applications are not blocked. The port numbers for these applications are usually listed on the Web sites of the product vendors.

Access Routers

This is another type of low-end product, but one that is intended for corporate environments, specifically branch offices. These are usually modular devices available in Ethernet and token-ring versions, which support a limited number of protocols and physical interfaces. They provide connectivity to high-end multi-protocol routers, allowing large and small nodes to be managed as a single logical enterprise network.

These devices provide routing, firewall, and VPN functions. When configured for VPN use, some routers can be equipped with optional hardware-based encryption to offer throughput performance up to full-duplex T1/E1 speeds. For voice applications, these routers support analog and digital communications with the addition of various WAN interface cards, allowing them to work with the existing telephone infrastructure, while providing VoIP or voice over frame relay (VoFR). Supported WAN technologies include broadband DSL, ISDN, leased lines, and frame relay. For serial connectivity, an optional integrated CSU/DSU is also available.

Backbone Routers

Backbone routers are used for building highly meshed internetworks. In addition to allowing several protocols to share the same logical network, these devices aggregate bandwidth from multiple smaller sites, pick the shortest path to the end node, balance the load across multiple physical links, reroute traffic around points of failure or congestion, and implement flow control in conjunction with the end nodes. They also provide the means to tie remote branch offices into the corporate backbone, which might use such WAN services as TCP/IP, T1, ISDN, and ATM. Some vendors also provide an optional interface for switched multi-megabit data service (SMDS), but support for this service is scheduled to end in 2003. The few remaining carriers that support SMDS have moved their customers to other fast-packet technologies.

The backbone routers support a variety of optical technologies, including SONET and resilient packet ring (RPR), which doubles network bandwidth over traditional SONET rings while maintaining sub-50-ms network restoration. This makes such routers useful for extending Ethernet and IP services across metropolitan areas. For companies without metro infrastructures of their own, the managed Ethernet services offered by carriers may be an economical alternative. The carrier supplies and manages the backbone router, which is located on the customer premises. In essence, the customer’s location becomes a node on the carrier’s network.

5.3.3 Routing Protocols

Each router on the network keeps a routing table and moves data along the network from one router to the next using such protocols as the Routing Information Protocol (RIP) and Open Shortest Path First (OSPF). There are numerous other special-purpose routing protocols, including the Border Gateway Protocol (BGP), Resource Reservation Protocol (RSVP), and Protocol Independent Multicast (PIM). Other protocols can be added to routers to enhance quality of services, such as Differentiated Services (Diff-Serv). One of the latest innovations in routing protocols is Multi-Protocol Label Switching (MPLS), which delivers QoS and security capabilities over IP networks, including VPNs.

Routing Information Protocol

RIP is the older of the two major routing protocols. Although still supported by many vendors, it does not perform well in today’s increasingly complex networks. As the network expands, routing updates grow larger under RIP and consume more bandwidth to convey the information to other routers on the network. When a link fails, the RIP update procedure slows route discovery, increases network traffic and bandwidth usage, and may cause temporary looping of data traffic. Also, RIP cannot calculate routes based on such factors as delay and bandwidth, and its line selection facility is capable of choosing only one path to each destination.

Open Shortest Path First

The newer routing standard, OSPF, overcomes the limitations of RIP and even provides capabilities not found in RIP. The update procedure of OSPF requires that each router on the network transmit a packet with a description of its local links to all other routers. On receiving each packet, the other routers acknowledge it, and in the process, distributed routing tables are built from the collected descriptions. Since these description packets are relatively small, they produce a minimum of overhead. When a link fails, updated information floods the network, allowing all the routers to simultaneously calculate new tables.

Border Gateway Protocol

As more mission-critical business applications become available over the Internet and corporate intranets and extranets, there is increasing need for equipment-based restoral/protection processes to keep paths continuously available. On a highly meshed TCP/IP-based intranet, for example, routers are capable of diverting traffic around failed nodes or points of congestion, but often the access links must be protected as well.

One way to do this is by implementing the BGP, which balances the traffic between two carriers. When different paths to the same destination are available, BGP chooses the single best path for reaching that destination based on such metrics as next hop, administrative weights, local preference, origin of the route, and path length. Once the path is selected, all the traffic goes out over that path. An alternative to per-destination load balancing is per-packet load balancing, whereby individual packets are distributed evenly between the two links. In either scenario, if one of the links goes down, the other link takes all of the traffic.

Resource Reservation Protocol

For real-time applications like VoIP, this protocol reserves network resources and prioritizes traffic to guarantee QoS over the IP network. RSVP runs on top of IP to provide receiver-initiated setup of resource reservations on behalf of an application data stream. When an application requests a specific QoS for its data stream, RSVP is used to deliver the request to each router along the path the data stream will take and maintain router and host states to support the requested level of service. In this way, RSVP essentially allows a router-based network to mimic a circuit-switched network on a best-effort basis.

At each node, the RSVP program applies a local decision procedure, called admission control, to determine if it can supply the requested QoS. If admission control succeeds, the RSVP program in each router passes incoming data packets to a packet classifier that determines the route and the QoS for each packet. The packets are then queued as necessary in a packet scheduler that allocates resources for transmission on a particular link. If admission control fails at any node, the RSVP program returns an error indication to the application that originated the request.

RSVP is a stateful protocol, meaning that the network nodes must coordinate with each other to set up a path, and then remember state information about the flow. This can be an overwhelming task on the Internet, where millions of flows may exist across a router. The RSVP approach is now considered too unwieldy for the Internet but appropriate for smaller enterprise networks.

Differentiated Services

Applications like Web browsing and e-mail work well with the best-effort QoS provided by the Internet. With best-effort services, however, data can easily be lost or delayed. The emergence in recent years of high-bandwidth and delay-sensitive applications such as VoIP, video over IP, and VPNs has prompted development of improved Internet QoS levels. The older RSVP, based on a sophisticated perconnection signaling system, requires routers in the network to agree to a specific level of service. For this reason, RSVP is complex to deploy and does not scale well.

One of the newest attempts to remedy the deficiencies of RSVP is Diff-Serv, a simple technology that allows large corporate IP backbone users to quickly deploy different QoS levels. Diff-Serv employs a stateless approach that minimizes the need for nodes in the network to remember anything about flows. This method is not as good as the stateful approach but more practical to implement across the Internet. Diff-Serv devices at the edge of the network mark packets in a way that describes the service level they should receive. Network elements simply respond to these markings without the need to negotiate paths or remember extensive state information for every flow. In addition, applications do not need to request a particular service level or provide advance notice about where traffic is going.

Instead of the complex dynamic signaling of RSVP, various types of traffic requiring different QoS have different tags applied. With Diff-Serv, instead of handling each voice connection separately, for example, all traffic with the same tag is treated in the same way. This built-in aggregation mechanism is an important reason why Diff-Serv can scale to support larger environments.

A router’s forwarding process modified by a Diff-Serv marking is known as a per-hop-behavior (PHB). A PHB defines forwarding behavior that stretches across a network to provide a particular class of service. Among the PHBs are default and expedited. Default PHB is defined as today’s best-effort service. Expedited PHB is the other extreme: low absolute delay, low delay variation, and low packet loss.

Diff-Serv is implemented in two types of routers: traffic conditioners and DS-capable. Traffic conditioners perform sophisticated traffic classification, monitoring, shaping, scheduling, and marking. They are most likely to be access routers. DS-capable routers have scheduling capabilities and modify their forwarding behavior based on the markings. They are most likely to be backbone routers. This separation of function is another reason for the simplicity of Diff-Serv—most of the complexity is in the traffic conditioner, which is at the edge of the network. At the same time, DS-capable routers in the core need only support modified forwarding operations.

Protocol Independent Multicast

For applications that rely on content streaming, network performance can be greatly improved with PIM. With this routing protocol, instead of sending out 100 information streams to 100 subscribers, only one information stream is sent from the source server. The multicast routers replicate and distribute the stream within the network to only the nodes that have subscribers (see Figure 5.4) who requested the stream through a registration process. The larger the size of the distribution list, however, the more multicast will impact router performance.

Click To expand
Figure 5.4: In PIM, streaming content goes out the server one time and is replicated at the RP to reach the nearest subscribers who have specifically requested the stream. This method of content delivery reduces the processing burden of the source server and conserves network bandwidth.

When subscribers join a multicast group, the directly connected routers send PIM “join” messages to the rendezvous point (RP). The RP keeps track of multicast groups. Servers that send multicast packets are registered with the RP by the first-hop router. The RP then sends join messages toward the source. At this point, packets are forwarded on a shared distribution tree. The result is that content providers no longer need to purchase enormous amounts of bandwidth to accommodate a large number of subscribers or buy multiple high-capacity servers to send out all the data streams. Instead, a single data stream is sent, the size of which is based on the type of content.

A multicast can reach potentially anyone who specifically subscribes to the session—whether they have a dedicated connection or use a dial-up modem connection. Of course, the content originator can put distance limits on the transmission and restrict the number of subscribers that will be accepted for any given program.

A variety of methods can be used to advertise a multicast. A program guide can be sent to employees and other appropriate parties via e-mail or it can be posted on a Web site. If the company already has an information channel on the Web that delivers content to subscribers, the program guide can be one of the items “pushed” to users when they access the channel.

When a person wants to receive a program, he or she enrolls through an automated registration procedure. The request is sent to the server running the multicast, which adds the subscriber’s IP address to its subscriber list. In this way, only users who want to participate will receive packets from the server.

The user also selects a multicast node from those listed in the program guide. Usually, this will be the router closest to the user’s location. The user becomes a member of this particular node. Group membership information is distributed among neighboring routers so that multicast traffic gets routed only along paths that have subscribers at the end nodes. From the end node, the data stream is delivered right to the user’s computer.

Once the session is started, users can join and leave the multicast group at any time. The multicast routers adapt to the addition or deletion of network addresses dynamically, so the data stream gets to new destinations when users join and stops the data stream from going to destinations that no longer want to receive the session.

Multiprotocol Label Switching

With the explosive growth of the Internet in recent years, there is growing dissatisfaction with its performance. New techniques are available to improve performance on private intranets as well, such as multiprotocol label switching (MPLS), which delivers QoS and enforces security over IP networks.

MPLS attaches tags, or labels, to IP packets as they leave the edge router and enter the MPLS-based network. The labels eliminate the need for intermediate router nodes to look deeply into each packet’s IP header to make forwarding and class-of-service handling decisions. The result is that packet streams can pass through an MPLS-based-WAN infrastructure very fast, and time-sensitive traffic can get the priority treatment it requires.

The same labels that distinguish IP packet streams for appropriate class-of-service handling also provide secure isolation of these packets from other traffic over the same physical links. Since MPLS labeling hides the real IP address and other aspects of the packet stream, it provides data protection at least as secure as other Layer 2 technologies, including frame relay and ATM.

To enhance the performance of IP networks, the various routes are assigned labels. Each node maintains a table of label-to-route bindings. At the node, a label switch router (LSR) tracks incoming and outgoing labels for all routes it can reach, and it swaps an incoming label with an outgoing label as it forwards packet information (see Figure 5.5). Since MPLS routers do not need to read as far into a packet as a traditional router does and perform a complex route lookup based on destination IP address, packets are forwarded much faster, which improves the performance of the entire IP network.

Click To expand
Figure 5.5: A label-switched route is defined by fixed-length tags appended to the data packets. At each hop, the LSR strips the existing label and applies a new label, which tells the next hop how to forward the packet. These labels enable the data packets to be forwarded through the network without the intermediate routers having to perform a complex route lookup based on destination IP address.

Although MPLS routers forward packets on a hop-by-hop basis, just like traditional routers, they operate more efficiently. As a packet arrives on an MPLS node, its label is compared to the label information base (LIB), which contains a table that is used to add a label to a packet, while determining the outgoing interface to which the data will be sent. After consulting the LIB, the MPLS node forwards the packet toward its destination over a label switched path (LSP). The LIB can simplify forwarding and increase scalability by tying many incoming labels to the same outgoing label, achieving even greater levels of efficiency in routing. The LSPs can be used to provide QoS guarantees, define and enforce service-level agreements, and establish private user groups for VPNs.

MPLS provides a flexible scheme in that the labels could be used to manually define routes for load sharing or to establish a secure path. A multilevel system of labels can be used to indicate route information within a routing domain (interior routing) and across domains (exterior routing). This decoupling of interior and exterior routing means MPLS routers in the middle of a routing domain would need to track less routing information. That, in turn, helps the technology scale to handle large IP networks.

MPLS could provide a similar benefit to corporations that have large ATM-based backbones with routers as edge devices. Normally, as such networks grow and more routers are added, each router may need additional memory to keep up with the increasing size of the routing tables. MPLS alleviates this problem by having the ATM switches use the same routing protocols as routers. In this way, the routers on the edge of the backbone and the ATM-based label switches in the core would maintain summarized routing information and only need to know how to get to their nearest neighbor—not to all peers on the network.

In terms of virtual networks, MPLS offers significant advantages over IP-based VPN tunneling protocols such as Internet Protocol with security (IPsec). In the latter case, VPN relationships are established between known endpoints, and large-scale deployment requires planning and coordination to address issues of policy synchronization and peering configuration. MPLS networks, on the other hand, are more scalable since no site-to-site peering is required. Labels are used instead of predefined user relationships. A typical MPLS-based VPN deployment is capable of supporting tens of thousands of VPN groups over the same network.

This makes MPLS ideally suited for the core of the network where QoS, traffic engineering, and bandwidth utilization can be fully controlled, especially if service-level guarantees are offered in conjunction with the VPN. IPsec is best at the edge of the network where there is a higher degree of exposure to data privacy and where the security mechanisms of IPsec can best be applied, such as tunneling and encryption. MPLS offers security as well, but this is achieved from provisioning virtual circuits that separate traffic between different organizations or departments within an organization to create a trusted environment similar to that offered by a frame relay or ATM network.

MPLS also offers benefits to Internet service providers and carriers. It allows Layer 2 switches to participate in Layer 3 routing. This increases network scalability because it reduces the number of routing peers that each edge router must deal with. It also enables new traffic tuning mechanisms in router-based networks by integrating virtual circuit capabilities previously available only in Layer 2 fabrics. With label switching, packet flows can be directed across the router network along predetermined paths, similar to virtual circuits, rather than along the hop-by-hop routes of normal routed networks. This enables routers to perform advanced traffic management tasks, such as load balancing, in the same manner as ATM or frame relay switches.

Finally, MPLS can be applied not only to the IP networks, but to any other network-layer protocol as well. This is because tag switching is independent of the routing protocols employed. While the Internet runs on IP, a lot of campus backbone traffic is transported on protocols such as IPX, making a pure IP solution inadequate for many organizations.

MPLS came about as a result of Cisco’s tag switching concept, which was given over to the IETF for further development and standardization. In 1996, the framework document published by the IETF presented MPLS as a label-switching architecture suitable for any protocol. The label process takes place without referencing the content of the data packet, eliminating the need for protocol-specific handling. By having the data-handling layer of MPLS separate from the control layer, multiple control layers—one for each protocol—could be supported. The IETF, however, focused on MPLS as a means of improving IP networking, where the commercial opportunity is greatest. MPLS may encourage more service providers to migrate core infrastructures from ATM to IP. Now that MPLS provides IP with high speed, QoS, and security, there may be less reason for service providers to build an ATM infrastructure, which provides these advantages but at a much higher cost than IP.


5.4 Gateways

Gateways are used to interconnect applications on dissimilar network environments. These systems operate at the highest layer of the OSI reference model—the application layer (see Figure 5.6). A gateway consists of protocol conversion software that usually resides in a server, switch, or front-end processor. Gateways process the various protocols used on each network so that information from the sender is intelligible to the receiver, despite differences in technology, network protocols, or platforms.

Click To expand
Figure 5.6: Gateway functionality in reference to the OSI model.

For example, when a systems network architecture (SNA) gateway is used to connect an asynchronous PC to a synchronous IBM SNA mainframe, the gateway acts as both a conduit through which the computers communicate and as a translator between the various protocol layers. The translation process consumes considerable processing power, resulting in relatively slow transmission rates when compared with other interconnection methods—hundreds of packets per second for a gateway versus tens of thousands of packets per second for a bridge or router.

In addition to its translation capabilities, a gateway can check on the various protocols being used, ensuring that there is enough protocol processing power available for any given application. It also can ensure that the network links maintain a level of reliability for handling applications in conformance with predefined error rate thresholds.

5.4.1 Gateway Applications

Gateways have a variety of applications. They can facilitate LAN workstation connections to various legacy host environments, such as IBM’s SNA systems and mid-range systems. Gateways can be used to consolidate hardware and software. An SNA 3270 gateway shared among multiple networked PCs, for example, can be used in place of IBM’s 3270 information display system or many individual 3270 emulation products. Although the IBM systems offer a standard means of achieving the PC-host connection, it is expensive when used to attach a large number of standalone PCs. The relatively high connection cost per computer discourages host access for occasional users and limits the central control of information.

If the PCs are attached to a LAN, however, one gateway can emulate a cluster controller and thereby provide all workstations with host access at a very low cost. Cluster controller emulators use an RS-232C or compatible serial interface to a host adapter or communications controller, such as an IBM 3720 or 3745. They can support up to 254 simultaneous sessions.

A gateway can also be used between TCP/IP workstations and a host. Instead of installing and managing the TCP/IP stack on the host—which can be very expensive —IT departments can take advantage of the protocol already in use on the host and connect the TCP/IP workstations through the gateway. Instead of using 3270 terminals in the IBM environment, for example, users can retrieve host data via the Internet using Web browsers on their PCs. This can result in lower connection costs for remote users who need access to information on the host.

Other applications of gateways include the interconnection of various e-mail systems, enabling mail to be exchanged between normally incompatible formats. The gateway function is actually provided by servers equipped with the X.400 international messaging protocol.

Cellular service providers that offer the short messaging service (SMS) also offer public SMS gateways, which allow anyone to compose and send messages from the service provider’s Web site. A number of independently operated message gateways also exist on the Internet. Some gateways have more features than others. A few let users compose messages to more than one recipient, create group lists, manage messages, and send preset or customized replies.

One of the newest uses of gateways is to provide interconnectivity between the Internet and the PSTN, enabling users to place phone calls from their multimedia PCs or conventional telephones over the Internet or a carrier’s managed IP data network and vice versa. This arrangement allows users to save on long distance and international call charges. Examples of gateways for voice applications include the following:

  • Trunking gateways that interface between the telephone network and an IP network (such gateways typically manage a large number of digital circuits);

  • Voice over ATM gateways, which operate much the same way as VoIP trunking gateways, except that they interface to an ATM network;

  • Residential gateways that provide a traditional analog (RJ11) interface to a VoIP network (examples include cable modem/cable set-top boxes, xDSL devices, and broadband wireless devices);

  • Access gateways that provide a traditional analog (RJ11) or digital private branch exchange (PBX) interface to a VoIP network (examples of access gateways include small-scale voice over IP gateways);

  • Business gateways that provide a traditional digital PBX interface or an integrated “soft PBX” interface to a VoIP network;

  • Circuit switches, or packet switches, that offer a control interface to an external call control element;

  • Interactive voice response (IVR)/announcement servers that can provide IVR and announcements to VoIP networks.

A telephony gateway, in summary, is a network element that provides conversion between the audio signals carried on telephone circuits and data packets carried over the Internet or over other packet networks.

5.4.2 Facilitative Protocols

With VoIP becoming more prevalent, there is growing interest in IP-PSTN gateways. Two of the primary standards in use today for joining IP nets and the PSTN are H.323 and the Session Initiation Protocol (SIP). The International Telecommunication Union (ITU) established H.323 as the first communications protocol for real-time multimedia communication over IP. Later, the IETF developed SIP for voice and video over IP. Both work well and support a comprehensive set of telephony features, but of the two, H.323 gateways are more prevalent, largely because they have been around longer. Another standard, the Media Gateway Control Protocol (MGCP), is also used. Some vendors, such as Cisco, support all three in their VoIP products.

H.323

This is actually a suite of protocols (see Figure 5.7) that defines how audio and videoconferencing systems communicate over packet-switched networks, such as the public Internet, and private intranets, which do not guarantee QoS. The H.323 protocol suite addresses call control and management for both point-to-point and multipoint conferences. The main components of an H.323 network (see Figure 5.8) include:

  • Terminals: These are any client device, hardware or software, capable of communicating with one or more other devices.

    Click To expand
    Figure 5.7: The H.323 protocol stack.

    Click To expand
    Figure 5.8: Basic H.323 network topology.

  • Gatekeepers: For each zone, these systems provide network-based services for the terminals such as registration, admission, and status (RAS) functions.

  • Multicast units (MCUs): These devices provide conference capabilities among H.323 terminals

  • Gateways: These systems convert signals and data transmission protocols so communication can take place between users on different types of networks.

When a standard voice call is received at a near-end gateway, the analog voice signal-is digitized, compressed, and packetized for transmission over an IP network. At the far-end gateway, the process is reversed, with the packets decompressed and returned to their original digital form for delivery to the nearest Class 5 central office.

The H.323 gateways support one or more of the internationally recognized G.7xx voice codec specifications for toll-quality voice. The most commonly supported codec specifications are the following:

  • G.711: Describes the requirements for a codec using pulse code modulation (PCM) of voice frequencies to achieve 64 Kbps, providing toll quality voice on managed IP networks with sufficient available bandwidth.

  • G.723.1: Describes the requirements for a dual-rate speech codec for multimedia communications (e.g., videoconferencing) transmitting at 5.3 Kbps and 6.3 Kbps. This codec provides near toll-quality voice on managed IP networks. [1 ]

  • G.729A: Describes the requirements for a low-complexity codec that transmits digitized and compressed voice at 8 Kbps. This codec provides toll-quality voice on managed IP networks.

The specific codec to be used is negotiated on a call-by-call basis between the gateways using the H.245 control protocol, a component of the H.323 protocol stack. Among other things, the H.245 protocol provides for capability exchange, enabling the gateways to implement the same codec at the time the call is placed. The gateways may be configured to implement a specific codec at the time the call is established, based on predefined criteria, such as the following:

  • Use G.711 only—in which case, the G.711 codec will be used for all calls.

  • Use G.729 (A) only—in which case, the G.729 (A) codec will be used for all calls.

  • Use highest common bit-rate codec—in which case, the codec that will provide the best voice quality is selected.

  • Use lowest common bit-rate codec—in which case, the codec that will provide the lowest packet bandwidth requirement is selected.

This capability exchange feature provides carriers and ISPs with the flexibility to offer different quality voice services at different price points. It also allows corporate customers to specify a preferred proprietary codec to support voice or a voice-enabled application through an intranet or IP-based VPN.

Session Initiation Protocol

Session Initiation Protocol (SIP) is an Internet protocol that provides simple application layer signaling for setting up, maintaining, and terminating multimedia sessions, including voice calls, videoconferences, and even instant messaging sessions. SIP performs many of the functions of the ITU H.323 multimedia conferencing standard, which was largely specified by telecommunication carriers. SIP, on the other hand, takes an Internet-oriented approach.

SIP requires only a datagram service and is independent of the packet layer. It can provide out-of-band call setup services in which the SIP exchanges take place over User Datagram Protocol (UDP) or TCP, but the actual voice conversation takes place over the public telephone network. Although most deployments of SIP will be over IP networks, it can also be used for non-IP networks such as ATM. In addition, because it communicates the capabilities exchange of the session, it can be used for voice, video, text messaging, or instant messaging.

A SIP-based network is made up of the following components:

  • SIP user agent: A network endpoint that can originate or terminate a session. This might include a SIP-enabled telephone, a SIP client (also known as a “soft-phone” installed on a PC), or a SIP-enabled gateway.

  • SIP proxy server: A call-control device that provides many services, such as routing of SIP messages between SIP user agents.

  • SIP redirect server: A call-control device that provides routing information to user agents when requested, giving the user agent an alternate uniform resource identifier (URI) or destination user-agent server (UAS).

  • SIP registrar server: A device that stores the logical location of user agents within the domain or sub-domain. This data is dynamically updated via REGISTER messages from the network.

  • SIP location services: Additional functionality that can be used by proxy, redirect, and registrar servers to find the identity (with a unique URI) and logical location of user agents within the network.

  • Back-to-back user agent: A call-control device that provides routing similar to a proxy server but allows centralized control of the network call flows. This device allows SIP networks to replicate certain traditional telephony services that require centralized knowledge of device state, such as call-park and pickup.

  • SIP-aware network devices: Devices that have knowledge of the SIP and allow the network to function more efficiently. This type of device might be a firewall or NAT device that can allow SIP traffic to cross network borders, or a load-balancing switch that allows requests to SIP servers to be more efficiently handled.

At one time, the H.323 call-setup process was considered unnecessarily cumbersome, requiring more than a dozen messages to traverse the network before voice communication could begin. SIP, on the other hand, requires only four messages before the start of voice communication. Recognizing this as a serious limitation, the ITU developed a “fast start” signaling process that cut the number of H.323 messages by half. Although H.323 sets up calls faster than before, SIP is still the simpler protocol, requiring much less code to implement than H.323. This is reflected in lower fixed and dynamic memory requirements, for both the SIP stack itself and the host application. Because of the smaller number of messages that the processor needs to handle to set up a call, SIP is still faster than H.323, which means SIP can process more calls per second—very important for call center environments—and requires a less powerful CPU to handle the same number of calls.

Media Gateway Control Protocol

Media Gateway Control Protocol (MGCP) is a protocol for the control of VoIP calls by external call-control elements known as media gateway controllers (MGCs) or call agents (CAs). MGCP assumes a call control architecture where the call control intelligence is outside the gateways and handled by external call control elements. The MGCP assumes that these call control elements, or CAs, will synchronize with each other to send commands to the gateways under their control. MGCP does not define a mechanism for synchronizing CAs; in essence, it is a master/slave protocol, where the gateways are expected to execute commands sent by the CAs.

MGCP assumes a connection model where the basic constructs are endpoints and connections. Endpoints are sources or destinations of data and could be physical or virtual. Examples of physical endpoints are the following:

  • An interface on a gateway that terminates a trunk connected to a PSTN switch;

  • An interface on a gateway that terminates an analog line to a phone, key system, PBX, or automated call distributor (ACD).

An example of a virtual endpoint is an audio source in an audio-content server. Creation of physical endpoints requires hardware installation, while creation of virtual endpoints is done by software.

Connections may be either point-to-point or multipoint. Once this association is established for both endpoints, data transfer between these endpoints can take place. A multipoint connection is established by connecting the endpoint to a multipoint session. Connections can be established over several types of networks, including the following:

  • Transmission of audio packets using the Real-Time Protocol (RTP) and UDP over an IP network;

  • Transmission of audio packets using AAL2, or another ATM adaptation layer, over an ATM network;

  • Transmission of packets over an internal connection; for example, the time division multiplexer (TDM) backplane or the interconnection bus of a gateway. This might be used for “hairpin” connections that terminate in a gateway but are immediately rerouted over the telephone network.

MGCP is designed as an internal protocol within a distributed system that appears to the outside as a single VoIP gateway. This system is composed of a CA, which may or may not be distributed over several computer platforms, and of a set of gateways. In a typical configuration, this distributed gateway system stands between one or more telephony circuit switches and H.323-conformant systems.

In the MGCP model, the gateways focus on the audio signal translation function, while the CA handles the signaling and call processing functions. Consequently, the CA implements the signaling layers of the H.323 standard and presents itself as an H.323 gatekeeper or as one or more H.323 endpoints to the H.323 systems. The distributed gateway systems and MGCP enable PSTN telephony users to access sessions set up using other protocols such as SIP. The CA provides for signaling conversion.

MGCP was developed by the telecommunications community to address signaling-system 7 (SS7) and VoIP integration issues. The H.323 initiative had originated out of the LAN environment and had trouble scaling to public network proportions. The H.323 architecture was incompatible with public telephony services, which are typified by multiple gateways and SS7. To address this problem, MGCP dispensed with the gatekeeper model and removed signaling control functions from the gateway, putting them in a media gateway controller or soft switch, which controls multiple media gateways. MGCP is the protocol used to communicate between the soft switch and the media gateways.

[1 ]The mean opinion score (MOS) used to rate the quality of speech codecs measures toll-quality voice as having a top score of 4.0. With G.723.1, voice quality is rated at 3.98, which is only 2% less than that of analog telephone.


5.5 Conclusion

Bridges are equally useful for partitioning sprawling LANs into discrete subnetworks that are easier to control and manage or extending the geographical reach of LANs over point-to-point wired or wireless connections. Through the use of bridges, similar devices, protocols, and transmission media can be grouped together into communities of interest. Such partitioning can yield many advantages, such as eliminating congestion and improving the response time of the entire network. Bridges can also make adding, moving, and changing devices on the network much easier because only the effect on the subnetwork need be considered. Finally, partitioning makes problems easier to diagnose and isolate, while enhancing overall security.

Routers fulfill a vital role in implementing complex mesh networks such as the Internet and private intranets using Layer 3 protocols, usually IP. They also have become an economical means of tying branch offices into the enterprise network and providing PCs tied together on a home network with shared access to broadband Internet services such as cable and DSL, as well as supporting branch offices and telecommuters with VPNs. Like other interconnection devices, routers are manageable via SNMP, as well as the proprietary management systems of vendors. Just as bridging and routing functions have been integrated into a single device, routing and switching functions have been combined in the same way, and even add firewall, Dynamic Host Configuration Protocol (DHCP), and NAT capabilities.

Gateways are available as software or may be dedicated hardware systems equipped with appropriate software to make the translations between different applications, networked devices, or different types of networks. Gateways can even be used to reconcile the differences between network management systems or operations support systems (OSSs), enabling them to interoperate with the systems of other vendors.


Chapter 6: Managing the Wireless Infrastructure

6.1 Introduction

Of all the communications services available today, wireless is having the most dramatic impact on our personal and professional lives, enhancing personal productivity, mobility, and security. In particular, the impact of cellular phone services on our lives is well documented, but wireless fidelity (Wi-Fi) promises to also have a comparable dramatic effect in the near future. In fact, emerging broadband cellular phone and Wi-Fi services are not mutually exclusive, but complementary, so much so that a single PC card for notebooks and some personal digital assistants (PDAs) will soon support both services, switching between the two networks automatically as the user changes locations or applications.

Wi-Fi operates in unlicensed frequency bands and is based on a set of standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE). The most popular standard, called the 802.11b, specifies requirements for connecting devices at the maximum throughput rate of 11 Mbps using the 2.4-GHz frequency band, while 802.11a specifies requirements for connecting devices at the maximum throughput rate of 54 Mbps using the 5-GHz frequency band. Proprietary extensions to each of these standards enable speed bursts of 22 and 72 Mbps, respectively. The 802.11g standard boosts the speed of 802.11b to 54 Mbps.

The innovation in Wi-Fi does not stop here. New standards will support video sessions and voice calls. For these and other reasons, Wi-Fi overshadows any other wireless LAN technology, including Bluetooth, which is limited in range to 30 feet and limited in bandwidth to less than 1 Mbps. Likewise, infrared once showed promise as a LAN technology, but this too has largely been abandoned for the more economical, scalable, and flexible Wi-Fi. Whereas Bluetooth and infrared will continue to address a few niche applications, Wi-Fi will eventually dominate as the technology of choice for wireless LANs.

Ultrawideband (UWB) was also supposed to challenge 802.11 for wireless networking. It promises a powerful combination of low power, high throughput, and better inherent security. Instead of sending its signal over a carrier wave, UWB sends its signals over the noise sections of the radio spectrum. Instead of getting drowned in the noise, UWB’s brief, sometimes nanosecond, signals get tremendous range with little transmission power. More importantly, UWB is inherently more secure than Wi-Fi—UWB transceivers are not only low powered and use what any ordinary radio frequency (RF) device will render as noise, but they can only communicate with each other if they are using the exact same signaling scheme. Because of this, it is much harder for someone to tap into UWB than it is for someone to listen in on an 802.11b network.

What will stop UWB from becoming widely deployed is the huge stride Wi-Fi has already made in the marketplace. With the cost of wireless equipment continually going down to the point of reaching parity with wired gear, Wi-Fi networks are now widely deployed in a number of settings, such as college campuses, business parks, office buildings, and even homes. Such networks are also being implemented by a number of service providers in public places such as airports, hotels, retail locations, and cafés to give users of notebook computers and handheld devices wireless access to the Internet for e-mail and Web browsing. In the corporate environment, Wi-Fi enables users to access LANs to search databases, share files, and print documents—all without requiring them to find an available port and set up a cable connection. And since many employees visit other locations in a building or campus throughout the day, wireless connections facilitate mobility without impeding productivity.

Aside from the low cost of equipment, the following are several other reasons for the growing popularity of Wi-Fi networks:

  • They not only work, they work well, and they are undergoing continuous refinement, particularly in the area of security.

  • Wireless connections are easy to set up, especially with Windows XP, which provides integral support for Wi-Fi, eliminating the need to manually install drivers. Some notebook computers even come with Wi-Fi antennas embedded into their lids, eliminating the need for a PC card for wireless LAN connections.

  • There is nothing new to learn about using Wi-Fi; anyone who uses an Ethernet LAN at work or at home will readily appreciate the convenience and performance of Wi-Fi, which is also based on Ethernet.

  • Connectivity is available from a growing number of service providers, so Wi-Fi can be used between the home and workplace at various “hot spots” such as airports, hotels, and cafes, which greatly extends its utility.

Bridges and access points are used to build the wireless infrastructure. The function of a bridge is to extend the range of a wireless link and make multiple LANs at different locations appear to users as a single network. Both functions are important, but in wireless networks, bridges are especially valued for their operating range and management features.

Wireless bridges come in a variety of configurations and price points. At the low end, there are workgroup bridges that extend the range of wireless connections within a building. At the mid-range are bridges that provide building-to-building coverage within a campus environment. At the high end are bridges that extend wireless links across town or even between towns.

While access points provide wireless clients with connections to wired LANs, wireless bridges connect access points to each other, expanding wireless coverage over greater distances. Bridges do not normally accept connections from clients, only from other bridges and access points (see Figure 6.1), but they can be modified to serve as access points. This has the advantage of greatly extending the range of an access point, allowing clients across town to access the wired LAN, while continuing to pass traffic with other bridges.

Click To expand
Figure 6.1: The role of a bridge in a wireless network.

Wireless bridges differ in their operating range. The actual range depends on many factors, including the data rate (bandwidth) desired, line of sight, antenna type, antenna cable length, and device receiving the transmission. In an optimal installation, range can be up to 25 miles. Ranges up to 50 miles have been reported using various combinations of off-the-shelf and custom-built components. But with greater distance there is greater susceptibility to signal interference. Police radar and heavy machinery, for example, are intermittent sources of interference.

Another important consideration is that the bridge’s antennas require not only visual line of sight but also radio line of sight, which includes an elliptical region around the visual line of sight called the Fresnel zone (see Figure 6.2). For optimal performance, the Fresnel zone must be clear of all obstructions, including trees, power lines, buildings, and topographic features, such as mountains.

Click To expand
Figure 6.2: Relationship of visual line of sight to the Fresnel zone.

The bridge comes with its own MAC address. The IP address for a bridge is usually-obtained via the DHCP. Alternatively, the network administrator can console in and set a static IP address. Bridges also support 40/64-bit and 128-bit wired equivalent privacy (WEP), which encrypt the payload of packets sent across a radio link. The WEP key is a user-defined string of characters used to encrypt and decrypt data.

Since wireless bridges are usually placed outdoors, commercial versions usually come in moisture-proof enclosures and feature built-in lightening protection. They support power over Ethernet (PoE) in which the unused pairs in the Category 5 cable carry electrical current from an Ethernet switch to power the unit. Bridges also can be configured to support the SNMP, making the units easy to monitor.


6.2 Configuration Details

Bridging has been around for a long time and so the 802.11 wireless bridges for the enterprise environment are configured in a similar way, regardless of manufacturer. The screens in the configuration utilities are different, but they ask for the same basic information. If there are any differences, it is usually in the granularity of the configuration information. In other words, instead of accepting default configurations, the network manager is given the opportunity to enter very precise information in order to have maximum control of all aspects of network operation. Consumer products, on the other hand, stress ease of use and generally do not offer as much choice in setting the configuration.

To configure the bridge for the first time, the console connection is used for setting up initial configuration information. This is accomplished by attaching the console port cable to the console port on the bridge. The other end of the console cable is attached to the serial port on a terminal or PC running a terminal emulation program. The terminal is usually set to 9,600 baud, 8 data bits, no parity, 1 stop bit, and Xon/Xoff flow control. Future changes to the bridge can be made over the wireless link, including firmware upgrades.

  • Service set identifier. The console port is used to set the service set identifier (SSID), which allows the wireless bridge to communicate with other nodes. The SSID is a case-sensitive identifier of up to 32 alphanumeric characters that is attached to selected packets sent out over the radio network. It can be a plain text description for easy identification such as “Cisco_Aironet.” All devices on the same wireless network must have the same SSID or their association requests will be ignored. This same SSID is assigned to all bridges, as well as access points and clients.

  • IP address. To enable remote access to the bridge using Telnet, Hypertext Transfer Protocol (HTTP), or SNMP, the bridge must be assigned an IP address. If there are multiple bridges on the wireless network, each of them must be assigned a unique IP address. The network administrator can also assign other detailed Internet addressing options, such as gateway address, subnet mask, or SNMP configuration.

  • DHCP or BOTP. By default, the bridge is configured to attempt to get a DHCP or Boot Protocol (BOTP) server to assign it an IP address. With BOTP, IP addresses are assigned based on MAC addresses. With DHCP, IP addresses are “leased” for predetermined periods of time.

On power up, the bridge will issue boot protocol requests to see if there are any BOTP or DHCP servers on the network. If a response is received, an IP address is assigned by the server. If multiple responses are received, the bridge will pick a DHCP server over a BOTP server. If there is no response, the request is repeated up to 30 times. If there is still no response, the unit gives up. It is recommended, however, that a static IP address be assigned to the bridge to simplify network management and prevent delays in receiving an address through DHCP or BOTP.

  • Subnet mask. If the network uses subnets, a default gateway and an IP subnet mask will be needed for the bridge. The subnetwork mask determines the portion of the IP address that represents the subnet ID, which is used to group devices based on the network topology.

  • Domain name servers. A domain name server allows the network administrator to specify the plain language name of a known host rather than its raw IP address when accessing another node in the network. The IP addresses of the primary and backup domain name servers are entered into the appropriate fields using the bridge’s configuration utility.

  • IP routing table. The IP routing table controls how IP packets originating from the bridge will be forwarded. If the destination IP address exactly matches a host entry in the table, the packet will be forwarded to the MAC address corresponding to the next-hop IP address from the table entry. If the destination is in the local subnet, the Address Resolution Protocol (ARP) is used to determine the node’s MAC address.

If the destination address is on another subnet and matches the infrastructure portion of a net entry in the table, using the associated subnet mask, the packet will be forwarded to the MAC address corresponding to the next-hop IP address from the table entry. If the destination address is on another subnet and does not match any entry in the table, the packet will be forwarded to the MAC address corresponding to the default gateway’s IP address.

  • Root configuration. The default setting for a bridge is a root bridge. A root bridge is located at the top, or starting point, of a wireless infrastructure. The root bridge is usually connected to the main wired backbone LAN. Since the radio traffic from the other bridges’ LANs will pass through this unit, the root unit is usually connected to the LAN that originates or receives the most traffic.

Before performing a detailed configuration of a bridge, the network administrator-should determine whether it will be a root bridge or a nonroot bridge. A nonroot bridge, sometimes referred to as a remote or repeater bridge, establishes a connection to the root bridge or another repeater bridge to make the wired LAN to which it is connected part of the bridged LAN. Changing the default root bridge simply involves accessing the bridge’s configuration utility using a terminal emulator or browser and selecting “on” or “off” for the Enable root mode setting.

Once the bridge is configured as a root or nonroot unit, the network administrator can quit the terminal emulator or browser, disconnect the console port cable, and install the bridge in its desired location. After installation, an antenna alignment test should be run before proceeding with remote configuration. This test can be run from a utility installed on a client or from a wireless LAN management system. The antenna test displays signal strength and signal quality, in a text or graphical format (see Table 6.1). The test can be used to verify the link to each radio partner or to monitor signal strength while aligning directional antennas between two nodes. As the antennas are moved, the signal strength can be monitored to achieve the highest level.

Table 6.1: Sample Antenna Alignment Test Results
ID | Name | Address | Signal Strength | Signal Quality
15 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
14 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
13 | North Bridge | 00409631158c0 | 100% –10 dBm | 95%
12 | North Bridge | 00409631158c0 | 100% –10 dBm | 97%
11 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
10 | North Bridge | 00409631158c0 | 100% –10 dBm | 99%
9 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
8 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
7 | North Bridge | 00409631158c0 | 100% –10 dBm | 97%
6 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
5 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
4 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
3 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
2 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%
1 | North Bridge | 00409631158c0 | 100% –10 dBm | 100%

The test works by sending a packet once per second to the parent access point. This packet is echoed back to the bridge, which records and displays the RF signal strength associated with that particular node. The network administrator can choose the duration of the test, from 15 to 60 seconds. The columns provide the following information:

  • ID: This is the sequence number of the data sample. The most recent sample appears at the top of the column. In this test, there are 15 data samples.

  • Name: This is the system name of each device in the antenna alignment test.

  • Address: This is the MAC address of the device involved in the alignment test.

  • Signal strength: The left side of this column displays the percentage of signal strength between the bridge and the other device; the right side of the column displays signal strength in dBm.

  • Signal quality: This column shows the quality of the signal link between the bridge and the other device.

Data rate The network administrator can define the rate at which the bridge is allowed to receive and transmit data. When a repeater associates to a root bridge, data is usually transmitted between the units at the highest rate that they both support. The units can also downshift to use lower common rates if conditions warrant it. The basic rates option is set on the root bridge. It is the set of rates that all nodes in the radio cell must support or they will not be allowed to associate.

The lowest basic rate is used to transmit all broadcast and multicast traffic, as well as any association control packets. Using the lowest rate helps ensure they will be received by all nodes, even at the farthest distances. The highest basic rate determines the maximum rate at which an acknowledge packet may be transmitted.

Frequency The actual frequency allowed depends on the regulatory body that controls the radio spectrum in the location in which the unit is used. If the setting is left as “auto,” the unit will sample all the allowed frequencies when it is first started and try to pick one that is not in use. This setting is only allowed on the root unit, since it is in charge of setting up the radio cell.

Range Since the radio link between bridges can be quite long and vary between individual devices, the time it takes for the radio signal to travel between the radios can become significant. The range parameter is used to adjust the various timers used in the radio protocol to account for the extra delay. The parameter is only entered on the root bridge, which will inform all the other units. The range is entered as the distance in kilometers of the longest radio link in the set of bridges.

Beacon interval The beacon interval is expressed as K µ s, which is 1,024 microseconds, or a kilo-microsecond. The beacon packets are primarily used for radio network synchronization. A small beacon period means faster response for roaming nodes.

Broadcast SSID When the bridge is configured as an access point, this option controls whether client nodes will be allowed to associate with the unit if they specify the empty or broadcast SSID. Clients that do not know the SSID of the bridge can transmit packets with the broadcast SSID. Any bridges present will respond with a packet showing their SSID. The client will then adopt the SSID and associate with that device. However, if the network administrator wants to ensure that clients know the SSID beforehand, this function can be disabled.

RTS/CTS The IEEE 802.11b standard specifies an optional request to send/ clear to send (RTS/CTS) protocol. This four-way handshake protocol reduces the probability of data collisions at the bridge or access point (see Figure 6.3). When a sending node wants to transmit data, it first sends an RTS message and waits for the bridge to reply with a CTS message. Since all nodes in the network are listening, the CTS causes them to delay any intended transmissions, allowing the sending node to transmit data and receive a packet acknowledgment (ACK).

Click To expand
Figure 6.3: This four-way handshake occurs between the sending node and the access point or bridge. Its purpose is to minimize the chance of data collisions at the access point or bridge when multiple nodes have data to send.

This setting in the configuration tool specifies the size of the data packet that the low-level RF protocol issues to an RTS packet. The range of this parameter is 0 to 2,048 bytes. A small value causes RTS packets to be sent more often and, when this occurs, more of the available bandwidth is consumed and the throughput of other network packets is reduced. On the upside, however, the system is able to recover faster from interference or collisions, which may be caused from a high multipath environment characterized by obstructions or metallic surfaces.

The RTS and CTS packets are small and, if lost in a collision, they can be retried more quickly and with less overhead than if a larger packet containing real data must be retried. The downside of using RTS/CTS is that for each data packet transmitted, another packet must be transmitted and received, which affects throughput.

Packet encryption This parameter controls the use of encryption on the data packet transmitted over the wireless link, which is usually 40/64-bit or 128-bit WEP, but depending on vendor may also include 256-bit enhanced WEP. The packets are encrypted using any one of up to four known keys. Each node in the radio cell must know all the keys in use. Not only must all nodes in the wireless network know the keys in use, but they must be entered into the fields of the configuration utility in the same order.

Only one of these keys is used for transmitting data. This key is selected by the network administrator. Each wireless device is capable of decrypting received packets sent with any of the four keys. Any unencrypted data received by these devices will be discarded. Of course, the network administrator can also choose not to encrypt data, but this would leave transmissions exposed to hackers.

A root bridge can be set to accept association from clients that have encryption enabled or disabled. A situation where this might be used is in the mixed vendor environment, to ensure compatibility between devices. But this mixed mode of operation is not recommended for security reasons. If a client with encryption enabled sends a multicast packet to its parent, the packet will be encrypted. The parent will then decrypt the packet and retransmit it to the cell for all other nodes to see. If a hacker sees a packet in both encrypted and unencrypted form, this can make it much easier to break a key.

Time The bridge can be configured to query a network time server so that any logs can reference the current date and time. Since the time returned by the network time server is based on Greenwich mean time (GMT), the network administrator must adjust this parameter to display the time in an appropriate local format. Another option is used to select whether a particular time zone uses daylight savings time so that the change is implemented automatically.


6.3 Mobile IP

A bridge can be set up to allow client roaming across different IP subnets while maintaining their original IP address. This arrangement requires that a mobile IP stack be set up on both the bridge and the client devices. Each client is assigned an IP address and a home agent IP address by the network administrator. The home agent resides on the subnet for which the client’s IP address is local.

When the client roams to a foreign subnet, it contacts a foreign agent on that subnet, supplying its home agent address. The foreign agent contacts the home agent with the client’s information. The home agent relays any packets found on its local LAN destined to the client’s IP address—first to the foreign agent and from there back to the client.

From the home agent, the IP addresses of mobile clients that are currently away from their home network can be displayed. For each IP address, the foreign agent it is connected with is also displayed. From the foreign agent, the IP addresses of the mobile clients that are currently visiting the agent are displayed.

Before a node is allowed to roam, the home agent must be given information about the clients to validate their identity. The configuration utility asks for a range of IP addresses. The network administrator only needs to enter the low and high IP addresses in the range. If an employee leaves the company, the network administrator can remove only the IP address of the affected client device from the table. For security, the setup packets sent between the home agent, foreign agent, and the clients can be encrypted. The configuration utility also allows the network administrator to set parameters that control the operation of the agents. These parameters include the following:

  • Lifetime. This parameter has two functions. It is the maximum amount of time the home agent will grant a mobile client to be registered on a foreign network before renewing its registration. The lifetime value is also placed in the agent advertisement packets. Mobile clients typically use this field from the advertisements to generate the lifetime value for the registration request.

  • Replay protection. This option determines the scheme used to prevent attacks based on capturing packets and playing them back at a later time. Two replay protection methods are specified for mobile IP: timestamps (mandatory) and nonces (optional). Nonces are a type of handshake that checks the validity of information between the mobile client’s agent and a bridge’s home agent before granting a registration request.

With timestamps, mobile clients use the date and time of day in the identification field of the registration request. The home agent rejects the registration request if the timestamp is not close enough to its current time. A rejection message includes the home agent’s current time, so the mobile client can synchronize its clock accordingly.

With nonces (random numbers), the identification field is subdivided into lower and higher halves. The registration request specifies to the home agent which value to place in the lower half of the registration reply. The registration reply specifies to the mobility agent which value to place in the upper half of the next registration request. Both sides check nonces; if a non-matching registration message is received, the mobility agent ignores the message and the home agent rejects the message. It also sends back a message that includes values it expects in the next registration request. This process is summarized in Figure 6.4.

Click To expand
Figure 6.4: Replay protection via the nonces handshake between a mobility agent and a home agent.

  • Broadcasts. Mobile clients can be configured so that broadcasts from their home network will be forwarded to them via tunneling. Some protocols, such as NetBIOS, require broadcast packets from the home network to maintain proper operation. Unless needed, however, this option should be disabled to avoid unnecessary traffic over the wireless links.

  • Registration required. Mobile clients can be set up to allow registering to a home agent (HA) without the use of a foreign agent via a care-of-address (COA) dynamically acquired while on the foreign network. This is useful in cases where foreign agents have not yet been deployed on the foreign network. But this scheme consumes IP addresses on that network. Unless there are plenty of spare IP addresses, mobile clients should be forced to always register using a foreign agent.

  • Host redirects. This indicates whether or not the foreign agent can send an Internet Control Message Protocol (ICMP) packet to mobile clients registered through it, specifying the IP address of a router for the mobile client to use. Disabling this feature will result in the mobile client always using the foreign agent as its default gateway (router). Enabling this feature may improve performance while visiting a foreign network but may also pose connectivity problems caused by ARP broadcasts from the mobile node.

  • Control agent advertisements. Agents advertise themselves on the LAN so that mobile clients can find them and determine whether they are home or away. The network administrator can specify how frequently (in seconds) the mobility agent will send out an ICMP router advertisement multicast. These advertisements are used by the mobile clients to locate the mobility agents and to determine to which network they are currently attached. The more frequent the advertisement, the faster the mobile node will become aware that it has attached to a new network and can start the registration or deregistration process.


6.4 Spanning Tree Protocol

For an Ethernet network to function properly, only one active path can be present between two stations. To ensure that this happens, a link management protocol must be used to prevent the occurrence of undesirable loops in the network. At the same time, there must be path redundancy in the network to ensure that a bridge does not become isolated due to the failure of the primary link. Both of these requirements are handled by the Spanning Tree Protocol (STP).

In multibridge environments, the STP is used to remove loops on the network. If a loop exists, there is the possibility for duplication of messages. When loops occur, some bridges see stations appear on both of its sides, confusing the forwarding algorithm and allowing duplicate frames to be forwarded.

To provide path redundancy, the STP defines a tree that spans all bridges in an extended network and then forces certain redundant data paths into a standby (blocked) state. If one network segment becomes unreachable, the spanning-tree algorithm reconfigures the spanning-tree topology and reestablishes the link by activating the standby path.

STP is a standard feature in conventional bridges used on cabled LANs, but it is just as applicable in wireless LANs. In essence, STP allows the bridges in an arbitrarily connected infrastructure to discover a topology that is loop free and ensures that there is an active and standby path between every pair of LANs.

STP works by having the bridges transmit special configuration messages to each other called BPDUs, which contain information about the transmitting bridge and its ports, including bridge and port MAC addresses, bridge priority, port priority, and port cost. [1] The STP uses this information to do the following:

  • Elect a single bridge from all the bridges on all the LANs to be the root bridge;

  • Find a bridge for each LAN that is closest to the root bridge;

  • Remove loops in the network by placing redundant bridge ports in a backup state.

All ports on a bridge, either the root port or the designated port for their LAN, are allowed to forward packets. All others are blocked and do not transmit or receive any data packets.

It may take some time for the protocol to determine a stable loop-free topology because of the time it takes for messages to pass from one end of the infrastructure to the other. If the ports were allowed to forward packets while the protocol was stabilizing, then temporary loops could form. To avoid temporary loops, ports are not allowed to go immediately from the blocked state to the forwarding state. Instead, the ports must first go through a “listening” state whereby they may receive and transmit configuration messages, but must block all data traffic. The amount of time spent in the listening state must be at least twice the end-to-end transmit time of the infrastructure.

If a port is still part of the spanning tree at the end of the listening period, it is put in the “learning” state, whereby it can still receive and transmit configuration messages, but it is also allowed to learn the source addresses from the packets received from its LAN. At this point, however, it is still not allowed to forward any packets. The learning state is used to decrease the amount of flooding of unknown destination addresses that would occur if the port started forwarding before there were any entries in its learning table. Once the learning period is over, the port is allowed to forward data normally.

Several parameters must be set in the bridge’s configuration utility to get STP working properly. With a small infrastructure consisting of a point-to-point wireless link between two units, there will never be any loops. In such cases, the STP can be set to “off.” If the network administrator is not really sure how many bridges are out there, there is no harm in changing the setting to “on” because the amount of overhead traffic between bridges is not that significant.

Priority This option is used to set the priority value appended to the infrastructure address of the bridge ID. By changing the priority value, the network administrator can influence which bridge in the infrastructure will become the root bridge. The lower the priority value, the more likely the bridge will be the root. If all other bridges are set to the default value, a bridge set with a lower value will become the root.

Hello time This option is used to set the interval time, in seconds, between transmitted configuration messages. This value is only used if the local bridge becomes the spanning tree root bridge. If not, the value contained in received configuration messages transmitted from the root bridge is used. If the interval time is set too high, the infrastructure will respond slowly in resolving any conflict problems; if set too low, the infrastructure will be congested with hello message traffic. The interval time values range between 1 and 10 seconds.

Forwarding delay This option is used to set the delay time, in seconds, that the ports will spend in the listening and learning states. This value is only used if the local bridge becomes the spanning tree root bridge. If not, the value contained in received configuration messages transmitted from the root bridge is used.

This option is also the timeout period used to age learned addresses whenever the spanning tree topology is changed. The value should be at least twice the transit time of a packet sent from one end of the infrastructure to the other. This allows for news of a topology change to reach all nodes and allows all ports to be blocked before new ports enter the forwarding state.

If the interval time is set too low, then temporary loops could be formed; if set too high, it will take longer for the infrastructure to become active after a spanning tree topology change has been made. The delay time values range between 4 and 30 seconds.

Message timeout This option is used to set the timeout period, in seconds, a blocked or root port watches for configuration messages from the infrastructure’s designated port. This value is only used if the local bridge becomes the spanning tree bridge. If not, the value received in configuration messages transmitted from the root bridge is used. Each time a configuration message is received, the timer is started. If the timer expires, the root bridge is assumed to have failed and the spanning tree infrastructure will be reconfigured.

If the timeout period is set too low, the spanning tree infrastructure may reconfigure itself unnecessarily and messages can be lost due to heavy traffic on the infrastructure. If set too high, the infrastructure will take longer than necessary to recover from failed ports or bridges. The upper limit on the allowed range is determined by the setting of the forwarding delay. The timeout period must be less than twice the forwarding delay, minus 1 second. Therefore, the timeout values range between 6 and 29 seconds.

Port This option is used to enable STP on the local port. The default setting is “on,” which allows all root bridge LAN ports to be initially placed in the listening state. If the option is turned “off,” the LAN ports are placed in the forwarding state. If the port’s LAN will always be connected to the bridge and loops will never occur, turning the protocol “off” will prevent the port from transmitting configuration messages on every timeout period.

Local port priority This option is only used when two or more repeaters are connected to the same LAN for redundancy and the network administrator wants to select which one will forward the packets. The port assigned the lowest priority value will be the one to forward.

Local port cost The value for the cost option is added to the root cost field from any received configuration messages to determine if the port has the least cost path to the root. The larger the cost value, the more likely the port will be a backup for another active port on its LAN. If there is no active port, it is likely the LAN will be a leaf of the infrastructure tree or a less-used LAN in the tree.

Ports of active connected repeaters The port, priority, and cost options are used to configure the ports of active and connected repeaters in the root’s radio tree. These parameters are the same as previously described, except that when the values are entered, the network administrator will be prompted for the applicable port number, which can be obtained from the port ID field on the configuration tool’s protocol status display screen.

Protocol status This display shows the overall status of the spanning tree protocol and the state of each port on the local bridge. Among the information that may be displayed from the status screen are the following:

  • Bridge ID: Shows the ID of the local bridge.

  • Root ID: Shows the ID of the spanning tree root. If the local bridge is not the root, then the cost to the root is also displayed.

  • Topology change: Shows whether the short aging timeout is currently in use because of a port state change somewhere on the infrastructure.

  • Network hello interval, network forward delay, and network message timeout: Shows the timeout values received from the root bridge in use by all bridges on the infrastructure. These values override any locally configured values.

  • Port address: Shows the infrastructure address of the bridge on which the port resides.

  • ID: Shows the port ID, which consists of the port priority and the port number. As each repeater connects to the root, its port is assigned the next available port number.

  • Cost: Shows the cost for the port as configured by the network administrator.

  • State: If used, shows the current state of the port—forward, learn, listen, or blocked.

  • Type: Shows the current port type as root, designated, or blocked.

  • Designated (bridge, port, root cost): Shows the designated bridge and port for the specific LAN, as well as the cost to the root from the designated port.

[1]The lower the port cost, the more likely the port will be chosen to forward frames. Usually, network managers will assign lower numbers to ports attached to faster media and higher numbers to ports attached to slower media. The default port cost is different for each media.


6.5 Performance Monitoring

The monitoring tools of bridges display a number of statistics about their performance, which network administrators can use to fine-tune the network or head off problems. Such tools can be used to gather baseline statistics when the network is considered to be operating at peak performance. These baseline statistics are saved for comparison against new measurements taken periodically. If there is significant negative deviation, steps can be taken to determine the cause and an appropriate remedy.

Throughput This display shows details about the data packets passing through a particular bridge. The statistics are categorized in terms of radio transmit and receive, and bridge transmit and receive, providing the following information:

  • Recent rate: Displays the event rates, per second, averaged over the last 10 seconds.

  • Total: Displays the number of events that have occurred since the statistics were last cleared.

  • Average rate: Displays the average event rates, per second, since the statistics were last cleared.

  • Highest rate: Displays the highest rate recorded since the statistics were last cleared.

  • Packets: Displays the number of packets transmitted or received.

  • Bytes: Displays the total number of data bytes in all the packets transmitted or received.

  • Filtered: Displays the number of packets that were discarded as a result of an address filter being set up.

  • Errors: Displays the number of errors that may have occurred.

Radio errors This display shows the extent of radio receiver and transmitter errors that have occurred at the bridge and includes the following information:

  • Buffer full frames lost: Shows the number of frames lost due to a lack of buffer space in the unit.

  • Duplicate frames: Shows the number of frames received more than once. This is usually due to a frame acknowledgment being lost.

  • CRC errors: Shows the number of frames received with an invalid CRC, which is usually caused by interference from nearby radio traffic. CRC errors can also occur from random noise when the receiver is idle.

  • Retries: Shows a cumulative count of the number of times a frame had to be retransmitted due to an acknowledgment of it not being received.

  • Maximum retries/frame: Shows the maximum number of times any one frame had to be retransmitted. An excessive number of retries may indicate a poor-quality radio link.

  • Queue full discards: Shows the number of times a packet was not transmitted due to too many retries occurring to the same destination. This occurs if packets destined to the same destination are taking up more than their share of transmit buffers.

Ethernet error statistics This display provides details on the receiver and transmitter errors that have occurred at the bridge and includes the following information:

  • Buffer full frames lost: Shows the number of frames lost due to a lack of receiver buffer space in the unit.

  • CRC errors: Shows the number of frames received with an invalid CRC.

  • Collisions: Shows the number of times a collision occurred while the frame was being received. This would indicate a hardware problem with an Ethernet node somewhere on the infrastructure.

  • Frame alignment errors: Shows the number of frames received whose size in bits was not a multiple of eight. Occasionally, extra bits of data are inadvertently attached to a transmitted packet, causing a frame alignment error.

  • Over-length frames: Shows the number of frames received that are longer than the configured maximum packet size.

  • Short frames: Shows the number of frames received that are shorter than the allowed minimum packet size of 64 bytes.

  • Overruns: Shows the number of times the hardware receives first in first out (FIFO) overflow. This should be a rare occurrence.

  • Misses: Shows the number of Ethernet packets that were lost due to lack of buffer space on the unit.

  • Excessive collisions: Shows the number of times transmissions failed due to excessive collisions. This usually indicates the frame had to be continuously retried due to heavy traffic on the Ethernet infrastructure.

  • Deferrals: Shows the number of times frames had to wait before transmitting due to heavy traffic on the cable.

  • Excessive deferrals: Shows the number of times the frame failed to transmit due to excessive deferrals. This usually indicates the frame had to be continuously retried due to heavy traffic on the Ethernet infrastructure.

  • No carrier sense present: Shows the number of times the carrier was not present when a transmission was started. This usually indicates a problem with a cable on the Ethernet infrastructure.

  • Carrier sense lost: Shows the number of times the carrier was lost during a transmission. This usually indicates a problem with a cable on the Ethernet infrastructure.

  • Out-of-window collisions: Shows the number of times a collision occurred after the 64th byte of a frame was transmitted. This usually indicates a problem with a cable on the Ethernet infrastructure.

  • Underruns: Shows the number of times the hardware transmit FIFO buffer became empty during transmission. This should be a rare occurrence.

  • Bad length: Shows the number of times an attempt was made to transmit a packet larger than the specified maximum allowed.


6.6 Applying Filters

If the bridge is connected to an infrastructure with a large amount of multiprotocol traffic, the network administrator may be able to reduce the amount of radio traffic by blocking out (filtering) those addresses or protocols that are not needed. Such filtering is especially important for battery-operated radio nodes, which might otherwise have to waste battery power receiving irrelevant multicast messages that will only be discarded.

To achieve consistent performance throughout the infrastructure, especially as clients roam, any filters set for one bridge should be duplicated on all bridges.

The network administrator can control the direction packets are traveling before they are affected by the filters. For example, only packets from the LAN might have filters applied, while packets from the radio will not be filtered. This option reduces the amount of LAN traffic to the radio network. Alternatively, packets in both directions can be filtered. This option allows control of the type of traffic the radio nodes may use.

Filtering multicast addresses. Using the bridge’s configuration utility, the network administrator can control the filtering of multicasts based on whether or not multicast addresses appear as entries in the bridge’s table. The following options are available:

  • Discard: This option prevents multicasts with no table entries from being forwarded out to the radio network.

  • Forward: This option allows multicasts with no table entries to be forwarded out to the radio network.

  • Access point: This option allows multicasts with no table entry to be forwarded only to other access points and bridges, but not to the clients.

  • Nonpower saving protocol: This option allows multicasts with no table entries to be forwarded out to the radio network to nonpower saving end nodes, but not to any nodes using the Power Saving Protocol (PSP).

If there are special multicast addresses the network administrator wants to filter differently than the defaults previously described, there is the option to add or remove a multicast filter. And if the network administrator knows that the radio nodes are not going to communicate with each other but will only communicate with nodes on the wired LAN, multicasts received from the radio nodes can be set so they are not rebroadcast to the radio cell but are forwarded only to the wired LAN. For example, if there is a large number of radio clients that only talk to the network server, enabling multicast filtering will result in much less radio traffic congestion.

Filtering by node addresses. The forwarding of packets can be controlled based on the source node addresses. As with multicast filtering, there is a default action for those addresses not in the table. The network administrator can enter actions for specific addresses to override the default action. Specific node filters can be entered as either the 6-byte infrastructure address of the node or by its IP address. If the latter method is used, the bridge will determine the infrastructure address associated with the IP address and use this for the actual filtering.

Packets may be filtered based on the source address in the received packet. For example, if the network administrator wants to prevent all but a limited number of clients to communicate with nodes on the radio network, the default action would be set to discard and then entries added for the specific clients whose action is “forward.”

The bridge is always performing filtering based on the destination MAC address of the packets it receives. The bridge will learn where a node is based on the source address of received packets and then can make a decision as to whether to forward a packet based on its knowledge of the location of the node.

There are default actions that can be set when doing destination address filtering. The Ethernet-destination value specifies the default action for packets received on the Ethernet. The radio-destination action specifies the default action for packets received on the radio interface. The allowed values for each are discard or forward.

Bridges usually come with source address filtering turned off by default. This saves processing power, since the unit has to look up the source address of each incoming packet to see if a filter is to be applied. Once a decision is made by the network administrator on which filters to apply, individual source filters can be made active with the forward or discard setting.

The network administrator can add filters for specific addresses to the filter table by entering either the infrastructure address or IP address of the node to which the filter applies. The network administrator specifies whether this is a source address, radio destination address, or Ethernet destination address filter. Then the filter action is applied to this address—forward, discard, or remove the filter. When a node address filter is entered by IP address, the bridge first determines the infrastructure address associated with this IP address. The actual filtering is done based on the infrastructure address. One or all specific node filters can be removed by specifying a single node’s infrastructure address or a single node’s IP address, or by entering an “all” parameter.

Filtering by protocol. Traffic can be filtered based on the type of protocol used to encapsulate the data in the packet. This type of filtering can have the most value in almost all situations and is the preferred method of filtering. With this type of filtering, the bridge can be set to forward only those protocols that are being used by the remote radio nodes. This is easier than setting up filters based on infrastructure and IP addresses.

The bridge can be set up to monitor and record the list of protocols currently being forwarded, how many packets were encountered, and whether the packet came from the LAN or the radio. To set up the protocol filters, the network administrator starts the monitor and lets it run. Filters are added by selecting the protocols from the monitor list.

A default action can be assigned for those protocols not in the list of explicitly filtered protocols. If the network administrator knows exactly what protocols are used by the radio nodes, the default action can be set to discard, and filters added to forward only those protocols that will be used. If all the protocols that will be used by the radio nodes are not known, but the network administrator knows there are certain protocols that will not be used, the default action can be set to forward, and filters added to discard only those protocols that will not be used.

Once a filter has been added for the IP protocol, the network administrator can also filter packets based on their UDP or TCP port number, their IP subprotocol (i.e., UDP/TCP/ICMP), or on an IP address range.


6.7 Logs

The bridge produces logs that record the occurrence of significant events occurring within the unit and on the infrastructure. The types of logs that are available include the following:

  • Information logs: This type of log records status changes that occur in the normal operation of the system, such as when an end node associates to a bridge.

  • Error logs: This type of log records errors that occur occasionally, but which the unit can easily recover from, such as errors that occur during the reception and transmission of packets to and from the unit.

  • Severe error logs: This type of log records errors that drastically affect the operation of the system. Although the system will continue to run, action is required by the network administrator to return the unit to normal operation.

All logs are stored within the bridge’s memory. Log entries are displayed in least recent to most recent order. If the memory buffer becomes full, the oldest log in the buffer will be replaced by the most recent. Only logs that have occurred since the unit was last powered up or since the memory buffer was cleared will be saved.


6.8 Setting SNMP Traps

The SNMP standard provides a limited number of unsolicited messages, called traps, which are sent from a device to an SNMP application. These messages can be sent by the SNMP agent on the device to notify an SNMP application of a change in the status of the device. Bridges occupy a key position in the wireless infrastructure and may be set up to generate SNMP traps and send them to a network management station. A trap is sent whenever a significant event occurs. The following trap messages will be sent as they occur:

  • A cold start trap will be sent when the bridge is first powered up;

  • A linkup trap is sent for a bridge as soon as the radio is configured;

  • A link-down trap is sent when a bridge configuration is changed or encounters a severe error condition;

  • A linkup trap is sent when a bridge’s configuration is changed or restored from a severe error condition;

  • An authentication failure trap will be sent if an SNMP request is received with an unknown community name.

In addition, enterprise-specific traps can be sent whenever a log of a given severity or higher is produced. The generated trap will contain the text of the log message along with the severity of the log.

The network administrator can choose one bridge to monitor and have all other units associate with that unit as their host for logs. All logs can be forwarded to a UNIX host so that if the bridge fails for any reason, the logs may still be viewed on the UNIX host. At the UNIX host, the current time and IP address of the unit that sent the log will be added.


6.9 Conclusion

Wireless bridges are used to connect two or more networks, typically located in different buildings, providing high data rates for data-intensive applications. They connect discrete sites into a single LAN, even when they are separated by obstacles such as freeways, railroads, and bodies of water. Remote bridges connect hard-to-wire sites, noncontiguous floors, satellite offices, corporate campus settings, temporary networks, and warehouses. Wireless bridges also allow multiple sites to share a single, high-speed connection to the Internet. The high-speed links between wireless bridges deliver throughput faster than T1/E1 lines for a fraction of the cost, eliminating the need for expensive leased lines or fiber-optic cable. The initial hardware investment can be quickly paid for with the money saved on leased-line service. The systems are easy to install and configure, they are compact and unobtrusive, and can be redeployed quickly as network requirements or company locations change—without any involvement from the local telephone company. And they do not require a Federal Communications Commission (FCC) license, even when the signals travel distances of 25 miles or more.


Chapter 7: Managing Voice Systems

7.1 Introduction

Over the years, the PBX has emerged as the undisputed cornerstone of today’s corporate voice network (see Figure 7.1). As the networking requirements of organizations continue to change, however, new approaches to handling voice communication are being considered, such as VoIP systems.

Click To expand
Figure 7.1: The PBX as the cornerstone of the corporate voice network. (ACD = automatic call distributor, KTS = key telephone system, SDN = software-defined network, ISDN = integrated services digital network, WATS = wide area telecommunication service, OPX = off-premises extension, FX = foreign exchange, SMDR = station message detail recorder.)


7.2 Historical Perspective

In the simplest terms, the PBX is a circuit switch that, through control signaling, performs the following three basic functions:

  • In response to a call request, establishes end-to-end connectivity among internal users (on-net) and from its own users to other users (off-net) through intermediate nodes, which may consist of other PBXs or central-office (CO) switches on the public telephone network. In both cases, the connected path is dedicated to the users for the duration of the call.

  • Supervises the circuit to detect call request, answer, signaling, busy, and disconnect (hang-up).

  • “Tears down” the path when a call is terminated (disconnected) so that another user can access the resources available over that circuit.

These functions closely parallel those of the CO switch. In fact, the PBX evolved from operator-controlled switchboards used on the public telephone network. The first of these simple devices was installed in 1878 by Bell Telephone Company to serve 21 subscribers in New Haven, Connecticut. The operator had full responsibility for answering call requests, making the appropriate connections, supervising the line for answers and disconnects, and tearing down the path upon call completion. Interconnectivity among subscribers was accomplished via cable connections at a patch panel.

Today’s PBXs are much more complicated, of course, but they provide the same basic functionality as the first generation of circuit-switching devices. The difference is that the process of receiving call requests, making the appropriate connections, and tearing down the paths upon call completion is now entirely automated and, because the intelligence necessary to do all this resides on the user’s premises, the PBX allows organizations to exercise more control over internal operations and to incorporate communication planning into their long-term business strategies.

In a little more than 125 years, PBXs have evolved from simple patch panels to sophisticated systems capable of integrating voice and data. The generations characterizing the development of PBXs can be summarized as follows:

  • First generation PBXs consisted of the operator-controlled patch panels.

  • Second generation PBXs evolved from the electromechanical central-office switches: step-by-step (Strowger) and crossbar. Automatic dialing and space division switching are the capabilities that differentiated second from first generation switches.

  • Third generation PBXs include the attributes of second generation PBXs. Instead of electromechanical control, however, third generation PBXs use electronic components under stored program control, making possible the addition of many new features, as well as distributed architectures.

  • Fourth generation systems are computer-based to permit the integration of capabilities that previously had to be added on with external components, such as automatic call distribution and voice mail. Fourth generation PBXs also use time-division switching, which permits the integration of voice and data over T1 trunks and ISDN services.

  • Fifth generation PBXs are more data-oriented, adding LAN and Internet connectivity, plus support for ATM and management via SNMP.

Stored program control, advanced processing power, large-scale integration, and high-capacity memory have not only reduced the cost of PBX ownership, but endowed PBXs with an array of sophisticated features. In fact, among the dozens of products from which to choose, hundreds of different features are offered (see Table 7.1). The interesting thing about all of these features is that they can be implemented right from the telephone keypad.

Table 7.1: Select PBX Features under Direct User Control
Add-on conference | Allows the user to establish another connection while a call is already in progress.
Call forwarding | Allows a station to forward incoming calls to another station. This includes forwarding calls when the station is busy or unattended, or as needed.
Call hold | Allows the user to put the first party on hold so that an incoming call can be answered.
Call waiting | Lets the user know that an incoming call is waiting. While a call is in progress, the user will hear a special tone that indicates another call has come through.
Camp-on | Allows the user to wait for a busy line to become idle, at which time a ring signal notifies both parties that the connection has been made.
Last number redial | Allows users to press one or two buttons on the keypad to activate dialing of the previously dialed number.
Message waiting | Allows the user to signal an unattended station that a call has been placed. Upon return to the station, an indicator tells the person that a message is waiting.
Speed dialing | Allows the user to place calls using an abbreviated number. This feature also allows users to enter a specified number of speed-dial numbers into the main database. These numbers may be private or shared among all users. Entering and storing additional speed-dial numbers is accomplished via the telephone keypad.

Capabilities are also available that promote the efficiency and administration of the PBX (see Table 7.2). Capabilities are distinguished from features in that the former are typically transparent to most users. Whether certain features and capabilities are standard or optional depends, of course, on the vendor. For example, optional or “value-added” capabilities, which require the purchase of adjunct systems and other specialized hardware, as well as software, might include voice mail, a message center, automated attendant station equipment, local area networking, and telecommunication management systems.

Table 7.2: Select PBX Capabilities Transparent to the User
Automated attendant | Allows the system to answer incoming calls and prompts the caller to dial an extension or leave a voice message without going through the operator.
Automatic call distribution (ACD) | Allows sharing of incoming calls among a number of stations so that the calls are served in order of their arrival. This is usually an optional capability, but it may be integral to the PBX, or purchased separately as a standalone system from a non-PBX vendor.
Automatic least-cost routing | Ensures that calls are completed over the most economic route available. This feature may be programmed so that mail room staff always get the cheapest carrier, while executives get to choose whatever carrier they want.
Call detail recording (CDR) | Records information about selected types of calls. This includes the collection of detailed traffic statistics. But additional hardware and software are typically required to arrange this data into meaningful management reports.
Call pickup | Allows incoming calls made to an unattended station to be picked up by any other station in the same trunk group.
Class-of-service restrictions | Controls access to certain services or shared resources. Access to long-distance services, for example, may be restricted by area code or exchange. Access to the modem pool for data transmission over analog lines may be similarly controlled.
Direct inward dialing (DID) | Allows incoming calls to bypass the attendant and ring directly on a specific station.
Direct outward dialing (DOD) | Allows outgoing calls to bypass the attendant for completion anywhere over the public telephone network.
Hunting | Routes calls automatically to an alternative station when the called station is busy.
Music on hold | Serves as a call progress indicator; during peak hours, for example, incoming calls might have to wait in queue until handed off by the ACD to the next available station operator. Music on hold provides assurance to callers that the connection is still active.
Power-fail transfer | Permits the continuance of communication paths to the external network during a power failure. This capability works in conjunction with an uninterruptible power supply, which kicks in within a few milliseconds after detecting a power outage.
System redundancy | Enables sharing of the switching load so that, in the event of failure, another processor can take over all system functions.


7.3 PBX Components

Aside from the line and trunk interfaces, three major elements comprise the typical PBX: processor, memory, and switching matrix. Together, these elements provide all of the intelligence necessary to place calls anywhere on the public or private network without the need for human intervention.

7.3.1 Central Processor

The central processor is responsible for controlling the various operations of the PBX. This includes monitoring all lines and trunks that provide connectivity, establishing line-to-line and line-to-trunk paths through the switching matrix, and tearing down connections upon call completion. The processor even controls such optional capabilities as voice mail and the recording of billing and traffic information. Because the processor is programmable, features and services can be added or changed at a management terminal.

Many PBXs may be optioned for two or more processors to increase the reliability of the system; if one fails, another takes over. Programs and configuration information are automatically downloaded from the main processor to the standby processor to ensure uninterrupted service.

7.3.2 Memory

The central processor uses the memory element to assist in the implementation of the advanced functions of the PBX, many of which are defined and implemented in software, instead of hardware. There are two types of memory: nonvolatile and volatile. The former is fixed, whereas the latter may be changed as needed. Nonvolatile memory contains the operating instructions and stores system configuration information. Volatile memory, also known as random-access memory (RAM), is used for temporary storage of frequently used programs or for workspace.

In the event that a system failure was to destroy the content of the nonvolatile memory, a reserve program, also stored in nonvolatile memory, would begin operation automatically. (Some systems, however, still require that a spare program be loaded manually via disk or tape cartridge after a catastrophic failure.) As the term implies, nonvolatile memory can withstand a power outage while, in the process, retaining its contents. Information stored in nonvolatile electronically erasable read-only memory (EEROM) is automatically dumped into RAM for access by the redundant processor. Although EEROM is nonvolatile, it is changeable.

7.3.3 Matrix

The switching matrix, controlled by the processor, interconnects lines and trunks. [1] This may be accomplished through space-division switching or time-division switching. Space-division switching originated in the analog environment. A space-division switch sets up signal paths that are physically separate from one another, or divided by space. Each connection establishes a physical point-to-point circuit through the switch that is dedicated entirely to the transfer of signals between the two endpoints. The basic building block of the space-division switch is a metallic cross-point (relay contact) or semiconductor gate that can be enabled and disabled by the processor or control unit. Thus, physical interconnection is achieved between any two lines by enabling the appropriate cross-point.

Although the single-stage space-division switch is virtually non-blocking, [2] it has several limitations, the most serious of which is the number of cross-points that are required as the number of input lines and output lines grows (see Figure 7.2). This is not only costly but results in ever greater inefficiencies in the utilization of available cross-points. Growth notwithstanding, the loss of a cross-point prevents the interconnection of specific stations.

Click To expand
Figure 7.2: Architecture of a single-stage space-division switch. Because the single-stage space division switch always has a path available for the interconnection of inputs to outputs, it may be considered nonblocking. This scheme is acceptable only for small configurations. As the number of cross-points increases to accommodate system growth, the matrix becomes less efficient.

These limitations are mitigated through the use of multistage cross-point matrices-(see Figure 7.3). Although requiring a more complex control scheme, the use of multiple stages reduces the number of cross-points, while increasing their utilization. Also, because more than one path through the network exists to connect two endpoints, reliability is increased as well.

Click To expand
Figure 7.3: The architecture of a three-stage space-division switch. In this type of switch, the probability of blocking is substantially reduced. Although blocking can be further reduced by adding more switching matrices via multiple stages, blocking cannot be eliminated entirely.

Whereas space-division switching originated in the analog environment, time-division switching is a digital technology. It is the preferred switching technique employed in the latest generation of PBXs. With digital technology, voice signals are sampled at a rate of 8,000 times per second and encoded for digital transmission using PCM. The resulting 64-Kbps channel (8,000 samples by 8 bits) corresponds to a single-voice conversation, which is interleaved (multiplexed) with other input channels for simultaneous transmission through the matrix. The benefits of digital-time division extend beyond the matrix to the transmission link itself.

A digitized voice signal is not only easier to switch, it is easier to store, recognize, synthesize, multiplex, concentrate, and integrate with other digital streams; and, once digitized, these functions can be performed without increasing the impairments that typically disrupt transmissions over analog facilities. Furthermore, using PCM to encode an analog signal into digital form makes the signal compatible with the multiplexing formats used by telephone companies for transmissions through the public network.

For private PBX networks, there are add-in cards that implement various voice compression schemes, such as adaptive differential pulse code modulation (ADPCM). This standard algorithm reduces the 8-bit words under PCM to 4-bit words, thus doubling the number of voice channels available over a digital line. Instead of carrying voice at 64 Kbps under PCM, ADPCM allows voice to be carried very reliably at 32 or 16 Kbps to increase the bandwidth efficiency and eliminate the need for extra trunks between PBXs at each corporate location.

[1]Although the terms “line” and “trunk” are often used interchangeably, there is an important difference. A line refers to the link between each station (telephone set) and the switch, whereas a trunk refers to the link between switches. The term “tie line,” then, is really a misnomer. It should really be called a “tie trunk.”

[2]"Blocking” refers to the inaccessibility of the switch due to the unavailability of cross-points, which establish the connections between various endpoints. In theory, all switches can experience blocking no matter how they are designed. As a practical matter, however, some switch designs are less prone to blocking than others. Blocking can also be the result of having fewer trunks than lines, which is a normal condition. The assumption behind high line-to-trunk ratios is that not all users will try to access the switch at once. But if 21 lines out of 200 try to access 20 trunks, the twenty-first line will be blocked.


7.4 Centralized Versus Distributed Systems

The most common PBX network involves a centralized switching system to which all stations are connected (see Figure 7.4). Telephones, terminals, and other PBXs are connected to the PBX in a star arrangement. A central point of control simplifies implementation of the numbering plan, as well as the allocation and utilization of network resources. Overall system administration for implementing moves, adds, and changes are also simplified under the centralized system.

Click To expand
Figure 7.4: Centralized system architecture with two local PBXs.

The central system approach is not without its flaws, however. If the system fails, many users can become stranded without communication because there is no alternative means of routing calls.

Under the distributed approach, which became popular in the early 1980s, a number of smaller sites are integrated into a larger network and share control (see Figure 7.5). These nodes may be interconnected with each other via individual tie trunks (analog) or T1 lines (digital), which carry traffic from multiplexed tie trunks. The key aspects of this architecture are its distributed control and feature transparency. Each node functions independently and contains routing information for all other nodes. Special link protocols send information about the caller through the network to the receiving end, which lets each node on the network handle the call appropriately, based on such information as type of originating equipment and class of service. Thus, in the distributed architecture, information on network activity is relayed to each node on a continual basis, which results in a lot of management and maintenance overhead. Fortunately, an advantage of the distributed architecture is its ability to share a large number of connection channels between nodes via high-capacity links.

Click To expand
Figure 7.5: Distributed system architecture with multiple PBXs over a wide area.

In the distributed operating environment, trunk connections to the local CO may originate from any part of the network. With critical resources evenly distributed, the network is better protected from the possibility of catastrophic failure. But an apparent liability of the distributed system architecture is that the software needed for operational control is quite costly and complex, requiring some degree of customizing, testing, and debugging. This can become a heavy management burden to bear, if only because software problems generally are much harder to fix than hardware problems.

On the positive side, in the distributed approach, hardware problems are easier to isolate and fix. Diagnostic tools now available with most PBXs can facilitate fault isolation, regardless of architecture. Repairs or component replacements can even be performed faster under the centralized approach because the technician is already on site, whereas under the distributed approach, downtime may be prolonged until the technician’s arrival.

The argument that the distributed architecture provides a high degree of protection-against catastrophic failure is quite strong. However, even PBXs with a centralized-architecture may be adequately protected against the possibility of catastrophic failure. Redundant power and subsystems are available. PBXs offer redundant common equipment, processors, and memory. On top of that, today’s systems continually run self-diagnostics of the CPU, memory, and power units, making the system essentially fault-tolerant. For additional protection, even access lines can be brought to the PBX from different COs via dual entry points to the building, circumventing the effects of line cuts from construction equipment or a catastrophic failure at a CO.

A compromise between centralized and distributed architectures is a system that is distributed under centrally weighted control. Under the centrally weighted networking scheme, low-level functions like call setup are handled by PBXs at each node. Administrative functions like moves, adds, and changes are handled locally, whereas management and supervision of the entire network is accomplished through a designated node. From the management node, billing and traffic information can be collected from the subordinate nodes through a polling arrangement, lines and trunks may be added or reconfigured, and gateways to other networks may be accessed, such as the IP nets for voice or data.

The centrally weighted architecture is also implemented on the backbones of private networks via T1 networking multiplexers. A master node supervises the entire network. Should a subordinate node fail, the master node initiates a procedure that redistributes traffic across the entire network. When the failed node returns to operation, the master node initiates a procedure that restores the original configuration. Should the master node be disabled, network control responsibilities are handed off to a designated subordinate node. All other nodes are notified of the hand-off. When the master node is restored, the temporary master node returns control to the primary master node and resumes its status as a subordinate node.

In summary, the distributed architecture under centrally weighted control combines the advantages of centralized and distributed architectures to offer easier administration and network control, as well as a high degree of network reliability.


7.5 Virtual Networks

Carrier-provided networks that function like private networks are referred to as VPNs. Although VPNs today are often thought of in terms of tunneling data through the Internet, the term originally applied to sending private voice traffic through a software-defined network. Under that concept, corporations can minimize the operating costs and staffing requirements associated with private networks. In addition, they obtain the advantages of dealing with a single carrier, rather than the multiple carriers and vendors that are normally involved in setting up and maintaining a large private network.

The first VPNs were voice-oriented and later data capabilities were added over the same switched-network infrastructure. Eventually, frame relay and ATM technologies provided the basis for data-oriented broadband VPNs, with the IP providing an increasingly popular low-cost alternative.

AT&T introduced the first VPN service in 1985. Its software defined network (SDN) is a voice-only service offered as an inexpensive alternative to private networks comprised of leased lines. In essence, this is a custom-switched telecommunications service that permits companies to establish communications paths between PBX systems using uniform dialing plans. The service relies on access lines to designated AT&T central offices. Intrastate SDN Service is an add-on to interstate SDN Service.

MCI followed up with Vnet and Sprint with VPN Service. These networks included PBX interconnectivity, global reach, calling cards for on-net calls from any location, calls made from cellular phones, and low-speed data—all combined under a single discount plan and single service umbrella with expanded opportunities for cost savings.

7.5.1 Advantages of VPNs

VPNs came to be a viable alternative for obtaining private network functionality without the overhead associated with acquiring and managing leased lines. VPNs offered several other advantages as well, including the following:

  • The ability to assign access codes and corresponding class-of-service restrictions to users; these codes can be used for internal billing, to limit the potential for misuse of the telecommunications system, and to facilitate overall communications management.

  • The ability to consolidate billing, resulting in only one bill for the entire network.

  • The ability to tie small remote locations to the corporate network economically, instead of using expensive dial-up facilities.

  • The ability to meet a variety of needs (e.g., switched voice and data, travel cards, toll-free service, international and cellular calls) using a single carrier.

  • The availability of a variety of access methods, including switched and dedicated access, 700- and 800-dial access, and remote calling card access.

  • The availability of digit translation capabilities that permit corporations to build global networks using a single carrier. Digit translation services can perform seven-to-ten-digit, ten-to-seven-digit, and seven-to-seven-digit translations, and can convert domestic telephone numbers to international direct distance designator (IDDD) numbers via ten-to-IDDD and seven-to-IDDD translation.

  • The ability to have the carrier monitor for network performance and reroute around failures and points of congestion.

  • The ability to have the carrier control network maintenance and management, reducing the requirement for high-priced in-house technical personnel, diagnostic tools, and spares inventory.

  • The ability to configure the network flexibly, via on-site management terminals that enable users to meet bandwidth application needs and control costs.

  • The ability to access enhanced transmission facilities, with speeds ranging from 56 Kbps to 384 Kbps and 1.536 Mbps, and plan for the migration to broadband services.

  • The ability to combine network services pricing typically based on distance and usage with pricing for other services to qualify for further volume discounts.

  • The ability to customize dialing plans to streamline corporate operations. A dealership network, for example, can assign a unique four-digit code for the parts department. Then, to call any dealership across the country to find a part, a user would simply dial the telephone number prefix of that location.

7.5.2 VPN Architecture

The architecture of the VPN makes use of software-defined intelligence residing in strategic points of the network. AT&T’s SDN, for example, consists of access control points (ACPs) connected to the PBX via dedicated or switched lines. The ACPs connect with the carrier’s network control points (NCPs), where the customer’s seven-digit on-net number is converted to the appropriate code for routing through the virtual network (see Figure 7.6).

Click To expand
Figure 7.6: The architecture of AT&T’s Software Defined Network.

Instead of charging for multiple local access lines to support different usage-based services, carriers allow users to consolidate multiple services over a single T1 access line. A user who needs only 384 Kbps for a data application can, for example, can fill the unused portion of the access pipe with 18 channels of voice traffic in order to justify the cost of the access line. At the carrier’s cross-connect system, the dedicated 384-Kbps channel and 18 switched channels are split out from the incoming DS1 signal. The 384-Kbps DS0 bundle is then routed to its destination, while the voice channels are handed off to the carrier’s Class 4 switch, which distributes the voice channels to the appropriate service.

VPN service providers offer a variety of access arrangements targeted for specific levels of traffic, including a single-voice frequency channel, 24 voice channels through a DS1 link, and 44 voice channels through a T1 link equipped with bit-compression multiplexers. Providers also offer a capability that splits a DS1 link into its component 64-Kbps DS0s at the VPN serving office for connection to off-net services.

The same DS1 link can be used for a variety of applications, from 800 service to videoconferencing, thereby reducing access costs. Depending on the carrier, there may be optional cellular and messaging links to the VPN as well. Even phone card users can dial into the VPN, with specific calling privileges defined for each card. All of a company’s usage can be tied into a single invoicing structure, regardless of access method.

7.5.3 VPN Features

VPNs allow businesses and government agencies to define their own networks by drawing on the intelligence embedded in the carrier’s network. This “intelligence” is actually derived from software programs that reside in various switch points throughout the network. With services and features defined in software, users are afforded greater flexibility and cost savings in configuring their networks than is possible with hardware-based services. In fact, a customer’s entire virtual network can be reconfigured simply by changing the operating parameters in a network database. The following options are available:

  • Flexible routing: Enables the telecom manager to reroute calls to alternate locations when a switch node experiences a problem or during peak-hour traffic congestion. This feature can also be used to extend customer service business hours across multiple time zones.

  • Location screening: Allows the telecom manager to define telephone numbers that cannot be called from a given VPN location. This helps contain call costs by disallowing certain types of outbound calls.

  • Originating call screening: Gives the telecom manager the means to create caller groups and screening groups. Caller groups identify individuals who have similar call restrictions, while screening groups identify particular telephone numbers that are allowed or blocked for each caller. Time intervals can also be used as a call screening mechanism, allowing or blocking calls according to time-of-day and day-of-week parameters.

  • Exchange number (NNX) sharing: Allows VPN customers to reuse NNXs at different network locations to set up seven-digit on-net numbering plans. This provides dialing consistency across multiple corporate locations.

  • Partitioned database management: Enables corporations to add subsidiaries to the VPN network while providing for flexible, autonomous management when required by the subsidiaries to address local needs. The VPN can even transparently interface with the company’s private network or the private network of a strategic partner. In this case, the VPN caller is not aware that the dialed number is a VPN or private network location because the numbering plan is uniform across both networks.

  • Automatic number identification (ANI): Allows telephone numbers of incoming calls to be matched to information in a database; for example, the computer and telecommunications assets assigned to each employee. When the call comes through to the corporate help desk, the ANI data is sent to a host, where it is matched with the employee’s file. The help desk operator can have all relevant data available immediately to assist the caller in resolving the problem.

7.5.4 Billing Options

One of the most attractive aspects of VPN services is customized billing. Typically, users can select from among the following billing options:

  • The main account can obtain all discounts under the program. In some cases, even the use of wireless voice and data messaging services can qualify for the volume discount.

  • Discounts can be assigned to each location according to its prorated share of traffic.

  • A portion of the discount can be assigned to each location based on its prorated share of traffic, with a specified percentage assigned to the headquarters location.

  • Usage and access rates can be billed to each location, or subsidiaries can be billed separately from main accounts.

  • Billing information and customized reports can be accessed at customer premises equipment (CPE) or provided by the carrier on diskette, microfiche, magnetic tape, tape cassette, or CD-ROM, as well as in paper form.

  • A name substitution feature allows authorization codes, billing groups, telephone numbers, master account numbers, dialed numbers, originating numbers, and credit card numbers to be substituted with the names of individuals, resulting in a virtually numberless bill for internal distribution. This prevents sensitive information from falling into the wrong hands.

In addition, VPN service providers offer rebilling capabilities that can use a percentage or flat-rate formula to mark up or discount internal telephone bills. Billing information can even be summarized in a number of graphical reports, such as bar and pie charts. Carrier-provided software is available that allows users to work with call detail and billing information to generate reports in a variety of formats. Some software even illustrates calling patterns with maps.

7.5.5 Network Management

Management and reporting capabilities are available through a network management database that enables telecom managers to perform tasks without carrier involvement. The network management database contains information about the network configuration, usage, equipment inventory, and call restrictions. Once the telecom manager gains access to the database, he or she can set up, change, and delete authorization codes and approve the use of capabilities such as international dialing by caller, workgroup, or department. The telecom manager can also redirect calls from one VPN site to another to allow, for example, calls to an East Coast sales office to be answered by the West Coast sales office after the East Coast office closes for the day. Once the telecom manager is satisfied with the changes, they can be uploaded to the carrier’s network database and take effect within minutes.

Telecom managers can access call detail and network usage summaries, which can be used to identify network traffic trends and assess network performance. In addition to being able to download traffic statistics about dedicated VPN trunk groups, users can receive 5-, 10-, and 15-minute trunk group usage statistics an hour after they occur; these statistics can then be used to monitor network performance and carry out traffic engineering tasks. Usage can be broken down and summarized in a variety of ways, such as by location, type of service, and time of day. This information can be used to spot exceptional traffic patterns that may indicate either abuse or the need for service reconfiguration.

Via a network management station, the carrier provides network alarms and traffic status alerts for VPN locations using dedicated access facilities. These alarms indicate potential service outages (e.g., conditions that impair traffic and could lead to service disruption). Alert messages are routed to customers in accordance with preprogrammed priority levels, ensuring that critical faults are reviewed first. The system furnishes the customer with data on the specific type of alarm, direction, location, and priority level, along with details about the cause of the alarm (e.g., signal loss, upstream failed signal, or frame slippage). The availability of such detail permits telecom managers to isolate faults immediately.

In addition, telecom managers can request access-line status information and schedule transmission tests with the carrier. The network management database describes common network problems in detail and offers specific advice on how to resolve them. The telecom manager can submit service orders and trouble reports to the carrier electronically via the management station. Also, telecom managers can test network designs and add new corporate locations to the VPN.

7.5.6 Local VPN Service

A more recent development in the voice-oriented VPN market is the emergence of local service whereby some regional Bell operating companies allow corporate customers to manage their in-region calls using the public network as if it were their own private network. This allows customers to do such things as access their voice network remotely, make business calls from the road or home at business rates, originate calls from remote locations while billing them to the office, and block calls to certain telephone numbers or regions. Uniform pricing and billing plans can also be arranged for all of the customer’s locations to reduce the administrative costs involved with reviewing billing statements, even if each location uses a different carrier.

The service allows large business customers to configure components of the public-network like a customized private network without the expense of dedicated lines or equipment. The service is also compatible with Centrex services, PBX systems, or other CPEs.


7.6 Call Detail Reporting

Call accounting systems are used by businesses and other organizations to capture detailed data about telephone calls. The accumulated data is stored on a PC or other collection device and then processed into a variety of cost and usage reports. Such systems are offered in the form of standalone products, or they may be one of several modules within a suite of management applications that include one or more of the following functions:

  • Call center management;

  • Move, add, and change administration;

  • Cable management;

  • Inventory management;

  • Invoice management;

  • Lease management;

  • Trouble reporting and tracking;

  • Work order management;

  • Traffic analysis;

  • Network design and optimization.

7.6.1 Benefits

Call accounting systems represent a powerful management tool that can be used to monitor complete telephone system usage by every employee—including phone, fax, modem, and dial-up Internet connection time. Such systems provide organizations with the following benefits:

  • Reduce toll fraud: On-line, real-time fraud detection can notify telecom managers as it is occurring so it can be stopped before it gets out of hand.

  • Reduce unauthorized use: If employees know that telephone usage is monitored, including incoming calls and local calls, the number of personal calls decreases.

  • Charge allocation: Call charges can be billed back to the actual extensions, projects, or departments that incurred the cost.

  • Cost allocation: Administrative charges can be allocated to departments to help pay for the telephone system and its management.

  • Tenant billing: If the organization leases office space to other companies or individuals, they can be billed directly for their phone usage.

  • Increase productivity: Since telephone usage can be monitored, unnecessary calls are decreased, which increases productivity; if the job description requires phone contact, being able to monitor the number of calls is an indicator of productivity.

7.6.2 Operation

Call records are collected from one or more locations via a polling process, which is usually done by a PC. Multiple sites can feed their data simultaneously into a single recording PC via a dial-up or dedicated line. During the polling session, CRC is used for error correction. Compression can be added to minimize collection time and save on long-distance call charges. User-defined filters can be applied to exclude certain types of call records from being captured. Once the relevant data is collected, it can be processed into the appropriate report formats.

At each location, there is typically a solid-state recording unit that attaches to the PBX. These devices are available with various memory capacities that range from 256 Kbps to 8 Mbps. They include a battery backup that preserves data integrity for 30 to 60 days in case of a local power failure. The devices also have a graphical interface that is used by management. Through this interface, system settings can be set, including the system and polling parameters, as well as alarm and callback schedules.

Several polling methods are available. Polling can be triggered when the station message detail recording (SMDR) device reaches 80% full to ensure that buffers are not overwritten before the call data is retrieved. Polling sessions can occur on a scheduled basis for each location. Polling can also be initiated manually. The telecom manager determines the number of automatic retries (if the line is busy) and restarts (if transmission is aborted) during a polling session.

Some polling applications can collect call detail records over TCP/IP networks, including the Internet, at a much lower cost than traditional long-distance services (see Figure 7.7). A PC acts as a polling device and works in conjunction with a serial server, which acts as a protocol converter that can translate RS-232 serial data into IP packets. Commands can be automatically sent from a PC over the network through a serial server to the solid state recorder’s buffer box to begin polling the call detail records. The records move via the solid state recorder’s serial port into the serial server, where data is packetized and sent across the TCP/IP network to the PC where the call accounting software resides (see Figure 7.8). There, the call detail records are processed into various reports.

Click To expand
Figure 7.7: A typical configuration of a call accounting system. A backup modem is used for polling over the PSTN if the TCP/IP network is unavailable.

7.6.3 Call Detail Records

Call accounting systems produce reports from SMDR devices, which capture call detail records generated by PBX, Centrex, hybrid, or key telephone systems, or from tip-and-ring line scanners. Most call accounting systems compute costs for each outgoing call, whether local or long distance. Call detail records usually contain the following basic fields:

  • Number called;

  • City called;

  • Extension number;

  • Authorization code (if applicable);

  • Date of call;

  • Time of call;

    Click To expand
    Figure 7.8: Detailed view of how the PC poller is configured.

  • Type of call (local or long distance);

  • Duration of call;

  • Cost of call.

The information from call reports can be printed in detail or summarized by such categories as individual station, department, or project. Other summary categories might also include the most frequently dialed numbers, longest-duration calls, or highest-cost calls.

Standard call accounting reports can be used to locate toll fraud by identifying short, frequent calls; long-duration calls; unusual calling patterns; and unusual activity on 800 and 900 numbers. In addition, the reports can be used to identify calls made after hours, on weekends, or holidays. Some vendors offer special toll-fraud detection packages. These programs alert managers to changes in calling patterns or breached overflow thresholds. Several types of alarms indicating suspicious activity can be generated and sent to a printer, a local PC, remote PC, or a pager.

7.6.4 Call Costing

A key feature of call accounting systems is call costing. For each call record, the cost per call can be figured in a variety of ways to suit various organizational needs, including the following:

  • Actual route cost;

  • Comparison route cost;

  • User-defined least-cost route;

  • What-if recosting for comparison;

  • Equipment charge assignment;

  • User-definable pricing by route group;

  • Tariff table pricing;

  • Usage sensitive pricing;

  • Flat rate with percentage surcharge;

  • Minimum charge;

  • Evening and night discounts;

  • Operator-assisted charge.

The ability to price calls according to various parameters gives the organization flexibility in allocating costs and meeting budgetary targets. A related feature of call accounting systems is cost allocation, which is used to distribute call costs to the appropriate internal departments, projects or clients, workgroups or subsidiaries, or external customers or individuals. With this feature, costs can be applied to calls that also include the cost for equipment, trunks, lines, maintenance, or other administrative charges. Some systems can also depreciate equipment according to organizational depreciation schedules. Most cost-allocation applications also provide an interface to the organization’s general ledger.

7.6.5 Outsourcing

An alternative to in-house call detail record collection and processing is the third-party service bureau. The service bureau collects call records from a PC or other type of recording device at the customer’s premises via a dial-up connection or dedicated line—depending on the call record volume—on a daily, weekly, or monthly basis. The call detail records are processed into reports for the customer. The client may choose from among a set of standard reports or have the data processed into custom reports.

Some third-party processing firms offer carrier billing verification services. Audits verify that carrier invoices accurately reflect charges for telephone services (voice and data) and equipment actually contracted for and used, assuring that appropriate rates, taxes, and surcharges have been properly applied. Refund requests are prepared and submitted to ensure that customers receive the appropriate reimbursement for incorrect prior bills, as well as ensure that future bills are accurate. Refunds of historical overcharges have produced ongoing savings to customers generally ranging from 5% to as much as 15% of basic monthly service charges.

7.6.6 Web-Based Reporting

An alternative to call detail reporting and outsourced bill processing is Web-based reporting, which is available from the carrier. MCI WorldCom, for example, lets business customers access their account information from its Web site using any standard Web browser that supports secure sockets layer (SSL) encryption. All the tools are available to customers free of charge. The tools include electronic billing and reporting, broadband reporting, price reporting, traffic reporting and traffic monitoring.

Electronic billing and reporting lets users easily view invoices, run reports, and pay their voice and data bills monthly. After accessing the Web page, users can transfer funds from their banks to a preapproved MCI WorldCom financial institution to pay their bills. Users can also print bills and mail the invoices with payment.

The broadband reporting feature lets ATM and frame-relay users monitor their data connections and generate monthly or daily reports on usage. The tool is also useful in determining when a link may be reaching capacity.

The price reporting tool allows users to receive rated-call detail records on a daily or monthly basis so they can determine usage and costs. The information allows administrators to manage voice services more efficiently.

The traffic reporting and traffic monitoring tools are specifically designed for MCI WorldCom’s toll-free users. These tools let users gather information such as peak calling times and overall network utilization for departmental charge-backs.


7.7 IP PBXs

A relatively new development is the IP-based PBX, which transports intraoffice voice calls over an Ethernet LAN and, via an IP-PSTN gateway, transports off-net calls over the PSTN. In a nutshell, voice is converted to data, the data is compressed, and the compressed data is arranged into packets using the IP. At the other end, this process is reversed, allowing calls to be made even to conventional phones through the PSTN.

Full-featured digital phone sets link directly to the Ethernet LAN via a 10BaseT interface, without requiring direct connection to a desktop computer. Phone features can be configured using a Web browser. Existing analog devices, such as phones and fax machines, can be linked to the LAN via a gateway. In addition to IP nets, calls can be placed or received using T1, ISDN Primary Rate Interface (PRI), or traditional analog telephone lines.

All the desktop devices have access to the calling features offered through the IP PBX management software running on a LAN server. The call management software allows hundreds of client devices on the network, like phones and computers, to perform functions such as call hold, call transfer, call forward, call-park, and calling party ID. Other advanced capabilities—such as multiple lines per phone or multiple phones per line—are also implemented in the call management software.

All of the major PBX vendors offer IP interfaces to their conventional PBX systems. Lucent, for example, offers an IP trunk interface for certain models of its DEFINITY product line. The IP interface supports 24 ports and allows businesses to integrate least- cost routing and class-of-service features, giving network managers the ability to add the Internet and corporate intranet as alternative routes for voice and fax services. The ability to add the IP trunk interface directly into DEFINITY products also reduces the cost of obtaining Internet telephony capabilities by eliminating the need to buy a separate IP-PSTN gateway. Nortel also offers a 24-port IP interface for its Meridian communication system, enabling the routing of real-time voice and fax calls over IP data networks, rather than the PSTN.

7.7.1 Administration

Among the vendors offering IP-based phone systems is Cisco. Administration of the phone system is performed through the company’s CallManager, a software application that provides the intelligence necessary for implementing PBX-like features. The application is installed on a Windows server and provides basic call processing, signaling, and connection services to IP and virtual phones, VoIP gateways, and other local and remote devices. This includes the management and control of various signaling protocols such as Q.931 for ISDN WAN control and H.225/H.245 for IP packet control. With total switch and network independence, administrators can create a virtual campus environment using the familiar interface of a Web browser.

An example of an administration system for an IP PBX is Cisco’s CallManager Administration, a Web browser-based application used to configure devices such as telephones and gateways. It allows the administrator to add a new IP phone by configuring the telephone number (called a directory number), protocol information, and other parameters. CallManager Administration stores all the information about the IP PBX system in a database.

Supplementary and enhanced services such as hold, transfer, forward, conference, multiple-line appearances, automatic route selection, speed dial, last-number redial, and other features are extended by CallManager to IP phones and gateways via parameters stored in a configuration database. Microsoft’s Internet Information Server (IIS) is installed at the CallManager server to provide a browser interface to this database. With administrator approval, users can be granted access to configure their own phones. Any user with appropriate access privileges on the IIS can administer the CallManager from any location through a Web browser.

CallManager manages the resources of the IP PBX by signaling and coordinating-call control activities. It sets up a call by instructing the calling party to set up an RTP audio stream to the other device, either telephone or gateway. Once the audio stream is set up between the two devices, the CallManager is out of the picture until a new request is made, such as transfer or disconnect. Should the CallManager fail during a call, the two parties stay connected and can complete their call. The application also supports the RSVP—which, combined with routers that support the standard—reserves network resources and maintains a stateful connection over the IP network. RSVP also prioritizes voice traffic to guarantee QoS over the IP network.

An optional suite of integrated voice applications can be added to CallManager to provide basic voice messaging, voice conferencing, manual attendant console, click-to-call, and other functions. Because CallManager is a software application, these and other options and enhancements can be loaded for quick implementation, eliminating expensive hardware upgrade costs and installation delays.

CallManager supports the industry standard Station Message Desk Interface (SMDI) to provide connectivity to various voice-mail and IVR systems, along with call detail record reporting for tracking call activity and billing. Call records are kept in a standard CDR database, from which a variety of summary and detail reports can be generated.

CallManager is implemented on a single server, but the architecture allows for a scalable network of multiple, redundant CallManager servers. This enables any IP phone to receive CallManager services from a primary, secondary, or tertiary server. In the event that communications between the active CallManager and the IP phones is disrupted, the phones will register with the backup CallManagers for their call processing service.

7.7.2 Managed Services

PBXs can also be interconnected over IP nets. PSINet (now owned by Cogent Communications) offers a service called Voice iPEnterprise, a fully managed service that delivers internal voice traffic over the same connection as corporate Internet data. This service leverages existing investments in PBXs and uses a T1 dedicated connection to the PSINet network, allowing businesses to carry voice services between their offices.

The quality of this type of managed service is virtually indistinguishable from that of traditional tie line or dedicated voice services between PBXs. Such services are aimed at companies with branch offices, especially those that must scale rapidly due to internal growth or operate in widely dispersed geographic locations. Service providers claim corporate customers can save up to 50% on call costs over traditional carrier services. IP desktop fax, conference calling, and unified messaging capabilities are options that companies can consider to further reduce their communications costs.

AT&T has married aspects of VPNs and corporate PBXs to extend PBX functionality to remote users via VPNs. Called Virtual Connection Services (VCS), the service includes an Internet-based IP VPN, which is used to send PBX signals from a remote user’s PC to the corporate PBX located at a node on the VPN. Those signals instruct the PBX to forward inbound calls to the site where the intended recipient of the call happens to be located. The signals also instruct the PBX to place outbound calls over the public phone network and then ring up the remote user and link the two calls together when the call has been established. That effectively lets a remote user make calls directly from the PBX and take advantage of the lower rates corporations get for their phone trunks.


7.8 Wireless PBX Systems

With office workers spending increasing amounts of time away from their desks supervising various projects, working at temporary assignments, attending meetings, and just walking corridors, there is a growing need for wireless technology to help them stay in touch with colleagues, customers, and suppliers. The idea behind the wireless PBX is to facilitate communication within the office environment, enabling employees to be as productive with a wireless handset as they would be if they were sitting at their desk.

7.8.1 Applications

Typically, a wireless switch connects directly to an existing PBX, key telephone system, or Centrex service, converting an office building into an intracompany, microcellular system. This arrangement provides wireless telephone, paging, and e-mail services to mobile employees within the workplace through the use of pocket-sized portable phones, similar to those used for cellular service. Almost any organization, including the following, can benefit from improved communications offered by a wireless PBX system:

  • Manufacturing: Roving plant managers or factory supervisors do not have to leave their inspection or supervisory tasks to take important calls.

  • Retail: Customers can contact in-store managers directly, eliminating noisy paging systems.

  • Hospitality: Hotel event staff can stay informed of guests’ needs and respond immediately.

  • Security: Guards can quickly and clearly relay emergency information directly to the control room or police department without trying to reach a desktop phone.

  • Business: Visiting vendors or customers have immediate use of preassigned phones without having to take over employee offices to use a phone.

  • Government: In-demand office managers can be available at all times for instant decision-making.

A wireless PBX is especially appropriate in such areas as education and health care, or any operation with multiple buildings in a campus environment. In the health care industry, for example, a typical environment for a wireless PBX would be a hospital where staff members typically are away from their workstations one-third of the workday.

7.8.2 System Components

Many of the wireless office systems on the market today are actually adjunct systems that interface to an existing PBX that provides user features and access to ordinary telephones and outside trunk carrier facilities. The advantages of this approach include cost savings in terms of hardware, space requirements, and power. A wireless PBX typically consists of several discrete components (see Figure 7.9).

Click To expand
Figure 7.9: A typical wireless PBX system in the corporate environment. In this case, workers can roam between the office and home using the same handset. When the handset moves within range of the local cellular service provider, the signal is handed off from the wireless PBX to the cellular carrier’s nearest base station.

Adjunct Switch The adjunct contains the CPU and control logic. Its function is to manage the calls sent and received between the base stations. The adjunct is a standalone unit that can be mounted on the wall for easy installation and maintenance. It can be collocated with the PBX or connected to the PBX via twisted-pair wiring or optical fiber from several thousand feet away. Optional battery backup is usually available, permitting uninterrupted operation should a power failure occur. System control, management, and administration functions are provided through an attached terminal that is password-protected to guard against unauthorized access.

As portable telephones and base stations are added to accommodate growth, line cards are added to the PBX and radio cards are added to the adjunct switch to handle the increasing traffic load. Each adjunct is capable of supporting several hundred portable telephones. Additional adjuncts can be added as necessary to support future growth.

Base Stations

The antenna-equipped base stations, which are about the size of smoke detectors, are typically mounted on the ceiling and are connected by twisted-pair wiring to the wireless PBX. They send and receive calls between the portable telephones and the adjunct unit. As the user moves from one cell to another, the base station hands off the call to the nearest base station with an idle channel. When the next base station grabs the signal, the channel of the former base station becomes idle and is free to handle another call.

To facilitate the handoff process, each base station may be equipped with dual antennas (antenna diversity). This improves signal detection, enabling the handoff to occur in a timely manner. This is accomplished by the base station sampling the reception on each of its antennas and switching to the one that offers the best reception. This process is continuous, ensuring the best voice quality throughout the duration of the call. Some vendors offer optional external antennas for outdoor coverage or directional coverage indoors.

Wireless PBX systems are easily expanded—portable telephones and base stations are added as needed. Substantial savings can accrue over time through the elimination of traditional phone moves, adds, and changes. There is also significant savings in cabling, since there is less need to rewire offices and other locations for desktop telephones.

Telephone Handset

Each portable phone has a unique identification number that must be registered with the adjunct switch. This allows only authorized users to access the communications system. The portable phone can be configured to have the same number as the user’s desk phone, so when a call comes in, both phones ring. The user can even start a conversation on one phone and switch to the other. If the portable and desktop phones have different numbers, each can be programmed by the user to forward incoming calls to the other.

Since the adjunct switch becomes an integrated part of the company’s existing telephone system, users have access to all of its features through their portable phones. Users can even set up conference calls, forward calls, and transfer calls. If the handset is equipped with a liquid crystal display (LCD), the unit can also be used to retrieve e-mail messages, faxes, and pages. An alphanumeric display shows the name and number of the person or company calling. The wireless handset offers a number of other features, including the following:

  • Private directory of stored phone numbers for quick dialing;

  • Multilevel last-number redial;

  • Audio volume, ring volume, and ring tone control;

  • Visual message-waiting indicator;

  • Silent vibrating alert;

  • Electronic lock for preventing outgoing calls;

  • In-range/out-of-range notifications;

  • Low battery notification.

When the handset is not being used, a desktop unit houses the phone and charges both an internal and a spare battery. An LED indicates when the battery is fully charged. Recharging takes only a few hours and varies according to the type of battery used: nickel cadmium (NiCd) takes about 2.5 hours, while nickel metal hydride (NiMH) and the newer lithium ion (Li-Ion) batteries take about 1.5 hours. Li-Ion batteries offer longer life and are lighter weight than NiCd and NiMH batteries. Some vendors offer an intelligent battery charging capability that protects the battery from overcharging.

Distribution Hub Distribution hubs are used in large installations to extend and manage communications among the base units in remote locations that are ordinarily out of range of the adjunct unit. They also allow high-traffic locations to be divided into smaller cells, called “microcells,” with each cell containing multiple base stations. This arrangement makes more channels available to handle more calls.

The distribution units are connected to the adjunct unit with twisted-pair wiring or optical fiber. Optical fiber is an ideal medium for an in-building wireless network because its low attenuation over distance (approximately 1 decibel per kilometer) allows high-quality coverage even in large buildings and campus environments. Fiber is also immune to electromagnetic interference, allowing it to work effectively alongside other electronic equipment in installations such as factories and warehouses.

Frequency Bands Wireless PBXs operate in a variety of frequency bands, including the unlicensed 1,910- to 1,930-MHz personal communications services (PCS) band. The term “unlicensed” refers to the spectrum that is used with equipment that can be bought and deployed without FCC approval because it is not part of the public radio spectrum. In other words, since wireless PBX operates over a dedicated frequency band for communications within a very narrow geographical area, it has little chance of interfering with other wireless services in the surrounding area. The individual channels supported by the wireless PBX system are spaced far enough apart to prevent interference with one another.

7.8.3 Call Handoff Scenario

By examining the handoff from one base station to another, the operation of these protocols can be illustrated. A handoff occurs when the mobile user walks out of the range of one base station and into the zone or cell of another base station. When the handset detects a change of signal strength from strong to weak, it will attempt to get acceptable signal strength from another channel offered by the same base station. If there is a better channel available, an exchange of messages at the MAC level occurs, which allows the conversation to continue without interruption. This channel change takes place without notification to the data-link control (DLC) layer.

If an acceptable channel is not available to the current base station, the handset searches for another base station. An exchange of messages at the DLC and MAC layers secures a data link via a radio channel to the new base station while the call through the original base station continues. When the data link to the second base station is established, the handset drops the old channel and begins processing the frames received through the new one. This process occurs without the network layer being notified. This means the caller and the wireless PBX are not aware that a handoff has happened.


7.9 Centrex

For businesses that do not have the resources or the desire to manage their own voice systems, there is the alternative of letting the telephone company do it through a service offering called Centrex.

Centrex—short for central office exchange—is a service that handles business calls at the telephone company’s switch, rather than through a customer-owned, premises-based PBX. Centrex provides a full complement of station features, remote switching, and network interfaces that offer an economical alternative to owning a PBX. Centrex offers remote options for businesses with multiple locations, providing features that appear to users and the outside world as if the remote sites and the host switch are one system.

Centrex users have access to direct inward dialing (DID) features, as well as station identification on outgoing calls. Each station has a unique line appearance in the central office, in a manner similar to residential telecommunications subscriber connections. A Centrex call to an outside line exits the switch in the same manner as a toll call exits a local exchange. Users dial a four- or five-digit number without a prefix to call internal extensions and a prefix (usually 9) to access outside numbers.

The telephone company operates, administers, and maintains all Centrex switching equipment for customers. It also supplies the necessary operating power for the switching equipment, including backup power to ensure uninterrupted service during commercial power failures.

Centrex may be offered under different brand names. BellSouth calls it Essex, SBC Communications calls it Plexar, and Verizon calls it CentraNet. Centrex is also offered through resellers that buy Centrex lines in bulk from the local exchange carrier. Using its own or commercially purchased software, the reseller packages an offering of Centrex and perhaps other basic and enhanced telecommunications services to meet the needs of a particular business. The customer gets a single bill for all local, long distance, 800, 900, and calling card services at a fee that is less than the customer would otherwise pay.

7.9.1 Centrex Features

Centrex service offerings typically include DID, direct outward dialing (DOD), and automatic identification of outward dialed calls (AIOD). Advanced digital Centrex service provides all of the basic and enhanced features of the latest PBXs in the areas of voice communications, data communications, networking, and ISDN access. Commonly available features include voice mail, electronic mail, message center support, and modem pooling.

For large networks, the Centrex switch can act as a tandem switch, linking a company’s PBXs through an electronic tandem network. Centrex is also compatible with most private-switched network applications, including the federal telecommunications system (FTS) and the defense switched network (DSN).

Many organizations subscribe to Centrex service primarily because of its networking capabilities, particularly for setting up a virtual city-wide network without major cost or management concerns. With city-wide Centrex, a business can set up a network of business locations with a uniform dialing plan, a single published telephone number, centralized attendant service, and full-feature transparency for only an incremental cost per month over what a single Centrex site would cost.

7.9.2 Customer Premises Equipment

Centrex CPE is available for lease or purchase from a number of vendors, including the local telephone company. Centrex CPE combines the advanced features of a PBX with the convenience and flexibility of Centrex. Popular Centrex CPE products include multi-line phones, PC-based attendant workstations, attendant consoles, call reporting and management packages, voice processing equipment, line monitors, and tip-and-ring scanners.

Centrex Telephones Phones made specifically for Centrex service allow users to access a wealth of Centrex features with the touch of a button—without having to memorize codes. Many even provide single-button transfer capability to remote sites. When users have the proper equipment, the service is used more efficiently and the features are used more frequently, resulting in better value for the company’s Centrex investment dollars.

PC-Based Attendant Workstations Screen-based attendant consoles combine Centrex access and improved calling options with Windows databases. This allows an attendant to work in a Windows word processing application, for example, and hot-key over to answer an incoming call.

Some PC attendant workstations come equipped with database directories that can support multiple telephone, fax, and paging numbers for each entry and enable single-keystroke dialing. Those that support ANI and directory name lookup can do “screen pops” of caller information to enable organizations to personalize call handling.

Centrex workstations that interface with LANs also allow attendants to do more than just handle calls. Hot-keying lets administrative personnel answer and transfer calls and still complete computer-based tasks over the local network.

Centrex Answering Consoles

Centrex answering consoles can take the form of multi-button telephones, conventional-looking attendant consoles, or PC-based platform systems. Centrex attendant consoles allow call handlers to perform single-button call transfers. They also have line-status displays that let the attendant know when a line is in use or idle. In addition, many consoles allow the attendant to reprogram extensions, access features, and make other system rearrangements without the help of the telephone company.

Message Desk

As an option, the telephone company can provide a data line to the customer, which is called a station message desk interface (SMDI). Centrex CPE is available that interfaces with the SMDI link to give full voice mail and Centrex integration. It allows a call to an unanswered station to be rerouted directly to that person’s voice mailbox without the caller having to re-enter the extension number.

Call Accounting System

Many options are available for businesses that use Centrex to obtain SMDR data in order to increase system efficiency, just like a PBX. The telephone company can provide call detail information to their customers or, alternatively, customers can use CPE line scanners and PC-based telecommunications management products to obtain the same functionality at a lower price. Some systems record SMDR right from the switch and store the information until it can be transferred to a PC for processing.

Administration Systems

In the past, Centrex customers had to go through the telephone company to change an extension on their Centrex service. Now Centrex administration systems let users reconfigure their Centrex service. PC-based consoles allow users to turn enhanced CO services (e.g., CO voice mail) on and off; activate or deactivate lines; add or reassign trunks; and assign extensions for least-cost routing of long-distance calls.

7.9.3 IP Centrex

Centrex can be enhanced to support telephone calls over IP packet networks. The advantage of integrating Centrex with IP packet-based nets is to enable the telephone company to reduce facility costs by using the inherent efficiencies of IP networks. It also enables the telephone company to offer value-added services to its Centrex customers, such as VPNs, telecommuter access, and virtual call centers. Telephone companies can also use the IP network to extend the market reach for their Centrex offerings by serving corporate locations out of their local serving area.

The integration of Centrex with IP is accomplished with a gateway that gives the existing Class 5 CO switch the ability to offer the full spectrum of voice, data, and Centrex features over an IP network (see Figure 7.10). The gateway connects to the Class 5 switch using the Telcordia Technologies (formerly, Bellcore) standard GR-303 interface. The gateway uses the existing stable and secure Class 5 infrastructure for billing, OAM&P, signaling (SS7), and trunking. The telephone company can increase revenues with new IP applications that can be deployed immediately and minimize expenditures by providing these new services using existing equipment.

Click To expand
Figure 7.10: An IP gateway connects to the Class 5 central office switch using the industry standard GR-303 interface to extend the reach of Centrex features via the IP.

At the customer premises, a variety of equipment can be used to get voice and data traffic through the IP network to the gateway and then to the Centrex switch. A multiport access gateway is a concentration device that connects multiple legacy key sets to an IP network. Standard phone wiring is needed only between desktop key sets and the gateway.

Terminal adapters connect a single legacy phone to an IP network. They perform coding and decoding and packetization, using digital signal processors (DSPs) for high performance. Some terminal adapters come bundled with a PC user interface. Others have a PSTN connection as a backup.

Soft phones are telephony applications that run on a PC. Soft phones typically use the PC’s main processor to perform coding and decoding and packetization, in addition to any other work being done on the PC. There are also IP phones that replace conventional phones and connect directly to the IP network, usually via an Ethernet jack. The coding and decoding and packetization functions are performed in the key set. There are also wireless IP phones, which perform the coding and decoding function in the handset.

Centrex offers high-quality, dependable, feature-rich telephone service that supports a variety of applications. For many organizations, Centrex offers distinct advantages over on-premises PBX or key or hybrid systems. Centrex can save money over the short term because there is no outlay of cash for an on-premises system. If the service is leased on a month-to-month basis, there is little commitment and no penalty for discontinuing the service. A company can pick up and move without worrying about reinstalling the system, which may not be right for the new location.

Centrex systems are easily expanded to accommodate customer growth by adding communication paths, memory, intercom lines, tie trunks, and CO lines as needed. Now, with IP connectivity, Centrex can be used for VPNs, virtual call centers, and economical telecommuter access. If there is a Centrex problem, repair is immediate and inexpensive. There is no need for a company to invest in spare-parts inventory, test equipment, or technical staff to take care of a PBX—the telephone company is responsible for all of that. And, as the CO switching equipment is updated, the Centrex services are also updated.


7.10 Conclusion

Despite their humble beginnings more than 125 years ago, PBX systems still have plenty of room for innovation. Today’s PBXs emphasize integration into enterprise network infrastructures, thereby addressing the applications that are most in demand: LAN interconnectivity, wireless for increased mobility, videoconferencing, and multimedia applications. Accordingly, there are PBX add-ons that support in-building mobile communications using wireless technology, and those that can also be connected to LANs and IP networks, allowing users to send e-mail and run realtime and multimedia applications such as voice calls and videoconferences more economically.

Over the WAN, VPNs permit the creation of voice and data networks that combine the advantages of both private facilities and public services, drawing on the intelligence embedded in the carrier’s network. With services and features defined in software and implemented via out-of-band signaling methods, users have greater flexibility in configuring their networks from on-premises terminals and management systems. With a VPN, businesses can save significantly over traditional dial-1 rates on calls between on-net locations, including calls placed by mobile employees using the VPN phone card. With custom-dialing plans, corporate employees can simply dial extensions to place long-distance calls and, with accounting codes, telecom managers have an easy way to track costs and charge back users.


Chapter 8: Managing the TDM Infrastructure

8.1 Introduction

The TDM infrastructure spans both public and private networks and has been in widespread use for several decades in support of voice and data applications. This infrastructure is based on dividing bandwidth into time slots that constitute channels that convey information from source to destination. Despite TDM’s high reliability, it has several limitations, the most serious of which is that it is very inefficient in the use of available bandwidth. Channels are assigned to various devices, but during periods when these devices are idle, the bandwidth goes unused. While this technique is good for real-time applications because bandwidth is always available when needed, it inflates the cost of networks, since they must be provisioned with more bandwidth than is really necessary.

Different techniques have been developed over the years in an attempt to make TDM-based networks operate more efficiently. With statistical time division multiplex (STDM) technology, for example, devices share the available bandwidth. If a device is idle, its channel is dynamically reassigned to another device. The drawback to STDM, however, is that real-time applications like voice may have to wait for a channel to become available. This introduces delay, which can make communication difficult. The variability of delay can also make voice communication impractical.

Digital cross-connect systems (DCSs) represent another way to make TDM-based networks operate more efficiently via their groom-and-fill functions. These devices are deployed in the network to fill in the empty time slots of a T-carrier facility with traffic from other locations so that the available bandwidth can be used more efficiently. The DCS also performs a “groom” function, which splits out individual channels from the T-carrier facility, directing them to their appropriate destinations. The drawback to the DCS is that it must be programmed to carry out the groom-and-fill functions. This means that the channels are set up end-to-end and stay fixed between locations until the DCS is manually programmed to change them or until a stored program is implemented to change them based on such parameters as time of day or specific events. The functions of a DCS are implemented in a static manner rather than in the dynamic manner of a true switch.

The TDM infrastructure—characterized by traditional multiplexers, digital cross-connects, and switches—is being replaced by a more efficient and economical fast-packet infrastructure. Even voice is moving in this direction. Instead of buying new PBXs or investing in expensive upgrades, companies are increasingly implementing VoIP, VoFR, and voice-over ATM. Not only are the routers, integrated access devices (IADs), and packet switches needed for a fast-packet infrastructure less expensive than using a PBX, they also use the available bandwidth very efficiently without sacrificing voice quality or skimping on call-handling features.

Despite the migration of the TDM infrastructure to a fast-packet infrastructure, the complete transformation will be long and gradual. There is still plenty of useful life left in the TDM infrastructure, and it is premature to dismiss it. Furthermore, the two infrastructures are entirely interoperable. While this interoperability is necessary for the migration to fast packet, it also has the effect of preserving existing investments in legacy TDM infrastructures. Even from a management perspective, the TDM and fast-packet domains have been integrated via the SNMP. While many legacy TDM devices lack built-in support for SNMP, the use of proxy agents makes them manageable with SNMP.


8.2 Multiplexers

The economic benefits of multiplexing are readily appreciated by most network managers. By optimizing the network through multiplexing, the number of local voice-grade leased lines can be reduced, while higher-capacity digital facilities may be utilized to their full advantage and at less cost. This greatly reduces the cost of local access, which, despite dramatic reductions in the cost of long-haul transmission facilities, consumes the largest percentage of most corporate communication budgets.

The economies of T-carrier transmission are such that only five to eight voice-grade private lines justify the jump to T1, which has enough capacity to transport 24 channels at up to 64 Kbps each. The actual break-even point, of course, depends on the local exchange carrier and interexchange carrier used, as well as the length of the T1 line. Additional savings may accrue through the use of fractional T1 (FT1) services, whereby bandwidth may be ordered in increments of 64, 128, 256, 384, 512, and 768 Kbps to meet the needs of specific applications. Compression algorithms such as ADPCM can be used to reduce the bandwidth needs of voice to 32 Kbps or lower, rather than allowing it to pass at 64 Kbps under PCM. This allows more voice conversations to be handled on a private network but without any increase in the cost for more bandwidth.

With an IAD, the channels of one or more T1 local-access lines can be assigned to handle voice conversations over the PSTN, while the rest of the bandwidth can be used for a high-speed Internet access connection that can be shared by multiple users. The IAD can even bundle together the bandwidth of two or more T1 lines for Internet access or for high-speed LAN connections between two corporate locations. Although the IAD includes the multiplex capability, it provides more flexibility in how bandwidth is partitioned for use to support specific applications.

8.2.1 Time Division Multiplexers

High-speed multiplexers are generally divided into two major product types: TDMs and STDMs. Although they perform essentially the same function—that of dividing the available bandwidth into time slots or channels—the two products approach this function in different ways, which makes one more suitable than the other for particular applications.

In sequential fashion, the TDM continually scans or polls all input channels, giving each a chance to access the data link. Each channel has its own “time slot” into which it can place data. If no data is offered, that portion of the data link bandwidth goes unused and scanning continues to the next input channel. A “frame slot” is inserted by the TDM at the beginning and end of each group of time slots.

The frame slot is a “bit” in bit-interleaving muitiplexers, and a “byte” in byte interleaving multiplexers. The datum collected by one complete scan of all the input channels is called a “frame.” Each channel, then, occupies a unique time slot within a particular frame, with each frame separated by a frame slot.

Empty time slots are filled with bits or bytes as necessary to ensure the uniformity of frames. This “stuffing” helps maintain transmission synchronization. The frame slots act as the primary synchronizing mechanism, enabling the remote multiplexer to pass received data to the proper destination at the proper time. The framed data are transmitted over the digital facility to another multiplexer at the receiving end, where the data are “demultiplexed” so that the time slots containing particular bits or bytes of information from each data link can be directed to the appropriate output channel.

8.2.2 Statistical Time Division Multiplexing

Like TDMs, STDMs (“stat muxes”) scan the input channels for data awaiting transmission, and each frame of data is loaded into a time slot. If no data are present on a particular channel, however, the available bandwidth is assigned to a channel that is ready to transmit data. This technique is particularly useful when transmitting asynchronous data.

In most asynchronous, interactive data applications, the probability that all channels will be operating at full capacity simultaneously is small. Consequently, the sum of the active channel data rates will typically not exceed the composite link rate. STDMs can handle peak traffic conditions better than TDMs. With a TDM, the aggregate peak input speed cannot exceed the composite link speed. With an STDM, on the other hand, the aggregate peak input speed can be exceeded because it makes use of a buffer that holds data during peak traffic conditions until bandwidth becomes available. This wait period—known as latency—is measured in milliseconds (ms). This is only one component of latency; congestion on the network may be another source of latency.

To prevent data loss when the buffer fills up, the STDM channel regulates the output of the attached transmitting device. This is accomplished through the use of various flow control protocols, such as XON/XOFF, DTR/DSR, CTS/RTS, and ENQ/ACK. With XON/XOFF, for example, the XOFF code stops data flow, while the XON code permits data flow. This buffering capability also enables high-speed terminals to communicate with low-speed terminals, since the data are buffered from the high-speed terminal for low-speed transmission to the remote terminal.

The ability of the STDM to accommodate variable length frames also contributes to bandwidth efficiency. This means that more than one byte of data can be accepted from a given terminal before the STDM moves on to the next active terminal. Other advantages of STDM include the capability to prioritize channel scanning and perform retransmissions when errors are detected. This processing delay, however, contributes to overall latency.

STDMs offer some very sophisticated capabilities, such as channel prioritization, down-line loading, alternative routing, port contention, and virtual connections. With channel prioritization, the network administrator can designate one or more channels that will always be allowed to pass data before channels that have a lower priority. Down-line loading allows the host site to set the channel options at the remote site, eliminating the need for manual intervention by a network administrator. Alternative routing is the capability of some high-end STDMs to invoke stored configurations of the network to bypass failed facilities or reconfigure the network automatically by time of day to adjust bandwidth to handle different traffic patterns.

Alternative routing may be a simple redirection of a few channels or a complete reconfiguration that involves every node in the network. Port contention allows a larger number of users to contend for the services of a smaller number of multiplexer channels. Virtual connections are momentary (packet-by-packet) connections between devices on a switched or permanent basis.

The primary advantage of STDM over TDM is efficiency of bandwidth (see Figure 8.1). Despite this advantage, however, STDMs have some drawbacks that might make them unsuitable for certain applications. Using STDMs for voice in other than simple point-to-point situations would result in unacceptably low quality, as well as intolerable time delays, because the digitized voice signals do not arrive at their destinations in regular, predictable time slots as with TDM. This causes varying amounts of phase delay, which results in unacceptable voice inflection. Mixing voice with data is the function that TDMs perform best.

Click To expand
Figure 8.1: A comparison of TDM and STDM.

8.2.3 Points of Differentiation

The choice of an STDM or TDM depends on the application. In electronic brokerage transactions, for example, the processing rate of an STDM could inhibit the timely flow of information. Yet the benefits of built-in error checking and retransmission could off-load the brokerage’s host computers and actually hasten the transaction-processing task.

TDMs are totally transparent to the data that each channel is supplying in that they do not analyze the data to determine which protocol is being used. TDMs do not implement priority scanning or channel-based error checking. In the brokerage example, the communication network could transmit at T1 or higher rates, but error checking would be the responsibility of the host computer. The volume of trading would be a combination of the transaction processing capacity and error checking of the host and network. Whether it is better to use faster TDMs and have the host involved in retransmissions to correct errors or to use slower STDMs and let the host focus on transaction processing is an application-driven trade-off that must be considered during the planning process.

Typically, TDMs are deployed on network backbones to ensure the free flow of data between major nodes. STDMs are typically used at locations where many users require only sporadic access to the network, for instance, when clustered terminals query a remote host in point-of-sale applications. In this case, the STDM makes the most efficient use of available bandwidth to “feed” the T1 backbone or provide a connection to a packet-switching network. If STDM is selected, careful attention must be given to proper design; offered traffic must fall within certain statistical limits to ensure an acceptable level of performance for the applications.

When faced with the need to multiplex, the choice need not be limited to TDM only or STDM only. The mixing and matching of devices provides many varied configuration possibilities that can enhance network efficiency. Not only can TDMs network with other TDMs, they can interface with other types of hardware such as channel banks, PBXs, STDMs, front-end processors, and host computers (see Figure 8.2). An STDM, for example, can be used to concentrate data from a cluster of low-speed asynchronous terminals into a single input channel of a T1 multiplexer, which transmits the input of that 56-Kbps channel along with the other channels to a remote T1 multiplexer, where the channels may be routed to their separate destinations. Some of those channels (e.g., voice, low-speed data) may be routed to an appropriately equipped digital PBX that acts as a demultiplexer.

Click To expand
Figure 8.2: The interconnectivity potential of a TDM-based T1 multiplexer. (Note: The CSU at each end of the T1 link may be integrated into each multiplexer as a module.)

Multiplexers are also differentiated on the basis of architecture (bit versus byte), modularity, data and voice capabilities, synchronization characteristics, network management features, and interoperability with public network standards.

Modularity. This feature allows small and mid-size companies to take advantage of the technology with a minimum up-front cost. As networking requirements grow and become more complex, the channel capacity can be added incrementally.

With an STDM, for example, a company can start with a low-end product, which typically supports 2 to 8 input channels over a single point-to-point link. Later, the company can add modules to the empty card slots in the chassis to support up to 32 input channels. High-end STDMs handle even more input channels and provide multiple high-speed links on the output side. They also incorporate sophisticated switching and control capabilities.

Feature packages are available to support built-in modems with automatic dial backup and per-channel password protection. The same package allows network administrators to set different channel speeds and protocols at each end of the circuit.

For asynchronous traffic, STDMs strip out redundant bits to increase the density of the data stream, thereby permitting greater throughput over cheaper, lower speed lines.

Modularity also applies to the features and capabilities of TDMs, allowing the addition of specific capabilities to the T1 multiplexer through plug-in boards or cartridges. These include boards that provide X.25 bridges, LAN gateways, V.35 interfaces for wideband modems, and the ISDN PRI. Aside from cost savings, integrating modems with multiplexers simplifies maintenance and eliminates potential cabling and interfacing problems. Compression devices may be integrated into TDMs via plug-in cards to increase the number of voice channels that can be carried.

Some TDMs allow users to pick the type of input channels they want through software selection: asynchronous channels to support terminals, printers, and modems; synchronous channels to interface with multiplexers and other high-speed devices; and isochronous channels for applications requiring some form of encryption to safeguard sensitive information during transmission.

T1 multiplexers often transmit over private-network leased lines; for point-to-point compatibility, D4 framing suffices. If interconnectivity with the public network is desired, however, the high-capacity TDM multiplexer must be DS0-compatible [1] to provide access to carrier equipment such as a DCS that allows 56/64-Kbps channels to be directed to a location on the PSTN. Such multiplexers typically use extended super frame (ESF), a carrier-provided T-carrier format containing management bits that are used for non-intrusive circuit testing and diagnostics without taking the circuit out of service.

While subrate multiplexers are available as standalone products, some T1 multiplexers offer this capability as a value-added option. This allows users to feed lower-speed digital data service (DDS) circuits (2.4, 4.8, and 9.6 Kbps) to a COmultiplexer via a single 56 Kbps or T1 link so that, for example, five 9.6-Kbps data channels from five different locations can be consolidated over a single high-speed link terminating at an interexchange carrier’s PoP. At the PoP, the multiplexer distributes the data onto several subrate DDS lines to the appropriate locations. Because the telephone company CO or interexchange carrier PoP provides its own multiplexer, or appropriately equipped DCS, the user needs only a single-ended subrate multiplexing capability.

Bit versus byte architectures. As noted, TDMs may package data in either bit or byte formats. Companies interested in sending voice traffic through the public network require a byte-oriented TI multiplexer that adheres to the 8-bit byte structure (i.e., 64-Kbps DS0 format). Users interested primarily in moving data through their private networks usually turn to the bit-oriented T1 multiplexer because it can handle a variety of data rates and types with more efficiency and less processing delay than byte-oriented multiplexers (see Figure 8.3). Data-intensive applications like computer-aided design (CAD) require the lower delays and higher data density offered by bit-oriented T1 multiplexers.

Click To expand
Figure 8.3: Comparison of processing delay with bit- and byte-oriented multiplexers. With the byte-oriented multiplexer, there is a slight processing delay while the bits are assembled into bytes.

Byte-oriented multiplexers provide the connectivity needed to take advantage of current and future carrier services that require access to the public network through such services as DCS. Bit-oriented multiplexers cannot do this because their data format is proprietary. The byte structure is also required if the user wants to take advantage of ESF. While it may be desirable to choose a byte-oriented multiplexer to take advantage of carrier service offerings, byte-oriented multiplexers are not without drawbacks.

For instance, byte-oriented multiplexers waste bandwidth. Such multiplexers consume as much as 5% of the T1 bandwidth for overhead functions. This percentage may not appear to be very significant until such losses are translated into dollars. A T1 circuit might cost $4,000 a month, including local-loop charges at both ends. If overhead results in a 5% loss of available bandwidth, the user is paying about $200 for bandwidth that cannot be used, which translates into a $2,400 loss per year on that circuit. These losses are multiplied on a multi-node T1 network and compounded even further by increases in distance.

Suppose several 56-Kbps circuits are on a network and the bandwidth is derived with a byte-oriented multiplexer to yield five 9.6-Kbps data channels. This subrate scheme immediately results in 14% of unusable bandwidth, or 8 Kbps. Add to that the 5% of lost bandwidth that the multiplexer uses and the five 9.6-Kbps subchannels are no longer achievable because 19% of the bandwidth on a 56-Kbps circuit is lost to overhead. With multiple long-haul 56-Kbps links going through multiple byte-oriented multiplexers, the dollar losses over a year can be quite large.

A bit-oriented multiplexer, on the other hand, does not present such problems because it uses all of the available bandwidth for production data. When voice compression techniques like ADPCM are added to double the amount of voice channels on the circuit, the full 48 channels are derived, instead of only 44 under the byte orientation. Some vendors of ADPCM equipment accommodate both bit- and byte-interleaving multiplexers, preferring to let users configure the device for compatibility with either format.

[1]DS0 refers to digital signal level 0, which is a channel that offers 56/64 Kbps of bandwidth. A T1 facility is capable of supporting 24 of these channels, providing 1.536 Mbps/1.544 Mbps of bandwidth, with or without 8 Kbps for signaling information, which is digital signal level 1, or DS1.


8.3 The Backbone Network

The corporate network segment known as the “backbone” is one of several components of the entire corporate network. Other components include primary, secondary, and tertiary feeder links. The backbone segment of the network is transparent to individual users, who are most often connected to another network segment by analog modem tail circuits, STDM digital tail circuits, or even wireless links. In fact, most corporate networks consist of smaller regional or subnets tied together via the backbone. The backbone provides high-throughput and traffic concentration capabilities. However, the backbone is important for another reason: It defines the total corporate network architecture and its level of flexibility, efficiency, and control. In essence, the backbone can support existing business requirements and create business opportunities by providing corporations with the means to control their own destinies. In the process, these backbones can enable companies to secure competitive advantages over marketplace rivals.

8.3.1 Private Networking

Carriers offer services that coincide with their business objectives, which frequently are not the same as their corporate customers’ objectives. Traditionally, carriers have segmented traffic according to switched or dedicated, voice or data, and within the category of data, have subdivided this further into analog or digital. This carrier segmentation required users to segment their network traffic into a series of subnets that relied on different lines and services. While the carriers did this to make their infrastructures easier to manage, it also inflated the costs to companies that relied on their services. As a result, in the late 1980s, companies started to implement their own private networks using T-carrier facilities interconnected with multiplexers and DCSs. By combining voice and data over the same network, they realized substantial cost savings.

Another reason companies turned to private networks was to obtain control over communication resources. Following the divestiture of AT&T in 1984, the restructured Bell companies were still local monopolies and were slow to respond to the changing needs of corporate customers, whose reliance on communications, particularly for data, were growing and becoming more advanced. When combining previously segmented traffic from various applications (voice, data, image, video), there was a critical need for a global view of all resources and an immediate response to problems. This meant that companies had to hire technical experts in voice and data, invest in diagnostic tools and management systems, and stock spare parts.

In response, companies set up network operation centers (NOCs) to provide 24/7 active monitoring, diagnostics, and remote control. The center continually tests all customer lines and troubleshoots any problems before they become severe enough to disrupt service. When a service error occurs, technicians immediately reroute network traffic and dispatch local technicians to ensure minimal or no network downtime.

From an administrative perspective, the NOC provides an important vehicle for accommodating change. Equipment and subnets are continually added and deleted, while transmission parameters are continually changed to meet application requirements. Likewise, lines and services are continually added and deleted. All of this activity is not necessarily driven by internal demand; it may be fueled by the seemingly relentless cycle of corporate mergers, acquisitions, and spin-offs. In addition, as carriers compete against each other, new services and more attractive pricing becomes available, forcing companies to continually reassess their networks.

8.3.2 Public Networking

With all the advantages of private networking, why consider public networking at all? Some advantages to using public networks include connectivity, access to services, and economics.

Public networks conform to standards, which leads to a high degree of connectivity among the devices of different manufacturers. Equipment that conforms to public network standards takes advantage of the connectivity potential of the public network, making systems integration easier for economical expansion of the private network. As new technology and services are introduced, companies are better positioned to integrate them into the existing network because their specifications have been written to comply with public network standards. While no longer a problem in TDM-based equipment, some vendors still promote proprietary “boxes” that do not adhere to public network standards. For example, there are wavelength division multiplexers (WDMs) for enterprise networks that increase the bandwidth capacity of fiber but are not compatible with the WDMs used in carrier networks. Even if external conversion devices are available to provide connectivity to the public network, they introduce potential points of failure and weaken the possibility of integrated network management.

The use of private and public networks each have advantages, but the decision to go with one over the other is not always clear. Companies need the efficiency and control of private networking along with the connectivity and access to services that is associated with public networking. Therefore, companies should position themselves to implement the appropriate network architecture (public or private) to realize the best return on investment at any given time.


8.4 Public and Private Network Interoperability

The need to mix private and public TDM-based network elements into a hybrid arrangement and still implement network management and control requires an intelligent networking multiplexer with a sophisticated transport management system (TMS). The purpose of the TMS is to extend intelligence to the backbone network where the performance requirements of particular applications can be monitored. The TMS goes well beyond mere bandwidth allocation to ensure the integrity of applications for each circuit on the network.

A T1 multiplexer, for example, should support aggregate rates from 4.8 Kbps to 1.544 Mbps. Locations should be able to adjust to new transmission rates by software selection. When a new interface is required, the architecture of the T1 multiplexer should require that only a plug-in module be changed on the aggregate card. This facilitates network growth very economically, while providing maximum protection of existing hardware investments.

An integral subrate data multiplex (SDM) capability is desirable to support the transport of bandwidth in increments of 9.6 Kbps in standard DDS formats. The carrier’s DCS can then switch these increments into 64-Kbps channels for DS1 transport to a private network hub, at which the channels can be unbundled by the T1 multiplexer and directed to their destinations at the proper speed. This arrangement allows users to tie low-traffic locations into the backbone very economically. Likewise, the T1 multiplexer must have the capability to support FT1 services, which offer incremental bandwidth from 64 to 768 Kbps, plus voice compression. With a T1 multiplexer that is equipped with ISDN PRI, disaster recovery can be facilitated. If the private line goes down, a carrier-provided ISDN service can be used to offload the traffic.

The proprietary frame structure of a bit-oriented multiplexer can ensure low nodal delay for the best response time. All aggregates can be used to support data transfer rather than losing some aggregates to supervisory channel overhead.

However, building a hybrid network comprised of both private and public elements requires that the T1 multiplexer interconnect with the byte-oriented public network. This would seem to pose a dilemma; after all, T1 multiplexers are either bit or byte oriented at the bus level. When a bit-oriented multiplexer performs a bit-to-byte conversion at the interface, it can selectively interconnect with the public network without sacrificing the efficiency of private network elements.

By being able to interconnect selectively with the public network (including the ISDN service nodes of interexchange carriers), no sacrifice is made in end-to-end network management and control. Supervisory channel information is embedded into each 64-Kbps channel of a bundle of channels so that utilization of public network services is available without the loss of network management. Users can derive the full benefit of the public network’s interconnectivity without depriving themselves of the means to exercise control of remote locations.

By providing aggregate interfacing into the byte-oriented public network, the multiplexer not only facilitates access to services provided by the DCS network, it also accepts direct PBX connection in support of voice applications. Voice support is provided with an interface card that supports supervisory information within each N x 64-Kbps bundle of a T-carrier link. This interface connects to the DCS in the public network or a digital PBX or D4 channel bank service. Within the same multiplexer, however, there is the choice of using private aggregate interfaces for bandwidth efficiency and an aggregate interface for public network ( N x DS0) interconnectivity.

The multiplexer accepts the 1.544-Mbps line rate (DSX-1) directly from the digital PBX. Pulse density, needed to keep line regenerators synchronized, is met by placing a mark bit in the seventh bit position of the 8-bit DS0s. In this way, dense compaction transport efficiencies are combined with the interconnectivity of public standard support for maximum network flexibility. This allows organizations to design and implement high-capacity digital networks based on the needs of the applications, rather than on the limitations of the network technology.


8.5 Voice Compression

Even though 64 Kbps is the industry standard for encoding and transmitting voice using PCM, this is still a lot of bandwidth to allocate to voice traffic on a private network. Therefore, alternative voice-carrying capabilities can make more efficient use of the available bandwidth, which also would result in substantial cost savings. The voice compression algorithm ADPCM offers toll-quality voice at 32 Kbps, cutting the bandwidth requirement in half without sacrificing voice quality. Other implementations of ADPCM permit reliable voice transmission at 24 and 16 Kbps, which allows the user to further reduce the bandwidth required for voice.

The conversion from PCM voice to ADPCM voice can even be implemented “on the fly” without interrupting calls in progress. The conversion may be implemented through time-of-day reconfiguration, event-driven reconfiguration, or manually through keyboard command at the multiplexer’s system controller.

Other compression techniques can bring voice down to 10 Kbps or lower. These very low bit rate voice (VLBRV) techniques are typically employed in situations where the bandwidth is close to full utilization, such as during peak hours of the day, but the organization still has an additional requirement for voice and does not want to pay for more bandwidth. Because of the trade-off between quality and maximum bit compression, VLBRV schemes are more suited for internal communication than customer service lines, for example, where the detectable loss of quality may be a critical factor in providing support.


8.6 Data Support

Multiplexers support only a limited selection of data rates because vendors typically required a different card to support each transmission rate. This practice not only inflated the initial hardware investment but compounded the cost and logistics of maintenance. Today’s multiplexers are more efficient, using only one type of data channel card to support a variety of data rates: 75 bps to 19.2 Kbps for asynchronous transmission and 75 bps to 1.544 or 2.048 Mbps for synchronous transmission. Under software control, multiple data types and a broad range of data rates are available to suit different applications.

To minimize disruption due to maintenance or failure, each channel card should have only one port. Multiport cards can leave large numbers of users stranded in case of failure. Each channel provided by a four-port card, for example, may be configured to provide up to 32 terminals with “logical” access to a cluster controller. This may appear to be very efficient, but when one channel fails, three other channels must be taken out of service until a card swap can be made.


8.7 Clear Channel Capability

Support for the clear channel capability is another extremely desirable feature for T1 multiplexers. This option allows users to transmit DS0 or DS1 signals unconstrained by the general technical requirement that such signals not contain more than 15 consecutive zeros. This is achieved by implementing bipolar eight zero substitution (B8ZS). This line-coding technique uses bipolar violations to synchronize devices, a solution that does not require the use of extra bits, which means that a T1 circuit can use the full 64-Kbps channel for data, instead of only 56 Kbps. The scheme results in a gain of 192 Kbps of usable bandwidth on a full T1. The clear channel capability also applies to other types of T-carrier circuits, including T3.

This clear channel capability is required for ISDN, but as recently as year-end 2002, not all carriers supported it. The 64-Kbps clear channel capability is required for video applications over ISDN; carriers that provide only 56 Kbps cannot support video applications reliably.

To take advantage of the clear channel capability, the CPE must have the B8ZS capability and conform to ESF. For data applications involving frame relay or dedicated Internet access, the router or IAD will provide these features. Channel banks and multiplexers support B8ZS and ESF as well. For example, with the ESF capability integral to the multiplexer’s public network interface, bit-error rates can be picked up on a dynamic basis over the digital facility. On a static basis, the multiplexer’s transport management system comes into play by comparing error rates to predefined thresholds that are established by the network administrator when setting up the profile for each circuit.


8.8 ISDN

The two types of ISDN channels are the circuit-switched bearer (B) channels and the packet-switched data control (D) channel. With ISDN PRI, each channel takes 64 Kbps of bandwidth. True ISDN functionality is characterized by intelligent linkage between the transport facility (T1) and CPE. In addition to performing routine call setup and tear-down, B channel routing takes place under D channel control on a call-by-call basis.

As stated previously, the ability of the T1 multiplexer to provide interoperability-with both proprietary and DS1/DS0-framed products means that users can more easily build hybrid networks composed of private and public elements. It also means that the multiplexer can be used to improve the efficiency and economy of ISDN.

The multiplexer can be set up to treat the B channels of ISDN as bit-oriented (proprietary) subaggregates. When B channels are routed by the D channel through a public network element such as the Class 4 CO switch, multiple voice or data channels and supervisory information can be embedded within each 64-Kbps B channel destined for a remote corporate location. Because the 4ESS does not route the D channel (SS7 takes over from there), embedding supervisory information within the B channel extends private network management and control through the public ISDN network to remote corporate locations. In effect, this allows the public network to be used as a private network. Thus, control does not have to be sacrificed for the sake of cost savings.

Another way in which the multiplexer can enhance ISDN is through ADPCM. Because they are clear channels, each B channel can carry ADPCM compressed voice at 32, 24, and 16 Kbps. In addition to cost savings, this gives network administrators tremendous flexibility in configuring voice services between corporate locations that do not come with ISDN alone.

The multiplexer’s support of ISDN also greatly improves disaster recovery; it is faster and more economical to implement than, for example, a carrier’s reserved service. Under this subscription arrangement, a dedicated T1 line is brought into service only after a network administrator verbally requests it with a telephone call. Several hours may elapse before the reserved line is finally connected. With a PRI-equipped multiplexer, dynamic B channel call setup for disaster recovery can be accomplished in a matter of seconds under stored program control.

With a PRI-equipped multiplexer, the requirement for dedicated lines as alternate paths is no longer necessary as a hedge against disaster. Through the multiplexer’s dynamic restoration capabilities, data from failing lines may be switched to B channels on the multiplexer’s PRI. The PRI’s D channel routes the individual B channels to their destinations through the public ISDN network. Instead of paying for a dedicated link, the user is billed only for the bandwidth used under ISDN.

Some carriers have expanded PRI to include the higher capacity 384 Kbps and 1.536 Mbps channels, known as the H0 and H11 channels, respectively. These are marketed under different brand names, such as AT&T’s Switched 384 and Switched 1536 services. This gives subscribers the means to implement “wideband” dynamic disaster recovery with their PRl-equipped multiplexers. Support for this wideband function can be added as a software-expandable option without requiring the expense of a major hardware upgrade.

For organizations that do not see the need for ISDN, a multiplexer that is DCScompatible and capable of supporting FT1 can provide flexible bandwidth allocation, integrate voice and data, and extend network management and control to remote locations. The PRI can be added later when the need for ISDN is justified. In supporting both ISDN and FT1, the multiplexer further extends the options available for building hybrid networks. For example, the multiplexer can combine FT1 for dedicated circuits with primary rate ISDN for switched circuits over the same T1 access facility, saving the organization as much as 40% on local-access charges for the two services if purchased separately.

Dedicated data traffic can be carried over the PRI access link to a carrier’s ISDN service node, where it is routed to the appropriate destination via connections programmed into the network DCS. Voice traffic can be carried over the same link but directed to the Class 4 CO for switching through the public network.


8.9 Role of Digital Cross-Connect Systems

Another device that is commonly used to manage the TDM infrastructure is the DCS, which is a digital switching device that routes and switches T1 lines, and DS0 portions of lines, among multiple T1 ports. The proliferation of T1 links that started in the 1980s created the need for devices to concentrate and route channels to their destination, simplify the administration and control of bandwidth, switch channels from one link to another, reconfigure circuits to achieve optimal efficiency and cost savings, and facilitate the ability to access and test individual circuits.

The original purpose of the DCS was to streamline the internal engineering and operations activities of carriers by automating the entire process of circuit provisioning. Instead of having a technician manually patch the access line to the long-haul transport facility, for example, the DCS allows customer-ordered circuits to be set up between two points from a remote location via a keyboard command. Because connections are software-defined, customer reconfigurations can be implemented in a matter of minutes instead of days or weeks.

The DCS is used within the network to establish temporary end-to-end routes over circuits that are interconnected by the larger network switches. Although the DCS is more flexible than a manual patch panel, it is not as well suited for setting up calls like a CO-switch or performing alternative routing like a multiplexer because of the time needed to establish the desired pathways.

The main functions of a DCS are “groom and fill.” Grooming entails splittingout lower- capacity channels from a higher-capacity T-carrier facility to route the channel to its proper destination, while filling entails inserting lower-capacity channels onto a partially utilized facility to ensure that the bandwidth is used efficiently.

In the T-carrier environment, the following are three common DCSs in use today:

  • 3/1/0 DCS: This system accepts a DS3 signal, grooms out the 28 DS1 signals, and then further grooms out the individual DS0 signals for routing to their destinations in the network.

  • 3/1 DCS: This system accepts a DS3 signal and grooms out the 28 DS1 signals for routing to their destinations in the network.

  • 1/0: This system accepts a DS1 signal and grooms out the 24 DS0 signals for routing to their destinations in the network.

The DCS may be used in conjunction with other carrier services such as a CO multiplexing service. The customer may consolidate traffic from multiple locations and transport it to a carrier’s multiplexer site via T1 links (see Figure 8.4). From there, a T3 link brings the consolidated traffic to the DCS, where the individual DS1 channels are routed to different locations.

Click To expand
Figure 8.4: DS1 transport via a CO multiplexer and a 3/1 DCS.

Depending on the type of DCS used and the nature of the signal, the DCS may improve transmission quality by removing “jitter” from the channels. Jitter is the difference between where a pulse is and where it should be, which disrupts synchronization. Jitter is an impairment that affects the integrity of the bit stream as it moves through regenerators and switching equipment. Jitter has a variety of causes, including transmission system noise and transmission delay. A synchronous DCS regenerates and synchronizes input streams, thereby eliminating jitter. (In cases where the T1 stream itself is used to carry a synchronizing reference, however, the jitter is reproduced.) But other types of DCS based on space division switching do not have the capability of removing jitter. With these plesiochronous (nearly synchronized) systems, the transmitted signals have the same nominal digital rate but are synchronized on different clocks. This inaccuracy in timing allows the signal to be cross-connected, provided that the variation falls within strict limits.

8.9.1 Customer-Controlled Reconfiguration

Although the DCS is used in all carrier networks, these systems are used in private networks as well. In either case, the DCS groom-and-fill functions enable more efficient utilization of the available bandwidth, which helps reduce the cost of operations. But if an organization does not want to invest in infrastructure, but does want to retain control, a shared DCS can be accessed for reconfiguring bandwidth as part of a carrier service.

This arrangement is known as customer-controlled reconfiguration (CCR). Instead of waiting for service orders to be processed before they could rearrange their networks, users now have the capability to do it themselves via a terminal connected to a carrier’s central CCR control system (see Figure 8.5). Some carriers guarantee a response time to user-initiated reconfigurations, whereas other carriers make no guarantees.

Click To expand
Figure 8.5: Typical CCR arrangement, whereby the corporate subscriber manages bandwidth groom-and-fill functions of the DCS network by issuing instructions to the carrier’s central control center from an on-premises terminal.

The control system is the heart of any DCS network. It communicates instructions from the user to the various cross-connect systems that will be involved in implementing the routing changes. This capability is useful for disaster recovery, for bypassing critical systems so that scheduled preventive maintenance may be performed, and for handling peak traffic demand. Each carrier’s DCS central control facility holds network routing maps for each service subscriber. With the maps held in memory, each subscriber may invoke predefined alternative configurations with only a few keystrokes from its on-premises control terminal.

The reconfiguration activity may be implemented over a dial-up connection or leased line. The changes typically take effect within 30 minutes under a basic CCR service or within 5 minutes under a premium CCR service. Although this

performance is acceptable for many scheduled applications, other methods of reconfiguring circuits, such as ISDN’s primary rate services and switching via T1 multiplexers, are better suited for implementing reconfigurations on a dynamic basis. In the case of ISDN, reconfigurations may be performed on a call-by-call basis, whereas the multiplexer may implement event-driven reconfigurations in addition to scheduled reconfigurations by time of day. A T1 multiplexer equipped with the ISDN PRI offers the highest degree of flexibility for implementing reconfigurations.

Unlike the CO switch, which sets up, supervises, and tears down communication paths every time a call is placed, the DCS allows communication paths to remain in place for continuous use over a period of months, or even years. For networks with constantly changing needs, however, circuits may be added, deleted, or rearranged as demand warrants. This capability can result in tremendous cost savings because it eliminates the tendency to overextend facilities to meet any contingency.

Further, a single cross-connect system is typically shared among many customers, allowing the telephone company to offer VPNs to small companies, many of whom appreciate the benefits of private networks but still cannot afford to implement multi-node configurations of their own. Hubbing off the CO cross-connect system makes a viable alternative to setting up a separate network because the arrangement can provide all of the control and flexibility of a private network without the huge capital investment in equipment and the risk of obsolescence.

The carrier-provided DCS service offers a high degree of configuration flexibility.-Instead of connecting all sales offices in a region via dedicated facilities, for example, a single T1 span from each site to the local CO would allow company-wide voice, data, and video communication through the telephone company’s cross-connect system, thus facilitating information flow. Via a multipoint bridge, the headquarters office can be connected to all sales offices at once for e-mail broadcasting of current price and product availability information, or for voice conferencing with branch managers. Corporate reports requiring immediate action may be batch-faxed to all locations simultaneously. Instead of gathering the regional sales force at a central location, video transmissions can relay product demonstrations and installation procedures at a fraction of the cost.

Telecommunication personnel at the company’s main office would be able to alter the circuit configurations as needed to control the cost of telecommunication. During peak hours, for example, the cross-connect may be configured to make more bandwidth available to accommodate the increase in traffic. If traffic reports indicate trends in usage by hour of day or day of week, this information can be stored in a computer. Primary, secondary, and tertiary configurations can then be uploaded to the cross-connect system with only a few keystrokes.

In addition to obtaining a suitable hub location for private networks, the DCS provides access to standby digital facilities in the event of catastrophic failure. This “bandwidth on demand” capability eliminates the need and cost for dial backup systems, which are typically configured to provide access to the public-switched network in case of deteriorating conditions or line outages. In such cases, the cross-connect enables the telephone company to bill subscribers for bandwidth actually used, providing an alternative to the uncertain line quality inherent in the public network.

For subscribers who do not have the technical expertise to put failed facilities back into service, the telephone company may access and test failed facilities to isolate the cause of the failure. For a charge, the telephone company will perform tests and verification procedures to ensure the proper operation of circuits before turning them back on for the subscriber.

Since the cross-connect system and associated services offered by carriers are typically shared among several customers, they are password protected to prevent one company from inadvertently accessing the network of another company. Passwords also protect each customer’s network from unauthorized intrusions. By being able to partition the cross-connect system in this way, carriers can provide large and small businesses with the means to control their own facilities without having to invest too heavily in a team of experts to maintain it.

Companies with expensive digital PBXs would be able to achieve even greater economies by subscribing to a telephone company’s cross-connect system. The PBX pipes all voice and data traffic directly to the CO via one or more T1 lines. Here, the cross-connect routes the individual channels to their appropriate destinations. This greatly reduces the switching burden of the PBX, especially during peak hours, while permitting its more efficient utilization for other memory-intensive call-handling features, as well as sophisticated options like voice mail.

8.9.2 Selecting a Carrier-Provided Service

To succeed in an operating environment that is steadily becoming more competitive, carriers are becoming more market-oriented, not necessarily with the idea of increasing market share, but with the idea of protecting their revenue bases against further erosion. In subscribing to a carrier-provided cross-connect service, several factors must be considered.

Any relationship with the local telephone company (or interexchange carrier) is difficult to terminate quickly when things go awry; after all, financial penalties may be exacted and potential disruption of the organization’s entire communication system may result. Therefore, companies must know the costs for both entering into and withdrawing from the arrangement. The long lead times required to plan, order, and install a cross-connect system, as well as find a suitable location for it, can make dependence on the telephone company’s service a long-term affair. To minimize risks, future problems must be anticipated by thoroughly discussing installation, maintenance, operation, and expansion issues with the telephone company.

The user should also define and agree on the telephone company’s scope and level of responsibility. For example, if the user plans to rely on the telephone company’s digital facilities as a backup link for mainframe access, some assurance must be made as to the availability of such links and what recourse is provided if a backup facility is not available when needed. Despite assurances, a telephone company or carrier cannot guarantee that it will have the capacity available to switch all of a customer’s T1 circuits to backup facilities in the event of a disaster. Even if disaster recovery swapping arrangements with other carriers over their fiber networks are in place, the company has no guarantee that it will have all the bandwidth needed when a particular customer needs it. Because the possibility exists that the telephone company’s cross-connect could suffer a catastrophic failure, potential subscribers should determine what measures have been taken to guard against that eventuality and what penalties can be invoked in case critical facilities are lost as a result of a cross-connect failure.

Some newer cross-connects used in carrier networks can automatically reconfigure around a failed link in as little as 60 ms and switch back to the restored circuit in 250 µ s. Before opting for this feature, a company must decide whether giving up this level of control is worth the risk. The risk is that the carrier may reroute to a poor-quality circuit or that some circuitous route may introduce intolerable delays that can disrupt both voice and data traffic, all of which may succeed in compounding the original problem. And when the carrier switches back to the restored circuit, the delay, however slight, may be enough to disrupt transmissions in progress.

Companies with extensive networks using the services of multiple carriers might be concerned that making direct connections to a carrier’s cross-connect system could force them to take network timing from that carrier. When using multiple carriers for dedicated circuits, each carrier may have a slightly different timing network, in which case jitter can become an issue. In most cases, however, the jitter correction features of the DCS come into play, eliminating this as a serious problem.

In subscribing to a carrier-provided DCS service, it is worthwhile to ensure that the DCS is not front-ended by a legacy M13 multiplexer at the CO. The M13 is very limited in the type of information it provides, and what it does provide is of dubious value. The M13’s best in-service measurement is a parity check, which is only 50% accurate, and can be altered as the signal is transported through the network. Fortunately, M13 change-outs have been under way for several years in favor of more intelligent cross-connects or SONET equipment, which do provide extensive and accurate performance reporting.

The carrier should provide the necessary training on the use of the management terminal. Although most cross-connect systems feature reconfiguration systems that are menu-driven, operators may take awhile getting comfortable with such systems. After all, taking responsibility for rearranging an entire network, or even a small segment, with only a few keystrokes can overwhelm anyone until they get accustomed to the idea. Determine to what extent follow-up training is available. A customer-support hotline should also be available to provide technical assistance at any time of day or night.

8.9.3 Implementing a DCS Network

Companies with large private networks might want to implement their own DCS network. To design a cross-connect network, one of the first steps is the selection of strategic nodes. It is not necessarily the physical location of the nodes that counts most but the volume of traffic and the patterns of that traffic into and out of all sites that matter most. By looking at the volume and pattern of traffic, the best decision can be made on where to locate the DCS nodes to achieve the benefits of efficiency and economy. If a large percentage of traffic is clustered around a few nodes, these will probably be the best locations for the cross-connect systems.

Some cross-connect systems have enough memory to store up to a dozen network configurations so that circuit rearrangements may be invoked automatically by time of day using an internal clock as the controlling mechanism, similar to the way large network switches activate port reconfigurations by time of day to accommodate peak loads. Some systems even have multiple levels of memory backup to protect the cross-connect maps, which typically take hours of meticulous planning to prepare. Even if power is disrupted, the map images are restored automatically from nonvolatile memory upon resumption of power.

Because of the large amount of information that the cross-connect handles at any given time, reliability is crucial. The cross-connect should have redundancy in all critical circuits, including the switching network modules, system clock and synchronization circuits, and power converters. Self-monitoring software that continually verifies system performance and facility integrity should be embedded into its design.

Cross-connect systems should have an administration terminal capable of performing a range of network management tasks including the following:

  • Facility monitoring, which enables such functions as reset slip and framing loss counters for individual connections terminated on the cross-connect (the system should monitor and automatically report the occurrence of an impending facility failure);

  • Diagnostics, to include the ability to initiate tests while circuits are in or out of service;

  • Connection service, to include the ability to set up or remove connections between individual DS0 channels or sequential groups of channels of various cross-connect modules;

  • Test access, to include defining the test ports on the cross-connect system, invoking the test-port configuration, and making or removing test connections;

  • Removal and restoration of service, which entails removing circuits from service and restoring them to service (during restoration of service, diagnostic routines should run automatically before the circuit accepts traffic);

  • Utilities, to include status reports on facility performance and system status on request;

  • System configuration, to include allowing the addition or removal of T1 interfaces and switching network modules in preparation for expanding or contracting the network or network segment.

Finally, the possibility of using smaller cross-connects in conjunction with carrier-provided DCS services should not be overlooked. This allows network elements to be organized into a two-level hierarchical arrangement, whereby several low-end cross-connects would multiplex and switch bit streams onto a backbone network controlled by only a few high-end cross-connects. This arrangement can offer greater efficiency and management control.


8.10 Conclusion

Today’s TDM systems use a variety of techniques to maximize throughput, facilitate network management, and restore transmission facilities. Properly equipped multiplexers and cross-connect systems, for example, can provide substantial savings on the cost of private networking by using bandwidth more efficiently to minimize the number of lines needed and by reconfiguring lines and rerouting traffic on a scheduled or event-driven basis to accommodate changing needs or take advantage of the most economic services available. All of this, in turn, reduces the payback period of the initial investment in such systems.

Successful implementation of a TDM network hinges on the capabilities of the equipment to monitor for errors and delays and recover from fault conditions, as well as to prioritize and manage voice and data. In this way, the diverse application needs of the organization can be addressed properly without compromising the communications budget. Toward that end, the equipment should provide efficient interconnectivity of public and private network elements so the organization can leverage existing carrier offerings and benefit from new ones, while extending the reach of private facilities economically through the public network.

But the decades old reign of the TDM architecture may be headed for an end. Every carrier has a strategy in place to migrate its base of corporate customers from TDM networks to fast-packet networks. Instead of supporting voice and data over separate networks or trying to squeeze them into outmoded time slots, carriers want to run all traffic types over a unified fast-packet network, preferably an IP network because of its lower cost and global availability.

To encourage this migration, carriers are educating organizations about the benefits of so-called “IP convergence,” which lowers costs, simplifies the network, and allows customers to choose network infrastructures based on applications, instead of becoming locked into artificial technology constraints and specific vendor offerings. IP convergence supports productivity-enhancing applications such as multimedia to the desktop and unified messaging. It also supports cost-effective, all-distance connections and centralizes and simplifies security management. Finally, the ability to access IP through existing access services optimizes price and performance for each enterprise location.

Hardware vendors, too, are looking at how to migrate customers away from TDM-based products toward IP-based systems. All the major PBX manufacturers, for example, offer IP adjunct systems for connection to their conventional PBXs, enabling organizations to take advantage of IP for voice calling. These same vendors, sensing a change in customer purchasing patterns, also offer full-blown IPbased PBX systems. In fact, vendors are spending more for the development of IP systems than for conventional PBXs. Customers replacing or upgrading existing PBXs, or buying one for the first time, are more inclined to go with IP-based solutions.

Even wireless technologies—specifically 802.11b, also known as Wi-Fi—that started out as a way to extend the reach of Ethernet LANs without having to install new wiring to accommodate growth or keep up with organizational changes are now being extended with new standards to support voice and video. Local exchange carriers and interexchange carriers, too, are looking into Wi-Fi as a value-added service to complement their 2.5/3G data offerings such as general packet radio service (GPRS), which offers “always-on,” higher capacity, Internet-based content and packet-based data services, supporting Internet browsing, e-mail on the move, visual communications, multimedia messaging, and location-based services. The use of these wireless technologies is giving telecom and IT managers more flexibility in meeting corporate communications needs and can offer more opportunities for cost savings.

But the adoption of fast-packet solutions will be evolutionary, not revolutionary.-There is simply too much capital tied up in TDM infrastructures to permit change to occur too fast. Furthermore, sales of PBXs, multiplexers, channel banks, and cross-connect systems continue at a brisk pace, which has the effect of prolonging reliance on TDM. Such systems, including multiplexers and channel banks, even incorporate router functionality with optional plug-in modules, thereby extending the useful life of TDM products. In terms of management, SNMP has bridged the gap between these legacy systems and the newer fast-packet infrastructures, which contributes to the slower pace of migration.


Chapter 9: Managing Link Performance with CSU-DSUs

9.1 Introduction

Just as data transmission over analog lines requires modems, digital services require CSUs and DSUs to interconnect data terminal equipment (DTE) at the customer premises with the public network. CSU-DSUs are used for connecting bridges and routers, cluster controllers, and other DTE over point-to-point leased-line networks.

The CSU is positioned at the front end of a circuit to equalize the received signal, filter both the transmitted and received waveforms, and interact with the carrier’s test facilities. FCC Part 68 registration rules require that every digital circuit be terminated by a CSU. [1] The DSU element transforms the encoded waveform between alternate mark inversion (AMI) and a standard business equipment interface, such as RS-232C or V.35. It also performs data regeneration, control signaling, synchronous sampling, and timing. Both CSUs and DSUs must comply with AT&T Publication 62310 for interconnection with digital facilities and services.

Because digital transmission systems are capable of transporting signals between DTE in a form that is close to their native form, the serial data does not need to be compressed with complex modulation and demodulation techniques, as is the case when sending data via modems over analog facilities. Instead, customer-provided CSUs or DSUs encode serial data from terminals or computers and perform wave-shaping of the transmit signal before it is sent over the digital facility to ensure an acceptable level of network performance (see Figure 9.1). Lower-speed (2.4 to 56 Kbps) DTE interconnected via DDS by means of standard RS-232C or V.35 interfaces requires both the CSU and DSU functions. Some CSU-DSUs have multiple interfaces and can multiplex traffic from several sources onto the link. For example, two serial data ports may be available to mix data traffic types. There also may be a DSX-1 interface for connection to a local PBX. [2]

Click To expand
Figure 9.1: The original digital signal from a terminal’s serial data output (a) is translated into a bipolar format through AMI (b). The unshaped bipolar waveform is first reduced to a 50% bipolar waveform and then filtered (c), producing an output spectrum with zero energy at the data rate and reducing high-frequency components that may interfere with other services sharing the same cable binder. The output spectrum of a 9.6-Kbps transmission, for example, will exhibit no energy at either dc or 9,600 Hz and will peak at 4,800 Hz.
In a T1 environment, where up to 24 individual DS0s of 56/64 Kbps are available, these devices can operate as simple TDMs, inserting traffic on the correct time slot so it can be demultiplexed in the carrier’s network or at the customer’s remote site.

[1]Part 68 addresses connection of terminal equipment to the public telephone network, permitting consumers to connect equipment from any source to the public network if such equipment fits within the technical and safety parameters outlined in the guideline. Part 68 was first adopted in 1975 as part of the FCC’s Wide Area Telecommunications Service (WATS) rulemaking process in response to telephone company slowness in modifying tariffs to permit consumers to attach their own equipment to the public network. Since the introduction of Part 68, the FCC has consistently applied the principle that any device, which is privately beneficial without being publicly detrimental, may be attached to the network. In fact, without Part 68, users of the PSTN would not have been able to connect their computers to the network, which would have stalled the development and expansion of the Internet.

[2]DSX-1 stands for digital signal cross-connect, and the “1” defines the T1 signal as measured at a point of connection inside the customer premises. The only difference between DSX-1 and regular DS1 is the signal strength. The DSX-1, which is always inside the customer premises, can have line lengths of only up to 655 feet (196.5m). But DS1, which is outside the customer premise, can handle lengths up to about 1 mile (1.6 km).


9.2 Digital Data Services

As its name implies, DDSs provide digital communication circuits and support speeds up to 56 Kbps for point-to-point or multipoint applications. As a private-line interoffice service, DDS may be provisioned as a hub-based service and is available in point-to-point and multipoint synchronous configurations. With hub-oriented services, the user’s traffic must be routed through a series of special hub offices. Table 9.1 summarizes the primary and secondary channel bit rates.

Table 9.1: Primary and Secondary Channel Bit Rates of DDS with Secondary Channel Primary Channel Secondary Channel
Primary Channel | Secondary Channel
2.4 Kbps | 133 bps
4.8 Kbps | 266 bps
9.6 Kbps | 533 bps
19.2 Kbps | 1,066 bps
56 Kbps | 2,132 bps
64 Kbps | Not available

Optionally, DDS with a secondary channel (DDS/SC) may be provided to the customer. The secondary channel operates at a relatively low bit rate and is typically used to measure the end-to-end error-rate performance of the primary channel. DDS equipment also uses the secondary channel to provide remote unit configuration, surveillance of the remote DSU or terminal interface, remote alarming, performance testing of the network and equipment, and reporting of reference information resident in the firmware of each remote CSU/DSU.

In providing a completely independent, low-speed (auxiliary) data channel, DDS/SC allows network surveillance to be performed on a continuous and nondisruptive basis over the secondary channel (see Figure 9.2), without interfering with the production data, which continues to flow over the primary channel.

Click To expand
Figure 9.2: An application of DDS/SC. The secondary channel provides the means through which the diagnostic controller can poll location 3. At the same time, the host, using the primary channel, may poll location 1 for normal production data.

While there are CSU-DSUs that provide a virtual secondary channel on conventional DDS circuits, by multiplexing test data along with user data, these devices do not provide the testing flexibility of DDS/SC. Since the primary and secondary channels derived with this approach are not truly independent, continuous, real-time tests cannot be performed without impacting production data.

Both the CSU and DSU fall into the category of CPE. Because of the complementary functional relationship of the CSU and DSU when used with DDS, most vendors have integrated the two devices into a single unit, which is sometimes called a “digital data set” (see Figure 9.3). While the CSU and DSU elements can be provided separately for DDS, the more cost-effective approach is to integrate both functions into one unit. Almost all new DDS circuits are terminated in an integrated CSU-DSU device.

Click To expand
Figure 9.3: An integrated CSU-DSU on a DDS circuit.


9.3 CSU Functionality

For T1 systems, the CSU interfaces the carrier’s digital facilities with the user’s DTE. Because most terminal equipment that uses high-capacity 1.544 Mbps service (e.g., channel banks, multiplexers, PBXs) provides a four-wire DS1 interface, only the CSU function is required (see Figure 9.4). All T1 CSUs provide a regenerator to reconstitute signals that have been attenuated and distorted by the T1 span line or the customer’s in-house cabling. This function is also part of the FCC Part 68 equipment registration requirements for CSUs.

Click To expand
Figure 9.4: Deployment of CSUs and regenerators along a T1 span.

Line build out (LBO) is a functional requirement of all Part 68 registered T1 CSUs. LBO is an electronic simulation of a length of wire line that reduces the signal power so that it falls within certain limits (±7.5 dB). This is done to reduce the potential for one T1 transmitter to “cross-talk” into the receiver of other services within the same cable binder and to accommodate the first span line repeater’s receiver. The carrier establishes the proper LBO setting and simply instructs the user as to which one of three CSU settings to choose. A test signal is looped back over the receive pair and measured for signal loss. Through this procedure, the telephone company determines the line loss so that the proper setting can be made on the CSU.

DS1 circuits are designed to incorporate regenerators at approximately 6,000-feet intervals. As a practical matter, many telephone company installations position the final span repeater at less than half that distance, or 3,000 feet, from the network interface. This facilitates loop-back testing at the interface. By simply installing an RJ-48X jack (with transmit [Tx] and receive [Rx] shorting bars), removal of the CSU causes the Rx pair to be looped back mechanically to the Tx pair. The other benefit of this method of installation is that the customer can use the remaining 3,000 feet. This provides more flexibility to deal with problems related to inconsistent carrier installations and the placement of demarcation points, especially in multistory buildings. This flexibility means that users do not have to access riser cabling to insert regenerators and find appropriate CSUs to deliver the necessary power to the regenerators.

In addition to regenerating the received line signal and pre-equalizing the transmitted signal through the LBO, the CSU ensures that the user’s DTE does not send signals that could disrupt the carrier’s network. For example, very long strings of zeros do not provide timing pulses for the span line regenerators to maintain synchronization. The CSU monitors the data stream from the attached DTE so that the “ones-density rule” (e.g., the customer’s data shall have at least a 12.5% pulse density), which governs transmission over high-capacity 1.544 Mbps services, is not violated. The CSU will inject pulses if excessive zeros are being transmitted by the attached DTE. Transmissions with more than 15 consecutive zeros or ones-density averaging more than 12.5% could degrade network performance.

The CSU also removes bipolar violations of the AMI rules from the incoming signal, and it provides isolation between the DTE and the network to protect equipment and telephone company technicians from the potentially harmful line voltages and lightning surges that may propagate beyond the DTE. The CSU must also be able to send a “keep-alive” signal toward the network upon loss of a signal from the DTE to provide the T1 span line regenerators with timing pulses.

For DDS, there are two control signals that can be passed from the subscriber’s DSU to the network. “Control mode idle” is transmitted when the terminal’s RTS signal is turned off. “Excessive zeros” is transmitted when the terminal is sending six or seven consecutive spaces for subrate or 56-Kbps service, respectively. Both types of control signals are passed by using bipolar violations: two successive pulses of the same polarity that violate the AMI encoding rule.

Because the CSU interfaces user equipment with carrier facilities, it provides a window on the network, allowing both the carrier and the customer to perform testing up to the same point. CSU access to the network has prompted vendors to equip it with increasingly sophisticated diagnostic and network management features that greatly enhance user control and ensure the integrity of the T1 circuit.

9.3.1 Clear Channel Capability

Clear channel capability permits users to transmit DS1 signals with no restriction on the number of consecutive zeros. This is achieved by a line-coding technique called B8ZS, which is described in AT&T Technical Reference 62411. Although zero byte time-slot interchange (ZBTSI) also implements clear channel signaling, this method is not addressed in this discussion because B8ZS emerged a long time ago as the coding of choice among service providers and equipment vendors. B8ZS also supports the transmission of encrypted data over T1 circuits, without regard to the zeros content of the data. To take advantage of clear channel signaling, the user must have CSUs that conform to the B8ZS standard (see Figure 9.5).

Click To expand
Figure 9.5: B8ZS is a line-coding scheme that substitutes a known pattern for eight consecutive zeros. B8ZS maintains the ones-density rule at relatively little bandwidth overhead.

As an alternative to the classical AMI method of T1 encoding, B8ZS uses pulses that violate the AMI encoding rules (e.g., bipolar violations) to replace strings of eight consecutive zeros with a special pattern. This B8ZS pattern assures timing pulses, regardless of the data, so that synchronization problems do not occur. B8ZS does not inject errors because it guarantees that the minimum pulse density requirements are met without actually stuffing pulses into the production data stream.

Because B8ZS gets around the 15 consecutive zeros restriction, it provides for a clear signaling channel and is therefore said to be providing a “clear channel” capability. So B8ZS use applies all of the T1 bandwidth to data transmission and, in turn, the full 64-Kbps DS0 bandwidth, effectively removing the 56-Kbps limit associated with DDS. B8ZS transmitter circuitry in the CSU monitors the data stream from the terminal equipment for excessively long strings of zeros. When detected, these strings of zeros are replaced with a bipolar violation before being transmitted to the network. A compatible CSU at the other end recognizes this violation and converts it back into its original string of zeros.

9.3.2 Diagnostics

Realizing that users would be deploying CSUs and DSUs for digital transmission in a manner similar to that for modems over analog facilities, vendors over the years have added maintenance and fault-isolation capabilities to differentiate their offerings from those of competitors. Because these devices are strategically positioned at the network interface, they can be used to implement various tests to ensure the proper operation of the unit and the line.

With so many vendors involved in providing end-to-end connectivity, each with its own brand of equipment and type of cabling, troubleshooting the link has become a complex and arduous task. CSUs and DSUs are a natural and convenient point for such troubleshooting activities. With their built-in capabilities for self-diagnostics, as well as DTE loopback and network loopback tests, problems can be isolated along any point of the network. Tests may be initiated either locally from the front panel or remotely through a network management system.

Because the CSUs and DSUs are physically separate from the DTE, their maintenance features may be used even when the DTE becomes inoperable. This minimizes the requirement for expensive, external test equipment. For more extensive testing, however, some T1 CSUs do provide jack access for external test equipment.

The most essential diagnostic capabilities found in CSU-DSUs are loopbacks, which enable technicians to test communications through portions of the network and isolate problems. They can be initiated by the carrier or the customer locally or through the network remotely. These loopback tests are frequently used to isolate problems and are disruptive only to the receive path of the element being tested. For example, individual frame relay permanent virtual circuits (PVCs) may be looped back without affecting other PVCs. Many T1 CSU-DSUs also present DSX-1 ports to the customer and may let individual DSUs be looped back while other channels remain undisturbed. The following are examples of loopbacks:

  • DTE loopback: Reflects data sent via DTE port back to DTE. The signal, framing, and CRCs are regenerated during a payload loopback, whereas line loopbacks regenerate the signal only.

  • Network loopback: Reflects data sent viaWANport back to WAN, using payload or line loopback options as with DTE tests. Network loopbacks may be initiated inband by the carrier or remote site, or locally from the network management system (NMS) or front panel.

  • Frame relay PVC loopback: In a frame relay environment, data on an individual PVC may be sent back to its source.

CSUs and DSUs offer diagnostics via loopback tests to check the subscriber loop between the customer’s equipment and the carrier’s facilities, as well as the entire circuit between near-end and far-end CSU-DSUs. Many CSUs and DSUs allow the user to perform DTE loopback tests to verify the integrity of the link between the CSUs and DSUs and the originating terminal equipment. CSU-DSUs are equipped with various types of monitors to facilitate problem determination. Units equipped with front-panel LEDs can readily display information about bipolar violations received from the network, loss of DTE signal, loss of network and equipment synchronization, and detection of certain alarm conditions.

Because CSU-DSUs must rigidly adhere to network specifications and FCC regulations, one vendor’s product would seem to need to be compatible with those of another vendor and capable of being mixed on the same network. This is true up to a point. While these devices will transfer data back and forth, most vendors have added proprietary testing techniques that will not interoperate with the products of other vendors.

9.3.3 Circuit Maintenance

Some T1 CSUs support both the D4 superframe (SF) and ESF formats. ESF is useful in helping the service providers maintain the network. ESF extends the normal 12-frame SF structure of the T1 to 24 frames (hence the name “extended superframe”). By doubling the number of framing bits available for diagnostics, more functionality is available (see Figure 9.6). Of the 8-Kbps bandwidth (repetition rate of the 193rd bit or framing bit), 2 Kbps are used for framing, 2 Kbps for CRC, and 4 Kbps for a facilities data link (FDL) for two-way communication along a T1 circuit.

Click To expand
Figure 9.6: A comparison of how the 193rd bit is used in SF (D4) and ESF formats.

With CRC, the entire circuit may be segmented so that it can be monitored for errors without disrupting normal data traffic. In this manner, performance statistics can be maintained to determine the quality of the T1 circuit. ESF diagnostic information, often displayed on a terminal or computer, is most useful to support troubleshooting by the carrier. For user T1 circuits with ESF, the supervisory terminal provides information about T1 link performance over protracted periods of time, furnishing a historical record of circuit performance.

The original ESF, as described in AT&T Technical Reference 54016, required that the CSU compile performance statistics (from the CRC) every 15 minutes. This information would be kept updated for a full 24 hours, so that a complete one-day history could be accessed by the service provider. Under the AT&T ESF method, the carrier could poll each CSU to retrieve data and clear these storage registers on a demand basis. By equipping the ESF CSU with dual registers (one for the carrier and one for the user), both carrier and user alike have full access to the performance history.

A newer version of ESF, standardized as ANSI T1.403, does not require the CSU to store performance data for 24 hours. Also, the CSU no longer will respond to polled requests from carriers but will simply transmit (volunteer) ESF performance messages every second. The new standard requires that approximately 200 bps be transmitted to the CO without polling. The CSUs will be required to gather statistics on clock synchronization errors and framing errors, as well as errored seconds, severely errored seconds, failed seconds, and bipolar violations that are currently reported by CSUs.

Customers can use ESF to gather end-to-end performance data and sectionalized alarms in real time. This enables them to narrow down problems between carrier-access points and on interoffice channels and to find out in which direction the error is occurring.

As the networks become more complex from the addition of multiple local and interexchange service providers, all carriers will need access to ESF performance data. Most likely, no one carrier will have complete control. If, for example, one interexchange carrier did have the ability to clear the remote CSU registers, local exchange carrier access to the accumulated information would be precluded.

Recognition of this potentially disruptive situation led to the development of the T1.403 monitoring standard for ESF.

9.3.4 Impairment Testing

Depending on the design of the CSU, certain impairments, such as jitter, may actually be reduced, thereby improving overall system performance. Data applications are much more sensitive than voice to jitter because errors forced in the least significant bits (LSB) of the digitized analog signal (e.g., those bits that have the smallest value in a binary word or number) are almost undetectable by the human ear.

Today’s ESF CSUs not only provide conversion between D4 and ESF signals but also monitor signals received from the line, generate alarms based on user-defined thresholds, and report these alarms to a control location. These devices invoke system tests in a variety of ways: from a central location through a network management system; locally via front-panel switches on the units themselves, or from a terminal or microcomputer connected to a supervisory port.

T1 CSU-DSUs are also available to support interface and data rate translations from the standard DS1 format to V.35 terminal interfaces used on high-speed front-end processors requiring 1.536 Mbps serial data transmission. These CSU-DSUs can perform other speed conversions to support FT1 transmission. This speed translation may be required for videoconferencing equipment and for unchannelized high-speed data from LANs to bridge together remote locations.


9.4 Carrier Testing Services

In addition to the diagnostic and loopback test capabilities built into many of today’s CSU-DSUs, users rely on telephone company-provided test systems like AT&T’s Automated Bit Access Test System (ABATS) for DDS. For nationwide AT&T ACCUNET DDS customers, ABATS can actually command each and every CSU-DSU termination into a line loopback (LL) and remote terminal loopback (RTL) test to isolate network problems.

ABATS is activated when a user places a call to the serving test center (STC) to report a problem. The STC interacts with the ABATS test center where technicians troubleshoot the customer’s entire network, right down to the DTE interface of the remote CSU-DSUs. The test center verifies test data after they are looped through the CSU-DSU, where the data are decoded, reclocked, and retransmitted. Many smaller organizations, with neither the diagnostic test equipment nor the technical expertise required to run sophisticated diagnostic systems, have come to rely on this service for maintaining their networks.

In addition, users can subscribe to AT&T’s CTS, which is available over inter-LATA DDS circuits only. From an asynchronous terminal and a leased or dial-up data set on the customer’s premises, the user can access the network test system. The user can use the service provider’s computer resources to identify a problem on the network and isolate its cause by initiating loopback tests in both directions, as well as tests on the DSU. This, coupled with the built-in CSU-DSU diagnostics, provides one means of maintaining the customer’s circuits.

Tests initiated through ABATS and CTS are disruptive, however, because they are conducted on an “in-band” basis; that is, the test signals replace the user’s production data. To lessen the effect, users may schedule circuit testing for off-peak hours. Because these services utilize standard LL and RTL testing, users can take advantage of them as long as they have a CSU-DSU that is completely compatible with the old Western Electric Company’s (WECO) 500A type of DSU.


9.5 User-Controlled Diagnostics

Telephone company diagnostics such as ABATS and CTS provide only the most rudimentary test capabilities. Because these methods are based strictly on loopback testing, which is always interfering, other network control and diagnostic systems are frequently chosen instead. Of special importance for DDS is the newer DDS with secondary channel previously mentioned and illustrated in Figure 9.2.

By providing a completely independent, low-speed (auxiliary) data channel, network surveillance can be performed on a continuous, non-disruptive basis. In addition, non-disruptive loopback testing may be performed over the secondary channel without interfering with the production data, which continues to flow over the primary channel. Overall network reliability is also improved because a failure in the data channel will not inhibit passage of alarms and, consequently, prevent corrective action from being taken.

While some CSU-DSUs provide a “virtual” secondary channel on conventional DDS circuits (by multiplexing test data along with user data), these devices do not provide the testing flexibility of DDS/SC. Because the primary and secondary channels derived with this approach are not truly independent, continuous real-time tests cannot be performed on the secondary channel without affecting production data. Also, because this technique steals bandwidth from the primary channel, equipment that requires precise clocks (such as channel-splitting multiplexers) may not run properly.


9.6 Fractional T1

With the introduction of FT1 services in the late 1980s, speculation by industry observers was that DDS would become obsolete. After all, the pricing structure of AT&T’s FT1 Service made 64 Kbps look like a bargain compared to DDS at 56 Kbps. Both types of services, however, are still available.

One reason for this coexistence is that DDS offers error correction, whereas T1 and FT1 do not. The CRC of AT&T’s ESF does not correct errors; it only monitors for error conditions. DDS also offers a higher availability rate than T1 and FT1. A 1,000-mile DDS interoffice channel has 99.95% availability, which translates into 4.38 hours of downtime per year, whereas a T1 interoffice channel at the same distance has 99.75% availability, which translates into 21.9 hours of downtime per year.


9.7 Integrated Solutions

With the advent of broadband Internet access, CSU-DSU functionality has been embedded into routers via optional add-in interface cards for T1 and FT1 service supporting nonchannelized data rates of N x 64 Kbps or N x 56 Kbps. An integrated solution has fewer components and fewer points of failure—one less power supply and fewer cables—which makes for greater reliability, space savings, and simplified management. When WAN bandwidth requirements or service provider pricing change, network administrators can easily change WAN services either by changing the software configuration or replacing the WAN interface card. Because the same card can be used on a vendor’s other router platforms, the number of spare units can be reduced, and the WAN interface card can be redeployed from one platform to another.

At installation, the router’s setup utility prompts a series of basic configuration questions. A Web browser interface tool provides point-and-click initial configuration for the CSU-DSU card. CSU-DSU statistics, such as 24-hour history, are provided by using the command line interface (CLI). Loopbacks, bit error rate tester (BERT) test patterns, alarm counters, and performance reports are also accessible from CLI, while front-panel LEDs provide indications for carrier detect, loopback, and alarm functions for quick troubleshooting. A manual loopback button allows users at remote sites to easily initiate a T1 network line loopback by pushing a recessed button on an interface card front panel without having to access the router via a console port or Telnet. The types of diagnostic information provided by the integrated router/CSU-DSU are summarized in Table 9.2.

Table 9.2: Diagnostic Information Provided by the Integrated Router/CSU-DSU
 | Network line loopback (user initiated) Recessed push button for network line loopback (toggle on/off) Network line loopback (carrier initiated) Network payload loopback Local DTE loopback
Loopbacks | Remote line and payload loopback
Self | Self test activated by user 0 in 1: Transmits an all-zeros test pattern to verify B8ZS line encoding. The remote end may report a loss of signal when using AMI line coding. 1 in 1: Transmits an all-ones test pattern for signal power measurements. 1 in 2: Transmits an alternating ones-and-zeros pattern for testing bridge taps. 1 in 5: Transmits the industry-standard test pattern loopback request. 1 in 8: Transmits a test pattern for stressing timing recovery of regenerators. 3 in 24: Transmits a pattern for testing the ones-density tolerance on AMI lines. Quasi random word (QRW) test pattern to simulate user data.
Test patterns (BERT) | User-programmable 24-bit test patterns. Loss of network signal Loss of network frame
Network (T1) alarms | Receive from network CRC Bipolar violations (BPV) Out of frame (OOF) Errored seconds Burst errored seconds Severely errored seconds
Performance reports/error counters | Ft and Fs framing errors for SF framing FPS framing errors for ESF framing 24-hour history stored in 15-minute increments Data carrier detect (CD) Loopback (LP)
LEDs | Alarm (AL)

Through the router’s operating system, there is the capability for remote configuration via Telnet from a CLI of both the router and CSU-DSU. This eliminates the need for out-of-band management as well as the need to learn and use a second set of command syntax for an external CSU-DSU. With the integrated approach, CSU-DSU management becomes simply another menu selection in the overall router management. If there is a failure at any level in the data transport stack, the router will analyze the failure by layer and indicate the lowest layer that is responsible. If the problem is at the CSU-DSU layer, the router will indicate it so the system administrator can quickly focus on the problem.

The integrated device is manageable as a single SNMP entity through an element-level management system. The CSU-DSU interface card comes with an SNMP agent that supports the standard MIB II, CSU-DSU MIB, and T1 MIB. All T1 performance statistics can be monitored. In addition, the router generates the appropriate SNMP traps in response to CSU-DSU alarms.

When the CSU-DSU and router are not integrated, locating the cause of a data transport failure can be quite complex. Consider the case where a technician has improperly configured the line coding on a standalone CSU-DSU. The CSU-DSU will experience bit errors, and the router will fail to bring up a link. Thus, the CSU-DSU and the router will each report a problem. The network administrator will be confronted with two separate failure reports and may not know which problem to address first.

When a standalone CSU-DSU loses its T1 network connection, usually the end of network connectivity for any attached router is lost as well. But with an integrated CSU-DSU, the ISDN basic rate interface (BRI) can be configured as a backup link. In addition, the console port can provide a second backup, since it can be configured to dial out through a connected modem to a remote network.

Despite the many advantages of integrated CSU-DSUs, a strong case can still be made for dedicated devices. As noted, CSU-DSUs provide a natural handoff point between the carrier and the customer premises. Carriers can perform diagnostic and loopback functions up to the CSU-DSU, even if there is no WAN edge device, such as a router. However, if the router malfunctions, all onboard components will become unavailable along with it, preventing the carrier from isolating the cause of the failure. If the CSU-DSU fails—because of a lightning hit on the carrier circuit, for example—CSU-DSU spares can be put into place quickly without having to reconfigure the router and possibly disrupting Internet connectivity while loading a new address table.

Dedicated CSU-DSUs can also reduce the ongoing cost of WAN management. By standardizing on a single WAN-interface management strategy, such as physical and data link network monitoring systems, it does not matter what equipment is connected behind it. Local technicians can easily verify the health of the link by checking the front-panel LEDs of the CSU-DSU before they start troubleshooting back-end routers and systems. Many test functions are available at the front panel of the CSU-DSU, allowing for diagnostics without compromising router management security.


9.8 Integral Protocol Analyzers

Some CSU-DSUs include a built-in protocol analyzer. In addition to watching traffic at the frame relay level, administrators can set traps and analyze the data at the IP layer, locally or remotely. If there is a problem with a particular traffic type, a trap can be set for the data pattern in the CSU-DSU, rather than having to set up a protocol analyzer and physically break into the circuit. This eliminates having to dispatch a technician to a remote site to find problems that would otherwise need an analyzer to resolve.

There is a potential downside to the integral protocol analyzer. Usually these devices are a key component of a carrier’s managed service, and it is the carrier that is providing the monitoring and analysis of link performance. This means the carrier could trap and view user data. Vendors address this concern by allowing the protocol analyzer to trap only a small sample of the data rather than whole packets and by permitting this feature to be turned off if necessary.


9.9 SNMP for Management

Managed CSU-DSUs generally offer SNMP management support and/or IP telnet. To carry the management data, they require an Ethernet interface, the FDL bits available on ESF links, or a frame relay PVC. With this approach, management data is inserted on a private data link connection identifier (DLCI) between a local router and the remote device or on a WAN PVC dedicated to management. Management data can even use a PVC that usually carries user data. When there is no user data on that PVC, it is made available to carry management information.

SNMP can provide a variety of performance information to a centralized console, including physical-link errors and frame counts. Alarms in the network can be passed up to an SNMP console via traps, and often trap thresholds may be set. But SNMP is not good for collecting long-term statistics for trending and service-level management. SNMP is also poor for providing higher-layer protocol data. Frequent polling of the device to collect management data is impractical, and many information elements are not captured via SNMP.

An increasingly popular management option is the use of the Web browser as the user interface. When an administrator points a browser at the device’s IP address, a graphical configuration, status, and diagnostics display are presented that are more intuitive than the typical command-line text-based interface. Alerts from the unit can be issued to an administrator via e-mail.

Custom device-configuration applications are available that run on Windows- or-UNIX-based computers. These systems provide graphical configuration, monitoring, and management of the CSU-DSU and can be used to create configurations offline or update software over the network.


9.10 Disaster Recovery

To ensure continued traffic flow in the event of an access link failure, some CSUDSUs provide failover services that automatically switch to an ISDN BRI or other standby link. This is useful in that the router or other CPE need not process and distribute route topology updates, which is typically a slow process. However, the disadvantage to handling failovers in such a transparent manner is that the router is not able to adjust route costs to reflect the link’s changed status.

Disaster recovery over frame relay links presents a set of problems that are addressed by CSU-DSUs specifically designed for frame relay. These links will not pass data if frame relay signaling is not present, so just having a dial-backup mechanism in place will not suffice—there must be some device that continues to behave like a frame relay switch, or the router will not send any data. On these occasions, the frame relay CSU-DSU will spoof the link management interface (LMI) to the router, accepting frames and transparently passing data around the failure point.

Some CSU-DSUs include line learning features, enabling them to automatically detect the characteristics of the underlying circuit such as line coding, framing, and the DS0 channels used. While this greatly simplifies installation, there is little deviation in most circuit configurations, especially those in the United States, where T1 lines typically use B8ZS line coding and ESF framing. Since manufacturers use these default settings, line learning may not be an essential feature.


9.11 Service-Level Management

Some products offer service-level management capabilities that, among other things, collect data concerning WAN usage, especially in frame relay environments. These CSU-DSUs collect and display data gathered from onboard probes and provide historical and real-time circuit analysis. The data is collected at the CSU-DSU and may be brought into an enterprise network management system or offered as a service by the carrier. The advantage of having service-level management capabilities in the CSU-DSUs is that they can monitor both the router’s serial interface and the WAN T1/DDS circuit. As a result, they provide more information than single-interface probe devices.

Products such as Visual Networks’ Visual UpTime offer service-level agreement (SLA) validation with detailed service-level reports, which provide insight into variations of SLA parameters over time. This helps enterprise users resolve how and where SLA violations occurred during the previous day, week, or month. The detail level reports can be created either as a daily, monthly, or multimonth report on a per-PVC basis. The summary reports can be created as a monthly, multimonth, and month-to-month report for all PVCs (aggregate).

Among the SLA drill-down reports offered by Visual UpTime is one for frame relay service-level validation (see Figure 9.7), which provides availability, delay, and throughput information that describes the performance of each PVC.

Click To expand
Figure 9.7: Frame relay service-level validation from Visual Networks’ Visual UpTime.

Frame relay service providers can use management tools like Visual UpTime to offer the following tiered services to their customers:

  • CSU-DSU provisioning and maintenance, allowing end-to-end monitoring 24 hours a day, 7 days a week;

  • Network planning and performance reporting, which adds network performance reports for help with bandwidth and capacity planning;

  • Troubleshooting and real-time support, delivering to customers the same real-time access to network performance information, collected by the CSU-DSU, as the carrier’s own maintenance technicians.

Customers get wide-area data access and in-depth monitoring and analysis of critical metrics regarding their network performance. The embedding of such monitoring and analysis functions into the CSU-DSU improves end-to-end network service quality by minimizing network downtime and performance degradation. This functionality includes real-time and historical troubleshooting, network baselining, and detailed reporting for use in bandwidth planning.

Baselining is a procedure for understanding the behavior of a properly functioning-network so that deviations can help identify the cause of problems that may occur in the future. The only way to know a network’s normal behavior is to analyze it while it is operating properly. Later, technicians and network managers can compare data from the properly functioning network with data gathered after conditions have begun to deteriorate. This comparison often points to the right steps that lead to a corrective solution.


9.12 Conclusion

Even though the basic functions of CSU-DSUs have not changed in almost 30 years, they are critical to carriers and customers alike. Acting as a protective barrier for the carrier’s network and an interface or signal converter for the customer, a CSU-DSU also provides a variety of functions that ensure WAN links run properly.

Improvements in the underlying technology have enabled CSU-DSUs to evolve from interface devices that sat passively on the network to “intelligent” devices with sophisticated network management features, innovative diagnostic capabilities, and higher levels of functionality that enable users to take full advantage of new digital services. While CSU-DSUs are available as standalone units, they are also available as add-in modules for channel banks, multiplexers, and routers.


Chapter 10: Managing High-Speed Packet Networks

10.1 Introduction

There are four types of services that qualify as “fast packet.” Frame relay offers up to 45 Mbps, ATM up to 622 Mbps, and Ethernet at up to 40 Gbps. IP also qualifies as a fast-packet service, since it is capable of running across frame relay, ATM, and Ethernet. These services, available as wired or wireless, can be obtained from numerous carriers, or they can be set up and managed as private networks.

All of these fast-packet technologies were developed for specific types of applications, but IP is playing a growing role in corporate communications and is viewed by many as the most economical means for achieving voice-data convergence. Under this concept, all types of traffic are capable of running over a single data network, rather than multiple networks, as is the case today. In fact, all of the major carriers and equipment makers have a strategy for migrating customers to IP networks exclusively.

This migration has already started. Service providers like IDT specialize in offering telephone service over a managed IP network, the quality of which is indistinguishable from calls over the PSTN. In the equipment realm, routers no longer support data exclusively, but voice as well. Modules and software can be added to routers to support voice over IP, whether the actual carrier-provided service is frame relay, ATM, or IP. Moreover, the router is equipped with protocols that give preference to voice, rather than routine data that is more tolerant of delay.


10.2 Frame Relay

Frame relay is a stripped-down version of the X.25 protocol for packet-data networking, which was designed to transport data very reliably over noisy analog-line networks. In running over cleaner digital-line networks, however, frame relay eliminates many of the functions of X.25, including node-to-node error checking and correction. In stripping away unnecessary functions and relegating error correction to the CPE at the edge of the network, frame relay could transport data at much higher speeds. Whereas the speed of X.25 topped out at 56 Kbps over analog facilities, frame relay offers up to 45 Mbps over more reliable T-carrier facilities, and even higher over optical carrier (OC) facilities, making it better suited for interconnecting LANs at native speeds over a WAN.

With LANs becoming popular in the 1980s, there was a growing need to interconnect them over the WAN. Point-to-point T-carrier lines were becoming commercially available, but they were cost prohibitive for all but the largest companies. Frame relay was developed specifically to provide LAN interconnectivity as a carrier-provided service, eliminating costly leased-line charges based on the distance between corporate locations.

With the increasing use of digital facilities, there is less need for error protection of the kind offered by X.25. At the same time, the end devices increased in intelligence, processing power, and storage, making them better at handling error control and diverse protocols. Consequently, the communications protocols used over the network may be scaled down to their bare essentials to greatly increase throughput. This is the idea behind frame relay, which can support voice traffic, as well as data, packaged in variable-sized frames of up to 4,000 bytes in length.

Frame relay was introduced commercially in May 1992. It initially gained acceptance as a method for providing end users with a solution for data connectivity requirements, such as LAN-to-LAN connections. Frame relay provided both an efficient and flexible data transport mechanism and also allowed for a cheaper bandwidth cost associated with connecting legacy SNA networks.

Whereas X.25 operates at the bottom three layers of the OSI reference model, frame relay operates at the first layer and the lower half of the second layer. This cuts the amount of processing by as much as 50%, improving network throughput. Although the frame relay network can detect errors, it does not correct them. Bad frames are simply discarded. When the receiving device detects corrupt or missing frames, it can request a retransmission from the originating device, whereupon the appropriate frames are sent again.

10.2.1 Advantages of Frame Relay

The most compelling advantages of a carrier-provided frame relay service include the following:

  • Improved throughput/low delay: Frame relay service uses high-quality digital circuits end to end, making it possible to eliminate the multiple levels of error checking and error control. The result is higher throughput and less delay compared to legacy packet-switched networks like X.25.

  • Any-to-any connectivity: Any node connected to the frame relay service can communicate with any other node via point-to-point PVCs or dynamically via switched virtual circuits (SVCs).

  • No long-distance charges: Since frame relay is offered as a service over a shared network, the need for a highly meshed private-line network is eliminated for substantial cost savings. There are no distance-sensitive charges with frame relay, as there are with private lines.

  • Oversubscription: Multiple PVCs can share one access link, the aggregate bandwidth of which can even exceed the port speed of the frame relay switch. In oversubscribing the port, multiple users can access the frame relay network on a contention bases, eliminating the cost of multiple private-line circuits and their associated CPE for further cost savings.

  • Higher speeds: Whereas X.25 offers up to 56 Kbps, frame relay service supports transmission speeds up to 44.736 Mbps. If the frame relay switches in the network support Frame Relay Forum Implementation Agreement 14 (FRF 14), speeds at the OC-3 rate of 155 Mbps and the OC-12 rate of 622 Mbps over fiber backbones are possible.

  • Simplified network management: With fewer access circuits and less equipment to monitor, companies subscribing to a frame relay service can reduce their management requirements. And under a managed service, the carrier provides proactive monitoring of CPE and network maintenance on a 24/7 basis, assuming the entire management burden from the customer, even if a firewall is implemented by the routers operating system.

  • Intercarrier connectivity: Frame relay service is compatible between the networks of various carriers, through network-to-network interfaces (NNIs), enabling data to reach remote corporate locations that may not be served by the primary carrier.

  • Performance reports: Customers can manage their frame relay service to maximum advantage. Accessible on the carrier’s secure Web site, network reports are available for utilization, errors, health, trending, and exceptions.

  • Service-level guarantees: Frame relay service providers offer customers SLAs that specify availability as a percentage of uptime, round-trip delay expressed in milliseconds, and throughput in terms of the committed information rate (CIR). If the carrier cannot meet the SLA for a given length of time, it credits the customer’s invoice accordingly.

10.2.2 Types of Circuits

The two primary types of virtual circuits supported by frame relay are SVCs and PVCs. SVCs are analogous to dial-up connections, which require path setup and tear down. A key advantage of SVCs is that they permit any-to-any connectivity between devices connected to the frame relay network. In contrast, PVCs are more like dedicated private lines; once set up, the predefined logical connections between two sites stay in place. Another type of virtual circuit is the multicast virtual circuit (MVC), which is used to broadcast the same data to a group of users over a reserved data link connection in the frame relay network. This type of virtual circuit might be useful for expediting communications among members of a single workgroup dispersed over multiple locations or to facilitate interdepartmental collaboration on a major project. It can also be used for broadcast faxing, news feeds, and “push” applications from the corporate headquarters to branch locations.

The same frame relay interface can be used to set up SVCs, PVCs and MVCs. All three may share the same access facility. The behavior of the virtual circuits is programmed into the frame relay switches within the network. In supporting multiple types of virtual circuits, frame relay networks provide a high degree of configuration flexibility, as well as more efficient utilization of the available bandwidth.

The virtual circuits have a CIR, which is the minimum amount of bandwidth the carrier agrees to provide for each virtual circuit. If some users are not accessing the frame relay network at any given time, extra bandwidth becomes available to users who are on-line. The CIR of their virtual circuit can burst up to the full port speed. As other users come on-line, however, the virtual circuits that are bursting beyond their CIR must back down to their assigned throughput rates.

10.2.3 Congestion Control

Real-time congestion control must accomplish the following critical objectives in a frame relay network:

  • Maintain high throughput by minimizing time-outs and out-of-sequence frame deliveries;

  • Prevent session disconnects, unless required for congestion control;

  • Protect against unfair users who attempt to hog the available network resources by exceeding their CIR or established burst size;

  • Prevent the spread of congestion to other parts of the network;

  • Provide delays consistent with application requirements and service objectives.

In the frame relay network, congestion can be avoided through control mechanisms that provide backward explicit congestion notification (BECN) and forward explicit congestion notification (FECN).

BECN is indicated by a bit set in the data frame by the network to notify the user’s equipment that congestion avoidance procedures should be initiated for traffic in the opposite direction of the received frame. FECN is indicated by a bit set in the data frame by the network to notify the user that congestion avoidance procedures should be initiated for traffic in the direction of the received frame. Upon receiving either indication, the end-point (i.e., bridge, router, or other internetworking device) takes appropriate action to ease congestion.

The response to congestion notification is dependent on the protocols and flow-control mechanism employed by the end-point. The BECN bit would typically be used by protocols capable of controlling traffic flow at the source. The FECN bit would typically be used by protocols implementing flow control at the destination.

Upon receipt of a frame with the BECN bit set, the end-point must reduce its offered rate to the CIR for that frame relay connection. If consecutive data frames are received with the BECN bit set, the end-point must reduce its rate to the next “step” rate below the current offered rate. The step rates are 0.675, 0.50, and 0.25 of the current rate. After the end-point has reduced its offered rate in response to receipt of BECN, it may increase its rate by a factor of 0.125 times the current rate after receiving two consecutive frames with the BECN bit clear.

If the end-point does not respond to the congestion notification, or the user’s data flow into the network is not significantly reduced as a result of the response to the congestion notification, or an end-point is experiencing a problem that exacerbates the congestion problem, the network switches implement congestion recovery procedures. These procedures include discarding frames, in which case the end-to-end protocols employed by the end-points are responsible for detecting and requesting the retransmission of missing frames.

Frame discard can be done on a priority basis; that is, a decision is made on whether certain frames should be discarded in preference to other frames in a congestion situation based on predetermined criteria. Frames are discarded based on their “discard eligibility” setting of 1 or 0, as specified in the data frame. A setting of 1 indicates that the frame should be discarded during congestion, while a setting of 0 indicates that the frame should not be discarded unless there are no alternatives.

The discard eligibility may be determined in several ways. The user can declare whether the frames are eligible for discard by setting the discard eligibility bit in the data frame to 1. Or, the network access interface may be configured to set the discard eligibility bit to 1 when the user’s data has exceeded the CIR; in which case, the data is considered excess and subject to discard. For users who subscribe to CIR=0, which moves data through the frame relay network on a best-efforts basis subject to bandwidth availability, all traffic is discard eligible.

10.2.4 Frame Relay Charges

Frame relay charges differ by carrier and may differ further by configuration. Accordingly, frame relay service charges may include the following:

  • Port charge for access to the nearest frame relay switch, which is applied to every user location attached to the frame relay network.

  • Local loop charge, which is the monthly cost of the facility providing access to the frame relay network. This charge may not apply if the customer’s building is directly connected to the carrier’s metro fiber ring, in which case the customer is charged only a one-time setup fee.

  • Charges for the PVCs and SVCs, which are determined according to the CIR assigned to each virtual circuit.

  • Burst capability, usually determined by the burst excess size. Most carriers do not specifically charge customers for bursting beyond the CIR, since this is one of the key advantages of going with the service in the first place.

  • CPE, which includes the frame relay or internetworking access equipment optionally leased from the service provider and bundled into the cost of the service.

  • IntraLATA/interLATA service charges. Usually, there is one price for “local” frame relay service and another price for “national” frame relay service. National frame relay service is usually defined as one that crosses LATA boundaries and involves the services of another carrier. Neither intraLATA or interLATA service is distance-sensitive with regard to pricing, however.

10.2.5 Voice over Frame Relay

VoFR is receiving growing attention. Most data-oriented frame relay access devices (FRADs) and routers use the FIFO method of handling traffic. In order to achieve the best voice quality, however, voice frames cannot be allowed to accumulate behind a long queue of data frames. Voice FRADs and routers, therefore, employ traffic prioritization schemes to give preference to voice traffic, thereby minimizing delay. During times of network congestion, one of the easiest ways to relieve congestion is to simply discard frames. In such cases, data rather than voice frames will be discarded first, giving voice a better chance of making it through the network.

Some service providers offer prioritization of PVCs within the frame relay network. Prioritization features on both the CPE and the frame relay network can result in better voice application performance. The CPE ensures that higher priority traffic is offered to the network first, while PVC prioritization within the network ensures that higher priority traffic is delivered from node to node first.

VoFR equipment compresses the voice signal from 64 Kbps to at least 32 Kbps. In most cases, compression to 16 Kbps or even 8 Kbps is possible. Some equipment vendors support dynamic compression options. When bandwidth is available, a higher voice quality is achieved using 32 Kbps, but as other calls are placed or other traffic requires bandwidth, the 16- or 8-Kbps compression algorithm is implemented. Most voice FRADs also support fax traffic. A fax can take up as little as 9.6 Kbps of available bandwidth. VoFR usually allows a company to use its existing phones and numbering plan. In most cases, an internal dialing plan can be set up that allows users to dial fewer digits to connect to internal locations.

A persistent myth about VoFR is that voice calls can be carried free on an existing-frame relay network. In fact, VoFR requires special CPE, entails an increase in the port speed, and possibly an increase of the CIR—all of which have a cost associated with them. Furthermore, to communicate with all other corporate locations, there must be a fully meshed network of PVCs, which increases the overall cost. If the carrier offers SVCs—and not all of them do—fewer virtual circuits are needed, but there is still a cost associated with the SVCs that are needed. Despite all this, many companies choose to run VoFR because it saves them money.

Another issue to contend with when considering VoFR is that many carriers refuse to offer it as a separate service and do not address it in their SLAs. Consequently, a company will have to take responsibility for choosing the right CPE and setting it up to handle voice calls, even if that means hiring a consultant. To many carriers, voice is simply another data application running over their frame relay network; if the customer is not satisfied with the QoS for voice, the carrier does not accept responsibility. All this will be discussed prior to subscribing to a frame relay service, so these issues should come as no surprise.


10.3 Asynchronous Transfer Mode

ATM is a cell-switching technology that offers low-latency transmission with built-in QoS guarantees in support of data, voice, and video traffic at multi-mega-bit-per-second speeds. The high speed is the result of ATM’s fixed-length, 53-byte cell, which is switched in hardware. ATM is also highly scalable, making it equally suited for interconnecting legacy systems and LANs and for building WANs over today’s high-performance optical-fiber infrastructures. ATM-based networks may be accessed through a variety of standard T-carrier and OC interfaces, as well as such services as frame relay and IP.

10.3.1 Applications

Many applications are particularly well suited for ATM networks, including the following:

  • LAN internetworking: ATM can be used to interconnect LANs over the WAN. Special protocols for LAN emulation (LANE) make the connection-oriented ATM network appear as a connectionless Ethernet or token-ring LAN segment.

  • Videoconferencing or broadcasting: ATM can be provisioned for interactive video-conferencing between two or more locations or to support point-to-multipoint video broadcasts.

  • Telemedicine: With ATM, large amounts of bandwidth can be provisioned to support the rapid exchange of high-resolution diagnostic images and multimedia patient records while permitting interactive consultations among medical specialists at different locations.

  • Private-line connectivity: An ATM virtual circuit can be used to provide a more economical way to provision leased lines on the WAN. ATM protocols can emulate N x 64 Kbps DS0 transport.

  • PBX voice trunking: An ATM virtual circuit can be used to interconnect PBXs and maintain full PBX feature support, call routing, and switching. Voice trunking combines multiple calls onto a single virtual circuit for further bandwidth optimization, reduced delay, and lower cost. PBX voice trunking requires an integrated access device at the customer premises, between the PBX and ATM switch, which performs the protocol conversions necessary to extend feature signaling across the ATM network.

ATM also offers a consolidation solution for any company that maintains separate-networks for voice, video, and data. The reason for separate networks is to provide appropriate bandwidth and preserve performance standards for the different applications. But ATM can eliminate the need for separate networks, providing a unified platform for multiservice networking that meets the bandwidth and QoS needs of all applications. Although the start-up cost for ATM is high, the economics of network consolidation mean that companies do not have to wait very long to realize significant return on their investment.

10.3.2 Quality of Service

ATM serves a broad range of applications very efficiently by allowing an appropriate QoS to be specified for each application. Various categories have been developed to help characterize network traffic, each of which has its own QoS requirements. These categories and QoS requirements are summarized in Table 10.1.

Table 10.1: ATM Quality of Service Categories
 |  | Quality of Service
Category | Application | Bandwidth Guarantee | Delay Variation Guarantee | Throughput Guarantee | Congestion Feedback
Constant bit rate (CBR) | Provides a fixed virtual circuit for applications that require a steady supply of bandwidth, such as voice, video, and multimedia traffic. | Yes | Yes | Yes | No
Variable bit rate (VBR) | Provides enough bandwidth for bursty traffic such as transaction processing and LAN interconnection, as long as rates do not exceed a specified average. | Yes | Yes | Yes | No
Available bit rate (ABR) | Makes use of available bandwidth and minimizes data loss through congestion notification. Applications include e-mail and file transfers. | Yes | No | Yes | Yes
Unspecified bit rate (UBR) | Makes use of any available bandwidth for nonessential communications between computers, such as e-mail delivery acknowledgements, but does not guarantee when or if data will arrive at its destination. | No | No | No | No

CBR is intended for applications where the PVC requires special network timing requirements (i.e., strict PVC cell loss, cell delay, and cell-delay variation performance). For example, CBR would be used for applications requiring circuit emulation (i.e., a continuously operating logical channel) at transmission speeds comparable to DS1 and DS3. Such applications would include private-line-like service or voicetype service where delays in transmission cannot be tolerated.

Variable bit rate-real time (VBR-rt) is intended for applications where the PVC requires low cell-delay variation. For example, VBR-rt would be used for applications such as VBR video compression and packet voice and video, which are somewhat tolerant of delay. Variable bit rate-non real time (VBR-nrt) is intended for applications where the PVC can tolerate larger cell delay variations than VBR-rt. For example, VBR-nrt would be used for applications such as large file transfers.

ABR is intended for routine applications and when the customer seeks a low-cost method of transporting bursty data for noncritical applications that can tolerate delay variations. The traffic goes out into the network when bandwidth becomes available; otherwise, it is held back until other applications with higher priority are finished using the bandwidth. If congestion builds up in the network, ABR traffic may be held back at the CPE to help relieve the congestion condition.

UBR is also intended for routine applications and when the customer seeks a low-cost method of transporting bursty data for noncritical applications that can tolerate delay variations. Although the carrier will attempt to deliver all ATM cells received over the PVC, if there is any network congestion, this traffic is the first to be discarded to relieve the congestion.

All of these QoS parameters can be set up by the corporate network manager using the Windows-based GUI that comes with the router or integrated access device. If the ATM service is managed by the carrier, then the carrier will supply the CPE, program it per the performance requirements of the customer’s applications, install it, and maintain it.

QoS enables ATM to admit a CBR voice connection, while protecting a VBR connection for a transaction-processing application, and allowing an ABR or UBR data transfer to proceed over the same network. Each virtual circuit will have its own QoS contract, which is established at the time of connection setup at the user-to-network interface (UNI). The network will not allow any new QoS contracts to be established if they will adversely affect its ability to meet existing contracts. In such cases, the application will not be able to get on the network until the network is fully capable of meeting the new contract.

As noted, when the QoS is negotiated with the network, there are performance guarantees that go along with it: maximum cell rate, available cell rate, cell transfer delay, and cell loss ratio. The network reserves the resources needed to meet the performance guarantees, and the customer is required to honor the contract by not exceeding the negotiated parameters. Several methods, including traffic policing and traffic shaping, are available to enforce the contract. Traffic policing is a management function performed by switches or routers on the ATM network. To police traffic, the switches or routers use a buffering technique referred to as a “leaky bucket.” This technique entails traffic flowing (leaking) out of the buffer (bucket) at a constant rate (the negotiated rate), regardless of how fast it flows into the buffer. If the traffic flows into the buffer too fast, the cells will be allowed onto the network only if enough capacity is available. If there is not enough capacity, the cells are discarded and must be retransmitted by the sending device.

Traffic shaping is a management function performed at the UNI of the ATM network. It ensures that traffic matches the contract negotiated between the user and the network during connection setup. Traffic shaping helps guard against cell loss in the network. If too many cells are sent at once, cell discards can result, which will disrupt time-sensitive applications. Because traffic shaping regulates the data transfer rate by evenly spacing the cells, discards are prevented.

10.3.3 Virtual Circuits

As in frame relay, ATM virtual circuits can be bidirectional or unidirectional, meaning that each virtual circuit can be configured for one-way or two-way operation. The virtual circuits can be configured as point-to-point (i.e., PVC), switched, or multipoint. They can also be symmetric or asymmetric in nature. In other words, each bidirectional virtual circuit can be configured for symmetric operation (same speed in both directions) or asymmetric operation (different speeds in each direction).

A virtual circuit has two components: a virtual path and a virtual channel. In this simplified view of an ATM network (see Figure 10.1), the customer has two locations connected together by a virtual path, which contains a bundle of virtual channels. Each of the three virtual channels is assigned to a particular end system, such as a PBX, server, or router.

Click To expand
Figure 10.1: A simplified view of virtual circuits through an ATM network.

In this example, an IAD is used to consolidate the virtual circuits and deliver them to the ATM switch via a dedicated line. VC-1 provides LAN users with access to a mainframe. VC-2 provides trunking between two PBXs. VC-3 provides LAN users with access to a remote server.

In a large network, there may be hundreds of virtual paths. ATM standards allow up to 65,000 virtual channels to share the same virtual path. This scheme simplifies network management and network recovery. When a virtual path must be reconfigured to bypass a failed port on an ATM switch, for example, all its associated virtual connections go with it, eliminating the need to reconfigure each virtual circuit individually.

On a private ATM network, the individual end devices at each location can be identified by IP addresses or, in the case of LAN emulation, MAC addresses. For interoperability between private and public networks, several addressing formats are in use. One of them is based on the E.164 standard, which entails giving each device its own 15-digit address, which is similar to a telephone number used on the PSTN. (Internationally, the ITU Telecommunication Standard Board assigns country/service codes.) Blocks of E.164 addresses are obtained from the numbering plan administrator in each country for assignment by local service providers to their subscribers.

To facilitate network administration, the ATM Forum’s Interim Link Management Interface (ILMI) automates address registration. Any device joining the network exchanges address information with its host switch to determine the complete ATM address. If the same E.164 number is used for the same service from multiple providers, other criteria need to be used for determining which service provider’s database will be consulted for call delivery.

10.3.4 ATM Layers

Like other technologies, ATM uses a layered protocol model. ATM exists at Layer 2 of the OSI model and has only four layers (see Figure 10.2), which typically operate above SONET at Layer 1.

Click To expand
Figure 10.2: ATM protocol model in relation to the OSI reference model and SONET physical layer protocols.

The ATM adaptation layer (AAL) provides the necessary services to support the higher-layer protocols. The functions of this layer are summarized in Table 10.2 and may exist in the end-stations, servers, or network switches. Among other things, this layer is responsible for segmenting the information into 53-byte cells and, at the receiving end, reassembling it back into its native format. This is known as segmentation and reassembly (SAR). Table 10.2 describes the adaptation layers.

Table 10.2: ATM Adaptation Layer Functions AAL Application Examples Notes
AAL | Application Examples | Notes
1 | Isochronous constant bit-rate services, such as circuit emulation. | Supports connection-oriented services that require CBRs and have specific timing and delay requirements.
2 | Mobile trunking, which entails the transmission of compressed voice between radio base stations and a mobile switching center. | Supports low-bit-rate delay-sensitive traffic
3/4 | Near real-time VBR data, either connectionless or connection-oriented. | Originally intended as two layers: one for connection-oriented services and the other for connectionless services. AAL 3/4 is no longer used; AAL5 satisfies all potential applications.
5 | Near real-time VBR data, such as datagrams and signaling messages. | Supports connection-oriented VBR data services. It is a leaner AAL compared with AAL 3/4 at the expense of error recovery and built-in retransmission. It uses less bandwidth overhead, has simpler processing requirements, and reduces implementation complexity.

10.3.5 Inverse Multiplexing over ATM

Today, even mid-size companies with multiple traffic types and three or more distributed locations can benefit from ATM’s sustained throughput, low latency, and adept traffic handling via appropriate QoS mechanisms. The availability of ATM-based inverse multiplexers and N x T1 access makes ATM suitable for mainstream use, particularly for companies that appreciate the benefits of ATM but have been locked out of the service due to its high cost of implementation.

In the past, T3 links were the minimum bandwidth required to access ATM networks, making the cost prohibitive for the vast majority of companies. Inverse multiplexing over ATM (IMA) solves the bandwidth gap problem. With IMA, companies can aggregate multiple DS1 circuits to achieve just the right amount of bandwidth they need for their applications and pay for only that amount on an N x T1 basis. The advantage of IMA is that such companies can scale up to the bandwidth they need, starting with a single T1, and then add links as more bandwidth is justified.

For example, when the bandwidth of four T1s is bonded by the IMA device, the virtual connection through the service provider’s network is provisioned at 6 Mbps. When the bandwidth of eight T1s is bonded by the IMA device, the virtual connection through the service provider’s network is provisioned at 12 Mbps. Regardless of the number of T1 access links in place, the IMA device bonds them together, combining the bandwidth into a fatter logical pipe that can support mixed-media applications running over interconnected LANs (see Figure 10.3).

Click To expand
Figure 10.3: IMA allows the use of bonded multiple T1 access lines into and out of the service provider’s ATM network, rather than forcing companies to use more expensive T3 access lines at each location. This makes it cost-effective for mid-size companies to take advantage of ATM services to support a variety of applications.

The IAD’s management interface usually consists of a PC equipped with software that allows the network manager to define and monitor traffic flow, bandwidth requirements, access line quality, and various configuration parameters.

Through this interface, administrative functions, such as the creation of call profiles, are also performed. A call profile is a file that contains the parameters of a particular data call so that a similar call can be quickly reestablished at another time simply by loading the call profile. The call profile function usually includes a factory-loaded profile that acts as the template for creating and storing user-defined call profiles. Because each data call may involve as many as 25 separately configurable parameters, the use of call profiles can save a lot of time. Users typically load or edit a call profile via the management system using keyboard commands.

Inverse multiplexer management interfaces often support remote devices. This capability allows a network administrator at a central location to configure, test, and otherwise manage other inverse multiplexers at remote locations in much the same way as is currently offered by the in-band management systems of some T1 multiplexers. This is accomplished by the management interface reserving a certain amount of the network bandwidth, usually not more than 2%, as a subchannel to implement remote management.

Most inverse multiplexers can be remotely monitored and controlled via SNMP. This is usually accomplished with SNMP agent software included with the product. The agent collects detailed error statistics, utilization ratios, and performance histories that can be retrieved for analysis.

A solid base of standards now exists to allow equipment vendors, service providers, and end users implement a wide range of applications via ATM. The standards will continue to evolve as new applications emerge. The rapid growth of the Internet is one area where ATM can have a significant impact. With the Internet forced to handle a growing number of multimedia applications—telephony, videoconferencing, faxes, and collaborative computing, to name a few—congestion and delays are becoming ever more frequent and prolonged. ATM backbones have played a key role in alleviating these conditions, but other technologies such as MPLS and packet over SONET (PoS) allow next generation networks to be used to their full potential.

As noted in Chapter 5, MPLS selects specific routing paths based on source identifiers and the requested destination. MPLS is becoming the preferred protocol for enabling QoS in IP networks, while PoS offers a backbone architecture that preserves existing investments in SONET infrastructure and supports the deployment of IP-based video and voice applications. With PoS, the IP layer is placed directly above the SONET layer, eliminating the need to run IP over ATM. This enables QoS guarantees but dispenses with the overhead required to run IP over ATM over SONET.


10.4 IP Networks

The IP is part of a suite of protocols that form the basis of the Internet. The Internet is a “network of networks” consisting of millions of interconnected servers worldwide, all of which use IP. The Internet has been developing since 1969, largely without any blueprint and without central management. Instead, the Internet is composed of interlocking autonomous systems, each of which is separately managed. Systems interoperability is enforced through the use of globally accepted protocols recommended by the IETF.

The architecture of the Internet allows new types of services to be layered on top of existing protocols and for new protocols to be introduced without impacting the rest of the Internet. Numerous users can share the lines and equipment that compose the Internet. The distributed network of hundreds of thousands of routers moves the traffic along the various paths to their destination.

Although IP networks do not have integral QoS mechanisms in the same way as ATM, rudimentary QoS capabilities were long available in the IP packet header’s 8-bit precedence and type-of-service field. Precedence indicates the priority of data-packet delivery, which may range from 0 (lowest priority) for normal data to 7 (highest priority) for time-critical data applications. Type of service contains QoS information that determines how the packet is handled over the network. Packets can be assigned values that maximize throughput, reliability, or security and minimize monetary cost or delay. But these fields were long ignored and never really used on a wide scale.

Diff-Serv supersedes the original IP precedence/type-of-service specification for defining packet priority. Using the same 8-bit field, Diff-Serv works by categorizing IP packets into a small number of forwarding “classes.” It uses the 8 bits in the IP header of each packet to classify priority via “code points” that comprise a class-of-service system that eliminates the scalability limitations, complex policy statements, and management problems of other add-on QoS standards such as RSVP.

Virtually all new routers come with Diff-Serv support and have dedicated traffic-management capabilities. Also, end systems such as telephones or Windows clients and servers can mark the traffic by entering Diff-Serv values for expedited forwarding, assured forwarding, and best-effort forwarding. Although Diff-Serv does not completely address all QoS issues, it is an important step in achieving this long-term objective. By allowing traffic to be segmented by media type, data type, or even application, Diff-Serv opens the door to end-to-end enterprise-wide QoS.

10.4.1 Operating Characteristics

The fundamental operating characteristics of the Internet are that it is a distributed, interoperable, packet-data network. A distributed network has no-one central repository of information or control but is composed of an interconnected web of host computers, each of which can be accessed from virtually any point on the network. Routers throughout the network regulate the flow of data at each connection point and reroute data around points of congestion or failure. Even the name servers, which perform translations between IP addresses and plain language names, are distributed. Should one or more of these “domain name” servers fail, the others are still available to perform the translations.

Another feature of the Internet is the network access point (NAP). These are NAP peering points on the Internet through which traffic is routed between the major backbone providers and national ISPs. Among these NAPs are the Chicago NAP managed by SBC Ameritech, the New York NAP managed by Sprint, MAE East managed by WorldCom, and MAE West managed by SBC Pacific Bell. There are dozens of other NAPs where carriers interconnect with each other in private-peering arrangements. Traffic is usually brought into the NAP via high-speed links at speeds that vary from the DS3 rate of 45 Mbps to the OC-192 rate of 10 Gbps. If one of these NAPs goes out of service, traffic is redistributed among the other NAPs to keep the Internet in operation.

The Internet is interoperable in that it uses open protocols so that many different types of networks and facilities can be transparently linked together to allow multiple services to be provided to different users, regardless of what computing platform or operating system they may have. The Internet protocols can run over virtually any type of facility that can transmit data, including copper and fiber-optic circuits of telephone companies, coaxial cable of cable companies, and various types of wireless connections.

The Internet protocols can run over any kind of data network or service, including-Ethernet and token-ring LANs and frame relay and ATM WANs. The Internet also interconnects users of thousands of different local and regional networks, using many different types of computers. The interoperability of the Internet is made possible by the TCP/IP protocol, which defines a common structure for Internet data and for the routing of that data through the network.

In TCP/IP nets, the routes can remain stable for long periods until a change (e.g., link failure) triggers a new episode of route recalculation. The route chosen is based on optimizing the sum of static link metrics to give a “shortest” path, without considering the traffic involved. Although simple and effective, the single shortest path approach can lead to significant inefficiency if the actual traffic pattern does not match the resources chosen. This problem may be alleviated by sophisticated traffic engineering procedures.

10.4.2 Addressing

When an end user sends information over the Internet, the data is first broken up into packets. Each of these packets includes a header, which indicates the point from which the data originates and the point to which it is being sent, as well as other information. TCP/IP defines locations on the Internet through the use of IP numbers. These numbers include four address blocks consisting of numbers between 0 and 256, separated by periods (e.g., 160.130.0.252).

Network managers can create subnets within the organization and devise their own IP addressing scheme. This conserves scarce IP addresses and aids in maintaining security. The private IP addresses are for internal use only and are never used on the public Internet because other organizations may be using the same IP addressing scheme on their subnets. A proxy server implements NAT to enforce this prohibition. NAT prevents external users on the Internet from being able to view the corporate network’s structure and IP addresses. Blocking this information severely limits the chances of attack from hackers via address spoofing.

In Figure 10.4, the proxy server gets a packet from station 135.112.56.52 for a destination on the public Internet. The address is rewritten so it appears to come from 194.70.71.5 and the packet is sent out with this address. When a reply packet comes back, it will be addressed to the public address 194.70.71.5. The proxy server maintains a database of outstanding requests and will look up the address of the station that made the original request. It then rewrites the address of the return packet to 135.112.56.52.

Click To expand
Figure 10.4: The network address translation capability of a proxy server allows the creation of subnets with private IP addresses that are locally administered and never exposed to the public Internet. In addition to conserving scarce IP addresses, this capability enhances security by hiding the private IP addresses from public view over the Internet through the use of one or more public IP addresses.

Both static and dynamic address translations are supported by NAT. Static address translations explicitly map an external address to an internal address. For incoming packets that have not been specifically requested, such as e-mail, static mapping is used. With dynamic translations, a pool is allocated and each new IP address to be translated is dynamically mapped to another IP address from the pool in a round-robin fashion. This real-time assignment of IP addresses is implemented with the DHCP.

IP addressing for extranets that are shared by multiple organizations can be handled in one of two ways—do it yourself or subscribe to a managed extranet service. The easiest way is for all partners to subscribe to a managed extranet service and let the provider manage things. This arrangement allows partners to communicate and conduct transactions with each other in a secure and managed environment, without having to spend a lot of time and money implementing expensive premises-based routing, assigning a set of IP addresses, and deploying a firewall. Instead, these functions are the responsibility of the service provider. Internet users generally do not need to specify the IP address of the destination site because IP addresses can be represented by alphanumeric domain names such as fcc.gov or ibm.com. Domain name servers throughout the network contain tables that cross-reference these domain names with their underlying IP addresses. This capability is also applicable to intranets and extranets, enabling resources to be easily and quickly accessed without users having to know cumbersome IP addresses.

10.4.3 Services on the Internet

The actual services provided to end users through the Internet are defined not through the routing mechanisms of TCP/IP but depend instead on higher-level application protocols, such as HTTP, File Transfer Protocol (FTP), Network News Transport Protocol (NNTP), and Simple Mail Transfer Protocol (SMTP). Because these protocols are not embedded in the Internet itself, a new application-layer protocol can be operated over the Internet through as little as one server that transmits the data in the proper format. The utility of a service to users, however, increases as the number of servers that provide that service increases.

By the late 1980s, the primary Internet services included e-mail, Telnet, FTP, and Usenet news. E-mail, which is still the most popular Internet service, allows users to send text-based messages to each other using a common addressing system. Telnet allows Internet users to log into a host and access information and applications from a remote location. FTP allows users to download files from a remote host computer onto their own system. Usenet newsgroups enable users to post and review messages on specific topics. Since 1995, with the advent of graphical browsers, the World Wide Web (WWW) has become one of the most utilized services on the Internet.

The Web has two primary features that make it a powerful, full-service method of accessing information through the Internet. First, the client software, or Web browsers, can access multimedia information—a combination of text, audio, video, and images embedded in the same file—and provide access to all of the other major Internet services such as FTP, e-mail, and news through one standard interface.

Second, the Web incorporates a hypertext system that allows individual Web pages to provide direct links to other Web pages, files, and other types of information. Thus, complex services such as on-line shopping, news feeds, and interactive games can be provided through the Internet over a nonproprietary system. The Web is the foundation for virtually all of the new Internet-based services currently being developed.

10.4.4 Management

As noted, no single entity or organization governs the Internet. Not even the FCC has anything to say about how the Internet is run. Each facilities-based network provider that is interconnected with the global Internet controls only the operational aspects of its network. No one can even be sure about the exact amount of traffic that passes across the Internet, because each backbone provider can account only for its own traffic, and there is no central mechanism for these providers to aggregate their data.

Despite all this, the Internet does not operate in an environment of pure chaos. Certain functions, such as domain name routing, the issuing of IP addresses, and the definition of the TCP/IP protocol, must be coordinated, or traffic would never be able to pass seamlessly between different networks. With tens of thousands of different networks worldwide, it would be impossible to ensure technical and administrative compatibility if each network provider had to separately coordinate implementation issues with all other network providers.

These coordinating functions have traditionally been performed by an array of quasi-governmental, intergovernmental, and nongovernmental bodies. The United States government, in many cases, has handed over responsibilities to these bodies through contractual or other arrangements. In other cases, entities have simply emerged to address areas of need.

The broadest of these organizations is the Internet Society (ISOC), a nonprofit professional organization founded in 1992. ISOC organizes working groups and conferences and coordinates some of the efforts of other Internet administrative bodies. Internet standards are developed primarily through the IETF, an open international body mostly composed of volunteers. The work of the IETF is coordinated by the Internet Engineering Steering Group (IESG) and the Internet Architecture Board (IAB), both of which are affiliated with the ISOC. The Internet Assigned Numbers Authority (IANA) manages the root servers of the DNS to promote the stability and robustness of the Internet.

10.4.5 Intranets and Extranets

An intranet is a private TCP/IP network that usually supports the same protocols and services as the public Internet, including e-mail, news, chat rooms, and Web pages. An extranet is simply a private TCP/IP network that is shared between multiple companies. Businesses build intranets and extranets to improve communication, facilitate information distribution, broaden access to corporate resources, enable group scheduling, and provide a browser front end to various corporate databases and services.

Intranets

There are a number of practical reasons for setting up a corporate intranet, the biggest of which is to improve internal communications and facilitate decision making. For example, an intranet makes it possible for employees to access information without documents having to be printed and distributed in paper form. Posting the documents on a department Web site provides direct access to the information from any location, so employees can get what they need when they need it without involving anyone else. This empowers employees to make decisions on their own, without causing them to experience information overload.

Another reason to have an intranet is that it reduces the cost of internal operations. With employees able to access information directly, schedule conferences, collaborate with each other using automated tools, submit timesheets directly to accounting, and communicate across departmental boundaries with e-mail, chat, IP fax, and IP telephony, there is no need for a middle-management layer in the organization to act as the facilitating agent. The result is across-the-board improvements in productivity, as well as cost savings from streamlined business operations. The applications to do all this are very inexpensive, and the browsers are free. The protocols run over the existing corporate LAN and WAN, eliminating the need to invest in a separate network. The intranet’s rollout can be gradual, modular, and minimally disruptive.

The cross-platform nature of TCP/IP provides another reason to establish an intranet. Most organizations are heterogeneous on the client side, having a mix of Macintosh computers, UNIX workstations, Windows PCs, and even some OS/2 machines. Intranets are the easiest way to get these devices talking. Since all of the operating systems have TCP/IP stacks already built into them, the clients are “intranet ready,” requiring no extra costs to network them together. There may be additional costs associated with servers and routers, but these are often incremental expenses since these systems are typically already in place to support other applications on the LAN and WAN. Supporting an intranet is usually just a matter of taking advantage of the TCP/IP stacks already embedded in the operating systems of these devices.

Another facet of intranets is that they are fast—much faster than the public Internet. This is because a company is in sole control of such critical elements as the intranet’s bandwidth, technologies and protocols, and applications and devices. All of these elements impact performance. When an intranet is under the control of a single company, steps can be taken to optimize its performance and safeguard its integrity end to end. For example, a company can implement QoS mechanisms, traffic prioritization schemes, and network caching, as well as add bandwidth wherever it is needed and even partition it among the applications. This is not possible when relying on the public Internet, which has no central management authority to make these decisions and see that they are carried out. With an intranet, a company can push the envelope in terms of applications and make adjustments to ensure peak performance.

Finally, setting up an intranet is a risk-free proposition. The underlying technologies and protocols that are used to implement corporate intranets have been in use on the public Internet for decades and have proved to be reliable and robust. Even when new capabilities are added, such as IP telephony and streaming video, which the original Internet was never intended to support, the protocols necessary for implementing these new capabilities are designed to work within the TCP/IP framework.

The decision to implement an intranet is relatively easy for large companies because they typically have the necessary components already in place. For example, they have LANs and use TCP/IP on the WAN to support e-mail, file transfers, remote database access, and other routine communications needs. They usually have the technical expertise to install and configure the necessary components—including a heterogeneous client base, plus servers, routers, switches, and gateways—and manage these and other network elements via an enterprise-level management system that also supports SNMP. They may also have people who implement and maintain client-server technology over LANs that also provide connectivity to legacy host systems. For these companies, it is relatively simple to add a graphical front end to this environment in the form of browsers and offer extra functionality, such as an SQL query capability, from Web servers distributed on the TCP/IP network.

Even for companies that do not already have an existing TCP/IP-based infrastructure, it does not take much to learn how to take advantage of Internet technology and adapt it for internal usage. These companies, as well as very small companies that lack any kind of technical expertise, can avail themselves of numerous vendors and service providers who are eager to educate potential customers on the benefits of corporate intranets and offer their own ideas concerning intranet implementation.

If a company does not want to build and run its own intranet, there are service providers that handle this as well. In fact, every aspect of designing, provisioning, and managing a corporate intranet can be outsourced to a carrier or third-party firm—including creating the intranet Web page, selecting the equipment and software, hosting one or more intranet Web sites, and procuring and managing the access and transport facilities of the network.

Critical to keeping an intranet running smoothly is IP address administration, which can become unwieldy as intranets lead to a proliferation of devices requiring IP addresses. Intranet-driven IP administration can be facilitated by DHCP software. For managers of large IP networks, DHCP reduces the work necessary to administer a large number of IP addresses by automatically assigning IP addresses to clients as they log on to the TCP/IP network.

Running on a server, the DHCP software also reclaims unused IP addresses and maintains a pool of reusable addresses. These features greatly simplify the workload of network managers, who would otherwise have to issue static IP addresses to every device on the network and manually assign an address to any device that is changed, moved, or added on the network. DHCP is also good for the organization because there is less chance of running out of IP addresses and having to justify the request for additional addresses.

Perhaps the most serious issue related to intranet implementation is security. Increasing the number of people who have access to important data or systems can make a company’s information technology infrastructure vulnerable to attack if the right precautions are not taken. A comprehensive security solution addresses internal as well as external threats and should include policies and procedures and the ability to monitor and enforce them, as well as robust security tools that work well together and do not leave any gaps in protection. The following basic functions are necessary for broad security coverage:

  • Access control software allows varying degrees of access to applications and data.

  • Secure transmission mechanisms like encryption prevent outside parties from intercepting, eavesdropping, or changing data sent over the network.

  • Authentication software validates that the information that appears to have been originated and sent by a particular individual was actually sent by that person.

  • Disaster recovery software and procedures assist in recovering data from a server that experiences a major fault.

  • Antivirus software detects and removes viruses before they cause problems.

  • Packet filtering controls what information can pass between internal subnets and between the intranet and Internet, on the basis of such criteria as source and destination addresses, specific applications, users or groups of users, and even time of day.

  • Intrusion detection identifies hacking attempts before they progress far enough to do any damage and closes off the port that has been breached.

The cost of developing a corporate intranet varies considerably on a case-bycase basis. Large companies can often build sophisticated intranets using existing TCP/IP networks, equipment, and management tools. In such cases, the intranet is treated as just another set of applications that is added to meet business needs. For such companies, the start-up cost for intranet development can be incremental.

The start-up cost for an intranet that supports 400 to 500 people can be as low as $25,000. This includes browsers for the client, a Web server, content development tools, and the communications hardware and software. The recurring cost of facilities and services can be obtained from the various carriers and compiled into an annual figure. Companies that do not have in-house technical expertise should also plan to spend 10% of the total start-up cost of equipment and software on integration services.

Fortune 100 companies with worldwide locations that must be tied into the intranet can expect to pay quite a bit more, especially if they intend to offer a high level of interactivity, engage in electronic commerce, and Web-enable various business processes. Here, security is extremely important and constitutes a significant cost to factor into the budget. Such companies should plan to spend at least $10 million.

As companies put together budgets for intranet development and management, eventually they will have to address the issue of return on investment (ROI), as they typically do for any other major capital expenditure. The extent to which this can be done with any degree of accuracy often depends on how the proposed intranet will be used.

For example, if the intranet will be used to publish staff handbooks, telephone directories, forms, office notices, and other administrative documentation, the annual cost of printing, distributing, updating, and storing these materials contributes to the ROI of the intranet. Although harder to quantify, there is also the significant cost of staff time for filing, updating, and referring to paper-based material that would also be eliminated. A publishing application can garner an annual ROI of as much as 30%. Other applications, such as database access and inventory management, may yield 70% and 50% annual returns, respectively. Reliance on electronic publishing would improve overall productivity, which is a “soft-dollar” benefit that can be used to cost-justify the intranet, especially when the intranet includes a search engine or SQL query capability that allows users to key in on desired information quickly.

If the company plans to use the intranet for transaction processing, ROI can be fairly easy to calculate. For example, the company can post all of its business forms on the intranet, including various health insurance forms, travel authorization and expense reimbursement forms, vacation schedule forms, worker’s compensation forms, 401K plan forms, and purchase order forms—just to name a few. These and other forms can be called up on the intranet with a browser, filled in by the employee, and sent to the appropriate department via e-mail. Employees need not waste time tracking down the paper forms they need and, since the employee-supplied information is submitted in electronic form, departments can process it faster and readily integrate it into various databases. The savings in time and improved form processing constitutes another element that can be factored into the intranet’s return on investment.

Corporate intranets are changing businesses in a profound way. They empower employees by providing them with a high degree of autonomy, encouraging creativity, enhancing decision making, and improving productivity. The result is that the company improves customer service and responds more effectively to changing market conditions.

Increasingly, PBX vendors are recognizing the importance of providing customers-with easier and more economical ways of supporting VoIP and, in the process, helping them transition to voice and data convergence. Vendors provide solutions with the flexibility to support voice, video, and data traffic over the Internet, intranets, extranets, public-switched networks, and ATM. When used as a gateway, such systems convert voice traffic to packets for reliable transmission over IP networks. The QoS for each call is monitored, so that if the IP network’s performance is not acceptable for voice or fax calls, the switch will reroute the call over an alternative network, if available.

Enterprises with a large number of telecommuters and mobile professionals can opt for a VoIP solution that supports remote log-in so these employees can have the same capabilities as their desktop telephone sets, including hold, call forward, transfer, speed dial, and conference, as well as multiple call appearances and call displays on their laptop computers while working remotely. Such systems offer the means for remote users to log into the corporate switch so they can take advantage of all these features and work virtually from any location. Remote users can also have access to voice mail.

This solution can even be applied to call center operations, helping companies take full advantage of their data networks by delivering call signaling and phone features to a call center agent’s PC through an IP connection. Among other things, this allows agents working at home to provide the same high level of customer care as agents working in a traditional call center environment. For the company, the solution lowers the cost of support operations and helps them attract qualified staff by offering them the means to work at home.

Network management vendors are offering tools that help IT administrators and network managers monitor voice and data traffic performance on IP nets. These tools provide call monitoring, adaptive voice and data traffic prioritization, QoS, bandwidth management, and accounting and billing metrics for voice-related traffic over IP networks.

Network managers can even monitor information such as callers and destinations, call duration, time-of-day distribution, and associated costs. Voice and data traffic are dynamically prioritized in real time, on the basis of actual bandwidth availability at the circuit level. Voice sessions can be accounted and billed for according to factors such as priority, user type, and time of day. Corporations can use these detailed accounting features to bill-back departments, while service providers may use them to bill customers on a per-use and/or priority basis.

Extranets

An extranet is a network that is shared among multiple organizations, usually strategic business partners, that are given controlled access to select information and applications. The extranet is based on the TCP/IP suite of protocols and provides the same capabilities as the public Internet but with security features and access privileges that guard against unauthorized entry.

Businesses build extranets to improve communication among key constituents, facilitate information distribution, broaden access to each other’s resources, enable group scheduling, and provide a browser front end to various corporate databases to expedite inventory tracking, supply-side management, and invoicing. Extranets have become the means through which companies engage in business-to-business (B2B) e-commerce on a global basis, while reaping the added benefits of reduced operational costs, improved productivity, and timely response to changing market conditions.

Extranets can also be made accessible to the general public, providing customers-with secure access to certain types of data. Banks, brokerage houses, and other financial institutions, for example, provide customers with secure access to their extranets to check on the status of their accounts. Delivery services, such as Federal Express and UPS, give customers access to their extranets to check on the delivery status of their packages. Airlines, hotels, and resorts provide extranet access to allow customers to place reservations on-line.

Among the advantages of establishing an extranet is that it provides self-service opportunities for constituents, who can order products directly, get immediate answers to their inquiries, and solve product-related problems by looking through a database. In some cases, an extranet can be used to allow customers to configure and price the products they want before placing the order electronically.

In turn, companies can serve constituents at a very low cost—24 hours a day, 7 days a week. Cost savings come from reductions in sales and support staff and the elimination of dedicated lines and services. In fact, an extranet allows an organization to create the equivalent of a corporate WAN with global reach but without the cost of leased lines. Like corporate intranets, an extranet uses the same hardware, software, protocols, and development tools as the public Internet.

In many cases, the same staff that maintains the corporate intranet also maintains the extranet, since the knowledge and skills to do both are not significantly different. The real challenges are in securing and managing the extranet, since the cooperation of several companies is necessary. Ensuring interoperability between the different systems, databases, and applications of the participants also merits technical expertise.

Before designing an extranet, the hub company needs to develop a document that discusses the network architecture, the goals of the architecture, and the system specifications that will support those goals. This document should be shared with partners for their input, since they will be the primary “customers” making the decision to join the extranet.

Before committing any resources to the extranet project, the hub company should determine what resources it already has that can be leveraged or redeployed. This could save on capital equipment costs and shorten the time to service cutover. A more realistic baseline budget can then be established for the project.

When building an extranet, personnel decisions should be made before resources are committed. There will be staff turnover to contend with and, as the extranet evolves, each person’s responsibilities may increase or change. It must be determined early on how extra resources will become available when needed, in what time frame, and in a way that will not erode confidence in the project among partners.

It is recommended that performance criteria be drawn up for the extranet and acceptance criteria developed that will satisfy management and partners that the job has been completed within specifications. In some cases, it might be worthwhile to offer an SLA to partners, governing such key areas as application performance, network availability, and response time to repair. An SLA could become a further inducement for partners to join the extranet.

If the resources of the hub company are constrained, consideration should be given to outsourcing extranet setup and management to an integrated communications provider (ICP). Since 24/7 monitoring is the responsibility of the ICP, there is no need for the hub company to have a support facility of its own, which is a critical requirement for the smooth functioning of an extranet. The ICP handles security with a combination of authentication and filtering techniques, the use of security protocols, and firewalls—all of which can be difficult and time consuming for organizations to set up and manage by themselves. By outsourcing extranet management, the hub company can save a substantial amount of money in start-up costs and free up IT staff to meet other business needs. Other reasons to outsource the extranet include the following:

  • Faster extranet development;

  • Easier integration of new technologies and capabilities;

  • The availability of best-of-breed equipment and higher-speed lines than a company cannot otherwise afford;

  • The availability of a wider range of expertise;

  • QoS guarantees;

  • Continuous network management and faster response to problems;

  • One-stop service and support.

Extranet management is a natural extension of systems management, except users are allowed to pass the firewall. Extranets present special management problems because they allow access to information systems that are normally considered private, including inventory databases, order entry and accounting systems, and product configuration and pricing tools. As with any network-based information system, there are management requirements to contend with, including the following:

  • Configuring new users and adding new nodes;

  • Setting up and changing access controls in response to changing needs;

  • Ensuring that system security works properly;

  • Adding new software and features to satisfy changing business requirements;

  • Ensuring that information systems, applications, and links continue to work properly.

These duties usually fall within the traditional domain of system administration but are made slightly more difficult when they involve multiple organizations. For the extranet to yield the anticipated benefits to all participants, managers must ensure that the right information is available to the right constituents, that frequently changing information—such as product prices, catalogs, and inventory—are kept up to date, and that all supporting systems function properly.

Management of a multi-company extranet usually is the responsibility of the largest organization, which acts as the “hub.” This company encourages its suppliers, sales channels, and other partners to join the extranet for mutual benefit and assists the others in configuring their information systems, routers, and firewalls. In addition, the hub company may arrange for dedicated access lines and dial-up service providers to access the extranet. To get inexperienced companies up to speed on using the extranet to optimal advantage, the hub company may also offer consulting services and on-line training.

Although extranets are extensions of corporate intranets and usually allow access via the global Internet, sensitive business data can be kept private via the use of a firewall, which may use a number of strategies—including packet filtering and intrusion detection—to keep private data and resources off limits. If implemented properly, extranets provide access to appropriate information while effectively securing other data from the general public, as well as from strategic partners, on a selective basis.

Security is problematic when applied to extranets for reasons that have nothing to do with the technologies for controlling access. The real challenge comes from the fact that the extranet involves partners whose relationships are dynamically changing and complex. Today’s partners may become tomorrow’s competitors, and a partner may be both a competitor and a partner simultaneously. If an extranet system does not permit dynamic changes in access control, there is the possibility of sensitive information getting into the wrong hands, which cannot simply be called back.

There are several key requirements to securing information on an extranet. First, the identity of an individual wishing to access the extranet should be authenticated. This process is complicated when employees or business partners access information from multiple computers and, often, from remote locations over the Internet. Users should be able to authenticate from a Web browser, with no client software requirements. In addition, there are often hundreds of Web servers in a large enterprise, and users need access privileges for each server they access. This can lead to many problems: Users must remember passwords for many servers, administrators need to manage the access controls for each individual server, and many separate entries must be added or removed when a user’s access privileges change or when employees join or leave the company. A security solution that lets the organization manage access controls for all of these servers centrally and presents users with a single sign-on to the Web space can greatly simplify security management, as well as enhance the user’s experience.

Once a user’s identity has been authenticated, access privileges should be determined. An authenticated user does not necessarily have permission to access resources. Security policies should explicitly grant access rights to Web resources. An access control decision function must establish whether requests for specific information should be granted or denied. Administration is complicated if access controls must be configured at each Web server, and it is difficult to construct a comprehensive picture of a user’s privileges in the Web space if an administrator must consult each Web server’s configuration information. A centralized authorization framework greatly simplifies administration.

Large extranets will require that certain management tasks be delegated. It is often necessary to delegate the management of security and privileges for certain information resources to either the individual or group responsible for maintaining them. An effective security system should facilitate secure delegation of permissions to ease the management burden.

Another important concern with any security management solution is how easy it is to implement and administer. For any security solution to be effective, it should integrate easily with the organization’s existing infrastructure and be easy to administer. Any complexities in security management increase the possibility of human errors, make the extranet difficult to navigate, and expose the extranet to attack or misuse.

Within the context of the extranet, security and content management are closely interrelated; after all, security is about protecting information. Content management is a critical issue with extranets because the owner has virtually no control over the information once it is downloaded and has no idea of its ultimate destination and how the information is really being used.

For example, extranets lend themselves to the aggregation of tactical information, which can have strategic value. This can become a threat if content control and the time value of information are not considered part of the security equation. While production figures for a specific month are considered tactical information and may help partners that are supplying raw materials to the assembly line, 3 months of production information may be of strategic value to another partner that is also a competitor. Therefore, the same information should not be made available in the same form to all partners.

An extranet is the only situation where a firm exposes its most proprietary information to a semi-open audience. Sound content management entails never assuming that the target user at the partner organization will be the final user of that information. While the success of the partnership is certainly important, and ease of communication is inherent to achieving that success, it must be recognized that failure can come from revealing too much information. It is therefore necessary for content owners to implement information security systems that permit content control and dynamic changes to minimize exposure to risk.


10.5 Conclusion

There are dozens of providers operating nationwide data backbone networks. Many of them offer ATM, frame relay, or IP services, giving customers the opportunity to take advantage of the most appropriate technology or easily migrate between them as their needs change, without having to deal with multiple service providers and equipment vendors. Some of these carriers have fiber networks in major metropolitan areas that are built on SONET or WDM technologies and which offer Ethernet services as well. Now that the latest generation of IMA systems supports all of these traffic types, there is not even the need for customers to add or change CPE to take advantage of any or all of these technologies.

Some vendors and service providers consider Ethernet as a high-speed packet network, especially since the emergence of Gigabit Ethernet. The initial applications for Gigabit Ethernet were for campuses or buildings requiring greater bandwidth between routers, switches, hubs and repeaters, and servers. Examples include switch-to-router, switch-to-switch, switch-to-server, and repeater-to-switch links. Today, Gigabit Ethernet switches are using better-quality electro-optics that can light up the fiber for 40 km, greatly exceeding the distance limitations of the original standards. And with optical-electrical-optical (OEO) regenerators, distances can be extended to a couple hundred kilometers (124 miles).

The specification for Ethernet at the SONET OC-192 rate of 10 Gbps was ratified by the IEEE in mid-2002. This flavor of Ethernet uses the IEEE 802.3 Ethernet MAC protocol, frame format, and frame size. Because 10-Gigabit Ethernet is still Ethernet, it minimizes the IT department’s learning curve by allowing use of the same management tools. If procured as a service, users can self-provision bandwidth using a browser to meet bandwidth needs that start at 1 Mbps and scale to 1 Gbps or more. Once the fiber is installed to the customer premises, the customer can directly provision the service. This is in considerable contrast to provisioning T3 or OC-3 connections, which entail lead times from incumbent carriers that can range from 45 to 120 days.

Ethernet will continue to scale. Some carriers have implemented the 40-Gbps draft specification, which uses SONET’s OC-768. Proprietary switches are available that support Ethernet at 100 Gbps, but the industry may lean toward 40-Gigabit Ethernet, since the pipes exist today in the form of OC-768 and there is proven technology to build off of that, whereas there is no specification yet for 100 Gbps.


Chapter 11: Network Management Systems

11.1 Introduction

Enterprise applications and mission-critical data that are essential to business operations rely on the availability and continued reliability of the corporate network. But the increasing use of wireless links and the Internet to extend the corporate network adds complexity to network management. While many companies prefer to retain total control of their network resources, others rely on computer vendors and carriers to find and correct problems on their networks or they depend on third-party service firms. Wherever these responsibilities ultimately reside, the tool set used for monitoring the status of the network and initiating corrective action is the NMS.

In addition to improving network availability (uptime) and service reliability, the purpose of an NMS is to centralize control of network components, reduce staff time for administrative tasks, and contain operational and maintenance costs. The NMS can effectively lower the cost and complexity of today’s networks by providing a set of integrated tools that allow IT staff to quickly isolate and diagnose network problems. The ability to analyze and resolve network problems from a central location is critical to the proper management of both network and personnel resources. The following are the minimum functional requirements of any NMS:

  • Fault management. This function includes the detection, isolation, and correction of events that are responsible for abnormal network operation. Fault management provides the means to receive alarms, determine the cause of a network fault, isolate the fault, and implement corrective action.

  • Configuration management. This function includes the setup, maintenance, and updating of network components. Configuration management also includes notification to network users of pending and completed configuration changes.

  • Accounting management. This function includes the ability to track network usage to detect inefficiencies, abuse of network privileges, or unusual network activity—all of which are useful for planning network changes or growth.

  • Performance management. This function includes the ability to recognize current or impending performance issues that can cause problems for network users. Activities include collecting and analyzing statistics to determine baseline network performance, as well as monitoring the system and conducting maintenance to ensure acceptable network performance.

  • Security management. This function includes controlling and monitoring access to the network and associated network management information. This usually involves controlling passwords and user authorization mechanisms and collecting and analyzing security or access logs to reveal suspicious activity and track down its source.

Ideally, these and other functions should be available from the same network management interface, which treats the entire network as a single entity. In practice, however, NMSs vary in sophistication, forcing organizations to rely on different tools from different vendors to obtain all the functionality they need to properly manage their networks. Increasingly, corporate programmers are even applying their UNIX scriptwriting skills to enhance freely available open-source management utilities. Within a relatively short time, they can create management tools for the wireless environment that meet their needs simply and economically instead of having to work with limited APIs or petition a vendor for desired features, which may or may not show up in a subsequent release.


11.2 Management System Evolution

NMSs started out by providing simple monitoring and alerting functions that helped to ensure that network links were operating properly. Monitoring simply determined whether a link was up or down, while alerting involved displaying or printing a statement that the link was up or down or sending a notification to a technician via e-mail. Specific classes of devices were monitored and controlled by element managers. Each vendor had its own element manager for its products. In general, network and element managers relied on SNMP to troubleshoot problem areas and determine fault locations. These functions worked well with small, relatively simple networks, but as companies added more devices to their networks, they needed a way to collect and prioritize all of this data at a central location so they could better determine what was happening on the network as a whole, rather on individual segments. They also needed more sophisticated capabilities than SNMP alone could provide.

These needs gave rise to central NMSs, such as Hewlett-Packard’s OpenView and IBM’s NetView, which emerged to fill this void. Meanwhile, networks continued to grow larger and more complex, motivating companies to look for ways to lower their management costs. Many found they were supporting two groups of network technicians, one supervising the performance of network devices on the WAN and a second supervising the systems on the LAN. Rather than continue with two management frameworks and data networks and hire people with different skill sets, enterprise IT organizations wanted to consolidate them into one group.

Desktop features, such as asset management, software distribution, license monitoring, and desktop management then became priorities. Now organizations are adding wireless devices to extend their wired networks without having to install cable and turning to the Internet to run business applications at lower cost than private networks. These issues present yet more requirements for NMSs that are only beginning to be addressed by vendors.


11.3 Management in the Wired World

In the wired world, network management begins with such basic hardware components as data sets (CSUs/DSUs), routers, switches, multiplexers and servers (see Figure 11.1). These and other devices typically have the ability to monitor performance, test for, and diagnose problems regarding their own operation and are capable of reporting their status to a central management station, either periodically or on request. The management station operator can initiate test procedures on systems at any point in the network. On more complex multipoint and multidrop configurations, the capability to test and diagnose problems from a central location greatly facilitates problem resolution. This capability also minimizes the need to dispatch technicians to remote locations and reduces overall maintenance costs.

Click To expand
Figure 11.1: Each type of device on the network may have its own EMS, which reports to a central network management system (CNMS) that integrates, prioritizes, and permits analysis of information from multiple element managers.

A minimal NMS consists of a CPU, system controller, operating system software, storage device, and an operator’s console. The central processor may consist of a minicomputer or microcomputer. The system controller, the heart of the NMS, continuously monitors the network and generates status reports from data received from various network components. The system controller also isolates network faults and restores segments of the network that have failed, or which are in the process of degrading. The controller usually runs on a powerful platform such as UNIX or Windows NT/2000.

Even today, SNMP is the basis for most NMSs. It provides the ability to manage network devices in a multivendor environment from a central location. In fact, virtually any enterprise-class device that can be connected to a network supports SNMP, including wireless client adapters, access points, and bridges. This means SNMP can be used to manage both the wired and wireless elements of an enterprise network.


11.4 The Mechanics of SNMP

SNMP specifies a structure for formatting messages and transmitting information between reporting devices and data-collection programs on the network. The SNMP-compliant devices on the network are polled for performance-related information, which is passed to a network management console. Alarms are also passed to the console. There, the gathered information can be viewed to pinpoint problems on the network or stored for later analysis.

SNMP runs on top of TCP/IP’s datagram protocol—specifically, the UDP—a transport protocol that offers a connectionless-mode service. This means that a session need not be established before network management information can be passed to the central control point. Although SNMP messages can be exchanged across any protocol, UDP is well suited to the brief request and response message exchanges characteristic of network management communications.

As noted, SNMP is a very flexible network management protocol that can be used to manage virtually any object. An “object” refers to hardware, software, or a logical association, such as a connection or virtual circuit. An object’s definition is written by the equipment vendor and is held in a MIB. The MIB is simply a list of switch settings, hardware counters, in-memory variables, or files that are used by the NMS to determine the alarm and reporting characteristics of each device on the network, including those connected over LANs.

SNMP is basically a request and response protocol. The management system retrieves information from the agents through SNMP’s “get” and “get-next” commands. The “get” request retrieves the values of specific objects from the MIB. The MIB lists the network objects for which an agent can return values. These values may include the number of input packets, the number of input errors, and routing information. The “get-next” request permits navigation of the MIB, enabling the next MIB object to be retrieved, relative to its current position. A “set” request is used to request a logically remote agent to alter the values of variables. In addition to these message types, there are “trap” messages, which are unsolicited messages conveyed from management agent to management stations. Other commands are available that allow the network manager to take specific actions to control the network. Although these commands look like SNMP commands, they are really vendor-specific implementations. For example, some vendors use a “stat” command to determine the status of network connections.

All of the major network management platforms support SNMP. In addition, many of the third-party systems and network management applications that plug into these platforms support SNMP. The advantage of using such products is that they take advantage of SNMP’s capabilities, while providing a GUI to make SNMP easier to use. Even MIBs can be selected for display and navigation through the GUI.

Another advantage of commercial products is that they can use SNMP to provide additional functionality. For example, Hewlett-Packard’s OpenView is used to manage network devices that are IP addressable and run SNMP. The automatic discovery capability finds and identifies all IP nodes on the network, including those of other vendors that support SNMP. On the basis of discovered information, the management system automatically draws a network topology map. Nodes that cannot be discovered automatically can be represented in one of two ways: first, by manually adding custom or standard icons to the appropriate map views; second, by using SNMP-based APIs to build map applications without having to manually modify the configuration to accommodate non-SNMP devices.

SNMP has several main components, including a management station, agents and proxies, and MIBs. The relationship of these components is shown in Figure 11.2.

Click To expand
Figure 11.2: Relationship of SNMP components.

11.4.1 Management Station

The manager is a program that may run on one or more hosts, with each responsible for a particular subnet. The management station provides the user interface, in the form of a CLI or a GUI, that provides the means to configure, monitor, analyze, and control the various components on the network.

SNMP communicates network management data to a single site, called a management station. Under SNMP, each network segment must have a component, called an agent, which can monitor devices (called objects) on that segment and report the information to the management station. The agent may be a passive monitoring device whose sole purpose is to read the network, or it may be an active device that performs other functions as well, such as bridging, routing, and switching. Devices that are non-SNMP compliant must be linked to the management system via a proxy agent.

The manager provides the information display, communication with agents, information filtering, and control capabilities. The agents and their appropriate information are displayed in a graphical format, often against a network map. Network technicians and administrators can query the agents and read the responses on the management console. The manager also periodically polls the agents, searching for anomalies. Detection of an anomaly results in an alarm at the management system.

11.4.2 Management Agents

SNMP provides get, set, trap, and other functions to, among other things, retrieve, set device values, and receive notification of network events. An agent that resides on a network device responds to requests from the management station and generates events (traps) based on instructions issued from the management station or programmed into the agent. To have a wireless access point (AP) send SNMP traps, for example, the network administrator enters the IP address of the target AP along with the trap that defines the event or condition to be detected by the AP’s SNMP agent. The AP might send back a notification when any of the following events occur:

  • AP is powered on (cold start trap);

  • Ethernet network connection is established (network linkup trap);

  • User tried to communicate with the AP using an incorrect SNMP community string (authentication trap).

Another type of agent is the proxy agent, which is a program used to support devices that do not have an SNMP implementation available. The proxy is an SNMP management agent that services requests from the management station on behalf of one or more non-SNMP devices.

11.4.3 Management Information Base

A MIB is a compact database for a given network component that contains the parameters that can be managed for a network device. There is a standard definition of a MIB for every device that is supported by SNMP, and there is a standard extension called MIB II. There is also a mobile MIB that includes wireless-related (e.g., wireless performance statistics) and other information, such as the type of network adapter and version of firmware. Via the agent, the management station monitors and updates the values in the MIB.

The MIB contains a list of objects necessary to manage devices on the network. As noted, an “object” refers to hardware, software, or a logical association such as a connection or virtual circuit. The attributes of an object might include such things as the number of packets sent, routing table entries, and protocol-specific variables for IP routing. A basic object of any MIB is sysDescr, which is a textual description of the entity. This value includes the full name and version identification of the system’s hardware type, software operating system, and networking software. This object should contain only printable ASCII characters.

The first MIB was primarily concerned with IP routing variables used for interconnecting different networks. There are 110 objects that form the core of the standard SNMP MIB. The latest generation MIB, known as MIB II, defines more than 160 objects. It extends SNMP capabilities to a variety of media and network devices, marking a shift from Ethernets and TCP/IP WANs to all media types used on LANs and WANs. Many vendors want to add value to their products by making them more manageable, so they create private extensions to the standard MIB, which can bring the number of objects to 200 or more.

Many vendors of SNMP-compliant products include MIB tool kits that generally-include two types of utilities. One, a MIB compiler, acts as a translator that converts ASCII text files of MIBs for use by an SNMP management station. The second type of MIB tool converts the translator’s output into a format that can be used by the management station’s applications or graphics. These output handlers, also known as MIB editors or MIB walkers (Figure 11.3), let users view the MIB and select the variables to be included in the management system. Some vendors of SNMP management stations do not offer MIB tool kits, but rather an optional service whereby they will integrate into the management system any MIB a user requires for a given network. This service includes debugging and technical support.

Click To expand
Figure 11.3: MIB Walk from SolarWinds.Net is used to search the SNMP tree for a target device and dump the value of each object identifier (OID). This tool is commonly used to find out what MIBs and OIDs are supported on a particular device. MIB Walk uses a database of MIB information to determine the plain language name for each OID and the MIB to which it belongs.

There are also MIB browsers that allow network managers, technicians, and systems engineers to query a remote device for software and hardware configurations via SNMP and make changes to the remote device. The remote device could be a router, switch hub, server, firewall, or any other device that supports SNMP. Another common use for a MIB browser is to find out what MIBs and object IDs (OIDs) are supported on a particular device, per Figure 11.3.

11.4.4 Remote Network Monitor

The common platform from which to monitor multivendor networks is SNMP’s remote monitoring (RMON) MIB. Although a variety of SNMP MIBs collect performance statistics to provide a snapshot of events, RMON enhances this monitoring capability by keeping a past record of events that can be used for fault diagnosis, performance tuning, and network planning. The original remote network monitoring MIB defines a framework for the remote monitoring of Ethernet.

Subsequent RMON MIBs extend this framework to token ring and other types of networks.

An RMON probe is installed on at least one remote system for each remote LAN or segment to be monitored, whether it is wired or wireless (802.11a and 802.11b). The probe views every packet and produces summary information on various types of packets, such as undersized packets, and events, such as packet collisions. The probes can also capture packets according to predefined criteria set by the network manager or test technician. At any time, the RMON probe can be queried for this information by a network management application or an SNMP manager so that detailed analysis can be performed in an effort to pinpoint where and why an error occurred.

When it comes to monitoring wireless LANs, despite the interoperability of Wi-Fi equipment from different vendors, vendors of RMON probes or consoles support only certain types of equipment. Some vendors may only support Wi-Fi equipment from Cisco, Intel, or Nortel, for example. The reason is that the Wi-Fi vendors use different manufacturers’ chipsets, and these chipsets must support RMON. To complicate matters, a different chipset may be used for 802.11a and 802.11b products.

Implementing RMON entails having a management application that views the internetwork, for example, to gather data from RMON agents running on each segment in the network, both wired and wireless. The data is integrated and correlated to provide various internetwork views that provide end-to-end visibility of network traffic, both LAN and WAN. The operator can switch between views to monitor the performance of the network from a variety of perspectives.

The operator can switch between a MAC view (which shows traffic going through hubs and switches), a network view (which shows end-to-end routed traffic), or apply filters to see only traffic of a given protocol or suite of protocols. These traffic matrices also provide the information necessary to configure or partition the internetwork to optimize LAN and WAN performance and utilization.

Another type of application allows the network manager to consolidate and present multiple segment information and configure RMON alarms, as well as perform baseline measurements and long-term reporting. Alarms can be set on any RMON variable. Notification via traps can be sent to multiple management stations. Baseline statistics allow long-term trend analysis of network traffic patterns under normal conditions, which can then be used to plan for network growth.

The original RMON specification consists of Ethernet groups, which are sets of functions that can be carried out at the MAC layer. (The specification has been extended over the years to support other networks as well, such as legacy token ring and FDDI, but Ethernet will suffice for this discussion.) A follow-up specification called RMON2 allows probes to gather information from the network layer (Layer 3) all the way up to the application layer (Layer 7) of the OSI reference model. This allows probes to gather not only the information that RMON can, but information about network specific applications like HTTP, NFS, Apple Talk, and IPX as well. With this added data-collection capability, administrators can obtain a more complete picture of the enterprise network.

Ethernet Statistics Group

The statistics group provides segment-level statistics (see Figure 11.4) that show packets, octets (or bytes), broadcasts, multicasts, and collisions on the local segment, as well as the number of occurrences of dropped packets by the agent. Each statistic is maintained in its own 32-bit cumulative counter. Real-time packet size distribution is also provided.

Click To expand
Figure 11.4: The Ethernet statistics window accessed from Enterasys Networks’ NetSight Element Manager. This window would be used to view a detailed statistical breakdown of traffic on the monitored Ethernet network segment. The data provided applies only to the interface or network segment, either wired or wireless.

History Control Group

The history control group controls the statistical sampling of data from various types of networks. This group specifies control parameters, such as the frequency of data sampling.

Ethernet History Group

With the exception of packet-size distribution, which is provided only on a real-time basis, the history group provides historical views of the statistics provided by the statistics group. The history group can respond to user-defined sampling intervals and bucket counters, allowing for some customization in trend analysis.

The RMON MIB comes with two defaults for trend analysis. The first provides for 50 buckets (or samples) of 30-second sampling intervals over a period of 25 minutes. The second provides for 50 buckets of 30-minute sampling intervals over a period of 25 hours. Users can modify either of these or add additional intervals to meet specific requirements for historical analysis. The sampling interval can range from 1 second to 1 hour.

Host Table Group

The RMON MIB specifies a host table that includes node traffic statistics: packets sent and received, octets sent and received, as well as broadcasts, multicasts, and errored packets sent. In the host table, the classification “errors sent” is the combination of undersized packets, fragments, CRC/alignment errors, collisions, and oversized packets sent by each node.

The RMON MIB also includes a host timetable that shows the relative order in which the agent discovered each host. This feature is not only useful for network management purposes but also assists in uploading those nodes to the management station of which it is not yet aware. This reduces unnecessary SNMP traffic on the network.

Host Top N Group

The host top N group extends the host table by providing sorted host statistics, such as the top 10 nodes sending packets or an ordered list of all nodes according to the errors sent over the last 24 hours. The data selected and the duration of the study are both defined at the network management station. The number of studies that can be run depends on the resources of the monitoring device.

When a set of statistics is selected for study, only the selected statistics are maintained in the host top N counters; other statistics over the same time intervals are not available for later study. This processing—performed remotely in the RMON MIB agent—reduces SNMP traffic on the network and the processing load on the management station, which would otherwise need to use SNMP to retrieve the entire host table for local processing.

Alarms Group

The alarms group provides a general mechanism for setting thresholds and sampling intervals to generate events on any counter or integer maintained by the agent, such as segment statistics, node traffic statistics defined in the host table, or any userdefined packet match counter defined in the filters group. Both rising and falling thresholds can be set, each of which can indicate network faults. Thresholds can be established for both the absolute value of a statistic or its delta value, enabling the manager to be notified of rapid spikes or drops in a monitored value.

Filter Group

This function provides a generic filtering engine that implements all packet-capture functions and events. The packet-capture buffer is filled with only those packets that match the user-specified filtering criteria. Filtering conditions can be combined using the Boolean parameters “and” or “not.” Multiple filters are combined with the Boolean “or” parameter.

Packet-Capture Group

The type of packets collected is dependent on the filter group. The packet-capture group allows the user to create multiple capture buffers and control whether the trace buffers will wrap (overwrite) when full or stop capturing. The user may expand or contract the size of the buffer to fit immediate needs for packet capturing, rather than permanently commit memory that will not always be needed.

Notification (Event) Group

In a distributed management environment, the RMON MIB agent can deliver traps to multiple management stations that share a single community name destination specified for the trap. In addition to the three traps already mentioned—rising threshold and falling threshold (see alarms group) and packet match (see packetcapture group)—the following seven additional traps that can be specified:

  • coldStart: Indicates that the sending protocol entity is reinitializing itself such that the agent’s configuration or the protocol entity implementation may be altered.

  • warmStart: Indicates that the sending protocol entity is reinitializing itself such that neither the agent configuration nor the protocol entity implementation is altered.

  • linkDown: Indicates that the sending protocol entity recognizes a failure in one of the communication links represented in the agent’s configuration.

  • linkUp: Indicates that the sending protocol entity recognizes that one of the communication links represented in the agent’s configuration has come up.

  • authenticationFailure: Indicates that the sending protocol entity is the addressee of a protocol message that is not properly authenticated. While implementations of the SNMP must be capable of generating this trap, they must also be capable of suppressing the emission of such traps via an implementation-specific mechanism.

  • egpNeighborLoss: Indicates that an External Gateway Protocol (EGP) neighbor for whom the sending protocol entity was an EGP peer has been marked down and the peer relationship is no longer valid.

  • enterpriseSpecific: Indicates that the sending protocol entity recognizes that some enterprise-specific event has occurred.

The notification (event) group allows users to specify the number of events that can be sent to the monitor log. From the log, any specified event can be sent to the management station. The log includes the time of day for each event and a description of the event written by the vendor of the monitor. The log overwrites when full, so events may be lost if not periodically uploaded to the management station.

Traffic Matrix Group The RMON MIB includes a traffic matrix at the MAC layer. A traffic matrix shows the amount of traffic and number of errors between pairs of nodes—one source and one destination address per pair. For each pair, theRMONMIB maintains counters for the number of packets, number of octets, and error packets between the nodes. Users can sort this information by source or destination address.

11.4.5 RMON2

As noted, the RMON MIB is basically a MAC-level standard. Its visibility does not extend to the router port, meaning that it cannot see beyond individual LAN segments. As such, it does not provide visibility into conversations across the network or connectivity between the various network segments. Given the trends toward remote access and distributed workgroups that rely on wireless as well as wired connections, both of which may generate a lot of intersegment traffic, visibility across the enterprise is an important capability to have.

RMON2 extends the packet-capture and decoding capabilities of the original RMONMIB to Layers 3 through 7 of the OSI reference model. This allows traffic to be monitored via network-layer addresses—which letRMONsee beyond the router to the internetwork—and distinguish between applications based on the protocols used. Since a bridge does not perform any IP routing or forwarding, however, certain groups of managed objects are not meaningful. For SNMP requests pertaining to such managed objects, the node simply returns a “no such name” error status in the response.

Analysis tools that support the network-layer can sort traffic by protocol rather than just report on aggregate traffic. This means that network managers will be able to determine, for example, the percent of IP versus IPX traffic traversing the network. In addition, these higher-level monitoring tools can map end-to-end traffic, giving network managers the ability to trace communications between two hosts—or nodes—even if the two are located on different LAN segments. RMON2 functions that allow this level of visibility include the following:

  • Protocol directory table: Provides a list of all the different protocols a RMON2 probe can interpret.

  • Protocol distribution table: Permits tracking of the number of bytes and packets on any given segment that have been sent from each of the protocols supported. This information is useful for displaying traffic types by percentage in graphical form.

  • Address mapping: Permits identification of traffic-generating nodes, or hosts, by Ethernet or token-ring address in addition to MAC address. It also discovers switch or hub ports to which the hosts are attached. This is helpful in node discovery and network topology applications for pinpointing the specific paths of network traffic.

  • Network-layer host table: Permits tracking of bytes, packets, and errors by host according to individual network-layer protocol.

  • Network-layer matrix table: Permits tracking, by network-layer address, of the number of packets sent between pairs of hosts.

  • Application-layer host table: Permits tracking of bytes, packets, and errors by host and according to application.

  • Application-layer matrix table: Permits tracking of conversations between pairs of hosts by application.

  • History group: Permits filtering and storing of statistics according to userdefined parameters and time intervals.

  • Configuration group: Defines standard configuration parameters for probes that include such parameters as network address, serial line information, and SNMP trap destination information.

RMON2 can help network managers understand traffic flow for the purpose of capacity planning, as well as for network troubleshooting. The capability to identify traffic levels and generate statistics by application has the potential to greatly reduce the time it takes to troubleshoot certain problems. Without tools that can pinpoint which software application is responsible for gobbling up a disproportionate share of the available bandwidth, network managers can only guess. Often it is easier just to upgrade a server or buy more bandwidth, but that inflates operating costs and shrinks IT budgets.

Applying remote-monitoring and statistics-gathering capabilities that are available through the RMON MIBs offers a number of benefits. The availability of critical networks is maximized, since remote capabilities allow for timely problem resolution. With the capability to resolve problems remotely, operations staff can avoid costly travel to troubleshoot problems on-site. With the capability to analyze data collected at specific intervals over a long period of time, intermittent problems can be tracked down that would normally go undetected and unresolved. And with RMON2, these capabilities are enhanced and extended up to the applications level across the enterprise.


11.5 Graphical SNMP Tools

Being a very simple application, SNMP does not have all the features of a full-blown NMS. Among the many capabilities SNMP does not have are automatic discovery and topology mapping. The automatic discovery capability finds and identifies all devices or nodes connected to the network. Based on the discovered information, the NMS automatically populates a topology map. Nodes that cannot be discovered automatically can be represented by manually adding custom or standard icons to the appropriate map views, or by using the NMS’ SNMP-based APIs for building map applications without having to manually modify the configuration to accommodate non-SNMP devices.

A network map is useful for ascertaining the relationships of various equipment and connections, for keeping accurate inventory of network components, and for isolating problems on the network. The network map is updated automatically when any device is added or removed from the network. Device status is displayed via color changes to the map. Any changes to the network map are carried through to the relevant lower layer maps.

Some vendors have developed graphical wrappers for SNMP, which makes SNMP easier to use than its traditional text-based CLI. They have also appended additional functionality such as automatic discovery and topology mapping, giving SNMP-based products the look and feel of a high-end NMS.

Many wireless devices, including both access points and bridges, support SNMP. There is a set of common management tasks that can be done with SNMP, but vendors often include proprietary management features in their products that can be handled via SNMP as well. This enables SNMP to perform some management tasks that cannot be done using the vendor’s GUI. For example, it might be possible to disable service set identifier (SSID) broadcasts from an access point using SNMP but not with the vendor’s GUI configuration tool. The purpose of these broadcasts is to let wireless clients know that they are in range of an access point. The reason for disabling the broadcasts is to hide the access point from hackers, who can use the access point as a point of entry to the enterprise network.

But care must be taken when using SNMP-supported products because they often ship with a default password. When changing other default settings, administrators should not overlook changing the default SNMP password (often called the “community”) as well. As an extra security precaution, administrators should consider disabling SNMP until it is actually needed. If a hacker ever succeeds in exploiting the security vulnerabilities of SNMP, he or she could tie up network resources at will. This aspect of SNMP is discussed in Chapter 13, Section 13.11.


11.6 SNMP on Wireless Networks

Although they share standard elements and mechanisms, wired and wireless networks have significant differences. In addition to the conventional wired network, wireless networks have the following unique issues:

  • Secondary hierarchy. The wireless network environment is hierarchical, with portable devices associated to a given access point. Standard network management products designed for wired networks often do not represent this critically important tiered topology network structure and are more likely to represent the wireless network as a flat topology.

  • Roaming. The wireless network environment supports dynamic cell connection or roaming, which is the process of changing the network connection of a portable device from one access point to another as the user changes location.

  • Persistence of mobile units. In an environment comprised of portable devices, the devices’ persistence also becomes a factor. Unlike desktop systems or other network components that operate continuously or are powered on/off daily, portable devices typically are turned on and off frequently throughout the day, making it difficult to monitor them.

  • SNMP agents. The ability of devices on wired and wireless networks to host an SNMP agent also impacts network management functionality. Desktop or notebook computers have adequate amounts of memory and processing power to support an SNMP agent operating as a background task handling requests from the management station. With PDAs and other handheld devices, however, memory and processing power are limited resources, making it difficult to provide agents for these devices.

11.6.1 Performance of SNMP

Managing a wireless network is a significantly more difficult task than managing a wired network. One reason is the unpredictable behavior of the wireless channel due to fading, jamming, and atmospheric conditions. This variability of signal quality can reduce the efficiency of the management operation. The bandwidth of wireless links is another issue. Bandwidth will always be limited due to the properties of the physical medium and regulatory limits on the use of radio spectrum, making it necessary for network protocols to utilize the available bandwidth efficiently.

Using mobile agents to facilitate management offers several benefits, including reduced network traffic and efficient utilization of processing resources. On the other hand, the use of mobile agents consumes considerable resources from the agent host, which can pose a problem for mobile terminals like PDAs. And the response time in notifying the network manager depends on the wireless link quality. Response time can vary from several seconds to even several minutes depending on the link condition. Management functionality is unusable in situations with bad link quality and with system load at 20% of the whole capacity of the system.

Unusable means not being able to update the whole MIB tree using SNMP’s get-next operation. Accordingly, a management station can manage several times the number of devices when the signal strength is good than when it is bad with the same system load. The response time increases in an exponential way as the load of the system grows.

Using SNMP’s get-bulk request, on the other hand, provides the means to retrieve much more data about a network entity—as much data as is possible to carry in the response message. This is especially useful when channel conditions are bad because the number of round-trip time-outs is reduced, which is important to maintain performance in a wireless environment. With traffic reduced between manager and agent, the probability of UDP packet loss is also much less.

While measurements obtained through the get-next command are good for short transactions, such as retrieving individual objects when the query and response messages fit into a single UDP packet, if the MIB contains a considerable amount of tables, the retrieval process will involve a high number of protocol data unit (PDU) exchanges over the network, which in the case of bad link quality, could make management performance worse. But using a single get operation makes it much easier to adapt channel conditions for the current transaction. The user can specify relevant options like time-out for the response message or a maximum number of retransmission with respect to link quality.

The SNMP agent itself could provide an approximate indication of the link condition. For instance, information about the number of retransmissions performed by the manager/agent application or maximum delay time on receiving a response measured by the manager could be useful for determining wireless LAN performance.

11.6.2 Platform Support for Wireless

IT departments tend to favor a single management console that integrates wireless management with existing wired infrastructure. Yet with so much change in the wireless industry and the rapid pace of standards development, many established network management platform vendors do not yet support wireless networks. Instead they rely on wireless vendors or third parties to provide management applications that can be incorporated into their management platform to manage the wireless component of the network. With its simplicity, SNMP provides management capabilities from a central point of control that spans wired and wireless environments.

There are NMSs that have been specifically designed for the wireless environment, enabling administrators to navigate, examine, and manage the wireless network Such wireless management systems may even offer seamless integration into larger corporate enterprise network management platforms, such as Hewlett-Packard’s OpenView Network Node Manager, to provide a single management environment. This integration offers IT managers the tools to install, configure, centrally monitor, and manage the entire enterprise, wired and wireless. This approach also helps IT departments avoid the additional expense of purchasing, training, and maintaining a new management tool. A good wireless NMS should offer the following basic features:

  • Automated discovery of new access points and remote configuration capabilities;

  • Access point configuration to include a group management capability, a configuration database, and standard SNMP support;

  • Configuration of the access control list (ACL) to regulate what devices are allowed to associate with an access point;

  • Threshold and event notification, whereby designated events trigger alerts before a system problem or failure occurs (there should also be real-time updates on network events);

  • Exception-based management to allow key parameters in the wireless LAN to be monitored for values that exceed a predefined threshold, so network operators or support personnel can be notified;

  • Single-source report generation for inventory, configuration, and usage;

  • Data trending to track and trend network traffic and usage and allow for proactive analysis of network utilization;

  • Mapping to provide a concise network representation, including a tree view showing all devices in various levels of detail (there should be a facility for creating custom maps and importing device-specific images);

  • Drill-down and component-zooming capabilities to allow information to be expanded as required;

  • Intelligent agent technology to monitor and coordinate tracking information from multiple data sources, thereby reducing the amount of management traffic on the network;

  • Remote firmware and software revision control to permit the configuration of system components from a central location without having to tie up staff resources with on-site service calls;

  • Wireless proxy agent to support non-SNMP mobile devices such as PDAs.

Some vendors offer graphical management systems for their wireless products. Cisco’s Wireless Manager is one example. It is a UNIX-based solution that can be run locally from a server console—or remotely via remote login (rlogin), Telnet, or remote shell (rsh)—from a UNIX workstation, or a Windows computer.

Wireless devices can even be managed through a Web browser. Although the Web management interface may not support remote configuration of any securitysensitive parameters, it gives IT staff more flexibility to monitor network performance from any location that has Internet access. To implement Web management, the browser proxy is configured for direct Internet connection. The administrator then enters the IP address of the target access point in the browser window. The administrator is prompted for a user name and password. Once connected, a navigation tree appears on the left side, providing access to the management features.


11.7 Telecommunications Management Network

As companies seek to merge their networks and systems, they must consider how to manage heterogeneous environments of differing protocols, technologies, and legacy systems. Telecommunications management network (TMN) provides for more capable and efficient networks by defining standard ways of performing network management tasks and communicating across networks. As defined by the ITU, TMN is a set of international standards that enables telecom companies to save existing investments by integrating legacy systems and newer equipment from different vendors into the same network management infrastructure. When implementing theTMNdefinitions, telecommunications networks become interoperable, even when interacting with the networks and equipment of other telecommunications service providers. Ultimately, interoperability can be achieved across all managed networks.

TMN uses an object model to describe each network element (such as a frame relay switch or a fixed wireless base station) that is being managed. The object model facilitates the development of management applications that are independent of the implementation details of the network elements, making it possible to manage equipment from many suppliers with a single application.

An intelligent agent provides the means through which a TMN manager communicates and controls the network elements. The agent acts as an interpreter and filter for sending object-specific commands to the network elements it controls to get the data it requires. The agents send the collected information back to the manager. In turn, the manager may also act as an agent, collecting and filtering information for another higher-level manager.

11.7.1 Benefits of TMN

Telecommunications carriers today are faced with the task of rapidly introducing and managing new competitive services. To do this successfully, they must quickly integrate and be able to manage communications equipment from multiple vendors. Focusing on the communication of management information, the TMN framework fulfills this need and offers telecommunications carriers the following added benefits:

  • Cuts time to market for new services by separating the management model from the physical detail of the networked devices, allowing new services to be released without affecting the switching network.

  • Makes the network more robust by allowing network management to be distributed, while decreasing the amount of management traffic over the network. Protects existing investments in network equipment by allowing legacy systems and new systems to be integrated into the same network management infrastructure. Empowers telecommunications companies to be more competitive by allowing service, management, and accounting systems to be integrated, thus streamlining business processes and improving quality of service.

TMN is also applicable in wireless communications, cable television networks, private overlay networks, and other large-scale, high-bandwidth communications networks.

11.7.2 Standards

TMN consists of a series of interrelated national and international standards and agreements. The International Telecommunication Union-Telecommunications (ITU-T) began work on TMN in 1988. The ITU [formerly known as Consultative Committee for International Telegraphy and Telephony (CCITT)] extended the ISO/OSI standards for systems management by adding its own recommendations for architecture (M.3000 series), modeling (G series), and interfaces (Q series). The resulting standard M.3010 is the high-level specification of the framework, which provides for the observation, control, coordination, and maintenance of telecommunications networks. Since theTMNmodel is based on open interfaces, it is attractive to telecommunications operators and service providers as a way to solve common management problems without being limited by proprietary vendor solutions.

By making all internal network management functions available through standardized interfaces, service providers can achieve more rapid deployment of new services through maximum use of automated functions. Vendors of network elements can offer specialized management systems known as element managers, which can integrate readily into a service provider’s larger management hierarchy. Groups of service providers can enter into business-level agreements and deploy resource-sharing arrangements that can be administered automatically through interoperable interfaces.

Under TMN, management tasks are arranged into network element, element management, network management, service management, and business management layers. OSI’s Common Management Information Protocol (CMIP) is used to communicate between the adjacent layers.

Object-oriented techniques are used for creating data structures and their access methods for the MIB. Traditional manager/agent concepts are used for the hierarchical exchange of management information between systems. A MIB is located at an agent and provides an abstraction of network resources for the purpose of facilitating management. The agent provides service elements, which are a standard set of access methods into the MIB.

11.7.3 Functional Architecture

TMN breaks the tasks performed in a management network into the following functional blocks:

  • Network element function (NEF): Contains the telecommunications functions, which are the actual subject of management.

  • Operations systems function (OSF): Processes information related to management.

  • Workstation function (WSF): Provides the means to interpret TMN information for the management system operator.

  • Q adaptor function (QAF): Reconciles a non-TMN NEF or OSF to TMN via protocol conversion to a standard TMN interface.

  • Mediation function (MF): Mediates between a non-OSF and a NEF or a QAF and presents the information in a different form for the OSF.

  • Data communication function (DCF): Transfers telecommunication network management information.

11.7.4 Physical Architecture

TMN standards define two types of telecommunications resources: managed systems, generally known as network elements (NE); and managing systems, of which the operation system (OS) is the most prominent. TMNalso defines reference points (f, g, m, q, and x), which can exist between these functional blocks. Reference points become interfaces when they occur at locations that require data communications between network elements. The key interface in the TMN model is the OS-NE (or Q3) interface, which uses a CMIP manager/agent pair to provide access to a standardized MIB.

For each functional block, a physical block can be implemented, thus leading to a physical architecture. Reference points are a significant part of the TMN functional architecture and are realized within the physical architecture by physical interfaces within systems or equipment. The implementation of the reference points are represented by capital letters (Q, F, X) and form the common boundary between associated buildingTMNblocks. The F interface is found between workstations and the TMN; the Q (Q3) interface is found between TMN devices; and the X interface is found between the devices of one TMN and the devices of another TMN via the data communication network (DCN). Figure 11.5 describes the physical architecture, showing the implementation of reference points (i.e., interfaces) within TMN.

Click To expand
Figure 11.5: Physical architecture of the TMN.

A telecommunications network provides voice and data services to customers; this function is outside of the TMN. However, the network consists of various network elements that can provide TMN functions and services. Central to the TMN is the DCN, which typically uses portions of the carrier’s telecommunication network to transmit management information. Telecommunications network NEs, which provide transmission to the DCN, are part of the TMN’s DCN.

Most NEs provide services such as environmental alarm notification or telecommunications transmission for a facility or a telecommunications network. NEs that provide a TMN management interface as well as non-TMN functions straddle the TMN boundary.

The operation system provides the mechanism for interaction, observation, and execution of many of the functions within the TMN. All higher level functionality, however, does not have to be physically located within the OS, NE, or any other single point in the TMN.

TMN elements use object-oriented techniques to represent resources under their control as managed objects. A common understanding of these objects is shared between the element that controls the resources—a mediation device (MD) or NE—and the manager of the resource, an OS or MD. As noted, TMN uses a manager/agent paradigm where the manager issues instructions and the agent carries out the instructions. In response to instructions to the agent, methods in the managed object are invoked, resulting in a variety of information storing, retrieving, and processing activities within the NE or MD. A NEF agent can be controlled either by an OSF or MD manager, but an MF agent is under the control of an OSF manager.

In sum, the ITU defined the TMN standards to facilitate the management of global telecom networks. The advantage of TMN is that it enables companies to integrate diverse network elements, including legacy systems and newer equipment, into the same network management infrastructure. TMN uses an object model to describe each network element being managed. The object model eases the development of management applications that are independent of the implementation details of network elements, such that a single application can manage equipment from many suppliers. Among the popular management platforms that support TMN are Hewlett Packard’s OpenView, IBM’s NetView, Sun’s Solstice Enterprise Manager, and Tivoli’s (an IBM company) Management Framework. The companies also offer TMN development tools that allow rapid integration of applications into TMN networks.


11.8 Open Source Management Tools

There is a continuing debate about whether it is better to build or buy management tools. Advocates of the open-source model cite the high cost of management applications as reason enough to “build it yourself.” Like their counterparts in the operating systems market, management software vendors have priced their offerings so high that they have virtually invited the open-source response. Moreover, many of these management solutions have become far too complex to deploy and offer a range of features that buyers often do not want—either because they do not really need them or because they are just too complicated to implement. Consequently, organizations end up paying for functionality that goes unused. Open-source packages take the opposite approach, allowing users to start with a set of core functions and then add others as required at little or no expense.

Open-source software implies that the “source code” is freely available and may be enhanced by anyone who wants to offer new features. By comparison, “closed source” or proprietary software has its source code hidden so that changes cannot be made. SNMP is an example of an open-source tool that is freely available and may be extended to offer additional functionality. Hewlett-Packard’s OpenView is an example of a closed-source product that must be purchased and whose source code is not accessible to customers who might like to change it. With mixed results, the open-source movement is turning its attention to network management software, both to add needed functionality and to help users avoid the exorbitant costs big vendors charge for their outdated platforms.

True open-source products are governed by the GNU general public license (GPL). Under this arrangement, software is published under the GPL so others can use it and modify it. Among other things, this frees developers to share and improve on code without concern for corporate intellectual property issues, allowing a community to focus on solving common problems and leverage a much larger test environment, which can result in more robust software. The success of the Linux operating system in the corporate environment attests to the validity and effectiveness of this software development method.

From a strategic perspective, the open-source movement has compelling ramifications for network management because it offers organizations the ability to differentiate themselves based on the skill with which they can build highly customized management solutions. Since virtually all enterprise applications have been extended to remote locations, telecommuters, mobile professionals, and even customers and partners via IP networks, the ability to solve problems fast to keep them running at peak performance offers a significant competitive advantage. Firms that lack the ability to custom-build management solutions must rely on expensive, often unwieldy, off-the-shelf packages. In today’s slow-growth economy, the availability of the right tool at the right time could spell the difference between profit and loss.

11.8.1 Sample Tools

There are a number of open-source network management tools that can be downloaded from developers’ Web pages, along with documentation and release histories. For additional support, there may be frequently asked questions (FAQs), invitations to e-mail the author, subscriptions to mailing lists, and Internet relay chat (IRC) discussion forums. Many of these open-source tools are text-based and provide very specific functions. Those that are graphical typically do not have the polished look of high-priced products from traditional suppliers. A sampling of open-source management tools follows.

OpenNMS

This open-source project is intended as the foundation of an enterprise-grade network management platform. It addresses two main aspects of network management: detecting when faults occur and measuring performance. It has pollers that simulate users’ access to a network service in order to detect faults and determine service levels, and it includes a collection engine for gathering performance data. Reporting and notification capabilities are accessed through a Web browser. Once installed and configured, much of the operation of the product is automated.

Since OpenNMS is built to simulate a user, its focus starts at the application layer (Layer 7) of the OSI reference model and works its way down. Polls are made to network services just as the users would access them, which dispenses with the need for application-specific agents.

After the system is started, the discovery process sends pings to every address configured for discovery. If a device responds, discovery will generate a “suspect node” event. It is also possible to generate these events manually or through a script, which allows for the discovery process to be bypassed automatically. By default, 24 hours after the discovery process has run, it will repeat in order to determine if new devices are on the network.

During a poll, a test is run to determine if the monitored service is available. If not, an outage event is generated. When an outage is detected, the system can be configured for adaptive polling. By default, the poller will check HTTP, for example, on a node every five minutes. If the HTTP service is down, determined by multiple failed attempts to reach the service over a short period of time, a “node lost service” event will be generated and the poller will increase the frequency of polls from 5 minutes to 30 seconds. If after 5 minutes the service is still down, the poller will resume normal 5-minute polls. If after 12 hours the service is still down, the polling rate is further reduced to once every 10 minutes. If an outage lasts 5 days or more, the service is removed from the node. The polling intervals are configurable.

For any device that supports SNMP, data specific to that device can be collected and presented in reports. The data can be at the device level (i.e., CPU utilization, free memory) or at the interface level (i.e., in/out, errors). Non-IP interfaces can be polled as long as the SNMP agent on the device can be reached via at least one IP address.

An event management system displays the events currently in the database via a Web-based interface. Events can be generated internally, such as when there is a service outage, or if a data collection threshold is exceeded; or externally, either via a command or SNMP trap. Automatic actions can be taken based on the type of the event and the information passed with it. For every event in the system, a notification can be sent. Events used in notifications can be filtered based on source and service.

Through the Web browser, which requires a user name and a password, users can determine the current system state and current service levels via the main console. They can list and manage events and notifications and generate reports.

Admin-level users can perform system management tasks in addition to all of the functions available to other users.

Multirouter Traffic Grapher

The multirouter traffic grapher (MRTG) improves on the way SNMP collects data and sends it to the management station for analysis. SNMP relies on the UDP to send messages to a target device, requesting performance information it has collected according to various trap definitions. But UDP is connectionless, meaning that the delivery of request messages and the trapped information to be sent back from the target device is not guaranteed. Unlike the TCP, which tracks packets and acknowledges their receipt and, if needed, requests retransmission of missing or corrupt packets, UDP just issues packets into the network with the assumption that they will arrive at their proper destination. But sometimes the packets are dropped along the way.

Some likely causes of lost SNMP data are path congestion and busy routers. Another possibility might be links with high error rates. In such cases, where some SNMP packets are lost but traffic is flowing, the resulting graph is filled with gaps. MRTG interpolates the lost data to produce a smoother graph that is more accurate in cases of intermittent packet loss. When an SNMP query goes out and a response does not come back, MRTG assumes something to put in the graph; by default, it assumes that the last answer it got back is probably closer to the truth than zero. This trade-off does not hold up during a total outage, but the user has the choice of applying it or not.

Round Robin Database

The Round Robin Database (RRD) Tool is a reiteration of MRTG’s graphing and logging features but offers more speed and flexibility. RRDTool provides a system to store and display time-series data such as network bandwidth, machine-room temperature, and server load average. It stores the data in a very compact way and presents it in the form of useful graphs by processing the data to enforce a certain data density. It can be launched via simple wrapper scripts from shell or Perl, or a front end that polls network devices and puts it in a user-friendly graphical format.

MRTG can be used to graph the round-trip time and packet loss of ping echoes sent from the data center to each remote location on the network. The historical network information MRTG provides is important in situations where the network manager gets phone calls from users stating that they were not able to connect to the servers a few minutes ago, but everything seems to be working fine now. The collected data can show if there was packet loss or long round-trip times on the Internet during the period when users could not connect.

However, MRTG does not combine round-trip time (milliseconds) with packet loss (percentage) on the same graph, forcing network managers to graph them separately. Using the RRDTool’s infinite number value (INF), network managers are able to put both sets of data on a single graph (Figure 11.6). And with the RRD Tool’s fetch command, information can be pulled out of the RRD files for other uses. For example, a current-status page can be provided to the organization’s help desk so that staff can easily check if a major network outage has taken place. This information can be useful when answering trouble calls.

Click To expand
Figure 11.6: Tobi Oetiker’s RDDTool showing packet-loss/round-trip delay.

Big Sister

This tool provides a simple Web browser view of current network status, generates alarms on status changes, and provides a history of status changes. The tool interoperates with other Big Sister instances and commercial network monitors such as HP’s OpenView.

Big Sister provides detailed status information per tested host or service. A network administrator can use Big Sister to set up a custom view of the network. Big Sister supports grouping, summarizing, graphical displays, and other features. It also logs performance data and visualizes them via the RRDTool. The way Big Sister displays its information is configurable by the user.

Hyperlinks on the entry page guide the administrator through more detailed views. Status changes are logged, and history data is available for immediate viewing or can be stored for later reference. The tool can send alarms on status changes via mail or pager. An alarm summary page lists pending alarms (see Figure 11.7) that are viewed through a Web browser, which eases its use in collaborate environments. Alarm details can be viewed, acknowledged, or deleted.

Click To expand
Figure 11.7: Big Sister by Aeby Graeff showing alarms.

mon Service Monitoring Daemon

Developed under Linux, mon is a client-server scheduler and alert management tool used for monitoring service availability and triggering alerts upon failure detection. These functions are implemented by two separate programs. Monitors and alerts are not a part of the core mon server, but the distribution comes with samples to get the user started. This means that if a new service needs monitoring, or if a new alert is necessary, the mon server does not need to be changed, making mon easily extensible. Adding a test for a new service entails writing a monitor in any language and putting it in the monitor directory.

Mon includes support for asynchronous events communicated to the mon server. Traps generated by remote entities can be programmed to behave in the same manner as failures identified by local polling monitors. This makes it is possible to build a distributed monitoring architecture. For example, remote monitoring domains, such as sites separated by slow WAN lines, can collect their own data locally and report significant events to a centralized location, such as a NOC.

Alert scripts send a message or otherwise act on a failure that mon detects. Repetitive alerts can be suppressed. These alerts, like the monitors, are not part of mon but are easy to add. So-called “upalerts,” which are used to trigger an alert when a server comes back up after being down for a long period of time, are also supported. A history of failures and alerts that can be queried by clients is kept.

Failure of any monitor can trigger any (and multiple) alerts to different people at different times, effectively constructing “on-call” schedules using this feature. For example, a page can be sent to all system administrators if a resource goes down before 8:00 p.m., but after that time, a page can be sent to a specific system administrator on duty while an e-mail is sent to everyone else.

Mon supports parallel tasking, the checking of services on different hosts or groups of hosts. Hosts can be grouped together, and each host or group can have multiple services. For example, a ping of routers can occur at the same time as a ping of Web servers. There is no queue that can postpone the scheduled testing of other services. Interservice dependencies and event correlation prevents the system administrator from becoming overwhelmed by the cascading of alerts, which happens when some critical resource is not accessible. A service failure can be acknowledged so that alerts are suppressed until the problem is fixed. Also, alerts for particular hosts, groups, or services can be temporarily disabled and re-enabled by the client without stopping and restarting the server. If a particular server is being upgraded, for example, the alert can be disabled while the work is being done and then re-enabled on completion.

To help with large configurations, “views” can be generated to simplify reports for those who do not need to know the status of all services being monitored. For example, a network view can be generated that includes the status of all networking gear, just as a servers view can show all information pertaining to servers. Views can be configured on a per-user basis if needed, with each system administrator able to control his or her own views.

11.8.2 Risk Factors

There is some risk in relying too much on open-source network management software. Since nobody owns it, technical support may be difficult to obtain. This is one of the hurdles that had to be cleared before Linux could make significant headway in the enterprise environment as an alternative operating system to Windows and UNIX. Although vendors like Red Hat, SuSE, and Caldera (now known as The SCO Group) built their Linux distributions on an open-source kernel, they quickly realized that corporate acceptance hinged on the ready availability of technical support. Likewise, IBM, Hewlett-Packard, Computer Associates, Oracle, and other vendors had to build extensive support infrastructures to position themselves for enterprise sales of Linux products.

Mitigating the support risk, however, is the fact that open-source products are peer-reviewed and thoroughly tested before distribution. This is how SNMP and TCP/IP were developed over the years, and nobody dismisses them for the lack of development discipline or support availability. It can be argued, however, that these successes were due primarily to government funding.

It is recommended that open-source network management tools be tested extensively before relying on them exclusively. These tools are developed by individuals or teams of people whose contributions to the source code may be few and far between. Web pages may not be up to date, and the content of some is a few years old, raising doubt about the viability of any downloaded code. Support is often spotty, and projects seem to be abandoned as many times as new ones start up. Other tools seem to be in eternal beta development and are acknowledged by the author as incomplete or buggy. There is less risk, however, if the user is technically savvy and can add code to enhance functionality and fix bugs.

Traditional NMS vendors have not yet embraced the open-source movement the way application and hardware vendors have for Linux. Currently, there is no all-encompassing project that seeks to tie together all the independent open-source utilities that have sprung up over the years. Consequently, there is no credible threat to traditional NMS vendors and certainly no incentive for them to participate in developing an open-source platform. This may happen in the future, as it did for Linux, but only when a groundswell of support materializes from enterprise users. To date, open-source network management has not progressed beyond the small-project stage. Nevertheless, some of these tools show promise and are worth trying.


11.9 Conclusion

Most network management architectures use the same basic structure and set of relationships. Managed elements, such as computer systems and network devices, run software that enables them to send alerts when they recognize problems; for example, when one or more user-determined thresholds are exceeded. Upon receiving these alerts, management entities are programmed to react by executing one, several, or a group of actions, including operator notification, event logging, system shutdown, and automatic attempts at system repair.

Management entities can poll end stations to check the values of certain variables. Polling can be automatic or user-initiated, but agents in the managed devices respond to all polls. Agents first compile information about the managed devices in which they reside, then store this information in a management database, and finally provide it to management entities within NMSs via a network management protocol such as SNMP.

SNMP’s popularity stems from the fact that it works and is reliable, widely supported, and extendible. The protocol itself is in the public domain. SNMP capabilities have been integrated into just about every conceivable device that is used on today’s LANs and WANs, whether they are wired to the network or linked wirelessly to the network.


Chapter 12: Managing Service Quality

12.1 Introduction

Packet networks have become popular in recent years as the means of extending mission-critical applications across the enterprise, including remote branch offices, telecommuters, and mobile professionals. The choice of infrastructure will boil down to the IP, frame relay, or ATM, depending on the mix of applications and their performance requirements in terms of such metrics as reliability, availability, and latency. Sometimes it is necessary for the infrastructure to incorporate all three protocols because each is optimized to handle specific types of traffic. Of course, budgetary considerations also play a role in selecting the most appropriate protocol or mix of protocols for the network infrastructure.

Regardless of the infrastructure protocols used, the ability to assign a QoS to each type of traffic ensures the optimal performance of all the applications on the network. This also helps to contain bandwidth and equipment costs, which has the added advantage of making the enterprise network easier to manage and administer. It also makes the network easier to scale without necessarily having to add network equipment and aggregate bandwidth. On the flip side, however, the implementation of QoS mechanisims entail management challenges.


12.2 Role of ATM

Ensuring the predictable delivery of increasingly diverse applications and services running over packet-based networks has become the key challenge faced by companies seeking to consolidate networks, put more applications on the network, or adopt an electronic model of doing business. The ability to set QoS parameters is an inherent feature of ATM (see Table 12.1) and offers the most effective means of transporting multiple traffic types through the network without impacting the overall performance of individual applications.

Table 12.1: QoS Mechanisms Included with ATM QoS Mechanism Description Applications
QoS Mechanism | Description | Applications
CBR | Provides always-available bandwidth at a CBR. | Suited for real-time applications such as circuit emulation for PBX-to-PBX trunks, scheduled multicasts, distance learning, and videoconferencing. Also used for very large bit-rate applications such as streaming audio or video and the transfer of medical images, CAD/CAM files, and archival storage.
VBR | Provides bandwidth that can fluctuate according to the applications being used. | Suited for compressed voice (VBR-real time), or “bursty” LAN connectivity (VBR-nonreal time).
ABR | Provides bandwidth to the applications as it becomes available. | Suited for routine applications that are not time-sensitive such as file transfers and e-mail, which can wait for access bandwidth to become free.
UBR | Provides bandwidth to the applications on a besteffort basis. | Suited for nonessential traffic such as e-mail “messagedelivered” or “message-read” acknowledgments and Web lookups.

For example, LAN and video traffic can share the same physical link into the ATM network (see Figure 12.1). The aggregate bandwidth of a T3 link, for example, may be partitioned between the two applications, with each type of traffic assigned its own QoS. The video stream requires a CBR and is assigned to a highpriority (QoS 1) partition of the switching fabric, whereas “bursty” LAN traffic is admitted to the network at a VBR and is assigned to a low-priority (QoS 2) partition of the switching fabric. This scheme is referred to as QoS reservation. The QoS reservation can be set in the following ways:

Click To expand
Figure 12.1: In this depiction of QoS reservation, bursty VBR traffic does not cause cell delay for CBR traffic because it is assigned a low-priority (QoS 2) partition of the switching fabric. In this scheme, time-sensitive video traffic always has the right of way.

  • When set to 0%, there is no distinction made between connections. The system sends ATM cells through the switching fabric on an equal opportunity, round-robin basis.

  • When set to 25%, the available switch bandwidth is divided so that 25% of it is reserved for QoS 1 traffic and 75% reserved for QoS 2 traffic.

  • When set to 50%, the available switch bandwidth is divided so that 50% of it is reserved for QoS 1 traffic and 50% reserved for QoS 2 traffic.

The service provider configures the QoS parameters and connection priorities for each type of traffic the customer has. The service provider may even supply and manage an IAD for each customer location in order to consolidate the different traffic types over virtual circuits (VCs) that are provisioned over multiple T1 access links. These links can be bonded together to support applications at higher speeds, which is an economical alternative to T3 access lines.


12.3 Adding QoS to Frame and IP

Unlike ATM, frame relay and IP do not inherently support QoS—protocols must be added in order to prioritize different types of traffic for appropriate handling through the network. Most routers today can add prioritization schemes to expedite the delivery of real-time traffic over frame relay (see Table 12.2) and IP (see Table 12.3) using standard or proprietary mechanisms. However, with so many devices on these types of networks, IT staff can easily get bogged down performing manual QoS configurations to fully optimize the enterprise network. This task can be less tedious and error prone by using policy-based network management solutions.

Table 12.2: Selected QoS Mechanisms for Frame Relay Networks QoS Mechanism Description Applications
QoS Mechanism | Description | Applications
Rate enforcement on a per-VC basis | The peak rate value for outbound traffic can be set to match the CIR to provide a CBR. | Suited for real-time applications such as voice, streaming data, and large file transfers.
Dynamic traffic throttling on a per-VC basis | When BECN packets indicate congestion on the network, the outbound traffic rate is automatically stepped down by 25%; when congestion eases, the outbound traffic rate is allowed to increase. | This network function ensures that all or outgoing CIR during times of congestion. Routers that do not respond to BECN risk having their traffic discarded.
Enhanced queuing support on a per-VC basis | Either custom queuing or priority output queuing can be configured for VCs. | Custom queuing is used in environments that need to guarantee a minimal level of service to all applications. Priority output queuing is used to give mission-critical data the highest priority and hold back less-critical traffic during periods of congestion.
Table 12.3: Selected QoS Mechanisms for TCP/IP Networks QoS Mechanism Description Applications
QoS Mechanism | Description | Applications
RSVP | Sets up resources through the network to deliver the data stream to each router on the network that has attached subscribers who have preregistered to receive it. | Suited for real-time applications such as scheduled audio/video multicasts, computer-based training (CBT), and distance learning.
PIM* | Sends the data stream only once from the server, which is replicated at an RP only as many times as necessary to reach the nearest subscribers who have registered to receive it. | Handles same applications as RSVP but is more bandwidth-efficient than RSVP. PIM also conserves processing resources at the server, since the stream goes out to the network only once.
RTP* | Sequentially tags IP packets to enable proper reassembly of the packet stream at the receiving endpoint before conversion to the real-time application. | Handles real-time, multicast, and simulation applications but does not set up network resources as do RSVP and PIM. RTP is augmented by Real Time Control Protocol (RTCP) to allow monitoring of data delivery and provide minimal control and identification functionality.
IP Precedence | Expedites the handling of IP packets based on the partitioning of the traffic into as many as six classes that can be indicated in the type of service (ToS) field of the IPv4 header. | Handles a range of real-time and nontimesensitive applications based on the class of service they are assigned.
Diff-Serv | Supersedes the original IP precedence specification for defining packet priority. Diff-Serv first prioritizes traffic by class, then differentiates and prioritizes same-class traffic, offering finer priority granularity. | Satisfies differing services and applications based on the QoS specified by each packet.

*By themselves, PIM and RTP are not really QoS mechanisms, but they are often used with other protocols such as RSVP and Diff-Serv to achieve QoS.


12.4 Policy-Based QoS Management

To address the QoS challenges of IP networks, policy-based bandwidth management solutions are becoming available from a growing number of vendors. These tools allow network administrators to create assured service levels and deploy security features across enterprise networks, including intranets and VPNs based on IP. With these tools, network administrators can set traffic policies designed to guarantee that both mission-critical and routine data traffic are offered to the network and routed in a timely and consistent manner. Numerous capabilities are available with these tools, including the following:

  • Monitoring, categorizing, and optimizing IP, IPX, AppleTalk, and SNA traffic to support service-level guarantees based on the organization’s needs and priorities.

  • Applying access-control policies for extended network and application security.

  • Protecting the performance of mission-critical applications on LANs and IP networks by providing layer-independent policy configuration and enforcement at Layers 1–4.

  • Controlling bandwidth by prioritizing traffic, allocating bandwidth for specific application flows, and managing dynamically requested bandwidth via protocols such as the RSVP.

  • Dynamically controlling the QoS mechanisms in standards-compliant routers and automatically configuring network resources to accommodate missioncritical and time-sensitive applications. Traffic can be prioritized by user, IP address, time of day, or application.

  • Driving network behavior that maps to business processes and needs, enabling managers to deploy unified policy capabilities that provide end-to-end network traffic predictability and control.

  • Verifying delivered performance against application service-level agreements by tracking application flows and application response times.

  • Combining firewall, VPN, and traffic management functionality on a single platform.

  • Enforcing business-level policies such as QoS levels and access privileges on behalf of users, groups, and applications.

  • Using automatic discovery and classification of devices to lay out a network’s topology. The data is used to construct rules that assign QoS priorities to specific applications.

  • Employing TCP rate control to actively manage bandwidth and smooth out bursty IP traffic to relieve congestion on IP networks, while making performance more predictable for time-sensitive applications.

While these tools leverage the basic capabilities of the QoS standards for IP, policy-based solutions go far beyond them, allowing managers to fine-tune the network in terms of balancing costs, performance, and administrative productivity. In some cases, the products can be further enhanced with the addition of optional software packages, such as accounting, which provides policy-based tracking of bandwidth and transactions, and usage-based reporting and billing. Some software packages enforce network caching policies, and others distribute traffic according to individual server capabilities.

Some of the policy-based tools for IP are available as software solutions that are installed on existing routers located on the edges of the network, while others are implemented in hardware, requiring the purchase of dedicated devices that are also deployed at the edges of the network. Tool vendors typically specialize in IP rather than frame relay or ATM because of the growing popularity of intranets, extranets, and VPNs, which are based on the TCP/IP protocol suite. TCP/IP also lacks granular control of prioritization mechanisms that many organizations need. However, when IP is used over frame relay and ATM networks, these tools can be used to extend control of IP traffic across these networks as well.

Furthermore, IP networks support a diverse range of services, including VPNs, extranets, application hosting, and e-commerce, as well as voice and video traffic. The range of services supported by IP continues to grow. These new IP services offer companies the potential for new revenue streams and increased returns on investment from new and existing network deployments. Consequently, policy-based tools—software or hardware implementations—are more in demand for IP than for frame relay or ATM.


12.5 Software Solutions

Of the many software tools available, the one from Orchestream Ltd. stands out as one of the most comprehensive. The company’s namesake product, Orchestream Service Activator, is a bandwidth management system that includes several modules, one of which is a policy server that communicates with proxy agents that are distributed throughout the network. The proxy agents place the QoS policies into routers and other edge devices via appropriate drivers. These device drivers act as translators that interpret the abstract policies into actual commands that can be acted upon by equipment throughout the network, such as routers, access points, and packet switches. An Oracle database is used to store the policy information.

Orchestream addresses the problem of sluggish performance on IP networks by partitioning them into multiple performance classes tailored to the needs of specific applications. For example, the network administrator might want to guarantee a minimum bandwidth service class for mission-critical applications such as Citrix WinFrame, SAP R/3, or Oracle, while designating a low-latency performance class for delay-sensitive applications such as VoIP and videoconferencing. At the same time, the network administrator can set a standard class for applications that can tolerate some delay, such as e-mail and intranet access. With this classification scheme, the key traffic in the minimum bandwidth class will get network service even in times of congestion.

The software automatically discovers and classifies network devices and lays out a network’s topology. Network managers can point and click to check the settings on different devices in the network. Orchestream uses this data to construct rules that assign QoS priorities to specific applications. The software then translates those rules into the actual configuration commands that network devices can interpret to appropriately support the applications. The rule-based interface allows network administrators to set up dedicated classes on an IP WAN for different applications and to configure devices individually or as a group in one operation.

Devices are classified as edge, gateway, or core and then grouped by geographicallocation or other parameters. These capabilities allow network administrators to create generic rules that apply to all members who perform the same function but need to drill down for specific site requirements. For example, access routers at the edge of the network are responsible for classifying traffic, controlling access, and enforcing queuing mechanisms. Gateway and core routers can then be relieved of having to set the priority bits themselves and need only to enforce the queuing policies.

One of the QoS standards for IP networks is the Diff-Serv framework standardized by the IETF. Orchestream supports Diff-Serv by differentiating between the different types of traffic, classifying and marking each data packet accordingly so that each can get to its destination in a timely manner. By aggregating flows into a small number of classes, the software provides each application flow the most appropriate level of bandwidth, while giving the network administrator complete control over the allocation process.

The product also supports many of the QoS mechanisms found on Cisco router platforms, including WFQ, which provides consistent response time to heavy and light network users alike without having to add bandwidth. It is a flow-based queuing algorithm that classifies incoming traffic and then schedules interactive traffic to the top of the queue for priority admission to the network (see Figure 12.2). This improves the response time of interactive applications. Low-volume traffic streams, which comprise the majority of traffic, receive preferential service, allowing the entire offered load to be transmitted in a timely fashion. High-volume traffic streams share the remaining capacity proportionally between them. The remaining bandwidth is fairly shared between other high-bandwidth flows.

Click To expand
Figure 12.2: With WFQ, a router’s incoming traffic is classified and arranged in a queue structure according to its type before being released to the network. In this way, WFQ provides consistent response time to heavy and light network users alike without the addition of more bandwidth.

The Orchestream software also automates security configuration, eliminating the tedious, manual process of creating and deploying access control lists for every router on the network. It accomplishes this through an interface that uses an inheritance-tree model to apply policy to the entire network, a group of network devices, or just one device. For example, selected routers can be easily configured for packet filtering in one step to protect e-commerce and other vulnerable sites from malicious “denial of service” attacks. Rules can be set to activate at specified times of the day, week, or month, or even on demand. In being able to push the relevant QoS configuration information to selected routers, groups of routers, or all the routers in the network, Orchestream is scalable enough for both small enterprise networks and global IP infrastructures.

With the ability to configure security as well as assure service levels for applications, network administrators do not need separate tools to control the same network devices, which can have uncertain results. By integrating security and service-level management capabilities into one product, Orchestream eliminates the risk of conflicting configurations and gives the network administrator centralized control over these important functions.

Network administrators can use policy rules to extend or restrict network access. This is of increasing importance for companies that want to set up a shared extranet to make parts of their network open to suppliers, customers, trading partners, and other external constituents. Orchestream provides this functionality within the same interface as its QoS control features.

Orchestream is fairly easy to deploy on a company’s existing IP network, without-forcing a major upgrade to network hardware or software. The product ships with device drivers for Cisco, Lucent, and Nortel devices. A software development kit (SDK) is also available so customers and third parties can write device drivers for other network products.

Manual configuration of IP services can take several hours and incorporate human error. With Orchestream, implementations can be checked for faults and services changed dynamically from a single point in a matter of minutes. This intelligent activation reduces errors and saves time spent in configuring IP services.

Orchestream also supports the common open policy system (COPS), a protocol standard issued by the IETF for communicating QoS policy information to network devices. Essentially, COPS is a simple query-and-response protocol that can be used to exchange policy information between a policy server and its clients. Among other things, this allows routers and switches to signal their bandwidth requirements to a policy server or bandwidth broker. The advantage of COPS support comes from the ability, from a single point on the network, to define end-to-end policies and services that apply across a broad base of routers and switches. Thus, COPS allows for the creation of true multi-service networks by providing the tools to look at the network as a single policy system.

A potential hidden cost of implementing Orchestream comes from its support of Diff-Serv, which the product relies on for assigning a class of service to different types of network traffic. However, since Diff-Serv enforces most policies at the edge of the network, where older routers are most likely to reside, these routers may not be equipped to take on the increased processing burden and still handle peak traffic loads. This means network administrators will have to take stock of their edge equipment to ascertain the need for upgrades before implementing Orchestream or any competitive product that relies on Diff-Serv.

Most policy-based NMSs do not include all the functionality an enterprise really needs. To overcome this limitation, Orchestream supports links with other network management products through an integration module. Among the thirdparty functions that can be integrated with Orchestream are fault monitoring, performance monitoring, and usage billing. The integration module has been written so Orchestream can link with other management software as customer needs change.

Orchestream Service Activator is sold to enterprises with the QoS module switched on, allowing them to manage the classes and levels of bandwidth within their own networks. Other modules of the product are aimed at service providers who sell managed Internet services such as VPNs and VoIP to enterprise customers. This allows the service provider to meet the differing needs of multiple customers that share its network.


12.6 Hardware Solutions

One of the pioneers in policy-based bandwidth management systems is Packeteer Inc., based in Cupertino, California. The company’s PacketShaper relieves congestion on IP networks, while making performance more predictable for missioncritical applications. The hardware-based system employs TCP rate control to actively manage bandwidth and smooth out bursty IP traffic. While routers claim to do this as well, they rely on queues that introduce unnecessary delay, which can result in packet loss and retransmissions, in turn contributing to end-to-end latency. PacketShaper is available in different models to fit a range of network environments, including corporate and service providers’ data centers, enterprise networks, and remote offices.

Packeteer’s TCP rate control implements precise bits-per-second policies for bandwidth management that shapes bidirectional traffic to improve the performance of applications over the WAN without resorting to queues. This is accomplished by a software engine called PacketWise, which performs application discovery, analysis, control, and reporting. Through PacketWise, the system is able to discover and classify more than 200 distinct traffic types, including Oracle, SQL Server, Citrix applications, TN3270, and Microsoft Windows Terminal Server. It can also differentiate between multiple applications when they all use the same port. For example, HTTP-enabled applications, Web browsing, and subscription update services (sometimes called “pointcasts”) all run on port 80.

PacketShaper overlaps some functions provided by network probes, especially RMON (remote monitoring) probes, which have become very popular diagnostic tools in recent years. However, PacketShaper goes well beyond the intended scope of a probe. While probes are more useful for diagnosing network failures and connectivity problems, PacketShaper provides more useful information about network and application performance. In addition, probes and other network monitoring solutions detect problems but do not offer help solving those problems or preventing future occurrences. PacketShaper offers problem detection, resolution, and prevention.

When a high-speed LAN narrows into a lower-speed WAN access link, the resulting bottleneck causes delay and inconsistent response. The PacketShaper system typically sits behind each WAN link router to analyze and resolve such bottlenecks. The system requires no changes to router configurations, servers, or desktops. A Web browser acts as the user interface, allowing access to PacketShaper from virtually any desktop on the network.

PacketShaper tracks more than 50 separate behavioral variables for each traffic class, offering output in the form of tables, graphs, and reports. If this is not sufficient, network administrators can export the statistics to any reporting tool that accepts a comma-delimited format. In addition, all statistics are stored in a MIB, accessible from any SNMP platform.

With the response-time management capability of PacketShaper, network administrators have a tool to gauge network, server, and total delay for any TCP/IP-based application. Normally, purchased separately, this tool gives network administrators a much closer approximation of what the end user experiences in terms of application response. The data can be used to set and enforce SLAs and immediately allocate bandwidth across the WAN.

PacketShaper’s bandwidth management capabilities also can thwart denial of service attacks on e-commerce Web servers by hackers. This kind of attack floods the available bandwidth with bogus access attempts, thus blocking access to services by legitimate users. PacketShaper’s traffic identification features allow the network administrator to lock onto an excessive traffic stream for detailed analysis. Its control capabilities can then be used to block the flow, thereby shutting down the hacker’s ability to keep up a sustained attack against the Web server.

Diff-Serv might seem to dispense with the need for some of PacketShaper’s key capabilities, since it marks the headers of each packet to indicate relative priority while traversing the WAN. If successful, all WAN equipment will interpret the setting in the same manner, allowing the WAN to prioritize more important traffic. However, Diff-Serv does not discover or classify traffic or handle LAN-to-WAN congestion, as PacketShaper does. At the discretion of the network administrator, PacketShaper can read, set, ignore, and sanitize Diff-Serv settings.

PacketShaper offers a sophisticated set of traffic classification features. It lets network administrators prioritize IP traffic by the usual classifications of IP address, subnet, and TCP or UDP application. The system can also be used to manage non-IP protocols such as IPX, AppleTalk, SNA, DECnet, and NetBIOS. In addition, the network administrator can set characteristics for traffic by URL; for example, specifying that image files be treated differently from text files during Web page downloads, or by estimated speed of the client, by direction, and by options in the IP packet header.

Once the traffic has been classified, PacketShaper offers numerous traffic control-options. The network administrator can guarantee minimum bandwidth with a maximum burst capacity, choose a priority-based approach, or simply discard packets. For incoming HTTP traffic, clients running at various bandwidths can be handled differently, such as redirecting traffic streams that are above or below a given speed to a different server. The network administrator can also decide how to handle a new connection that comes in that cannot be guaranteed its minimum bandwidth: reject it or try to cram it in anyway.

PacketShaper provides network administrators with a mechanism to see what effect constantly changing traffic patterns have on network performance. Packet-Shaper provides a very broad picture of any segment, anywhere on the network. This allows the network administrator to see if huge bursts of activity are occurring on a segment, for example, and what application is causing it, all in real time.

The tool is designed to help network administrators apportion bandwidth to various outgoing traffic types. It can identify what type of traffic users are requesting so bandwidth can be split off just for those applications. For instance, if a site handles large amounts of FTP traffic, that traffic could choke other traffic types by consuming the entire bandwidth of a T1 line as users download files. PacketShaper allows the network administrator to cap the outgoing rate of traffic so e-mail, streaming applications, or other traffic types also get the bandwidth they need.

A possible hidden cost of implementing PacketShaper is that it is a highly complex product and may require technical support to configure properly. To many users, the product may seem to have an overly complex user interface, making it difficult to learn and use. While a network administrator can easily call for specific graphs for a particular traffic class, the whole status of the network cannot be seen at a glance. When the network administrator wants to look at usage data, the console furnishes the information one graph at a time.

Since PacketShaper is a hardware-based bandwidth management solution, a separate box is required at each edge location on the network, with high-traffic locations requiring multiple boxes. This could make large-scale deployments of PacketShaper more expensive than some software-based solutions. However, this may be justified for companies that need the traffic characterization flexibility PacketShaper provides.

PacketShaper is well suited for network administrators who must have the abilityto micromanage packet flow. Understanding the content, performance, and behavior of network traffic leads to better network planning and management. The combination of PacketShaper’s automatic application discovery, responsetime measurements, utilization statistics, and efficiency calculations provide network administrators with the information they need to accomplish these tasks, while giving them the opportunity to improve application performance, reduce retransmissions, optimize bandwidth capacity, and help avoid expensive bandwidth upgrades.


12.7 Service Level Agreements

Bandwidth management solutions are also useful for monitoring the extent to which carriers and service providers meet network performance guarantees, as written into SLAs. These are contracts between service providers and customers that define the services provided, the metrics associated with these services, acceptable and unacceptable performance levels, liabilities on the part of the provider, and what actions are to be taken in specific instances of noncompliance. Carriers and service providers write these documents in language that minimizes exposure to liability. Usually, the extent of liability is limited to credits that are applied to the customer’s next monthly invoice.

AT&T, WorldCom, and Sprint are among the largest carriers that offer guarantees on network performance that include metrics on packet loss and latency for their data services, which include Internet, frame relay, and ATM. SLAs are available for other services as well, from traditional T-carrier services to IPbased VPNs, intranets, and multicompany extranets. Service providers feel compelled to offer written performance guarantees to differentiate their offerings in the increasingly competitive market brought about by the Telecommunication Act of 1996.

SLAs are even becoming popular among ISPs as a means to lure business applications out of the corporate data center to outsourced Web hosting arrangements. To do this successfully requires that the ISP operate a carrier-class data center, offer reliability guarantees, and have the technical expertise to fix any problem, day or night. The SLA may also include penalties for poor performance, such as credits against the monthly invoice if network uptime falls below a certain threshold. Some ISPs even guarantee levels of accessibility for their dial-up remote-access customers.

Service-level management refers to the people, systems, and tools that allow the organization to monitor compliance with the SLA for each type of service.

Sometimes the service provider will make the tools available to the customer in the form of reports that can be accessed on its Web site. Depending on the service, the customer may choose to implement third-party tools that give it independent verification of SLA compliance.

It is not enough to have a clearly defined SLA and voluntary compliance to guarantee the service levels of various applications—there must be enforcement mechanisms in place to ensure the SLA is not violated. Enforcement can be automated with bandwidth management solutions, which are especially useful for IP networks. As more companies move to an intranet model that relies on information sharing and Web navigation, it is becoming necessary to ensure high-quality network services for mission-critical business applications. In addition, today’s IP network applications are both bandwidth intensive and time sensitive. They often require support for voice, video, and multimedia, which eats up scarce bandwidth. Bandwidth management tools ensure that users and applications share this resource appropriately.

The key issue to consider with regard to SLAs is having appropriate tools to monitor the performance of the service provider. There are a variety of performance metrics that require measurement to ascertain whether the carrier is delivering the grade of service promised in the SLA. These metrics differ according to the type of network service. A variety of vendors provide measurement tools, and each uses a different approach to address a narrow range of metrics. In being able to independently measure various performance metrics, however, companies have the means to effectively manage the SLA. This can be done with a bandwidth management system or an add-on module to such tools.

12.7.1 Performance Metrics

The SLAs from carriers and service providers define such performance metrics as latency, packet loss, and availability. These metrics are especially useful for describing the performance of packet services and comparing the offerings of different service providers.

Latency

This metric refers to the round-trip delay between the time a request packet is sent to a destination and the time a response packet is received. Latency is reported in milliseconds (ms). Carriers constantly measure the latency (speed) of core areas of their network using data collected by pings via the ICMP. Data is collected from designated routers in key network hubs worldwide, usually in 5-minute intervals. Monthly latency statistics are derived from averaging all samples from the previous month. Targets vary by carrier, but 65 ms or less for regional round trips within Europe and North America is considered very good performance.

Packet Loss

This is a measure of packets sent to a destination that do not elicit corresponding return packets. Packet loss is reported as a percentage of total packets sent. This should be a very low figure, such as 0.016. Instead of packet loss, some carriers use the metric packet delivery, which is also expressed as a percentage. For regional round-trip traffic within Europe and North America, for example, an SLA might promise a packet delivery rate of 99% or greater.

Availability

This metric is a measure of network uptime, or the time the network is actively handling customer traffic. Availability is reported as a percentage of the total uptime. For example, 99.999% uptime, often referred to as “five nines,” is viewed as the highest availability rate that can realistically be achieved. It translates to less than 5 consecutive minutes of downtime per year. A guarantee of 99.99%—“four nines”—availability ensures no more than 5 consecutive minutes of outage per month. The guarantee of 99.9%—“three nines”—availability means that there will be no more than 45 consecutive minutes of outage per month.

SLAs usually spell out conditions that do not qualify as “unavailability,” such as downtime resulting from network maintenance, circuits provided by other carriers, acts or omissions of the customer, or “acts of God,” such as civil disorder, natural cataclysm, or other occurrences beyond the reasonable control of the service provider.

Some carriers and service providers include additional metrics in their SLAs, such as provisioning time and restoration time.

  • Provisioning time. This metric refers to the agreed upon due date of a circuit. If the due date is missed, the recurring charge for that circuit may be waived for one month, for example. This applies to ATM or frame relay PVCs as well.

  • Restoration time. This metric refers to how quickly the carrier or service provider can return a circuit to full operation after a service-affecting outage. If a customer reports a frame relay service outage (even if the problem is with local access), for example, and it is not restored in 4 hours, as stipulated within the SLA, recurring charges for the affected ports and PVCs may be waived for 1 month.

12.7.2 SLA Compliance

This should not stop companies from preferring to do business with carriers and service providers that approach their SLAs proactively. After all, customers appreciate confirmation that the carrier or service provider is aware of the problem and that steps are being taken to achieve a prompt resolution. To maintain positive relations with their customers, most carriers and service providers understand the value of proactive network monitoring, which entails continuous surveillance to determine the potential of problems to arise so that steps can be taken to prevent their occurrence. Unfortunately, many carriers and service providers, such as smaller competitive local exchange carriers (CLECs) and ISPs, cannot afford the tools for proactive network monitoring and do not have the mechanisms in place to warn their customers of possible service-affecting events in a timely fashion.

Although SLAs exact financial penalties when network performance does not meet expectations, it is important to remember that they do not indemnify the organization for lost business. Particularly, such guarantees do not help much if the organization’s network were to go down for an extended period of time, as was demonstrated in April 1998 when AT&T’s frame relay network went down for 26 hours and in August 1999 when WorldCom’s frame relay network went out of service for 10 days. Both carriers tried to smooth things over with customers—AT&T by waiving frame relay service charges until it could be sure the problem would never reoccur and WorldCom by doubling the credits to 20 days to compensate users for the network outage. In both cases, many customers were left to fend for themselves in dealing with lost revenues and business opportunities, unless they had the foresight to have backup services like ISDN in place.

With regard to Internet performance, several reporting services are available on the Web, which periodically rank service providers according to various metrics. These services are not intended as SLA enforcement tools, but only to narrow down the choice of carrier or service provider. One reason why they cannot be used for SLA enforcement is that the measurements represent an “outside-in” view of a third-party and not the “inside” view of a customer. Thus, the rating service may show a carrier or service provider’s latency to be greater than 60 ms, while its SLA guarantees a latency under 60 ms.

Furthermore, ranking by monthly latency shows which providers offer the fastest-service but may not take into account the consistency of this performance. For businesses that depend heavily on Internet access, it will not matter how fast the service is if it is not available. This is why ranking service providers by “ reachability” or “packet loss” is a better methodology for corporate decision-making.


12.8 Conclusion

Business-critical applications often struggle to compete with less important traffic for the finite amount of bandwidth available on corporate networks, especially across WANs. The result is that end-user response times can fall below acceptable levels, which decreases productivity. If this condition persists, business processes and revenues may be impacted. This has led to the availability of policy-based network management tools from a variety of vendors. QoS policies can be defined once and deployed with a single command to routers, switches, traffic shapers, network interface cards, and even application servers.

Policy-based QoS management tools make it easier to configure and control network resources to accommodate network changes and new applications. For example, a business may want to ensure that its month-end financial statements are produced on time. To improve the response time of the financial applications around these business deadlines, a policy can be configured and deployed to assign the highest priority to this application’s traffic during the last few days of the month. When the deadline is met, the policy can return network resources to other applications as they were originally set up. The result is that all applications are served in an appropriate manner without the company having to spend for more bandwidth in a futile effort to stay ahead of the performance curve.

SLAs on packet services can ensure adequate levels of performance. SLAs offer service guarantees and credits to customers if various performance metrics are not sustained. In some cases, the customer need not even report the problem and provide documentation to support its claim. The carrier or ISP will report the problem to the customer and automatically apply appropriate credits to the invoice, as stipulated in the SLA. As noted, however, not all carriers and ISPs follow this practice, preferring instead to put the burden on customers to report incidents that violate the SLA. This means that the customer must have appropriate tools to monitor performance metrics with the idea of enforcing compliance and documenting the results. These tasks are also performed by bandwidth management systems or add-on modules to these systems.


Chapter 13: Managing Network Security

13.1 Introduction

The rise in Internet attacks and growing awareness of network vulnerabilities has enterprises taking security more seriously than ever before. While access to distributed data networks and Internet resources improves productivity by making information, applications, messaging, and collaboration tools readily available to employees, customers, and partners, it also makes the enterprise more vulnerable to attack by hackers intent on information theft, malicious file tampering, and service denial—all of which can result in harmful publicity, lawsuits, financial loss and, in the long term, damage to competitive position if security precautions are not taken. To determine what vulnerabilities the enterprise faces, a threat assessment should be performed so that effective security measures can be taken.


13.2 Threat Assessment

Threat assessment begins with the assumption of a potentially hostile environment, where intruders are passively or actively trying to breach network security. Passive intruders may browse through sensitive data files, monitor private conversations, or intercept e-mail messages. Active intruders, on the other hand, are malicious and seek to destroy information, deny others access to network resources, and introduce false data or unauthenticated messages onto the network. This type of intruder may even seek to destroy programs and applications by introducing viruses or worms into the network.

To determine the threat level faced by the enterprise, the IT department must conduct a comprehensive vulnerability analysis, starting with a port scan of all network resources. A port is simply a place where information goes into and out of a device on the network, like a router or computer. Left unguarded, a port is a door through which a hacker can enter and, from there, gain access to other resources on the corporate network.

After submitting the network to a battery of tests, sometimes using hacker tools, the findings are displayed in summary and detail form. Depending on the tool used, each discovered vulnerability can be assigned a score, indicating the level of risk. Reports can be prioritized so that all of the highest-level risks appear at the top. This prioritization allows IT staff to start implementing security measures so that the most serious and glaring holes are closed first, denying hackers easy access to the corporate network.

If a firewall is in use, these threat-assessment reports can be used to provide useful information for updating security policies. The recommendations are codified in the form of rule sets that are loaded into a firewall so that it can monitor for specific threats. If a firewall is not in use on the corporate network, the threat assessment findings may provide ample justification for implementing one. The company can add firewall capabilities by upgrading its routers, purchasing a standalone security appliance, or outsourcing security management to a service provider for a monthly fee.

Since most security breaches originate from within the organization, the best security systems will be useless if there are no means to protect against an insider attack. Therefore, threat assessment must include a thorough examination of the work environment.


13.3 Securing the Workplace

Securing the work environment starts with addressing building access and taking such obvious precautions as locking doors to sensitive areas, including wiring closets, restricting access to the data center, and having employees go through a checkpoint when entering and leaving the building. All unattended areas should be watched with video cameras. Elevators should require smart-card access to other floors, and access to office areas on different floors should require the same card. The smart-card should have the employee’s photo, and all employees should be required to wear it while in the building and even challenge those who are not wearing one. These precautions not only protect employees from physical harm and theft of personal property by intruders, they discourage employee theft of computers and other assets, as well as attempts by employees to enter unauthorized areas.

Risk can be further reduced by issuing badges to visitors, providing visitor escorts to their meeting location within the building, and having a security guard stationed in the lobby. The presence of a guard not only discourages intruders from entering the building to do mischief, it discourages employees from walking out the door with company property or sensitive information. Even the possibility of being challenged goes a long way toward dissuading violations of corporate security policies.

Securing the work environment requires the cooperation of management and staff. For example, employees who work near unprotected workstations should take note of authorized operators and their usual work shifts. However, such simple measures as keyboard and disk-drive locks, forced log-on after a period of inactivity, and biometric controls are even more effective in deterring unauthorized access to unattended workstations. In addition, locking down workstations to desks can help protect against equipment theft. These are important security features, especially since some workstations provide management access to wiring hubs, LAN servers, switches, routers, and other network access points.

Network administrators should also implement controls that prevent tampering-with the wires or cables linking the workstations to the network. In addition to examining the obvious wires linking telephones and data processing equipment, administrators should examine conduits, wiring closets, and patch panels where telephone and data wires traverse other floors in the building. A basement may have a wire room where all of the wires in a building terminate. Administrators should keep unattended wire rooms and closets locked and monitor any installation work that must be performed.

An open wiring closet, for example, might let an intruder plug in a wireless access point to an Ethernet hub, giving that person easy access to the corporate network from out in the parking lot. Since the wireless access point and hub are behind the firewall, this type of network intrusion might go undiscovered for months. Planting the wireless access point can also be carried out by non-employees who have easy access to the building, such as maintenance people, outside cleaning firms, and vendors who might be persuaded by “competitive intelligence” gatherers to install such devices. This scenario makes securing the workplace from inside threats just as important as securing the network from outside threats.

Implementing an asset management system is a form of protection that helps guard against employee theft, fraud, waste, and abuse. Among other things, these tools provide the means to inventory the network. A central repository stores such information as equipment serial numbers, hard-disk configurations, and memory utilization. They track changes in hardware and software configurations and update the database in terms of move, add, and other changes. They also monitor software usage, manage software licenses, handle software distribution, and implement security features.

The failure to implement an asset management program can actually encourage theft or “asset shrinkage.” If employees know that assets are not accounted for and that they will not be held accountable for lost or stolen equipment, they are more inclined to carelessness when entrusted with company assets. Although all companies are potentially vulnerable to employee theft, those with no way to track assets generally suffer greater losses than companies that can track assets.


13.4 Securing the Network

To thwart intrusion attempts from the public network, a number of mechanisms can be employed to provide multiple levels of security.

13.4.1 User Names and Passwords

The security features of a network operating system are the first line of defense. Usually this entails the user having to enter a logon ID and password to access the network. Most passwords identify the user and associate the user with a specific workstation and perhaps a designated shift, workgroup, or department. However, reliance on these mechanisms has drawbacks; chief among them is that users are notorious for their seeming inability to maintain password confidentiality.

Passwords should have a minimum of six or seven characters—anything less and they can be too easily broken by brute-force guessing. Worth noting is that plaintext passwords are especially vulnerable on LANs, since each guess increases the chance of unauthorized entry by a factor of 1 × N, where N equals the number of passwords on the LAN. To decrease the chances of a good guess, users should not be allowed to make up their own passwords. Random password generators can be used for this purpose. A user ID should be suspended after a certain number of passwords have been entered, further reducing the chance of a trial-and-error procedure accessing the operating system. In addition, changing passwords frequently can help to enforce tight security. If users are allowed to choose their own passwords, the selected passwords should be filtered through a dictionary to eliminate guessable words from being used, to eliminate already-used passwords, and to make sure the passwords meet minimum length requirements. When passwords expire, users should be prevented from using any expired passwords as the new password.

There are two systems of password protection that companies can employ to maintain security: hierarchical or specific. Using hierarchical passwords, users can employ a defined password to gain access to a designated security level, as well as all lower levels. With specific passwords, on the other hand, users can access only the intended level and not the others above or below. Although specific-level passwords offer more security, they require that a senior, trusted employee have many passwords in order to work with the many databases and associated levels used throughout the day. Password levels, especially specific levels, also complicate the task of security administration.

Once an administrator implements a particular password security method, he or she should ensure that the connected workstations play an active role in supporting password usage. For example, as a user enters the characters of the password, the monitor screen should automatically blank out all key entries to minimize the risk of exposing the password to casual observers. Administrators can also install password routines that do not display any information on the screen or that sound an audible alarm while locking the keyboard after a specified number of failed entry attempts.

Administrators also should periodically survey the password master file, change or retire any infrequently used passwords, keep the updated file on removable disk, and store it in a secure area. Risks should be reassessed whenever a breach of security occurs or is even suspected. In addition, when personnel leave the company, their user ID and password should be rendered inoperable. In the case of corporate layoffs, where hundreds or even thousands of people leave the company at once, some preplanning is necessary to ensure that corporate resources are protected. Such events constitute a window of vulnerability that may require close monitoring of the network to detect potential intrusions that may masquerade as normal activity.

13.4.2 Single-Point Logon

Distributed systems enable processing, data, and applications to be shared throughout the organization for the benefit of all users. However, the security features of a network should not impose limitations on the ability of users and network administrators to do their jobs. A capability called single-point logon or sign-on enhances network security by simplifying access, regardless of the user’s location. Using the same user ID and password, single-point logon provides controlled access to applications and services residing on a local disk or file server, as well as to host-based applications, anywhere on the network. A desktop window provides the user with a set of icons that invoke access to enterprise applications and services. The single-point logon software does the work of controlling and managing all of the procedures that are required to access and execute the applications, regardless of their location on the network. In addition to user IDs and passwords, the software provides emulator selection, network navigation, and application subsystem selection. All of this takes place automatically and transparently, while ensuring security.

The single-point logon software permits the storage of remote logon information and passwords in encrypted form, so that even the administrator does not know user passwords. The administrator can also establish customized password-aging policies of any length of time, setting up passwords to expire in a day—or to never expire. The administrator can control access to only the enterprise applications and services that are authorized for each user. When the administrator adds a service or application for a group, all users in that group have instant access to it. This ensures the administrator’s ability to consistently provide the information that end users need while preventing inappropriate access to information that should remain secure.

13.4.3 Key and Card Systems

Among the simplest security systems are those that require users to insert a key in a lock in order to turn on the computer. Some vendors also market external hard disks, keyboards, and modem switches that incorporate key locks. With lock-and-key systems, however, intruders can pick the lock or duplicate the keys. To help minimize this possibility, the network administrator should keep keys in a secure cabinet where they can be checked out and their use can be monitored.

Alternatively, magnetic card-reading systems can be used to control access to workstations. Card systems offer more flexibility than simple key systems in that they allow users to access data from any available workstation they are authorized to access simply by inserting a card into a reader attached to the workstation; most banking automatic teller machines (ATMs) use this type of security, combined with a system of user IDs and passwords. This card-key system allows access-level definition for each user, rather than for each workstation. If users take the cards out of the building, the cards should not contain a company logo, street address, or anything that could identify the company. A simple printed statement as to where to mail the card if it is found by someone is sufficient. Administrators should reserve a box at a commercial mail drop for this purpose, listing it under a fictitious person to maintain complete security.

Although cards with magnetic stripes are the most popular, other types, such as barcode, plastic, and proximity cards, are also available. Some companies favor plastic cards with embedded magnetic stripes containing authentication information, which can provide for employee-entrance control as well as workstation control. Cards encoded with barcodes for optical readers can also be used, but this type can be relatively easy to duplicate. Proximity cards, which can be read by radio frequency at distances of a few inches to 10 feet, may be unsuitable for offices in which the workstations may be too close together. Administrators should not issue the same card for both workstation identification and access to other areas of the company. The workstation deserves a higher level of security and a closer control of card distribution than company-access cards.

Network administrators can also consider so-called “smart” cards as possible security alternatives. These devices, which contain embedded microprocessors, can accommodate a range of security tasks, such as performing on-line encryption, recording a time-on/time-off log, and providing password and biometric identification. Such devices offer a feasible security option for local and remote access control.

Some smart keys can provide very complex security solutions. For example, one of these products, used in conjunction with system software that generates a flashing pattern on a monitor, optically scans the pattern. The key device interprets the coded pattern and displays a remote access code on its LCD. The user can then enter the code on a keyboard. This new generation of handheld smart security systems offers a wide variety of options, including cards (with synchronized host software) that internally generate new access codes every minute and devices that optically read user fingerprints to permit system entry. Most of these devices target organizations requiring a high degree of information security.

13.4.4 Biometrics

The one drawback with both key and card systems is that access control can, willingly or unwillingly, transfer to someone other than the authorized user. Biometric devices, on the other hand, use an individual’s unique physical attributes for identification, thereby providing a higher level of security. These devices can identify an individual based on characteristics that cannot be duplicated or forged, such as a fingerprint, voice quality, or pattern of capillary blood vessels in the retina of the eye.

Fingerprint recognition is the most developed of the biometric technologies for mainstream use. Some fingerprint scanners can be added to desktop computers via a universal serial bus (USB) connection, and more computer makers are offering notebook computers with built-in fingerprint scanners. There are even fingerprint scanners that are integrated into a standard two-button mouse. The functionality of these scanners is continually being expanded. Users can program in several or all of their fingerprints, for example, so that if one finger or hand is injured, or one fingerprint is especially hard to read, the user can switch to alternate fingers. Multiple users can have their fingerprints read as well, providing shared access to the computer.

One fingerprint reader, the FIU-710 from Sony (see Figure 13.1), connects to the client via a USB cable and scans the fingerprint by means of measuring the difference in capacitance between the ridges and valleys of the fingerprint and the sensor itself. But the device is not just a fingerprint reader; it supports other authentication methods as well. The device can securely generate and store up to 1,024-bit RSA keys and perform 56-bit data encryption standard (DES) and 3DES encryption (see Section 13.5.2), allowing it to substitute as a smart card for many applications, particularly those involving digital certificates (see Figure 13.2).

Click To expand
Figure 13.1: The Sony FIU-710 connects to the client via a USB cable and processes, encrypts, and stores fingerprint templates internally rather than in a server or desktop database. If the unit is disconnected from the computer, access is denied.
Click To expand
Figure 13.2: The role of the FIU-710 in the authentication process using a digital certificate.

Unlike the smart card, however, the FIU-710 does not really need a personal identification number (PIN) to unlock itself, since the user’s fingerprint serves this purpose. This allows a user to have the benefits of two-factor authentication and public-key technology and securely access public-key-based applications from any computer with a USB port, without having to deploy physical smart card readers on every machine. Users activate their public-key pair and certificate data with their fingerprint and do not have to rely on a possibly forgotten password or PIN. For additional security, the scanner can be set up to require a PIN or password instead of, or in addition to, the fingerprint, providing three-factor authentication.

To use fingerprint scanners, users must go through an enrollment process that registers fingerprints in the units’ database so it will have something to compare against. During enrollment, the computer records the characteristic bends and endpoints of fingerprint ridges. This process is repeated several times to verify the consistency of the results before the system will accept the user’s biometric profile.

To log in, the user’s fingerprint is scanned and the system compares the new scan with the stored image. If the right number of fingerprint details match, access to the computer is granted. At this writing, however, fingerprint scanning is not 100% reliable. For some people, getting the scanner to accept their fingerprint is like struggling to feed a dollar bill into a vending machine again and again—sometimes it is accepted, other times it is not. With practice and patience, users can train themselves to present their finger more consistently, thus minimizing the number of access failures. As a backup, these systems let the user enter a password or PIN to get in.

Another biometric security technique operates by sensing the user’s habitual typing rhythms. To log onto the network using this type of security system, the user types a brief sentence that has previously been recorded in workstation memory, creating an identification pattern that is extremely difficult to forge. This method provides a cost-effective means of user identification because it does not require additional hardware and it is sufficiently transparent that users do not have to learn a new technique, yet secure enough to deter an intruder from invading the network by guessing a password.

13.4.5 Disk and Drive Controls

LAN security is weakest at the desktop, not only because password confidentiality tends to be weak, permitting unauthorized access, but because removable disks make stored data vulnerable to theft. To avoid theft and unauthorized copying of removable disks, data cartridges, and portable hard drives, administrators should keep them in a locked cabinet and store critical disks, such as backup copies of sensitive files, in the corporate safe or in another secure location within the data center. Users should create backup copies of sensitive files at weekly or daily intervals to provide a reliable source of archived data for restoration in the event of system disaster.

Creating backup copies of data also helps to prevent the spread of worms and viruses. In this way, if an infected disk does contaminate network resources, multiple backup copies dating back to a time before the virus infection occurred are available to restore the affected files, application programs, databases, and operating systems. Some network operating systems like Windows XP make this unnecessary; a rollback capability lets the user return to an earlier problem-free configuration.

A removable hard disk is ideal for transferring large files between machines, for archiving and backup tasks, and for use as a secondary storage device. Some removable drives are entirely self-contained, while others use removable cartridges that contain only the disk itself. Removable cartridges are best for applications in which security and long-term portability are the most important considerations.

Disk-locking programs are also available to prevent program disks from operating properly if copied or used with an unauthorized host computer. Administrators can protect data disks and files with passwords or modify them so that they allow access to data only when used with a specific program disk.

Another method of securing workstations is to use “diskless” workstations. A diskless workstation relies entirely on the network server for boot-up, address assignment, applications, and data storage, thereby eliminating the need for local disks. These workstations offer several potential benefits from a security standpoint. For example, since diskless workstations do not contain disk drives, they eliminate the possibility of disk theft, unauthorized copying, or concealing information downloaded from the host computer. The absence of disk drives also lessens the risk of introducing a virus into the network through infected input disks.

In the final analysis, the type of disk storage facility required depends on the duties of each workstation user. Therefore, a variety of safeguards should be in place to accommodate the differing needs of users.


13.5 Data Encryption

Data encryption, once the exclusive concern of the defense community and financial institutions, is now a widely deployed tool, especially as more enterprise applications have migrated to the global Internet and wireless networks. But encryption is also widely used to protect databases. In the encryption process, the data is manipulated in such a way as to make it unintelligible to all but the designated recipient on a network or user of a database. If the encryption key is 128 bits or higher, even the most technically savvy hacker will not be able to make sense of the data easily.

Initially a complicated and difficult-to-use tool, encryption is now easy to set up by system administrators and users through a GUI. It runs as a background process and, in many cases, users may not even know it is there. This transparency has spurred new interest among large enterprises and small companies alike to use data encryption as a means to protect sensitive information that is accessible through their networks.

Data encryption, a method of scrambling information to disguise its original meaning, provides an effective and practical means of protecting information transmitted over dispersed communications networks. Since intruders cannot read encrypted data, the information is not vulnerable to passive or active attack. When implemented along with error detection and correction, encryption offers a highly effective and inexpensive way to secure a communications link. For example, file encryption with decryption at the user workstation adds security to both the file server and the transmission medium. The decryption key can be a string of characters known only to the user. The data are secure from other workstations, illegal taps, and interception of spurious electromagnetic radiation.

Either the hardware or software can perform encryption, but hardware-based encryption provides more speed and security, since an intruder who is skilled in programming will not usually be able to interfere with the encryption hardware.

Online encryption requires installation of encryption and decryption units at both ends of the communications link.

Cryptographic methods involve the use of an encryption key, which is a string of characters used in conjunction with an algorithm to scramble and unscramble messages. Cryptographic methods are designed so that even if intruders know the algorithm (a mathematical formula stored in electronic circuitry), they will not be able to decode the scrambled information unless they also have the specific encryption key. The more characters the key contains, the more difficulty an intruder will encounter when attempting to breach security. The strength of a cryptographic system lies in the quality and secrecy of the keys selected.

13.5.1 Symmetric Versus Asymmetric

Encryption systems are either symmetric or asymmetric. Symmetric crypto systems use the same key (the secret key) to encrypt and decrypt a message, while asymmetric crypto systems use one key (the public key) to encrypt a message and a different key (the private key) to decrypt it. Asymmetric crypto systems are also called public key crypto systems. Symmetric crypto systems have a problem: How can the secret key safely be transported from the sender to the recipient? If the secret key could be sent securely, there would be no need for the symmetric crypto system in the first place because the same secure channel could be used to send messages. Bonded couriers are used as a solution to this problem.

Another, more efficient and reliable solution is a public key crypto system. Such systems use a two-part key structure to eliminate the problem of sharing a single encryption/decryption key. This technology permits users to encode data files with a public key that is associated with a specific user. The public key can encrypt, but not decrypt, a file. A private key, associated with each set of public keys, enables users to decrypt files that have been encrypted using this technique. The key used to decrypt a file is associated with, and available to, only a single user; this minimizes the likelihood of a key being copied or discovered by unauthorized users. Furthermore, because the decryption key is valid for only one user, it cannot be used to decrypt files intended for a different user. There is no need to keep the public keys secret or to risk compromising private keys by transmitting them between various users.

13.5.2 Digital Encryption Standard

One of the most thoroughly tested cryptographic algorithms available is the DES, developed by IBM and adopted in 1977 as a federal standard by the U.S. National Bureau of Standards, now known as the National Institute of Standards and Technology (NIST), a unit of the Department of Commerce. DES is one of the most important cryptographic algorithms because it—and its successor, 3DES—is the basis for hundreds of security products in widespread use today.

DES-based encryption software uses an algorithm that encodes 64-bit blocks of data and uses a 56-bit key; the length of the key imposes a difficult decoding barrier to would-be intruders because 72 quadrillion (72,000,000,000,000,000) keys are possible. The DES offers four different encryption modes. Direct mode is the easiest to implement but provides the least security because it allows independent coding of each of the blocks of a message. Independently coded blocks can develop coding patterns in lengthy transmissions; such patterns can make the encryption technique vulnerable to unauthorized access. In the other three modes, coding of each data block varies depending on the coding of one or more previous blocks, reducing the risk of revealing a pattern in encoding that could provide clues to the decryption key.

Despite its 20-year performance of foiling decodes, DES was finally broken in 1998 by the Electronic Frontier Foundation, which managed to break the algorithm in less than 3 days at a cost of less than $250,000. The encryption chip that powered the so-called DES Cracker was capable of processing 88 billion keys per second. In addition, it was shown that for a cost of $1 million, a dedicated hardware device can be built that can search all possible DES keys in about 3.5 hours.

Since 1998, DES has been replaced with 3DES, which is based on the DES algorithm, making it very easy to modify existing software to accommodate the new standard. It also has the advantage of proven reliability and a longer key length that eliminates many of the shortcut attacks that can be used to reduce the amount of time it takes to break DES. Even this more powerful version of DES has a limited life span, due to the increasing processing power of today’s computers to break ever larger keys, and is being replaced by the Advanced Encryption Standard (AES).

In December 2001, NIST announced approval of the AES, which specifies the Rijndael symmetric encryption algorithm developed by two Belgian cryptographers. Experts claim that the algorithm is small, fast, and very hard to crack, estimating that it would take 149 trillion years to crack a single 128-bit AES key using today’s computers. Corporations using 3DES technologies will have to wait until low-cost AES implementations become available before a migration to the new standard makes sense from a price perspective.

13.5.3 Recommendations for Implementing Encryption

Encryption is one of the simplest and least-expensive ways to protect sensitive information. It is most effective when combined with other security methods that restrict access during the network logon process. Applying multiple layers of security disheartens even seasoned hackers, who will be more inclined to look elsewhere for easier pickings.

Implement WEP on Wireless Nets

As noted in Chapter 6, there has been a lot of controversy about the shortcomings of the first iteration of WEP, an encryption scheme for wireless networks operating in the unlicensed 2.4-GHz frequency band. These shortcomings make wireless networks vulnerable to hackers who know how to break the keys. However, WEP is still useful for hardening wireless networks and should not be dismissed entirely because key handling has been improved in newer products. Although many of these improvements are proprietary, they also contribute to security. RSA Security, Inc., the originator of the RC4 algorithm on which WEP is based, has even come up with a WEP fix that entails encrypting every packet with a distinct key, rather than reusing the same key information repeatedly, which makes it vulnerable to hackers. Although this capability represents an important development in security over the original WEP scheme, it should be noted that it is not part of any 802.11 specification at this writing, and its use would require that all users on the network use the same RSA Security, Inc software to realize the benefit of enhanced security.

Safeguard Encryption Keys

It is common to assign encryption keys, which are then stored either on the client’s disk or, in the case of wireless networks, in the memory of the notebook or PDA adapter. Wireless networks are particularly challenging because all the client devices associated with the same wireless access point must use the same encryption key to allow communication between all interconnected devices. If that key is compromised, all devices on that segment could be exposed to an attack or used as a gateway into the corporate network.

If the device is stolen or lost, anyone in possession of the client device has access to the MAC address and encryption key and can use them to gain access to corporate resources. It is virtually impossible for security management personnel to detect a security breach that results from misuse of the MAC address and encryption key until the owner reports it. Then the security scheme must be changed to render the MAC address and encryption key useless. This involves changing the encryption keys on all client devices that use the same keys as the lost or stolen device. The greater the number of devices, the larger the reprogramming task.

To deal with the ramifications of lost or stolen client devices, a more stringent security scheme must be implemented that incorporates device-independent user name and password for authentication. This not only grants users access to the network regardless of the client devices they may be using at any given time, but since they are device-independent, the user name and password are not stored in the device where non-employees can find them.

Use Dynamic Encryption Keys

Instead of assigning static encryption keys, which are typically stored in the client device, keys should be generated dynamically upon successful user authentication. This takes responsibility for key management away from users, who may grow lax about security over time. It also simplifies the job of IT staff charged with the responsibility for key management.

Issue Session Keys

Encryption keys should not only be generated dynamically, they should be good for only as long as the session. When the user logs off and then back onto the network later in the day, a new session key should be issued, giving hackers less time to capture enough data with which to search for patterns that can lead to breaking keys by brute-force methods.

Retire Encryption Keys

In addition, keys should not merely be recycled among different users’ sessions but should be made to expire permanently after a reasonable period. This practice would ensure that employees who leave the organization, for example, cannot use their old keys to indefinitely access corporate resources.

Implement Key Management

Key management should be implemented as well. This refers to the generation, distribution, updating, and revoking of the keys used to encrypt and/or digitally sign information. The trouble with any security system that uses encryption keys is that the keys are susceptible to compromise by hackers, user carelessness, or deliberate disclosure by disgruntled present or former employees. Good key management addresses these issues in a variety of ways, including the following:

  • Changing the keys at specific intervals;

  • Protecting the manner in which keys are distributed—never distribute in clear text via e-mail, for example;

  • Revoking the keys of personnel who have resigned, been laid off, or dismissed even before they turn in their notebook computers or PDAs;

  • Maintaining certificate revocation lists of keys known to be compromised or expired so they will not be accidentally used.

These management practices are important because even if only one copy of a key is found or captured, the entire security system could be compromised.

Automate Key Management Deploy a policy manager to automate key management. Key management, normally a time-consuming chore that requires continuous attention, can be expedited with a policy manager that automates many aspects of key management. The policy manager is an application that helps security administrators implement key management on a global or “policy” basis, rather than on an individual basis, making it as easy to assign or change encryption keys for 10,000 clients as it is for 10 clients.

Select Security Products with Care Vendors are becoming more attuned to the burdens of security management and are equipping their enterprise-level access points with automatic encryption key generation and distribution capabilities. Agere Systems, for example, offers the AP-2000 wireless access point that creates unique RC4 keys on a per-user, per-session basis.

Other vendors like Netlock Technologies offer an authentication step that is used to negotiate encryption keys to unambiguously establish the correctness of the network addresses of the two systems. Because of this, hackers cannot successfully tamper with data packets to impersonate one system when it is sending packets to the other. This not only prevents such attacks, but any packet tampering will be detected by the Netlock Agents and a security alarm will be issued to the management system where it is logged for review by the security administrator.

When evaluating new security products, it is recommended that ease of key management be elevated to a high priority in the purchase decision. The ease of key management can save time and money for IT departments and users by eliminating the need for manual intervention. More importantly, if encryption keys are easy to manage, there will be less chance that this administrative chore will lapse over time due to inattention and be the cause of security breaches down the road.

Use Hacker Tools to Assess Network Vulnerability

Decryption tools for hackers are freely available on the Internet, many with GUIs, instructions for use, and help files. Security administrators should have a collection of these tools on hand and use them periodically against the corporate network to test for vulnerabilities. Awareness of what vulnerabilities exist allows corrective action to be taken. These tools are becoming very sophisticated, and this is one way security administrators can stay a step ahead of the growing hacker population. Tools such as APSniff (see Figure 13.3) allow hackers to see critical network settings in a wireless network, even if WEP has been enabled.

Click To expand
Figure 13.3: Hackers can use a tool like APSniff to discover essential information about wireless access points, which enables them to more easily break into corporate networks.

Test Security with Social Engineering Techniques

Often, corporate employees are the weak link in any security system. There have been cases where employees have been tricked into giving out encryption keys over the phone to hackers posing as IT administrators. The hacker claims to be working on a problem involving the user’s equipment, but to gain access and fix the problem, all he or she needs is the encryption key to see if the problem is affecting data transmission. The request sounds legitimate, and the user is stepped through the process of finding the encryption key stored in the computer or network adapter. Security administrators can use this technique within their own company to determine the need for security training.

Educate Employees

Even the best encryption key management tools can be rendered useless by employees who do not understand security issues and the harm their carelessness can cause to their company. Employees must be made aware of their responsibilities through training sessions. They should not be allowed to reveal passwords, MAC or IP addresses, or encryption keys even to fellow employees—above all, not to anyone over the phone or through e-mail. They also should not be allowed to have hacker tools installed on their computers. This can be readily determined with periodic scans of client software by the asset management application that runs on a server.

Hold Employees Accountable

A security policy should be put in writing and each employee should be required to sign it. Any action that results in a security breach or increases the vulnerability of the network should result in a warning that becomes part of that person’s personnel file. Willful or repeated actions should result in termination of employment.

13.5.4 Encryption Deployment Issues

The advantages of data encryption are clear: protection of messages, documents, files, and databases from unauthorized access. But there are also risks and challenges associated with data encryption, including the increased latency in performance due to encrypt-decrypt processing, which especially affects Internet and wireless connections, and the restricted ability to look inside encrypted packets for routing and switching above Layer 2. Beyond these issues, there are others to be aware of, including the following.

Improper Configuration

Internet appliances and wireless devices must be properly configured for encryption. Although many types of equipment come with default settings from the factory so they can be deployed right out of the box, this equipment must be staged at a central location so default settings can be changed and encryption set up and tested before the devices are sent to their installation locations. Failure to take this precaution can result in a network that is easy prey for hackers.

Weak Encryption Keys

Several encryption schemes use the RC4 stream cipher developed by RSA Security, Inc. But the way some vendors’ products handle the RC4 keys for encrypting the 802.11 wireless Ethernet payloads compromises security. There is nothing wrong with the RC4 algorithm used for encryption; RC4 is the popular algorithm protecting millions of users who access secure Web pages and send data via the SSL protocol. This protocol is secure, and RC4 in SSL has never been broken. However, the way WEP handles the RC4 keys weakens the security of wireless networks. A sequential number that is repeated at specific intervals is used to help produce the RC4 keys. The repeated value allows hackers to compare different encrypted payloads and with enough sample data, the full RC4 key can be derived—all without having to test every possible 40/64- or 128-bit key. In fact, there are now tools readily available on the Internet that permit even novice users to successfully crack WEP keys without having significant skills or equipment.

To improve security, the IEEE is developing the 802.11i standard that will include Wi-Fi protected access (WPA), which, among other things, generates a new key periodically during transmission. While WEP uses fixed keys that are easy to attain via commonly available software such as Netstumbler, WPA uses the Temporal Key Integrity Protocol (TKIP) to generate a new key for every 10-KB of data transmitted over the network.

The way WPA will work in the enterprise environment is similar to the setup of any 802.1X authentication system. The clients and access points must have WPA enabled for encryption to and from an 802.1X-capable authentication server, such as a remote-access dial-in user service (RADIUS) server, with centralized access management. Once the server authenticates the user, the access point will let that user onto the wired network. Up to that point, the client had only talked to the server.

Eventually, AES will be incorporated into the IEEE 802.11 standard to make the encryption key unbreakable. One of the reasons for its delay is that AES requires a hardware upgrade and most users will not be able to take advantage of it with existing equipment.

Potential VPN Vulnerability

VPNs use tunneling protocols that, among other things, encrypt data so it can travel safely through the otherwise insecure public Internet. VPNs can even be extended to the homes of telecommuters so they can have secure access to corporate resources over their cable or DSL connection. But if the telecommuter has set up a wireless network in the home for sharing files, printers, and even the Internet access connection, the RF signals can be picked up by hackers riding by outside, allowing them to gain entry to the corporate network through the VPN. To prevent this from happening, either corporate security staff must get involved in helping telecommuters set up encryption or there must be corporate policy against telecommuters using wireless technology as a condition for being allowed to work out of the home.

Security Among Multiple Companies

It is common today for multiple companies to enter into strategic partnerships where sensitive information must be shared between them. Encryption can be used to safeguard this information, but each company must assure to the others that they take security as seriously as they do. If one party in the relationship is lax about managing encryption keys, for example, this could compromise security for everyone else. One way to demonstrate that security is a high priority is to implement a key management system.

Security Entails Extra Costs

Implementing security measures such as encryption adds to the cost of doing business and, like insurance, is often not appreciated until an emergency arises. However, the cost of such measures as key management solutions must be weighed against the damage that could result if a hacker breaks into the network and steals sensitive information like medical records, credit card numbers, and other types of customer information. The damage can come in many forms, including lawsuits, bad publicity, customer distrust, loss of market share, erosion of investor confidence, and deterioration of partner relationships. Compared to these calamities, the cost of implementing security precautions such as encryption becomes a non-issue.


13.6 Virus Protection

Among the dangers of inadequate network security are the alteration and destruction of valuable records and whole databases by worms and viruses introduced onto the network through unauthorized programs brought into the workplace by unknowing users. Worms and viruses are usually differentiated according to their degree of transferability. A virus, for example, limits its damage to the LAN workstation through which it entered and is transported by external action, such as by disks and software downloads from bulletin boards. Worms are self-replicating and move throughout the network—node to node. Some viruses and worms are timed for activation far into the future, making it even more difficult to track down their source.

Viruses can have a multiplier effect on networks. If a standalone PC gets infected, there is little chance that the virus will spread to other machines, unless handing disks around distributes the virus. If a mainframe gets infected, the damage can be more severe, but there still is only one system to disinfect. But when a virus invades a LAN, the damage can be far-reaching. Disks used to boot servers are a prime cause of LAN infections. Since workstations communicate with the network file server to obtain shared programs and data files, a virus can spread rapidly to every computer that accesses the server.

A virus presents a major threat to security because of the damage it can do to information, especially in distributed processing environments where any one user accesses an array of network resources on a regular basis. Once a virus program has been introduced into a system, it can cause the following problems:

  • Longer than normal program load times;

  • Excessive disk accesses for simple tasks;

  • Unusual system error messages;

  • Disk activity for no apparent reason;

  • Reduced available RAM;

  • Reduced available disk space;

  • Unexplained file or directory disappearances;

  • Changes in executable program size;

  • Changes in appearance of screen icons;

  • Screens that blank out or jitter;

  • Text that dribbles to the bottom of the screen.

To protect against a catastrophic virus attack, network administrators should implement internal barriers between connecting systems. These barriers (e.g., different encryption codes for separate programs or network devices) will not completely insulate a network from a virus attack, but they will restrict damage only to that area of the network where the virus has entered. If a subsystem (e.g., a LAN) is only a “pass through” from a data source to a major interior system, a virus can be detected and blocked from entering the interior system. The technique involves making hash totals at the input and output of the subsystem and matching them. If a virus has intervened, the total will not match and the data will be blocked from passage. Networks that can be accessed by dial-up lines should have a barrier, such as an encryption change, at the second entry port or interface of the access server.

Some anti-virus data security software packages only identify changes being made to files, while others identify and remove viruses and repair the damage the viruses inflict. Boot sector viruses locate themselves on the first sector of a floppy disk, while file viruses invade files, particularly executable files. Sometimes file allocation tables (FATs), files, and directories can be recovered after a virus attack, but anti-virus software can identify and eliminate viruses before the damage occurs. Some packages disinfect files, boot sectors, and memory without harming the infected portions of the system, while others are less sensitive. As yet, no product can guarantee complete protection against a virus attack, and new types of viruses are constantly being discovered.

Once viruses enter the network, they often begin by destroying crucial operating system files. Some virus protection programs can monitor the status of these files by periodically verifying byte count. Other programs can often isolate and detect an abnormal file condition, such as an excess byte count, but cannot resolve the problem. In these cases, companies must enlist the aid of skilled computer analysts and programmers to correct the problem. Since no product can completely secure the network, companies must strike a balance between data accessibility and the level of data protection needed to maintain security. Inevitably, cost will also become a consideration. Unfortunately, the cost of security measures can be difficult to justify, since the benefits of additional security (i.e., reduced exposure to security threats) cannot be predicted or directly measured until an attack actually occurs.


13.7 Firewalls

A firewall is a method of protecting one network from another untrusted network (see Figure 13.4). The actual mechanism whereby this is accomplished varies widely, but in principle, the firewall can be thought of as a pair of mechanisms: one that blocks traffic and the other that permits traffic. Some firewalls place a greater emphasis on blocking traffic, while others emphasize permitting traffic.

Click To expand
Figure 13.4: A firewall protects the enterprise network (trusted) from a variety of attacks emanating from untrusted networks such as the Internet, thereby safeguarding mission-critical resources.

One way firewalls protect networks is through packet filtering, which can be used to restrict access from or to certain machines or sites (see Figure 13.5). It can also be used to limit access based on time of day or day of week, by the number of simultaneous sessions allowed, or by the service host(s), destination host(s), or service type. This kind of firewall protection can be set up on various network routers, communications servers, or front-end processors.

Click To expand
Figure 13.5: Operation of a packet-filtering firewall: (1) inbound/outbound packets are examined for compliance with company-defined security rules; (2) packets found to be in compliance are allowed to pass into the network; (3) packets that are not in compliance are dropped.

Proxies are also used to provide secure outbound communication to the internetwork from the internal network. The firewall software achieves this by appearing to act as the default router to the internal network. However, when packets hit the firewall, the software does not route the packets but immediately starts a dynamic, transparent proxy. The proxy connects to a special intermediate host that actually connects to the desired service (see Figure 13.6).

Click To expand
Figure 13.6: An implementation of a proxy application.

Proxies are often used instead of router-based traffic controls to prevent traffic from passing directly between networks. Many proxies contain extra logging or support for user authentication. Since proxies must “understand” the application protocol being used, they can also implement protocol-specific security. For example, FTP proxy might be configurable to permit incoming FTP traffic and block outgoing FTP traffic.

While firewall operation may look simple, it is quite complex in terms of initial configuration, fine-tuning, and ongoing administration. A firewall vendor might offer help with initial configuration and fine-tuning, but ongoing administration is the responsibility of the buyer. Modifying the attack-detection parameters of a firewall to deal with new threats, for example, takes the knowledge and experience of a certified security engineer (CSE), whereas changing a firewall rule set might require a certified security administrator (CSA).

Since attacks can originate from anywhere at any time around the world, effective-firewall operation requires 24/7 vigilance by expert staff. This means the IT

organization must support three shifts of security personnel, which is expensive, or have someone on-call 24 hours a day, which can delay the response to threat situations. Either way, maintaining security staff is an expensive proposition. In fact, acquiring any level of management expertise is the biggest hidden cost of firewall ownership. The dearth of knowledgeable security personnel and the high salaries they command puts seasoned talent out of reach for many smaller companies. An effective and economical alternative, however, is a managed firewall solution that allows small and medium-size firms to implement best-of-breed security solutions at a fixed monthly cost and without the hassles of recruiting and retaining quality staff. These types of services could cost less than the equivalent salary of a half-time firewall administrator.

For effective security, a firewall solution will be required at each corporate location, including branch offices and the homes of telecommuters. Firewalls also protect the integrity of VPNs and multi-company extranets. In addition to regulating traffic flow between public and private network environments, firewalls can be used to regulate traffic to and from internal company networks, such as the subnets of human resource, marketing, and legal departments.

A managed firewall service consists of hardware, software, consulting, monitoring, and management tools that continuously scan and analyze the vulnerability of an organization’s Internet-connected systems. Firewall management usually must be ordered in conjunction with the provider’s Internet services, including those provisioned over ATM, frame relay, DSL, and integrated service offerings that combine voice and Internet services over the same access bandwidth. Assuming that the Internet service is already in place, a managed firewall solution can be up and running in 10 business days or less.

To configure a managed firewall appropriately, the service provider performs a comprehensive vulnerability analysis, starting with a port scan of the customer’s network resources. A port is simply a place where information goes into and out of a device on the network, like a router or computer. Left unguarded, a port is a door through which a hacker can enter and, from there, gain access to other resources on the corporate network. After submitting the network to a battery of tests, sometimes using so-called hacker tools, the managed firewall service provider will present the customer with recommendations for fixing problems that have been identified. The recommendations will be codified in the form of rule sets that will be loaded into a firewall.

The firewall itself can be physically located at the company’s location or the service provider’s location. Regardless of location, the firewall will make decisions about what traffic to pass based on instructions contained in the rule set. Access control rules can be defined according to the source and destination of network traffic, specific applications, users or groups of users, and even time of day. If incoming traffic contains an executable file that has the signature of a known virus, for example, that traffic will not be allowed to pass beyond the firewall onto the corporate network, where it can do harm when opened. The content security capabilities of the firewall can even spot suspicious Java applets and ActiveX controls, weed out undesirable Web content, and put limits on the size of files that are allowed onto the corporate network.

The service provider designs a firewall rule set in collaboration with the IT manager, and there is usually a trial period to allow for minor changes to the rule set at no charge. During this period, which can last as long as 14 days, real-world testing is performed and minor adjustments of the new firewall rule set are made, if necessary. Generally, customers may make unlimited changes during the trial period. After that, the service provider bills for further changes on a time-and-materials basis.

As new threats become known, the managed firewall service provider will take the appropriate course of action, which might entail adding a rule to the rule set or changing an existing port configuration on the firewall to thwart persistent access attempts. The changes are implemented remotely from the service provider’s network security operations center (NSOC) over an encrypted Internet connection. If the customer’s dedicated access connection is not available, perhaps due to an out-of-service transmission line or malfunctioning router, the service provider will use a dial-up connection to a modem attached to the firewall to upload the changes.

As an added precaution, the managed firewall service provider should take responsibility for maintaining backup copies of the customer’s rule sets for locations, along with all the firewall passwords. A copy of the most recent router configuration might be kept as well, since this information is usually needed to reconfigure the firewall or router in case of a major system failure. It should take no more than 4 hours for the service provider to fully restore a firewall rule set and associated configuration files, assuming the dedicated connection is available or a dial-up modem link can be established.

The managed firewall service provider will usually be able to generate performance reports that can be accessed by the customer on a secure Web site using a browser that supports 128-bit key encryption. By entering a user name and password, the customer can view high-level charts and graphs that summarize the quality of network and application resources. Comparative performance data on specific network resources and groups of resources should also be available.

Companies with branch offices, telecommuters, and mobile professionals should choose a service provider that can offer a range of security solutions, as well as connectivity services to suit the organization’s various needs. A low-end firewall solution that protects corporate information stored on a telecommuter’s PC, for example, might consist of firewall software loaded and configured in a DSL/cable router (see Figure 13.7). Since DSL and cable connections are always on, hackers can come in through the Internet and tamper with the personal data on the home computer, as well as any corporate information it may hold. There is even the very real threat of hackers using the telecommuter’s connection to launch an attack on the employee’s company.

Click To expand
Figure 13.7: Firewall software for individual computers allows users to control their own level of security. Shown is ZoneAlarm from Zone Labs, which is available for download at the company’s Web site.

For companies with an installed base of Cisco routers, the provider may offer a combined firewall-router service that entails configuring the operating system’s security features. For enterprise-level security, the choice might include Check Point Firewall 1. If separate devices provide firewall and router functionality, it might be preferable from a management standpoint to have both devices monitored by the same service provider. Firewall implementation is not as simple as “set and forget.” To maintain the highest degree of protection, security policy must be continually evaluated against the latest threats. For small and midsize companies, the value of a managed firewall service is in having an expert partner that will stay abreast of the latest developments and implement effective countermeasures to prevent unauthorized access to the organization’s valuable network resources.

It is important to choose a service provider that will maintain contact with various-network security watch groups, such as the Computer Emergency Response Team (CERT) Coordination Center and the National Infrastructure Protection Center (NIPC), to stay abreast of the latest security problems reported by the user community and the remedies proposed by the vendor community. This information helps the managed firewall service provider deal effectively with new types of security threats and become familiar with the associated attack profiles so the customer’s firewall policies can be updated in an appropriate and timely manner.


13.8 Intrusion Detection Systems

Intrusion detection systems are real-time tools that monitor for suspicious or unauthorized activity on all major operating systems, Web servers, firewalls, routers, applications, and databases. This tool instantly takes action to alert the security administrator, shuts down systems, terminates offending sessions, executes commands and takes other actions to stop attacks in progress before critical systems can be damaged or sensitive information can be compromised.

Hackers use port scanning tools such as Insecure.org’s Network Mapper (see Figure 13.8) that probe for a target network’s vulnerabilities. Designed to rapidly scan large networks, Network Mapper uses raw IP packets to determine what hosts are available on the network, what services (ports) they are offering, what OS (and OS version) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

Click To expand
Figure 13.8: Network Mapper is an open-source utility developed by Insecure for network exploration or security auditing.

The hacker checks for every possible piece of network software on a server, for example. If the hacker detects the presence of active software, he or she tries to find out more information about the computer. The hacker then tries to exploit that port further until he or she can enter the network at will. An intrusion detection system monitors all ports for this kind of scanning activity and raises alarms if suspicious activity is found. Some intrusion detection systems automatically shut down the vulnerable port when a scan is detected.


13.9 Remote Access Security

With an increasingly decentralized and mobile workforce, organizations are coming to rely on LANs that provide remote access through a communications server that can be reached with a toll-free number or a series of local dial numbers. From time to time, telecommuters, traveling executives, salespeople, and remote offices all need access to the various resources that reside on headquarters’ LANs and subnets. This calls for appropriate security measures to prevent unauthorized access to the corporate network.

13.9.1 Security Measures

Depending on the size of the network and the sensitivity of the information that resides there, one or more of the following security methods can be employed:

  • Authentication: This involves verifying the remote caller by user ID and password, thus controlling access to the server. Security is enhanced if ID and password are encrypted before going out over the communications link.

  • Access restrictions: This involves assigning each remote user a specific location (i.e., directory or drive) that can be accessed on the server. Access to specific servers also can be controlled.

  • Time restrictions: This involves assigning each remote user a specific amount of connection time, after which the connection is dropped.

  • Connection restrictions: This involves limiting the number of consecutive connection attempts and/or the number of times connections can be established on an hourly or daily basis.

  • Protocol restrictions: This involves limiting users to a specific protocol for remote access.

Among the most popular remote-access security schemes is the RADIUS. Under this scheme, users are authenticated through a series of communications between the client and server. When the client initiates a connection, the communications server puts the name and password into a data packet called the authentication request, which also includes information identifying the specific server sending the authentication request and the port that is being used for the connection. For added protection, the communications server, acting as a RADIUS client, encrypts the password before passing it on to the authentication server.

When an authentication request is received, the authentication server validates the request and decrypts the data packet to access the user name and password information. If the user name and password are correct, the authentication server sends back an authentication acknowledgment that includes information on the user’s network system and service requirements. The acknowledgment can even contain filtering information to limit the user’s access to specific network resources.

13.9.2 Callback Security Systems

Callback security systems, which are commonly used with password/ID security schemes, control remote dial-up access to hosts and LAN servers via modems. Typically, these systems use an interactive process between a sending and receiving modem. With callback security, the answering modem requests the caller’s identification, disconnects the call, verifies the caller’s identification against the user directory, and then calls back the authorized modem at the number matching the caller’s identification.

Callback security ensures that data communication occurs only between authorized devices. The degree of security that callback modems provide is questionable due to the widespread use of telephone functions such as call forwarding. It is also possible for a knowledgeable intruder to stay on-line and intercept the return call from the answering modem. In addition, some data security centers may find callback security inappropriate for their networks, since it assumes that users always call from the same telephone number. Traveling employees and users who must connect to the LAN through a switchboard cannot use this technique.

Many popular modems can generate acoustic signals to indicate to the callback modem that a call was received and correctly linked. Administrators can also add callback modems to an established security system without disrupting existing procedures. Neither passwords nor callback modems provide complete security for remote communications, however. The difficulties inherent in remote authentication make a combined security method imperative. As a result, administrators often find using two identification methods (e.g., callback modems combined with data encryption) more effective than using a single method.

Other techniques are in use to enhance the security of modem access. Among them is the use of an ASCII password that is typically entered from a remote keyboard or automated logon file. This method offers minimal security, since it is easy for computer hackers to crack the code using random-number generators and launch attacks on system dictionaries. Moreover, it is limited to relatively slow asynchronous communications. The modems must establish the connection and enter the “pass data” mode, which typically takes 4 to 12 seconds on high-speed modems, before passwords can be verified.

A more reliable approach combines password security with the callback feature. With this technique, the password is verified and the inbound call is disconnected. The security system then calls the remote user at a predetermined telephone number to enter the “pass data” mode. If a hacker breaks the password, the security system will call back a secure location, thereby denying the hacker access. This system is effective, but very slow, and is limited to a finite number of stored telephone numbers.

These approaches rely on establishing links to a central site device such as a front-end processor or communications controller. In all cases, security is implemented via ASCII passwords or dual tone multifrequency (DTMF) tones after the modem handshake. A tenacious hacker will eventually break the security codes. To prevent this, security procedures can be implemented before the modem handshaking sequence, rather than after it. This effectively eliminates the access opportunity from potential intruders. In addition to saving time, this method uses a precision high-speed analog security sequence that is not even detectable by advanced line-monitoring equipment.

With callback, the remote client’s call is accepted, the line is disconnected, and the server calls back after checking that the phone number is valid. While this works well for branch offices, most callback products are not appropriate for mobile users whose locations vary on a daily basis. However, there are products on the market that accept roving callback numbers. This feature allows mobile users to call into a remote access server or host computer, type in their user ID and password, and then specify a number where the server or host should call them back. The callback number is then logged and may be used to help track down security breaches.

To safeguard very sensitive information, there are third-party authentication systems that can be added to the server. These systems require a user password and also a special credit card-sized device that generates a new ID every 60 seconds, which must be matched by a similar ID number-generation process on the remote user’s computer.

In addition to callback and encryption, security can be enforced via IP filtering and log-on passwords for the system console and for Telnet and FTP server programs. Many remote-node products also enforce security at the link level using the Point-to-Point Protocol (PPP) with the Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP).

13.9.3 Link Level Protocols

When peers at each end of the serial link support the PPP suite, more sophisticated security features can be implemented. This is because PPP can integrally support the PAP or CHAP to enforce link security.

PPP is a versatile WAN connection standard for tying dispersed branch offices to the central backbone via dial-up serial links. It is actually an enhanced version of the older Serial Line Internet Protocol (SLIP). SLIP is recommended for an IP-only environment, while PPP is recommended for non-IP or multiprotocol environments. Since PPP is protocol-insensitive, it can be used to access both AppleTalk and TCP/IP networks, for example.

PPP framing defines how data is encapsulated before transmission over the WAN. It supports multiple network-layer protocols, including TCP/IP and IPX. PPP also offers remote protocol configuration, the capability to define the framing format over the wire, and password authentication. PAP uses a two-way handshake for the peer to establish its identity. This handshake occurs only upon initial link establishment. An ID-password pair is repeatedly sent by the peer to the authenticator until verification is acknowledged or the connection is terminated. However, passwords are sent over the circuit in text format, which offers no protection from playback by network intruders.

CHAP periodically verifies the identity of the peer using a three-way handshake. This technique is employed throughout the life of the connection. With CHAP, the server sends a random token to the remote workstation. The token is encrypted with the user’s password and sent back to the server. Then the server does a lookup to see if it recognizes the password. If the values match, the authentication is acknowledged; otherwise, the connection is terminated. Every time remote users dial in, they are given a different token. This provides protection against playback because the challenge value changes in every token.

Some vendors of remote-node products support both PAP and CHAP, while older, low-end products tend to support only PAP, which is the less robust of the two authentication protocols.


13.10 Policy-Based Security

With today’s LAN administration tools, security goes far beyond mere password protection to include implementation of a policy-based approach characteristic of most mainframe systems. Under the policy-based approach to security, files are protected by their description in a relational database. This means that newly created files are automatically protected, not at the discretion of each creator, but consistent with the defined security needs of the organization.

Some products use a graphical calendar through which various assets can be made available to select users only during specific hours of specific days. For each asset or group of assets, a different permission type may be applied: permit, deny, and log. Permit allows a user or user group to have access to a specified asset. Deny allows an exception to be made to a permit, for example, not allowing writes to certain files. Log allows an asset to be accessed but stipulates that such access will be logged.

Although the LAN administrator usually has access to a full suite of password controls and tracking features, today’s advanced administration tools also provide the ability to determine whether or not a single login ID can have multiple terminal sessions on the same system. The LAN administrator can also specify an enforcement action to be taken when a user’s login ID exceeds the system limit for violations, such as:

  • Cancel: The access attempt is denied, and the process that attempted the unauthorized access is canceled.

  • Log out: The access attempt is denied, and the process group and all child processes associated with it are canceled. If a logged-in user is associated with the attempt, he or she will also be logged out.

  • Suspend: The access attempt is denied, and the process group and all associated child processes are canceled. In addition, the login ID is suspended and the user locked out of the system until explicitly lifted by the LAN administrator.

Through the console, the LAN manager can review real-time and historical violation activity on-line, along with other system activity.


13.11 Network Management System Security

The SNMP is the basis for most NMSs. It provides the ability to manage network devices in a multi-vendor environment from a central location. In fact, virtually any enterprise-class device that can be connected to a wired or wireless network supports SNMP. As useful as SNMP is for managing systems and network devices, it has always had weak security, making it vulnerable to hackers. In particular, the decoding and subsequent processing of management messages between SNMP managers and agents may cause denial-of-service conditions, service interruptions, and buffer overflows, allowing an attacker to gain access to or disrupt the proper operation of a device affected by these vulnerabilities. To create a denial-of-service attack, for example, a hacker might send bogus SNMP requests and traps that could flood an SNMP management system or appliance running a trap application. This might cause the system to hang and may require a reboot.

Usually, vendors offer SNMP security patches or firmware updates free of charge, which can be downloaded from their Web sites. If the SNMP-managed equipment was purchased from a vendor that went out of business, however, a fix might not be available. Rather than risk an attack, it is better to replace the equipment with a newer model from a stable vendor. In addition to applying a patch from the SNMP vendor in order to prevent these problems from recurring, network administrators can take the following additional precautions:

  • Enable ingress filtering, which is the blocking of access to SNMP services at the network perimeter;

  • Configure SNMP agent systems to disallow request messages from non-authorized systems;

  • Segregate SNMP traffic onto a separate management network and filter traffic as it leaves the network to prevent the network from being used as a source for attacks on other sites;

  • Disable any service or capability that is not explicitly required, including SNMP if it is enabled.

The last point is very important because SNMP will help malicious users learn a lot about a target system, making password guessing and similar attacks much easier. Unless this service is required, it is highly recommended that SNMP be turned off. Since many vendors ship their products with SNMP enabled, this security hole can only be plugged by using the configuration utility to disable SNMP.


13.12 Security Personnel

Getting the most out of these security administration tools requires trained security personnel and special attention to the following certifications and certifying organizations during the hiring process:

  • CSA: This person configures and manages fundamental implementations of firewalls. This person possesses the requisite skills to define and configure security policies that enable secure access to information across corporate networks. In addition to these essential skills, a CSA also has the ability to monitor network security activity and implement measures to block intruder access to networks.

  • CSE: This person has in-depth knowledge for establishing and managing VPNs and implementing complex installations of firewalls. This person also understands the encryption schemes used by VPNs and firewalls, configures remote access security, writes policy definitions, and modifies attack detection parameters.

  • Security certified network architect (SCNA): This person has expertise in cryptography, biometrics, public key infrastructure (PKI) planning and implementation, the Health Insurance Portability and Accountability Act (HIPAA), security response, smart cards, legal and physical security issues, and network forensics.

Among vendors that offer security certifications are Cisco, Check Point, and Symantec. Security expertise can also be demonstrated by passing specific exams on non-security certifications. Microsoft, for instance, does not offer a separate security certification but does offer security-related exams, such as “Designing Security for a Windows 2000 Network,” which serve to demonstrate knowledge of key security issues.

Global Information Assurance Certification (GIAC), an organization founded by the SANS Institute in 1999, offers 10 standalone security certifications in specific areas of expertise, such as firewalls, intrusion, and incident handling.

The nonprofit International Information Systems Security Certification Consortium (ISC)2 offers one of the leading security certifications—the certified information systems security professional (CISSP). The CISSP program offers credentials for those responsible for developing and managing the implementation of security policies, standards, and procedures. Another (ISC)2 certification, the systems security certified practitioner (SSCP), is designed for network and systems administrators involved in security implementations.

The value of these security certification programs is universally recognized. IT organizations should stipulate them in job descriptions and look for them as a means of screening qualified candidates during the hiring process. If layoffs hit the IT department, security certifications can play a role in the decision about who to retain. In fact, 66% of those certified believe their certifications play at least some role in job security.

It pays to recognize that most security breaches originate from within the organization. A network is only as secure as the administrator is trustworthy. Steps can be taken to minimize this risk when filling such sensitive positions. During the hiring process, for example, employers should ensure that references from past employers are thoroughly checked, that the applicant’s resume account for all time from high school to the present, and that the applicant’s work experience and education are not exaggerated. The employer should not be timid about determining the responsibility level of a candidate for employment, even to the point of checking a credit report for excessive indebtedness or bankruptcy or police records for arrests and convictions.

At the same time, trust should not extend to individuals who leave the organization. Upon quitting or dismissal, any computers or devices issued to that person should be immediately retrieved and network privileges revoked. All encryption keys throughout the organization should be changed without delay. Furthermore, that person’s ID badge should be confiscated before he or she is escorted from the building. The harsh reality of network intrusions from within the organization justifies such measures.


13.13 Security Training

Network users usually resist improvements in network security, because security devices and controls can make a complex system even more difficult to operate. Trusted employees often resent having to use passwords to access the network. For these reasons, some security measures may cause delays and reduce productivity. Companies should expect resistance to added rules and regulations and counter this by providing security awareness training. The IT manager, with the aid of the human resources department, must sell the long-term employee on the idea of additional security by implementing bulletin board campaigns and training sessions. At a minimum, security awareness training should include the following:

  • A description of tangible security measures, such as locks, keys, card systems, and badges;

  • An explanation of password management, including password selection, access privileges, routine password changes, and the need to maintain the confidentiality of corporate information;

  • Definitions of sensitive data and procedures for keeping data confidential;

  • Procedures for reporting lost or stolen data, software, and hardware;

  • Mechanisms for encouraging and implementing employee suggestions for improving security.

Companies should also develop security demonstrations, possibly in the form of a game in which one employee is assigned to penetrate the system while others try to prevent or detect the attack. Games demonstrate how well the system works and involve staff members with the security system. Whatever the result of the game, the company wins. If the attempt fails, the security system is performing effectively. If a security breach occurs, the company has identified a weakness and can take appropriate corrective measures.

Once an acceptable level of security awareness exists throughout the organization, the company should schedule periodic retraining sessions to maintain awareness. All aspects of a security system—the hardware, software, premises, facilities, and personnel—must work in unison and at a consistently high level to safeguard against threats to security.


13.14 Conclusion

To protect valuable information, companies must establish a sound security policy before an intruder has an opportunity to violate the network and do serious damage. This means identifying security risks, implementing effective security measures, and educating users on the importance of security procedures. There is no way to bypass the human element—a commitment to secure computing and networking must be made at all levels of the organization if security provisions are to have the desired effect.

Ignoring security issues can result in information theft, malicious file tampering, and snooping by intruders inside and outside of the organization. In trying to deal with the consequences of leaked information, a company can experience immediate financial loss and, in the long term, damage to its competitive position. Depending on the nature of the security breach and the kind of information involved, such laxity can even expose the company to litigation, forced settlements, and government fines.

Few companies would dispute the need for a secure enterprise network, particularly with the growing number of telecommuters and mobile professionals who need remote access to the corporate network, typically through Internet connections. But security is a full-time endeavor that requires a proactive approach, specialized technical staff, and appropriate tools. Many small to mid-size businesses do not have the expertise to set up and manage firewalls and intrusion detection systems. Such organizations should consider outsourcing security to a qualified third-party firm.

Other companies do have the technical expertise on staff to set up their own security systems, but even these firms often need help in assimilating the information generated by these systems so they can respond to possible threats in a timely and appropriate way. The sheer volume of information that security systems generate, often hundreds of pages, is what really needs to be managed. If a company is fully capable of setting up and managing its security systems but is not able to keep up with the volume of information, then only this component need be outsourced. There are security firms that provide a monitoring, alerting, and reporting service without forcing companies to subscribe to a fully managed solution. This arrangement helps companies keep their costs down, while allowing them to reap the full advantages of their investment in security systems.


Chapter 14: Network Planning and Design Tools

14.1 Introduction

Today’s networks are more complex by orders of magnitude than networks built only a few years ago. New Internet services, technologies, and trends toward VPNs, voice-data convergence, and wireless, plus the sheer number of new equipment offerings, have made reliance on traditional paper-and-pencil solutions to network documentation and design simply unworkable. Intelligent design tools with auto-discovery, error-detection, simulation and analysis capabilities, and plug-in modules for ancillary functionality are now the norm.

A typical corporate network consists of different kinds of transmission facilities, equipment, LAN technologies, and protocols—all cobbled together to meet the differing needs of workgroups, departments, branch offices, divisions, subsidiaries, and, increasingly, strategic partners, suppliers, and customers. Building such networks presents special design challenges that require comprehensive documentation and design tools.

A variety of automated design tools have become available in recent years. With built-in intelligence, these tools take an active part in the design process, from building a computerized model of the network, validating its design, and gauging its performance, to quantifying equipment requirements and exploring reliability and security issues before the purchase and installation of any network component. Even faulty equipment configurations, design flaws, and standards violations are identified in the design process.

These tools are especially valued by IT departments experiencing high staff turnover because they allow new personnel to become familiar with the details of the network they played no part in designing and managing. The essential information can be retrieved on a moment’s notice—often with point-and-click ease— analyzed, queried, manipulated, and reanalyzed if necessary, with the results displayed in easy-to-understand graphical form or exported to other applications for further manipulation and study.

Network documentation and design tools are often purchased as separate applications, but each contains some of the functionality of the other. For example, both types of tools feature drawing capabilities and come with libraries of equipment shapes that can be linked together. But a documentation tool excels at documentation and is not so adept at design to the point of alerting the user to standards violations, for example. Likewise, a design tool excels at design and is not so adept at allowing users to add descriptions of equipment, lines, and services in the detail they often need.


14.2 Network Documentation Tools

Today’s documentation tools are specifically designed for network and IT planners. They can improve communications and productivity with their easy-to-use graphics capabilities that offer seamless integration with other applications on the Windows desktop. Their graphical representation of complex projects also enables more people to understand and participate in the planning process without requiring them to be intimately familiar with every aspect of their networks. Despite their origins as simple drawing tools, this new generation of documentation tools provides a high degree of intelligence, programmability, and Web awareness that makes them well suited for the demanding needs of planners.

Network documentation tools are applications that facilitate the layout and documentation of large networks. Network administrators faced with managing detailed and often large quantities of information on local and worldwide corporate networks require tools that can accurately depict these complex infrastructures. While the automatic discovery capabilities of high-end network management systems can help in this regard, they are not very useful for documenting the equipment at the level of detail that is now required by network planners.

To aid the design process, a variety of tools have become available with various features to document systems and networks in virtually any level of detail. Such tools provide an easy-to-use drawing engine for general graphics and line connections. An extensive library of pre-drawn images representing vendor-specific equipment makes the network drawing easy to create and modify. A drill-down capability allows multiple drawings to be linked to show various views of the network. A database capability is used to assign descriptive data to the device images. And all this only scratches the surface.

Microsoft dominates this market with its Visio product suite. Other vendors that offer network documentation and design tools include Fluke Networks, Netformx, and NetViz. The products of these and other competitors not only provide import/export support for Visio, some leverage Visio’s capabilities in their own products. Netformx, for example, marries the graphics and common language of Microsoft Visio with its DesignXpert’s advanced configuration capabilities, validation wizards, and proposal-generation capabilities to offer a value-added product to its customers.

Most network documentation tools are for Windows and make use of the drag-and-drop technique to move images of network equipment from a device library to a blank workspace. Many also allow network designs to be published on the corporate intranet or the public Internet, allowing any authorized user to view them with a Web browser. Some tools can automatically discover devices on an existing network to ease the task of documenting the network.

Device Library

A device library holds generic images of commonly used equipment such as modems, telephones, PBXs, switches, and multiplexers. Icons depicting LANs and WANs, databases, buildings and rooms, satellite dishes, microwave towers, and a variety of line connectors are included. There are also icons that represent such generic accessories as power supplies, PCs, towers, monitors, keyboards, and peripherals. There are even shapes for racks, shelves, patch panels, and cable runs.

From a library of network icons, items are dragged from a graphical list and dropped into the workspace as needed to design a new node or build a whole network (see Figure 14.1). While many drawing tools offer thousands of exact-replica hardware device images from hundreds of network equipment manufacturers, some tools have embedded intelligence into the shapes, which enables components such as network cards to snap into equipment racks and remain in place even when the rack is moved.

Click To expand
Figure 14.1: From a library of network shapes (left), items are dragged and dropped into place as needed to design a new node or build a whole network (right). (Source: © 2003 Visio Corp., a division of Microsoft Corp.)

Details about network equipment can be stored using custom property fields associated with each equipment shape, which can include serial number, inventory ID, location, manufacturer ID, manufacturer name, part number, and description (see Figure 14.2). This permits users to generate detailed inventory reports for network asset management.

Click To expand
Figure 14.2: Details about network equipment can be stored using custom property fields. Device-specific data for each network shape keeps track of asset, equipment, and manufacturer records that can be accessed from within network diagrams. (Source: © 2003 Visio Corp., a division of Microsoft Corp.)

The shapes are even programmable so they can behave like the objects they represent. This reduces the need for manual adjustments while drawing and ensures the accuracy of the final diagram. For example, the shape representing an equipment rack can be defined with its dimensions. When the user populates the drawing with multiple instances of this shape, it could issue an alert if there is a discrepancy between the space available on the floor plan and the space requirements of the equipment racks. An alert would also be issued if the user attempts to populate the rack with more equipment than its dimensions would allow.

Each shape can also be embedded with detailed information. For example, the user can associate a spreadsheet with any network element—to provide cost information on a new switch node or LAN segment, for example—along with a bar chart to perhaps illustrate the cost data by system component. The spreadsheet data can be manipulated until costs fit within budgetary parameters. The changes will be reflected in the bar chart the next time it is opened.

Starting a Project

To start a new project, typically the user opens the template for the manufacturer whose equipment will be placed in the diagram. This causes a drawing page to appear that contains rules and grid. The drawing page itself can be sized to show the entire network or just a portion of it. Various other systems and components can be added to the diagram using the drag-and-drop technique.

The user has the option of having the shapes snap into place within the drawing space for precise positioning onto the grid lines in the work space. The shapes can be moved, resized, flipped and rotated, and glued together to remain associated with each other if moved. Expansion modules, for example, can be dragged onto the chassis so that the modules’ endpoints glue to the connection points on the chassis expansion slots. This allows the chassis and modules to be moved anywhere in the diagram as a single unit. Via the cut-and-paste method, the user can add as many copies of the component as desired to quickly populate the network drawing. The associated documentation is reproduced for each copy as well, so that only the unique information needs to be entered manually.

To show the connections between various systems and components, the user can choose shapes that represent different types of networks, including LANs, Internet, fiber, satellite, microwave, and radio. Alternatively, the user can choose to connect the shapes with simple lines that can have square or curved corners.

AutoCAD files and clip art can be added to network drawings as well. The common file formats usually supported for importing graphics from other applications include encapsulated postscript (.EPS), joint photographic experts group (.JPG), tag image file format (.TIF), and ZSoft PC paintbrush bitmap (.PCX).

As is usual with such tools, the various shapes used in a network drawing can be kept organized using layers. For example, the user can assign walls, wiring, and equipment racks to different layers in a space plan. This allows the user to show, hide, or lock shapes on specific layers so they can be edited without affecting shapes on other layers. Shapes can be selected and printed based on their layer assignments. The display color of all shapes on a layer can be temporarily changed to make them easier to identify. A shape can be assigned to more than one layer, and the member shapes of a group can be assigned to different layers.

The user can also group shapes into customizable stencils. If the same equipment is used at each node in a network, for example, the user can create a stencil containing all the devices. All of the graphics and text associated with each device will be preserved in the newly created stencil. This saves time in drawing and documenting large-scale networks, especially those that are based on equipment from a variety of manufacturers.

At any step in the design process, the user can share the results with other network planners by sending copies via e-mail attachments. The diagram is converted to an image file, which is displayed as an icon in the message box. When opened by the recipient, the attachment with all embedded information is displayed. The document can then be edited by creating a separate layer for review comments, each of which is done in a different color. The use of separate layers and colors protects the original drawing and makes comments easier to view and understand.

Some network documentation tools provide a utility that converts network designs and device details into a series of hyperlinked HTML documents that can be accessed over the Web. These documents show device configurations, port usage, and even device photographs. Users can activate the links to navigate from device to device to trace connectivity and review device configurations. In addition to supporting fault identification, the hyperlinked documents aid in planning design changes.

Users can password-protect their work to prevent attributes of a drawing file from being changed. For example, a background containing standard shapes or settings can be password-protected. Users can also set a password for a drawing’s styles, shapes, and masters. A password-protected item can be edited only if the correct password is entered. Locking the diagram prevents shapes from being “ungrouped,” for example, which would sever the object’s link to its master and disassociate any documentation related to that shape.


14.3 Network Design Tools

As with documentation tools, the design process usually starts by opening a blank drawing window from within the design tool into which various vendor-specific devices can be dragged from a product library and dropped into place (see Figure 14.3). The devices are further defined by type of components, software, and protocols as appropriate. By drawing lines, the devices are linked to form a network, with each link assigned physical and logical attributes. Rapid prototyping is aided by the ability to copy objects from one drawing to the next, editing as necessary, until the entire network is built. Along the way, various simulations can be run to test virtually any aspect of the design. This level of intelligence is not found in drawing and documentation tools.

Click To expand
Figure 14.3: A design tool, such as DesignXpert from NetFormx provides workspace into which objects can be dragged-and-dropped from a device library to start the network design process. ( Source: © 2003 Netformx. Reprinted with permission.)

For a network that is already established, the auto-discovery capabilities found in some drawing and design products can be used to help populate a blank workspace. Topology information can also be supplied using the auto-discovery capabilities of such management platforms as Hewlett-Packard’s OpenView and IBM’s Net-View—which automatically detect various network elements and represent them with icons on a topology map. These NMSs also offer other useful information that can be considered in the design process, such as traffic statistics.

Designing a large, complex network requires a multifaceted tool—ideally, one that is graphical, object-oriented, and interactive. It should support the entire network life cycle, starting with the definition of end-user requirements and conceptual design, to the very detailed vendor-specific configuration of network devices, the protocols they use, and the various links between them. At each phase in the design process, the tool should be able to test different design alternatives in terms of cost, performance, and validity. When the design checks out, the tool generates network diagrams and a bill of materials—all this before a single equipment vendor or carrier sales rep is contacted or request for proposal (RFP) is written.

With the right tools, modules, and device libraries, every conceivable type of network can be designed, including legacy networks such as X.25, SNA, and DECnet, voice networks including ISDN, as well as T1, ATM, and TCP/IP nets. Some tools even take into account the use of satellite, microwave, and other wireless technologies like Wi-Fi.

The designer can take a top-down or bottom-up approach to building the network. In the former, the designer starts by sketching out the overall network; subsequent drawings add increasing levels of detail until every aspect of the network is eventually fleshed out. The bottom-up approach might start with a LAN on a specific floor of a specific building, with subsequent drawings linked to create the overall network structure.

As the drawing window is populated, devices can be further defined by type of component such as chassis, interface cards, and daughter boards. Even the operating system can be specified. Attributes can be added to each device taken from the library—to specify a device’s protocol functionality, for example. Once the devices have been configured, a simulation profile is assigned to each device, which specifies its traffic characteristics for purposes of simulating the network’s load and capacity.

With each device’s configuration defined, lines are drawn between them to form the network. With some design tools, the links can be validated against common protocols and network functions. This prevents NetWare clients from being connected to other clients instead of servers, for example. Such on-line analysis can also alert the designer to undefined links, unconnected devices, insufficient available ports in a device, and incorrect addresses in IP networks. Some tools are even able to report violations of network integrity and proper network design practices.

Network Simulation

Once the initial network design is completed, it can be tested for proper operation by running a simulation that describes how the actual network devices behave under various real-world conditions. The simulator generates network events over time, based on the type of device and traffic pattern recorded in the simulation profile. This enables the designer to test the network’s capacity under various what-if scenarios and fine-tune the network for optimal cost and performance. Simulators can be purchased as standalone programs or may be part of the design tool itself.

Some tools are more adept at designing WANs, particularly those that are based on TDMs. With a TDM component taken from the device library, for example, a designer can build an entire T1 network within specified parameters and constraints. The designer can strive for the lowest transmission cost that supports all traffic, for instance, or strive for line redundancy between all TDM nodes. By mixing and matching different operating characteristics of various TDM components, overall design objectives can be addressed, simulated, and fine-tuned. Some tools come with a tariff database to price transmission links and determine the most economical network design.

Such tools may also address clocking in the network design. Clocks are used in TDM networks to regulate the flow of data transmitted between nodes. All clocks on the network must therefore be synchronized to ensure the uninterrupted flow of data from one node to another. The design tool automatically generates a network topology synchronization scheme, taking into account any user-defined criteria, to ensure that there are no embedded clock loops.

Bill of Materials

Once the design is validated, the network design tool generates a bill of materials that includes order codes, prices, and discounts. This report can be exported to any Microsoft Windows application, such as Word or Excel, for inclusion in the proposal for top management review or an RFP issued to vendors and carriers who will build the network. Through the tool’s capability to render multiple device views, network planners can choose either a standard schematic or an actual as-built rendering of the cards and the slot assignments of the various devices. Some tools also generate Web-enabled output, which allows far-flung colleagues to discuss and annotate the proposal over the Internet—even allowing each person to drill-down and extract appropriate information from the network device library.

The most popular network drawing and documentation tool is Visio Professional from Microsoft. It is used to document existing networks and plan new ones, develop proposals for new infrastructure and directory services, including Active Directory, Novell Directory Services (NDS), and other Lightweight Directory Access Protocol (LDAP)–based directories. Also included in Visio Professional is an extensive collection of clip art that can be kept current with an annual subscription, a scanner and digital camera interface, and photo-editing tools. Visio Professional 2002 is available in 13 languages and for Windows users getting started is very intuitive.

Although Visio is a powerful product, it is best suited for technical professionals. It can be daunting for the average user in a small to medium-size business who just wants to draw presentation-quality network diagrams, without having to learn a complex program. For this level of user, SmartDraw is a viable alternative to Visio, offering support for MS Office and containing 50,000 symbols sorted into 11 collections, including those for networks, floor plans, engineering, and software. A file conversion wizard converts Visio files to SmartDraw files.

For an advanced package that offers more than drawing and documentation capabilities, there are several noteworthy offerings with such capabilities as network monitoring, analysis, and troubleshooting. Fluke Networks, for example, offers Network Inspector. Designed for switched Ethernet LANs, this application works with other packages from Fluke to actively monitor and diagnose problems in TCP/IP, IPX, and NetBIOS environments. Through its discovery process, it pinpoints whether the problems are on the server, client, switch, router, or printer and provides an extensive suite of reports identifying all devices in the LAN and the services they provide. Network Inspector also tightly integrates with Microsoft’s Visio. Any device search will translate itself into a detailed Visio drawing, which can be examined with a high degree of granularity, often down to the port level.

Netformx offers DesignXpert, which supports the design, validation, and procurement phases of the network development process. It offers users a network device library containing over 30,000 images from more than 65 vendors, each of which can be located with the product’s navigation facility. An import/export capability converts between Netformx and Visio. With this capability, network professionals can take existing network documentation and convert it as a baseline for advanced network design or take designs created by Netformx and distribute diagrams in Visio format. Through an annual Web-based subscription service, users can obtain weekly downloads containing thousands of device changes that reflect the latest product changes of equipment manufacturers. DesignXpert can be augmented with a separately priced enterprise auto-discovery capability and an annual subscription to an update service.

NetViz Professional is a network-diagramming and data-visualization tool that uses data-embedded graphics to make hierarchical diagrams that integrate graphics, data, and relationship information across a complex system. Unlike simple diagramming tools, NetViz allows links to an enterprise’s existing data. Instead of creating flat diagrams that can only be viewed one at a time, NetViz creates a comprehensive, enterprise-wide view of all of the infrastructure information important to a business. NetViz also allows users to drag and drop additional graphics into diagrams from virtually any source, including other applications and Web pages. A user simply needs to open an application that has graphics—Visio, PowerPoint, or any clip-art collection—then select a graphic and drag it into a NetViz diagram. It will automatically be incorporated into the NetViz project, where the user can assign data fields to the graphic and link the fields to external data sources. The NetViz package also offers a separately priced Web-server package that allows projects to be saved as Web pages, complete with associated data.

Some of these tools are widely supported by third parties. Altima Technologies, for example, offers a service called NetZoom, which provides tens of thousands of symbols to create professional network documentation using existing applications, including Microsoft Visio, NetViz, and SmartDraw. NetZoom’s database encompasses well-known manufacturers, such as Sun, Cisco, IBM, Dell, and HP, as well as more than 900 other manufacturers. NetZoom includes manufacturer-specific equipment objects for specific networking environments, such as telco, ATM, Ethernet, wireless, broadband and others. NetZoom for Visio includes a 12-month subscription that enables users to download updates or request additional shapes at no additional charge.

There are even companies that specialize in building custom Visio shapes. Visimation, for example, designs shapes for any industry or application, including those for network equipment from such vendors as 3Com, Juniper Networks, Alteon, and Pluris. The company’s shape design expertise can turn a static graphic into an interactive and highly intelligent model of a real-world object.


14.4 Network-Specific Tools

For every type of network, there are tools tailored to design them. Some of these tools are fairly easy to use, even for those without formal training in network design. Others are quite complex, intended for use by enterprise users and service providers.

14.4.1 Designing IP Nets

Cisco offers a free tool called ConfigMaker, a Windows-based tool used to configure small IP networks of Cisco routers, switches, hubs, and other network devices from a single PC without requiring knowledge of Cisco operating system software. ConfigMaker is designed for network administrators of small to medium-size businesses who are proficient in LAN and WAN fundamentals and basic network design.

With this tool, the user can address and configure one or more devices or create an entire network of devices in a two-step process that entails creating a network diagram and delivering the configuration file. While the user creates a network diagram, ConfigMaker automatically creates configuration files for Cisco routers, switches, and hubs. The device and connection wizards prompt the user for information about the devices and connections on the network and then use that information to create the configuration files for the devices.

For example, when modular devices are added, the tool prompts the user to enter network modules, WAN interface cards, and voice interface cards so that the software reflects the same hardware configuration as the device. A connection wizard steps the user through the configuration of network links, such as ISDN, and to assign an IP address to the interface.

When connections are drawn between devices, a customized connection wizard helps the user set connection parameters. The configuration files can be viewed, saved, or printed. The user can also save a bitmap image of the network diagram.

For existing networks, an auto-detect wizard facilitates device population of the network diagram by reading any existing configuration to identify the device model and any installed network interface cards.

Another wizard helps the user define VPN connections on the network using the IPsec protocol. ConfigMaker configures the IPsec encryption technology, which allows the creation of site-to-site VPN connections. Internet key exchange (IKE) is used to authenticate each peer in an IPsec transaction, negotiate security policy, and handle the exchange of session keys.

There is also a wizard to help the user define a firewall between the corporate network and its connection to the Internet. The security wizard configures the Cisco operating system’s firewall feature set for an Internet or corporate network connection on the router. The user is prompted to define policies between devices or networks. Users may define broad policies, such as denying or permitting network traffic to pass, or very specific policies for types of allowable traffic.

The NAT feature is used to define static or extended static translations to devices on the corporate network. ConfigMaker configures NAT for additional security and network address conservation/simplification in remote access environments. NAT enables private IP nets that use non-registered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks, and translates the private (not globally unique) addresses in the internal network into legal addresses before packets are forwarded onto another network. As part of this functionality, NAT can be configured to advertise only one address for the entire network to the outside world. This provides additional security, effectively hiding the entire internal network from the world behind that address.

ConfigMaker can also be used to set a QoS by limiting bandwidth available for different traffic types. Specifically, the tool configures the committed access rate (CAR), which performs two QoS functions. One function is bandwidth management through rate limiting, which allows the user to control the maximum rate for traffic transmitted or received on an interface. CAR is often configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate parameters is transmitted, while packets that exceed the acceptable amount of traffic are dropped or transmitted with a different priority.

The other QoS function is packet classification through IP precedence. This function allows the user to partition the network into multiple priority levels or classes of service (CoS). CAR can be used to set the IP precedence for packets entering the network. Devices within the network can then use the adjusted IP precedence to determine how the traffic is treated.

After creating, addressing, and securing the network, the user can deliver configurations to the devices by using a computer’s communications (COM) port or network connection. Network delivery requires the target device to have an existing IP address assigned to it. The delivery wizard graphically displays the progress of configuration delivery until it is successfully completed.

14.4.2 Designing Wireless Nets

Wireless networks are becoming popular and, of course, there are tools available to help planners and engineers develop wireless network and service plans, including detailed technical and business analyses. One vendor, RSoft Design Group, offers Wireless SWAT, a design tool for service providers and enterprise users that performs complex interrelated traffic, capacity, propagation, equipment, and operations calculations, taking into consideration such factors as potential service areas, service types, and technology types and characteristics, including the impact of multiple simultaneous services, such as voice, data, e-mail, Internet, and video.

The tool can handle a variety of analyses, such as wireless evolution from 1G through 4G, as well as wireless local area networks (WLAN) (e.g., Wi-Fi), multi-channel multipoint distribution service (MMDS), and local multipoint distribution service (LMDS). A key feature of Wireless SWAT is that it designs and grows the plan over multiple periods, either quarterly or annually. As a plan is developed, the user can then analyze the results to determine in which areas, parts of the network, or time periods adjustment is required. For example, if the user wants to vary controls for bit rate and traffic of a proposed service or mixture of services Wireless-SWAT can help the user determine the network sizing and cost of each choice.

The tool can help identify the most cost-effective way of serving an area, considering a multitude of wired and wireless technologies, including detailed telecommunications, capacity, coverage, and economic design. Of special interest to established wireless service providers, as well as ISPs and entrepreneurs who want to set up Wi-Fi networks using the unlicensed 2.4-GHz frequency band, is that Wireless SWAT is capable of processing up to 50 areas in a run, typically less than 15 seconds per study area, and providing reports covering a variety of key elements, such as discounted cash flow, capital/expense flow, and network loads.

Another feature of the tool is its usefulness even when some necessary data for a study is missing. Estimates for the unknown variables can be used instead and, by changing some control screens in a few runs, the user can easily do parametric studies to see which range will be cost-effective. Using this type of technique, a number of key questions can be addressed, such as the following:

  • How well does the solution scale with increasing (or decreasing) traffic or market share?

  • How economical does the neighborhood hub or access link have to be to still make money?

  • How much do I have to charge to make the plan cost-effective?

  • Where are the cost bottlenecks or capacity bottlenecks?

  • Is technology A more cost-effective than technology B?

  • What are the likely economics of my competitors?

By making it easy to answer these types of questions, Wireless SWAT helps the user develop the best network plan. The studies also provide demand-and-service modeling, allowing up to seven simultaneous customer segments, with more than 40 simultaneous services. The study results reflect the combined traffic loads and revenue streams. The tool also has extensible network modeling, enabling the user to input detailed network link and node data or, where the details are not yet available, input limited parameters.

Another feature of the design tool is the guidance it provides when the user inputs the parameters. Validation logic checks user inputs at study setup time to try to prevent incomplete or incompatible inputs. In addition, just before run time, another check is made to detect service, technology, and other incompatibilities. The tool’s pop-up boxes provide appropriate messages, such as valid field ranges or location of errors, so that the study can run effectively.

Another key feature of the design tool is storage of study data. Whenever a study is saved, all of the inputs are stored for reuse so that they do not have to be entered each time a new variation of the plan is tested. The user can open a previously saved study, change desired parameters, services, technologies, or areas and then run and save the study under a different name. In addition to storing a database of studies, the design tool comes with sample catalogs of areas, services, and technology that can be modified with elements added, deleted, and changed through catalog screens. Information in the catalogs, as well as information stored in the database, automatically populates certain fields during design sessions. To save time, most of the screens contain default data or have pull-down menus, allowing the user to choose among a list of selections instead of having to input raw data.

The Wireless SWAT design tool produces numerous graphical reports showing such information as overall and detailed cost-and-load results. Using one of the network element capital/expense flow reports, for example, the user can further examine the plan to analyze which parts of the network are causing the problem. Such reports can be used to evaluate not only the cost-effectiveness of a proposed network but also to compare between two or more plans. For example, a service provider may need to determine whether to include 2.5G in its evolution plans to 3G, along with what factors influence that decision, the dominant critical costs, and the sensitivity to market share rise and falls.

RSoft Design Group also offers a design tool for companies that want to conduct wireline studies for xDSL, cable, direct fiber access, or a combination of wireless and wireline studies. In such cases, they would use Broadband SWAT, which combines all of the capabilities of Wireless SWAT with additional capabilities aimed at supporting wireline studies. For example, a user may need to determine whether DSL or fixed wireless is a better choice for a particular area. Is DSL or fixed wireless a more cost-effective way to reach the customers and, if so, why? Other questions this design tool can answer include the following:

  • What are the dominant critical costs?

  • How much do the losing technologies’ plug-in costs have to come down for it to win?

  • What is the sensitivity to market share dropping 10%?

  • How well does the favored choice scale go up if penetration increases 20% in the third year?

14.4.3 Predicting Network Performance

It is not good enough to have tools that lay out and document the network; there must be a way to predict the results to ensure that money is not wasted in trial-and-error implementations. Certain predictive analysis tools offer timely performance information so IT professionals can make the most intelligent decisions about the future of their enterprise resources under different application and traffic load scenarios.

One vendor, Compuware, offers a suite of performance management tools called EcoSYSTEMS, which includes EcoSCOPE, EcoTOOLS, and EcoPREDICTOR. Together, these tools manage and monitor application performance and service levels across the enterprise, helping IT professionals move from preproduction to postproduction and e-commerce environments, as their infrastructure needs change and grow.

EcoPREDICTOR assures service-level conformance by accounting, in advance, for fluctuations in daily or seasonal network traffic. Planners can vary growth-rate scenarios to examine the effects on network traffic and performance. The tool minimizes risk and boosts performance for complex e-commerce and traditional business applications, enabling network managers and software developers to see the effects of launching new applications with existing network traffic on their infrastructure and helping them minimize response times before deployment. The tool also helps network managers use existing information to build models of their infrastructure, so they can determine the effects of traffic and topology changes before they happen.

With the predictor tool, network professionals can overlay VoIP, e-commerce, enterprise resource planning (ERP), customer relationship management (CRM), e-mail, and other application transactions onto live background traffic to see how the application will deploy over the network. Users can then pinpoint alternatives to minimizing response times—such as increasing bandwidth, relocating servers, or increasing processor speeds—and viewing the effect of making each change before it is actually implemented.

More intelligent application decisions based on information learned from analyzing the impacts of changes before they actually occur ensures stable performance levels, particularly for e-commerce, which requires adequate network resources and appropriate capacity planning. Forecasting changes in specific SNA, IP, and streaming helps avert costly service disruptions resulting from a mismatch of resources to demands. Details from EcoPREDICTOR can pinpoint resources such as links, routers, or switches that might be involved in the type of outages that can make or break an e-business.

IT professionals can also import information from EcoSCOPE automatically, enabling them to focus on predicting performance versus the setup requirements often associated with capacity planning. EcoSCOPE provides a network view of application performance by focusing exclusively on Web traffic (HTTP and HTTPS) and drilling down to the Web-page level to provide a granular view of the pages and servers that make up Web traffic. The tool collects detailed performance data on Web applications, such as URL traffic volume and response times for Web applications. This Web focus allows users to analyze how specific pages and their elements affect, and are affected by, the network. Users can track and troubleshoot what, when, how, and where visitors are spending their time and which Web-page elements create unnecessary traffic.

EcoSCOPE also collects Web server statistics, such as page hits, from the Eco-TOOLS server monitoring solution. EcoTOOLS correlates and displays this information with detailed Web traffic data in a single user interface. Together, these products provide an integrated view of Web application traffic and response times with Web server information. This integration enables IT departments to track and correlate Web server load with application performance and gives a better understanding of pages customers access the most. These products also help isolate performance problems, determining if the bottleneck is at the network or server and pinpointing latency to a particular Web server.

A Web-based reporting console provides a common front end for all EcoSYSTEMS historical trending and service-level management reports. It collects data from the EcoSYSTEMS’ historical database and correlates the information into a single set of reports. This database is a common repository for historical data across the EcoSYSTEMS suite and provides multiple views within the infrastructure.

The console also provides IT departments with a single, integrated view of application performance over time. The console facilitates troubleshooting of complex problems and improves communication between IT department staff by giving them a common set of reports they can use to monitor and maintain all elements that impact an application’s performance.

The EcoSYSTEMS platform also offers historical trending reports that track e-business and performance trends and usage of e-business applications, Web servers, and Web sites over time. These reports help anticipate fluctuations and highlight performance problems. The e-business reports also track CPU utilization, traffic volume, and response time by Web servers and top pages for a Web server. The e-business reports gather both network and server Web-related data by accessing EcoSCOPE traffic and response-time metrics and EcoTOOLS Web server data available through the EcoSYSTEMS historical database.

Forecasting reports use EcoPREDICTOR’s predictive capabilities and trend data from the EcoSYSTEMS database to forecast future service levels based on past performance. EcoPREDICTOR analyzes daily and weekly data to project if traffic volume, response time, CPU utilization, and Web server hits will remain steady or increase over time. This is more reflective of future performance than simple linear trending because it accounts for actual past data and normalizes any anomalies in the data such as unusually heavy or light days. E-business trending and forecasting reports are available in the Web-based reporting console.


14.5 Systems Design

Network design can get quite detailed, including the specific configuration of devices like switches and routers that are linked together with various lines and services. A relatively recent trend in systems design is the ability to do it on-line with vendor-provided tools that provide an easy way to design, configure, and quote a customized network solution without the involvement of salespeople or committing to a purchase. Cisco does this with routers, Extreme Networks with switches, and computer manufacturers like IBM do it with PCs and servers. By filling in various fields in an on-line form, different products can be customized according to specific performance and budgetary requirements. If a configuration is invalid, the on-line configuration tool identifies the mistake, giving the user a chance to make other feature selections until the system meets valid criteria.

There are two ways to design systems on-line. One is to select a basic configuration and then customize it by choosing various features, capabilities, and options from a series of pick lists. Along the way, or upon completion of the custom build, the price is recalculated. When the user is satisfied with the results, the information can be stored for reference or the user may go ahead and order the product on-line.

The other way to design a system on-line is to use a needs-analysis tool to arrive at an appropriate solution. This method is used when the buyer needs help deciding what product would best meet organizational needs but is not familiar enough with a vendor’s product line to select a particular model. Cisco, for example, has so many different kinds of routers that it takes some technical expertise to navigate its entire line of offerings and zero in on exactly the right one. For small and medium-size businesses, the needs analysis approach might be best.

For selecting a branch office router, for example, Cisco’s needs-analysis tool starts by asking the user about voice requirements, assuming that a branch location might be interested in saving money and simplifying network administration. The user is asked, “Do you require voice capability now or in the future?” The user clicks on one of the following answers:

  • I require voice capability now;

  • I require voice capability in the future;

  • No, I require only data capability.

The needs-analysis tool then asks if the user has any VPN requirements, which provides a secure way to connect to the corporate network over the Internet. This is cheaper than using dedicated leased lines for that purpose, plus the VPN offers traffic prioritization, management, and new capabilities such as secure extranet communication among business partners. The user is asked, “Do you require VPN capability now or in the future?” The user clicks yes or no.

Following up on the VPN requirements, the needs analyzer asks the user about security; specifically, whether the user intends to use the DES for protecting VPN traffic, or 3DES, which iterates three times with three separate keys, effectively doubling the strength of DES. The user answers by clicking DES or 3DES.

Next, the analyzer inquires about the level of performance that will be required from the VPN connection, which determines whether or not the router will need to be equipped with a VPN module. The VPN module encrypts data using the DES and 3DES algorithms at speeds suitable for a full-duplex T1/E1 serial connection. The user must specify the type of connection that the VPN will run over. The choices are: T1/E1, ADSL, ISDN BRI at 128 Kbps or 56/64 Kbps.

The needs analyzer asks the user to specify the type of LAN interfaces the router should have. This is determined by the type of LAN installed at the branch office, which most likely would be a 10BaseT Ethernet. Then the user must decide how many ports the router will provide for 10BaseT Ethernet, either one or two.

Assuming the user wants the router to support voice as well as data, the needs analyzer asks the user to select the voice interface type. (The number of ports is fixed at two.) For a branch office router, the following choices are available:

  • Two-port FXS voice/fax interface card;

  • Two-port FXO voice/fax interface card;

  • Two-port FXO voice/fax interface card (for Europe);

  • Two-port FXO voice/fax interface card with battery-reversal detection and caller ID support (for the United States, Canada, and others);

  • Two-port FXO voice/fax interface card with battery-reversal detection and caller ID support (for Europe);

  • Two-port FXO voice/fax interface card (for Australia);

  • Two-port E&M voice/fax interface card;

  • Two-port ISDN BRI voice/fax interface card (network and terminal side);

  • Two-port DID voice/fax interface card.

The needs analyzer asks the user to provide requirements for WAN interfaces, specifying the type of port(s) and the number of ports. At this point, however, the user’s previous choices may not have left room to add any more modules, since the router has a limited number of slots. If this is the case, an error message pops up telling the user to go back and remove a module. If two 10BaseT Ethernet ports were specified previously, when only one would actually suffice, the configuration can be revised for one port, leaving room for a WAN interface. The choices for WAN interface include the following:

  • ISDN BRI S/T;

  • ISDN BRI U;

  • Sync/async serial (T1/E1);

  • Low-speed Sync/async serial (up to 128 Kbps);

  • 56/64 Kbps, four-wire DSU/CSU;

  • T1/Fractional T1 DSU/CSU ADSL.

The last step in the needs analysis asks the user to specify the software features of the Cisco operating system. To do this, the user must know what kind of operating systems, protocols, and applications are running on the LAN that the router will be connected to. Among the choices are the following:

  • AppleTalk, which is used to interconnect Macintosh computers;

  • BGP for load-balancing traffic between two Internet service providers;

  • DHCP, which assigns IP addresses to clients when they require access to the Internet, thus conserving IP addresses;

  • IP, which is required for sending and receiving information through the Internet;

  • IPX, which is used on Novell networks;

  • Layer 2 Tunneling Protocol (L2TP), a type of protocol for implementing secure private connections through the Internet;

  • NAT, which is used to conserve IP addresses and provide rudimentary security by presenting one IP address to the Internet from a pool of IP addresses;

  • Network Time Protocol (NTP), which provides a common frame of reference between all devices on the network for facilitating accounting, fault analysis, network management, and time-based authentication and authorization;

  • Port address translation (PAT), which is similar to NAT, but only uses one registered IP address instead of a pool of addresses. PAT is a true many-to-one solution in that it manipulates a field in the public-data packet, which is then related back to the private-address packet.

When the user reaches the end of the on-line needs analyzer, the final configuration is depicted in graphical form, along with the router model number and a complete list of modules and interfaces.


14.6 Conclusion

Virtually every carrier, service provider, integrator, and enterprise uses network documentation and design tools in some way. The sales account teams and technical consultants of carriers, service providers, and integrators use these tools to propose services to customers and potential customers. Other support people use them to answer RFPs. Engineers use them to provision services to customers. Enterprise telecom and IT departments use these tools to help track their technology assets and as the reference point for making design changes to systems and networks.

The price of a good drawing and documentation package like Visio Professional is so low that there is no downside to buying the product and using it immediately. For organizations that need more than a drawing and documentation package, products from Fluke Networks, Netformx, and NetViz are worthy of serious consideration, depending on specific functional needs. The price on all three is reasonable, considering they are true design tools that pack a lot of features, including linkages with Microsoft’s Visio.

While drawing tools are good for laying out and documenting networks, true design tools discover a network, offer a visual design environment for diagramming network changes, and simulate how a new application or new network components will affect response times. They also produce reports documenting the existing and proposed networks. Unfortunately, no single product does all these things perfectly, so multiple tools may have to be used.

For example, some tools offer good design, simulation, and documentation features, but they do not discover an existing network. Others not only discover existing networks, they can import network device information discovered by third-party sources such as Hewlett-Packard’s OpenView or Network Associates’ Sniffer. Other design tools are very adept at discovering, designing, and documenting a network but do not include a simulation capability to test new designs or changes against real applications or network activity.

Despite the limitations of particular products, no service provider or IT organization can afford to be without them. Even the use of multiple tools will save money by shortening the design-to-deployment cycle and contribute to a successful network implementation by identifying standards violations, interface incompatibilities, invalid equipment configurations, and other errors that can impede progress.


Chapter 15: WAN Restoration Planning

15.1 Introduction

To stay competitive, companies are relying on their networks to improve customer service, pursue new business opportunities, and increase market share. A properly functioning network allows an organization to reap strategic competitive advantages over rival companies that do not appreciate the importance of properly configured, fault-tolerant networks and services. When the corporate network becomes severely congested or experiences disruption for whatever reason, companies must be positioned to implement effective service restoration solutions or risk losing customer confidence and competitive position.

WAN restoration solutions typically are implemented using a mix of carrier services and CPE. When carrier services are relied on for networking, the responsibility for restoration is primarily on the carrier. When a private network of dedicated leased lines is relied on for networking, the responsibility for restoration is primarily on the enterprise. In the former case, WAN restoration is service based; in the latter case, restoration is CPE-based. However, there are hybrid networks that consist of both private lines and public services. In such cases, WAN restoration solutions usually employed on private networks may be used in conjunction with the switched digital services offered by the major carriers.


15.2 Redundant Carrier Systems

The networks of the major carriers are built as redundant systems, meaning that there is a duplicate or backup system immediately available to overcome outages that may occur virtually anywhere on their networks. While the large carriers offer a high degree of redundancy in their networks, smaller competitors may not. Many CLECs, for example, may have fiber rings in the cities they serve, which move traffic between their regional or national data backbones. But not all the CLECs have dual-ring architectures that can route traffic in another direction if a cable cut occurs. Given the high cost of building resilient networks and the shortage of capital for infrastructure enhancement, telecom and IT managers must factor these considerations into their decision-making when selecting carrier services.

15.2.1 Switching Systems

For voice services and low-speed data, local exchange carriers (LECs) operate central offices, which use voice- and data-switching equipment from vendors such as Lucent Technologies, Nortel Networks, Fujitsu, Ericsson, and Siemens. Typically, the goal for these systems, including failure and both scheduled and unscheduled maintenance, is 99.999% (five 9s) availability. This works out to 5 minutes of downtime per year. An exception is Lucent’s 5ESS, which performs at 99.9999% (six 9s) availability. This equates to only 10 seconds of downtime per year. To achieve these high levels of performance, each switch is equipped with dual processors, so that if one processor fails, the second one can take over automatically. In essence, the switch can be viewed as two computers running simultaneously, with the backup ready to take over the full processing load instantly if a problem is detected.

The near 100% availability of these switches is also achieved with redundant subsystems and continuous internal testing. If an internal test reveals that one or more of a subsystem’s performance metrics fall below an established baseline, the backup subsystem takes over while the primary subsystem undergoes a full suite of diagnostic tests to pinpoint the problem. So even though the primary system is not in service, the availability of the switch is not diminished. The switches themselves are closely monitored by on-site technicians as well as remotely from one or more NOC.

In selecting the services of a CLEC, however, telecom and IT managers should be aware that these carriers’ switches may not be provisioned in the same way as those of the Regional Bell Operating Companies (RBOCs). Many CLECs did not purchase central office switches in the volumes that would qualify them for discounts. Others lacked the negotiating skills to obtain feature parity with the RBOCs. As a result, they do not always have the redundant subsystems and features to provide their equipment with the highest level of reliability. To make a bad situation worse, some CLECs leveraged the reputation for reliability of their vendor’s equipment, while not actually having a configuration that would provide that level of reliability.

15.2.2 Signal Transfer Points

The carriers also operate signal transfer points (STPs), which are the computers that route network inquiries into their signaling networks. These signaling networks are separate from the networks that carry the voice and data traffic of customers; they are packet-switched data networks that use messages to set up calls and support intelligent services. The STPs are configured as mated pairs with separate processors. The load-balanced STP pairs are not collocated but are usually hundreds of miles away from each other and operate at just under 50% capacity. With this architecture, if something happens to one STP, its mate can pick up the full load and operate until repair or replacement of the damaged STP can be made.

15.2.3 Network Control Points

NCPs are the customer databases for advanced services such as 800 number routing. The NCP nodes process 800-number call-routing requests received from telephone switches in the carrier’s network. They have dual processors, but if the second processor should fail, there is a backup NCP that is called into operation, thus protecting the customer’s intelligent services information. With several levels of redundancy, there is little chance that customer information regarding services and features will be lost. By way of comparison, AT&T alone has 310 NCPs in its network—50% more than its nearest competitor—enabling it to provide the highest level of redundancy to cope with virtually any disaster scenario.

15.2.4 Digital Interface Frames

Digital interface frames (DIFs) provide access to and from Class 4 central office switches for processing calls. The DIFs that handle this work have spare units available to take over immediately should a problem occur. Guiding the overall work of each DIF are two controllers running simultaneously, so that if one experiences a problem, the backup controller can take over without the customer noticing.

In addition, certain switched business services such as 800, which entail large-quantity egress (traffic flowing off the carrier’s network) can make use of an optional capability. This feature sends a customer’s traffic to another DIF at another switch location if the customer’s primary switch encounters a problem.

15.2.5 Power Systems

Carrier switching systems derive power from the local utility companies. Power lines come into the building to provide direct current (dc) to redundant rectifiers, which distribute power to the switching equipment and battery banks. If commercial power fails, batteries, which are kept charged by the rectifiers, provide backup power. The power levels of the batteries are monitored to ensure readiness in case a commercial power outage should occur. An additional stage of redundancy is provided by diesel-fueled generators, which can replace commercial power for days or weeks at a time.

15.2.6 Cable, Building, and Signaling Diversity

A carrier’s network facilities (i.e., cable routes) are built as a series of circles or loops that touch one another to form an interconnecting grid. Should any particular loop be cut, such as by a backhoe operator hitting a fiber cable, a fair amount of traffic can be sent over one or more adjacent fiber loops. Construction of new facilities in recent years has focused on making these loops smaller and smaller to reduce the magnitude of problems when they occur.

Generally, in larger metropolitan areas, carriers are able to offer business customers building diversity. By being able to reach the carrier’s network at two distinct geographic locations, business customers can enhance reliability for their high-capacity switched and/or special services applications.

This is how STPs are protected as well. Each pair of STPs is connected to every other pair of STPs by multiple data links. To ensure that connectivity will always be available, these links are established through three geographically separated routes. Should something happen on one route to disrupt signaling message transfer, the other two routes remain available to keep the carrier’s signaling system operational.

Within each central office switch, there is a device that permits the switch to interface with the carrier’s common channel signaling system to send and accept information that is used to set up and deliver calls. Should this interface device malfunction, the switch can use special data links that are directly connected to one or more “helper” switches to gain access to the signaling network via their interface. In this manner, central office switches can continue to process long-distance calls while a repair is made. AT&T calls this backup signaling capability the alternate signaling transport network (ASTN).

The central office switches can also make use of ASTN should both halves of a mated pair of STPs fail. Each switch normally uses a particular mated pair of STPs to handle call setup. If something happens to the STP pair on which the switch normally relies, the switch can use ASTN to access the signaling network through helper switches that use a different STP pair.

15.2.7 Real-Time Network Routing

Some of the larger carriers employ very sophisticated call-routing schemes. The network of switches belonging to AT&T, for example, routes calls through a system known as real-time network routing (RTNR). This software system enables every switch within the AT&T network to know the available resource capacity of every other switch in the network on a real-time basis. Since AT&T has more than 130 switches in its U.S. network, customer calls will have more than 130 ways to be routed across the network. This path diversity enables high call-completion rates despite regional congestion and resource constraints. Together, the redundancy and alternate routing features of AT&T and other public networks enable AT&T to offer customers special restoration services.


15.3 Carrier Restoration Services

For most customers, a 5-minute service interruption is within tolerable limits. But other customers, such as businesses that rely extensively on inbound or outbound calling, need a much shorter restoration period. For these customers, carriers offer optional services that can be used to meet individual reliability requirements. These can range from the carrier planning and building a complete private network, to customers using one or more optional reliability features to meet highly specific needs. Of the more than 1,200 carriers operating in the United States today, none has a more comprehensive set of restoration services than AT&T. The following offerings, however, can also be used to make comparisons with other carriers:

  • Split-access flexible egress routing (SAFER). For users of dedicated access facilities, SAFER provides a backup mechanism to protect the exit ramp of an organization’s toll-free service to ensure consistent and reliable access to its customers. SAFER protects against network congestion, access facility failure, or a service disruption at the AT&T switch. SAFER can also be used to protect a business from a failed or busy T1 facility. If toll-free calls cannot complete through the normal terminating network switch, SAFER redirects these calls through an alternate switch in the AT&T network. This gives callers an alternate route to the business location. This mechanism is automatically activated in near real-time, whenever it is needed.

  • Alternate destination call routing (ADCR). For customers with toll-free operations in more than one location, ADCR allows the AT&T switch that normally carries the calls to the company’s location to route incoming calls to another business location automatically when a problem arises. For example, if a company’s ACD at the main location is unavailable or too busy with calls, any additional calls would be forwarded automatically to an alternate location. Calls could be directed either through the original AT&T switch or through an alternate switch, thus protecting against disruptions in AT&T switches, local exchange switches, or customer equipment.

  • Network protection capability (NPC). For digital service customers, the optional NPC provides a geographically diverse backup facility and will usually switch traffic to this backup route within 20 ms of a service interruption. When the service is fully restored, the NPC automatically routes traffic according to the original configuration. The backup and restoration processes occur so rapidly that the customer will not notice any disruption to service. If data is in transit during the configuration change, no data will be lost.

  • Enhanced diversity routing option (EDRO). To protect a business from service disruptions in the event of a cable cut or natural disaster, EDRO provides customers with a documented physical and electrical circuit diversity program. As part of EDRO, AT&T designs and maintains physically separate paths through its network to eliminate common points of failure between circuits. Under this option, diverse circuits are separated by at least 100 feet and avoid common AT&T buildings to further reduce the possibility of a common point of failure.

  • Access protection capability (APC). To protect the access portion of a customer’s circuit, APC provides immediate recovery of access circuits from certain network failures by automatically transferring service to a dedicated, separately routed access circuit.

  • Customer controlled reconfiguration. This service is available in conjunction with AT&T’s digital access and cross-connect system (DACS). CCR offers a means to route around failed facilities. The DACS is not a switch (PBX) that can be used for setting up calls in real time or for performing alternate routing on a dynamic basis; it is simply a static routing device. Originally designed to automate the process of circuit provisioning to avoid having a carrier’s technician manually patch the customer’s derived 64-Kbps DS0 channels to designated long-haul transport facilities, the DACS allows CCR subscribers to organize and manage their own circuits from an on-premises management terminal. Any changes will take a few minutes to a half-hour to implement because changes must be uploaded to the carrier’s network before they take effect.

  • Bandwidth manager services. For data services, AT&T offers network managers the capability of fine-tuning their WAN to handle dynamic applications requirements, such as LAN interconnection, videoconferencing, and traffic-load balancing. In addition, bandwidth management services can be used to automatically restore dedicated private-line circuits or redirect private line and frame relay service circuits to a backup location in the event of a circuit failure and/or a disaster at the primary site.

  • T1.5 reserved service. This service supports applications requiring T1 (1.544 Mbps) speeds. AT&T brings a dedicated T1 facility on-line only after the customer verbally requests it with a phone call. This restoration solution requires that the customer pre-subscribe to the service and that local-access facilities already be in place.


15.4 Fiber Network Restoration

The major carriers in the United States operate extensive fiber networks and have implemented architectures with sophisticated protection mechanisms to ensure uninterrupted voice and data services. Many of the smaller carriers with fiber networks, on the other hand, ran out of investment capital while expanding the reach of their backbones and did not have time to build much redundancy into their networks. Companies with mission-critical applications, therefore, should exercise due diligence when considering such carriers.

AT&T is one carrier that provides extensive restoration services for its fiber network. The carrier’s Fast Automatic Restoration (FASTAR) system provides automated facilities restoration for all types of services (special services and switched) traveling over AT&T’s fiber-optic transmission systems. FASTAR is designed to restore 90% to 95% of network circuits within 2 minutes, while FASTAR II is capable of rerouting circuits within 60 ms of a failure.

Specifically, FASTAR is a routing algorithm used to instruct DACS systems to reroute traffic around failed or congested routes. In the event of a fiber-optic cable cut in the core network, FASTAR automatically locates the exact site of the cut and transfers the affected circuits to spare capacity going around the cut. In this way, 72 T3 circuits can be rerouted by FASTAR within 5 minutes. Before FASTAR was introduced in 1992, T3 circuits had to be rerouted manually at patch panels, which could take hours.

When a facilities problem occurs, such as a cable cut, the following activities are typically performed by the FASTAR system:

  • The problem is identified;

  • The exact location of the problem is determined;

  • The amount and location of currently available protection or backup/spare facilities is determined;

  • A substitute route is constructed from the available spare facilities;

  • The substitute route is tested to ensure it is operational and of high quality;

  • The traffic on the damaged route is moved to the substitute route.

The FASTAR system goes through all these facilities restoration steps outlined but at computer speed and on a fully automated basis.

FASTAR II operates in conjunction with a network consisting of more than 50 double-interconnected SONET rings with ATM switching at crossover points to create a ring and mesh architecture for data services. Using overlapping, self-healing rings, FASTAR II can restore certain types of network failures, such as simple cable cuts, in milliseconds. With this type of outage, clients often do not even notice that traffic was interrupted.

Many other carriers also use SONET for disaster recovery, including RBOCs and CLECs. Fiber is deployed in redundant rings around major metropolitan areas and high-traffic corridors between major cities. SONET fiber facilities are typically configured in a dual counter-rotating ring topology, as illustrated in Figure 15.1. This topology makes use of self-healing mechanisms in SONET-compliant equipment [i.e., add-drop multiplexers (ADMs)] to ensure the highest degree of network availability and reliability. In the event of a break in the line, traffic is automatically switched from one ring to the other, thus maintaining the integrity of the network. In the unlikely event that both the primary and secondary lines fail, the SONET-compliant equipment adjacent to the failures automatically loops the data between rings, thus forming a new C-shaped ring from the operational portions of the original two rings. When the break is fixed, the network automatically returns to its original state.

Click To expand
Figure 15.1: Self-healing SONET-compliant fiber-ring topology. In this scenario, if the inner ring is cut or fails, traffic is rerouted in the opposite direction on the outer ring. The SONET equipment at node D changes the direction of the traffic.

SONET’s embedded management channels give carriers and users alike more capabilities for continuous monitoring and preemptive corrective action to impending trouble conditions. In private SONET networks, network managers can reconfigure channels and facilities without the involvement of telephone companies. Through software programming, it is even be possible to map SONET circuits so that they can be automatically rerouted to alternate carrier facilities should a failure occur on the primary circuit(s).

A new generation of optical systems have become available that offer much more bandwidth than SONET. WDM uses the different colors in the light source as separate high-speed channels. Each channel that can support a particular service, such as T-carrier for private lines, Gigabit Ethernet for LAN interconnectivity, Fibre Channel for storage-area networking, or ESCON for IBM mainframe connectivity. WDM-equipped fiber links can also transport SONET payloads. The WDM systems carry SONET’s embedded overhead channels transparently, which perform link supervision and gather performance statistics and allow SONET’s fault-recovery procedures to operate as normal to ensure network availability. With a 50-ms recovery time, WDM-matches the recovery performance of SONET in case of link failures, allowing both technologies to play complementary roles. And with embedded supervisory channels, WDM systems can report on a number of performance metrics to help diagnose problems with individual channels, as well as with the fiber link.


15.5 Packet Data Network Recovery

Frame relay is a popular data service for interconnecting LANs at multiple corporate locations. The data are sent over virtual circuits in the service provider’s network, which are priced on the basis of an assigned minimum increment of bandwidth (i.e., CIR) rather than distance, making frame relay more economical than private lines, especially for large mesh topologies.

One way to protect frame relay virtual circuits from loss due to a catastrophic failure within the carrier’s network is to subscribe to a dual frame relay service in which data traffic is load-balanced across two frame relay networks to provide businesses with uninterrupted service. The secondary network mirrors a company’s primary network, providing separate local-access lines, switch ports, and PVCs. Customers can seek either full or partial redundancy to their primary network without needing to diversify service across multiple carriers for optimal network reliability and availability.

Another protection method guards against the loss of a crucial port, which can be disastrous to a hub-and-spoke network configuration where multiple remote sites (spokes) are tied into a host site (hub). To protect the network if the host port goes down, carriers build PVCs from one or more remote sites to an alternate host port. When these PVCs are activated upon request, traffic is redirected to the backup host port within minutes. When the primary port is reestablished, traffic resumes to the primary host location. There is no need for complex rerouting algorithms within the CPE. The carrier’s restoration plan is tested to ensure proper operation when needed. In addition, customers can request tests on activation plans without charge. Several carriers offer this type of protection service for their frame relay customers.

One of the attractive aspects of using frame relay is that it offers more built-in reliability than leased lines such as T1. Although it does not offer error correction—this and other overhead functions of X.25, a predecessor packet technology designed for noisy analog networks in the 1970s, have been stripped out—frame relay has a dynamic rerouting capability. If a trunk on the carrier’s network goes down, the PVCs can be set up to be automatically rerouted over different trunks. In contrast, when a leased line goes down, traffic often must be manually rerouted to another available line with spare bandwidth.

The features of some frame relay switches maximize this inherent reliability to the point of creating a fault-tolerant frame relay network. These features include the following:

  • Fault-tolerant PVC: Provides automatic cutover to a designated set of backup ports on the frame relay switch, rerouting all affected frame relay circuits from a failed data center to a backup data center, for example.

  • Fault-tolerant trunking: Permits the frame relay switch to automatically establish a backup trunk to reroute all circuits over an ISDN network in the event of failure.

  • Access failure recovery: If a branch location loses access to the primary frame relay connection, an ISDN dial backup call is automatically placed to another frame relay switch.

Another type of packet data network relies on ATM technology. ATM uses very small fixed-length packets (also called “cells”) to achieve speeds in the gigabit-per-second range. At such speeds, traffic control is needed, especially since connections for each call may be routed through any number of intermediate switches. Each switch must be able to handle all pass-through traffic. Congestion problems occur when the input rate of traffic into a switch exceeds that switch’s available link capacity. Long-duration congestion is not necessarily a function of switch design; it just might be better handled with improved network design or increases in overall network capacity. Short-duration network congestion often can be alleviated simply by configuring the switch to buffer inbound data. ATM’s rate-based congestion control scheme provides end-to-end control using single-bit feedback. The switch monitors the network by way of these feedback bits and, when traffic is detected, adjusts the data rate up or down until the problem goes away.

High-speed ATM services over the WAN are implemented over highly reliable optical-fiber facilities, specifically SONET, which confers a high degree of reliability to ATM. Not only can SONET rings protect ATM traffic with its sub-50-ms service restoration capability, the embedded management channels of SONET can be used to detect real or impending performance problems. Consequently, ATM does not need much in the way of management functionality beyond a simple congestion control mechanism in the carrier’s network and QoS parameters implemented at the customer’s equipment and carried through the ATM network at initial configuration.


15.6 LEC Restoration Services

In recognition of their customers’ need for fail-safe voice and communications, LECs offer a variety of restoration services. Unfortunately, many of these services are available on a regional basis only. This means that companies with networks spanning multiple regions must implement their own restoration mechanisms via CPE, rely on local carriers for whatever restoration services might be available at each end of the circuits, or opt for an outsourcing agreement with a long-distance carrier to handle restoration from end-to-end.

  • Remote call forwarding. LECs can sharply reduce the time it takes to restore vital telecommunications services in the event of a crisis. If a customer needs to reroute voice traffic, many carriers’ customer care teams will facilitate a courtesy remote call forwarding arrangement and customize the number of paths the customer needs. This goodwill capability allows a business to continue its operations until its primary services are restored.

  • Preferred call forwarding. LECs also offer customers the ability to control the rerouting of incoming calls to a predetermined backup location in case of an outage. Preferred call forwarding is a line-side feature that is often available on a presubscription basis so that rerouting takes place as soon as an outage occurs.

  • Alternate serving wire center. In some cases, companies will want to split their voice traffic between carriers (e.g., inbound versus outbound trunk groups). Local loops can sometimes be provisioned to the same building from two different carriers’ wire centers, offering switch diversity. Even if only one carrier’s services are used, an additional level of protection can be achieved by bringing connections into the building at two different points of entry (see Figure 15.2), so that if the services on one route go down due to a cable cut, the services on the other route remain in operation.

    Click To expand
    Figure 15.2: Dual points of entry for connections into a building provide protection from cable cuts.

  • Dynamic rerouting. To support recovery services, many of the larger LECs have upgraded their central offices with fiber-optic lines and DCS. Normally, the cross-connect systems are used to set up semi-permanent, high-speed routes between central offices. However, when a DCS is equipped with its own processors and runs management software, it can automatically redirect network traffic to and from various central offices on demand. This dynamic rerouting capability is especially valuable in circumventing cable cuts and faulty central office switches, providing customers with highly reliable communications services.

  • Self-healing fiber rings. Major LECs and some of their competitors have installed fiber rings in metropolitan areas, which provide disaster recovery. T1 and T3 connections are protected with alternative routing in the event of node failure on a fiber-optic network. Another restoration service is the self-healing capability of some fiber networks, whereby traffic traverses a redundant counter-rotating ring. If there is a failure on one ring, traffic continues in a different direction to its destination, bypassing the fault.

  • Customer reconfiguration. A few LECs provide a comprehensive, real-time management service, which is used in conjunction with their portfolio of digital private-line services. The service allows customers or, if they prefer, the carrier, to reconfigure their private-line networks and perform a range of management functions, such as including DS3 hubbing and reconfiguration, automatic loop-back testing of backup circuits, time-of-day routing, load balancing, and diverse routing.

  • Emergency access. Major LECs and some of their competitors have arrangements in place with state authorities to gain access to areas and buildings during declared emergencies. The carriers maintain databases of CAD drawings of equipment configurations to assist in any required service restoration efforts. In addition, the carriers participate with each other in industry discussions about ways they can assist each other to sustain communication services in the event of local disasters or national emergencies.


15.7 Competitive Access Providers

In some cases, large corporate users have an incentive to move their traffic from a LEC to a competitive access provider (CAP). Users claim that the CAPs offer cheaper and more reliable access service and solve problems faster than the local exchange. Some users are switching to the CAPs solely for diverse routing and disaster recovery, while others are using the carriers for improved responsiveness and cost savings.

Typically, the CAPs set up a dual fiber ring in which the protect path is physically separate from the working path. In the event of service degradation or disruption—such as a cable cut—service is automatically switched to the protect path within a matter of milliseconds, permitting uninterrupted traffic flow.

LECs and CAPs sometimes cooperate in disaster prevention by interconnecting their networks. In broadening the interconnection of their networks, users are provided with more choice for disaster recovery services.


15.8 T1 Restoration

T1 facilities constitute the backbone of many private networks. Companies have a variety of means at their disposal to protect their T1 networks from congestion and link failures. Traffic can be offloaded to standby links or the switched digital services of various carriers. The CPE that handles this is usually the T1 multiplexer.

T1 multiplexers with advanced transport management systems can satisfy the instantaneous restoration requirements of the high-capacity facilities on today’s global WANs. For hybrid networks consisting of a combination of dedicated private lines and switched digital services, this means having a multiplexer that fully supports ISDN and other switched digital services. For dedicated (non-switched) networks, it is the inherent routing and rerouting capabilities that are important because they determine whether the T1 multiplexer will make a viable alternative to carrier-based restoration methods.

15.8.1 T1 Backup Via ISDN

Primary rate ISDN offers a viable solution to backing up private T1 facilities. Under ISDN, the typical time required for call setup is 3 to 10 seconds. Thus, the PRIequipped multiplexer permits traffic to be rerouted from a failing T1 line to an ISDN facility in a matter of seconds, rather than hours as is required by other restoration methods. With ISDN, the customer pays a monthly charge for the primary rate local-access channels but pays for the interoffice channels only when they are used. Figure 15.3 illustrates how primary rate ISDN can be used for backing up a T1 private line.

Click To expand
Figure 15.3: Configuration for ISDN backup for a T1 private line.

ISDN can also be used to back up fractional T1 (FT1) links. If a fractional link goes down, dial backup to ISDN can be implemented in a manner analogous to placing a standard telephone call. Each T1 multiplex node equipped with ISDN PRI could then be programmed with ISDN dial numbers for use in the event of a system failure. Placing ISDN calls would result in 64-Kbps or 384-Kbps channels being placed into service within a few seconds, and the network could then reroute private network voice and data traffic over the newly allocated channels.

15.8.2 Automatic Routing and Rerouting

A T1 multiplexer can automatically implement circuit routing through specific network circuits. The circuits to be routed are identified by the operator on a per-circuit or user group basis. The T1 multiplexer then chooses the best path based on a match between the circuit profile and the attributes and parameters of the aggregate.

The characteristics of each aggregate are determined during network configuration. The data entered is used in conjunction with circuit profiles to ensure optimum routing. In this way, a routing scheme is executed based on quality considerations to ensure the integrity of the applications. The quality-based parameters of each aggregate include delay, error rate, availability, and user-defined attributes.

A T1 multiplexer’s ability to perform automatic rerouting quickly and efficiently without the need for operator intervention ensures the continuous connectivity of critical applications. The T1 multiplexer maintains full optimization of all routes in conformance with the quality-based routing parameters established during initial circuit configuration. Circuits can even be down-speeded (i.e., compressed at varying rates) to ensure that all users, not just a few, continue to communicate when routes become congested.

When confronted with congestion or impending circuit failure, the system automatically calculates rerouting based on each likely failure. In the event of a failure, the system automatically recalculates optimized routing based on current network conditions. After restoration, the system again automatically calculates the best rerouting in preparation for a possible second failure on the network. The system continues this rerouting evaluation process so that it can handle each new emergency until there is not enough of the network remaining through which to reroute traffic.

To ensure that the applications of the highest priority are always rerouted over the best paths during reroutes, priority rerouting is performed on a network-wide basis, rather than on a node-to-node basis. This feature determines whether unaffected circuits will be “bumped” to accommodate higher priorities.

Because applications require different grades of service to continue operating efficiently during line failures, circuits must be routed to the best path for each application, not just switched to any available bandwidth. An application-based priority scheme ensures that the network continues to support all applications with the best response times. After the emergency has passed, the network can be manually returned to its original configuration or automatically returned on a scheduled basis.

The security of sensitive data is also protected during reroutes. During initial circuit configuration, sensitive data can be assigned to encrypted lines to ensure that there is no breach of security during line failures. Circuits that should not be involved in the rerouting scheme at all are alarmed immediately, time/date stamped, and logged to the system controller when problems occur.

Many automatic reconfiguration schemes result in service denial. However, with a down-speeding capability, T1 multiplexers can implement reconfiguration without bumping users off the network. As configured in the circuit profile, voice transmissions, for example, can be automatically down-speeded on a selective basis during automatic rerouting to ensure that full network connectivity for all applications (voice and data) is maintained. The multiplexer’s ability to support software-selectable optioning of voice-compression algorithms ensures that adaptive down-speeding can be implemented to keep users on-line during automatic rerouting instead of forcing them to get bumped off the network. This permits continued operation with efficient T1 bandwidth fills and saves money, since fewer T1 lines are required for emergencies.

The ability to reroute a full T1 circuit without timing out front-end/host sessions is a paramount concern. Some T1 multiplexers are capable of rerouting a circuit in a few seconds. EIA signaling leads remain frozen in their current state during rerouting to ensure active connections for front-end processor/host sessions during aggregate line failures. This ability to reroute nearly instantaneously ensures that network users do not have to manually restart host sessions after circuits are rerouted.

15.8.3 Dial Backup

The dial backup function of the T1 multiplexer allows the network manager to communicate from the system controller to a remote node that has become isolated from the rest of the network. The network manager can use the secondary port on the system controller as the alternate communications channel, whereas the primary port would be used for supervisory data (see Figure 15.4).

Click To expand
Figure 15.4: Dial backup communications link between multiplexer nodes.

To access a remote node that has become isolated, the local controller initiates dialing of a stored phone number. After establishing the dial-up link, the controller routes supervisory data, which permits the controller to communicate not only with local nodes but with the isolated remote node. When the dial backup function is no longer needed, the controller terminates the link, and the dial backup port returns to normal and is again available for test purposes.

15.8.4 Network Modeling

With the T1 multiplexer’s management system, network planners can simulate various disaster scenarios on an aggregate or node level anywhere in the network and devise effective recovery solutions. Off-line simulation allows planners to test and monitor changing conditions to determine their impact on network operations.

Models can be created that typify network failures and determine the viability of recovery strategies—all without impacting current network operations. The various models can be stored and retrieved for implementation when needed, eliminating guesswork during emergencies.

Through menu selections, the network planner can simulate aggregate failure, which then invokes automatic rerouting. During the simulation, optimum channel routing is determined from the quality-based parameters. The network planner can also simulate a node failure by forcing total aggregate failure to that node. The automatic rerouting algorithm then reroutes channels based on the entire node failing. The simulations do not impact the active network. Any of the stored reroute scenarios can be retrieved to facilitate disaster contingency planning.

Of course, this kind of network modeling can also be done with a variety of third-party tools. Although many do not provide easily verifiable data, they nevertheless make good prototyping tools for capacity planning, what-if modeling, and disaster-recovery scenario development. Some products feature a simple graphical interface, drag-and-drop features, and intuitive modeling functions that allow managers without network design experience to use them successfully. A systems administrator, for example, can use this kind of tool to help decide if switched T1, frame relay, or ATM is best for LAN interconnection over the WAN and what impact there might be on the entire network if one or more of these circuits should fail.

15.8.5 Inverse Multiplexing

Through an inverse multiplexer, a company can set up the appropriate switched digital bandwidth needed to temporarily replace failed higher-capacity private leased lines. By aggregating multiple channels available from the carrier—usually in increments of 56K/64 Kbps—users pay for the number of local-access channels only when they are used to transmit voice, data, or video traffic. Upon restoration of private facilities, the on-demand switched digital channels are taken down and carrier billing stops.

Under this bandwidth-on-demand concept, extra bandwidth can be set up to accommodate peak traffic periods, as well as to reroute traffic from failed private lines. Advantages to this approach include: the immediate availability of bandwidth; the user pays only for bandwidth used, according to time and distance; and the elimination of the need for standby links that are billed for whether fully used or not.


15.9 DDS Dial Backup

Despite carrier claims of 99.5% availability on DDSs, this still leaves room for 44 hours of downtime annually. This amount of downtime can be very costly to brokerage houses, airline reservation systems, and other firms that depend heavily on time-sensitive transactions in their daily business operations. To offset this potential amount of downtime, several dial backup solutions have become available for digital data services.

Digital data sets—the front-end devices used on the DDS lines—have the ability to “heal” interruptions in transmission. Should the primary digital network facility fail, communication is reestablished over the public-switched network via the data set’s built-in modem and integral single-call dial backup unit.

Sensing loss of energy on the line, the local data set automatically dials the remote data set, which sets up a connection through the public-switched network. Data is then rerouted from the leased facility to the dial-up circuit. If the normal DDS operating rate is 19.2 Kbps, dial restoration entails a fallback to 9.6 Kbps. For all other DDS rates (i.e., 2.4, 4.8, and 9.6 Kbps), the transmission speed remains the same in the dial backup mode, so the capability of adjusting the speed downward is not necessary.

While in the dial backup mode, the data set continues to monitor the failed facility for a return of normal energy levels, which indicates an active line. When the data set senses that the primary digital network service has been restored, it reestablishes that communications link and drops the temporary switched connection.

In addition to supporting automatic transfer between primary (digital) and dial-up (analog) facilities, these units can also be used to perform less complex tasks such as simply notifying support staff of a service disruption so that an operator can manually implement dial restoration. For larger networks, the data set can be used in conjunction with a network management system for control and management reporting at the console. The unit can store telephone numbers to facilitate restoration in multi-tiered networks, which may have several potential points of restoration.

For DDS at 56 Kbps, organizations can use data service units (DSUs) on leased lines to initiate restoration over switched 56-Kbps services such as AT&T’s Switched 56 Service for dial-up, point-to-point 56-Kbps operation. For standalone applications, transmission over dial-up 56-Kbps facilities translates into lower costs because the user pays only for connect time to the network. In addition to supporting full-duplex synchronous data transmission at 56 Kbps over four-wire facilities, DSUs also provide line equalization, data format conversion, and diagnostic capabilities.

After a problem with the DDS link has been identified, the connection to switched 56-Kbps service is set up through available dialing procedures. When the backup link has been verified as operational, operators can switch the terminal’s business equipment interface from the dedicated DSU to the spare DSU.

Depending on the applications supported and the number of dedicated DDS lines within the network, patch panels or intelligent data switches can be used for “1 × N” switching between dedicated and switched lines. In this way, a single DSU at the central site may be used to back up multiple DSUs.

When the primary link is restored, the process of reverting to the normal line configuration takes place. The primary link is first verified as operational, and then the terminal business equipment interface is switched from the spare DSU to the dedicated DSU.


15.10 Intelligent Calling Systems

While dial backup systems are adequate for rerouting communications to the public-switched network from a relatively small number of failed private lines, they can be quite cumbersome to implement when a large number of lines are knocked out of service at once. In such cases, the ability to reroute traffic rapidly over dial-up facilities can save organizations from financial disaster. For large private networks, an intelligent calling system (ICS) may provide the solution.

Via a network management system, multiple dial backup calls can be initiated to remote sites. The ICS provides an economical means of initiating four-wire dial backup for analog and digital point-to-point or multipoint circuits operating at data rates of up to 19.2 Kbps. The ICS is especially suited for use on multi-drop DDS lines because it reduces the number of modems and standalone dial backup units required.

On notification of a failure, the ICS restores the faulty line(s). The system initiates two calls (or multiple calls for as many drops) from a central or nodal site with two dial-up lines, one for transmitting and the other for receiving. Stored telephone numbers are passed from the NMS to the ICS, which performs the automatic dialing. The ICS then notifies the network operator of the successful or unsuccessful establishment of the dial backup link by monitoring call progress tones. The system continues to monitor the link and report its status to the operator.

Conventional dial backup configurations require two dial-up lines for each leased-line circuit being restored—one line to transmit (Tx) and the other to receive (Rx). Fault-tolerant dial backup systems are capable of single-call, full-duplex operation. These units provide the means to maintain nonstop communications while allowing users to save up to 50% in monthly dial backup charges.

From a central site, the ICS executes all restoration routines through commands issued from the NMS. Selected routines are monitored and the status reported back to the NMS. Under normal conditions, the fault-tolerant dial backup systems pass data between the leased line and the diagnostic modem. On failure of the leased line, the dial backup system automatically answers the phone call in response to ring signals carried over a switched network line, which initiates the dial backup process. When the connection is established, the data is transferred via the public network, thereby restoring communications. While in the dial backup mode, the diagnostic modem remains under constant management system surveillance. Termination of the dial backup call is under control of the network manager at the central site.


15.11 Dial Backup Units

Over the years, dial backup units (DBUs) have come into widespread use for temporarily rerouting modem and digital data set transmissions from failed facilities to the public-switched network. A DBU may be a standalone device that plugs into a modem or an optional add-in module that sits on top of the modem’s main circuit board.

On failure of the primary line, operation over the public-switched network can be manually or automatically initiated. At the remote site, the dial backup unit answers the two calls automatically. When the handshake sequence is completed and the dial backup connection is established, the flow of data resumes.

On restoration of the failed line, dial backup is terminated in one of two ways. The central site operator manually releases the backup switch on the dial backup unit. Alternatively, when in the automatic mode, the dial backup unit re-establishes the leased line on detection of acceptable signal quality. With either of these actions occurring at the central site, the remote site’s dial backup unit automatically disconnects, and all communications are transferred to the primary line.

There are two possible methods for initiating dial backup over the public switched network: manual-originate with automatic answer and auto-originate with automatic answer. In the manual-originate mode, the operator sets up a dial backup circuit for a failed data line, and the remote end answers. After a security check, the transfer of lines is implemented, which is accomplished by entering the backup mode, dialing a remote station over a regular business line, and switching to the backup circuit. No telephone set is necessary if the DBU does the dialing. In the auto-originate mode, the DBU recognizes a leased-line failure or signal-quality degradation and automatically establishes communications via the public-switched network to the remote site.

In both the manual-originate and auto-originate modes, the remote location is treated as unattended; the auto-answer capability provides the means to automatically answer a dial backup call. An auto-terminate capability disconnects the backup call when the originating site ceases to transmit due to the restoration of the primary link. An auto-abort capability disallows call transfer and disconnects the call if the handshake protocol (including the security check) is not properly completed. This prevents wrong-number calls from disturbing the network, thus minimizing its vulnerability to hackers.


15.12 Satellite-Based Restoration

Satellite carriers offer shared network restoration arrangements, whereby traffic is routed off failed terrestrial facilities and carried over previously contracted satellite links. There are, however, limitations associated with such arrangements, including the long lead time (a minimum of 24 hours) required to place backup satellite circuits into operation and the associated high cost.

Some very small aperture terminal (VSAT) vendors offer a complete restoration package that includes equipment, data recovery services, and an emergency procedures plan that is implemented in the event of a data communications failure. At least two types of services are offered on a subscription fee basis: on-call or dedicated. With on-call service, the vendor stores the necessary equipment at its headquarters under a constant test environment so that the backup devices are ready for immediate delivery to the customer’s site. Data recovery takes place within 24 hours from the time that vendor receives the customer’s emergency call. With dedicated service, the equipment is in constant standby operation at either the vendor’s headquarters or the customer’s host facility, or it is shared between both locations. This dedicated standby arrangement allows for network restoration in a matter of minutes.

Included in the subscription fee are all of the necessary satellite transponders, receivers, and VSAT dishes, which are provided by the vendor. The disadvantage of this arrangement, however, is that it is tantamount to the customer having redundant facilities in place, just waiting for a disaster to occur. Under abnormal network conditions, these redundant facilities would not be a disadvantage, but under normal networking conditions, the customer must still pay whether or not the equipment and service are ever used.


15.13 LAN Internets

LANs at distributed locations can be interconnected in a variety of ways—private lines, IP, frame relay, and ATM. When cost savings is the overriding factor, IP is used to exchange files between LANs at any location—even between the LANs of different companies. But there are serious security concerns that must be addressed, if sensitive information must be exchanged. When there are only two locations involved, a point-to-point private line will usually suffice and be more secure than IP. When more than two locations are involved, frame relay is the best choice, especially over long distances and when a fully meshed topology is required. Frame relay is as secure as private lines. When high-speed connectivity at 45 Mbps and above is required and real-time applications are involved, ATM is the appropriate choice and it is also as secure as private lines.

Routers are used for LAN-to-LAN connectivity and they can be configured to send traffic over another path when they sense that they can no longer send to the next nearest router or switch. However, they are less effective for rerouting a second time based on circuit congestion. The reason is that when primary circuits fail, secondary circuits often fill up quickly. This underscores the need to plan ahead for a network failure by giving the designated backup circuits enough bandwidth to handle the overload.

There are ways to address this problem. Carriers’ data services—IP, frame relay, and ATM—can be configured to deliver their traffic over alternate routes if the primary routes become unavailable. On the access links to the carrier’s network, however, it is still advisable, in many cases, to provide facility backup, if only to ensure that there is a local path always available between the company and the carrier.

Some access routers and IADs use inverse multiplexing to ensure continuous traffic flow despite the failure of one or more access links. IMA, for example, offers an efficient and economical way to tap into ATM networks for all types of traffic, providing scalable bandwidth over multiple T1 access lines ( N × T1) for extending PBX services and interconnecting LANs and private networks for voice, data, and video.

First generation multiport ATM routers and IADs that supported IMA, however, did not offer failure protection. In fact, if one of the T1 access links went down, the entire virtual connection went down, leaving the customer without communications. Today’s equipment not only provides bandwidth scalability, many IMA units feature built-in failure protection as well. Should one of the T1 links in a trunk group fail, traffic continues to be distributed over the remaining links (see Figure 15.5). When the failed link is restored to service, traffic is automatically distributed across the entire trunk group.

Click To expand
Figure 15.5: Devices that provide IMA now support trunk group failure protection, allowing communication to continue despite the failure of one or more access lines in the trunk group. (In the bottom diagram, the failed line is indicated with an X.)

This feature—the ability to maintain traffic flow in the event of a T1 circuit failure-—has proven attractive to customers of ATM services. IMA is built on redundant T1 circuits, and the probability of multiple T1 access lines failing at the same time is low compared to the possibility of a single T3 access line failure. Local circuit redundancy is a significant and sought-after benefit of IMA, especially among smaller companies considering ATM services. To prevent an equipment failure from making the access lines unavailable, many IMA devices are offered with optional redundant control logic, ports, power supplies, and fans.

In addition to N × T1 IMA, the access equipment may have a T3 (45 Mbps) or OC-3 (155 Mbps) ATM interface, so that if a company grows to the point of needing more than eight T1 access lines, the same system can support it without the company having to buy a whole new system. If the equipment does not come with the higher-speed interface, a plug-in module can be added at an incremental cost.

Today’s IADs offer carriers graphical interfaces for provisioning, configuration, and management. From a central network operations center, technicians can configure the device, perform diagnostics and troubleshooting, and gather and analyze performance statistics. These remote management capabilities are especially important for smaller companies, since they are not likely to have technical expertise on staff. The proactive monitoring capabilities of the carrier’s 24/7 NOC means that most problems will be discovered and fixed before the customer is even aware that a trouble condition exists with the equipment or access lines.

When backing up WAN circuits—regardless of the type of service or the applications running over them—the disaster recovery options boil down to the following:

  • Diversify the carriers and the routes that circuits will take;

  • Diversify just the route;

  • Have redundant facilities and extra bandwidth already in place;

  • Rely on the carrier to recover the circuits;

  • Use a combination of protective measures.

The mission criticality of the data, response-time requirements of the applications, and budget constraints will determine the choice of disaster recovery options for the WAN, as well as the access links.


15.14 Conclusion

Many corporations typically focus on protecting information systems at the expense of telecommunications services, preferring to leave the latter to various carriers and service providers. But both are critical elements of business continuity, and companies can take steps to better protect telecommunications by weighing the various protection options that have become available in recent years. Businesses, therefore, should conduct an analysis of what defines their organization’s critical business functions and how telecommunications services support those functions. This should include identifying and prioritizing risks (such as natural disasters or terrorist attacks) that correspond to those functions and establishing policies to avoid or mitigate those risks.

In the past, most organizations relied on their local or long-distance carrier for maintaining acceptable network performance. More often than not, the carriers were not up to the task. This led to the emergence and spectacular growth of private networks in the mid-1980s, which allowed companies to exercise close control of leased lines with an in-house staff of network managers, technicians, and other support personnel.

Today, companies are once again relying on carriers to maintain acceptable network performance. In their eagerness to recapture a lost market, carriers have made great strides in improving their response to network congestion and outages and back up their performance with SLAs. The ability of carriers to restore failed lines and whole nodes quickly and efficiently has gone a long way toward restoring lost confidence that once prompted companies to set up and maintain their own networks. The carriers’ ability to meet virtually any customer requirement for reliability is a compelling argument for returning to the public network for voice and data services.

With more and more companies recognizing the strategic value of their private networks, the ability to restore failed lines and whole nodes quickly and efficiently becomes an essential network planning consideration. By using the inherent restoration capabilities offered by more sophisticated network systems and equipment (such as T1 and inverse multiplexers and intelligent calling systems), companies can make use of standby links or available carrier services until primary links are restored to service. In the process of optimizing their networks for reliability and availability, companies can greatly enhance their competitive position.

These benefits are attainable by devising a disaster recovery plan for critical information systems and telecommunications services. The plan should include establishing primary and alternate recovery teams, setting up notification procedures such as call trees, determining primary and alternate meeting sites, tracking inventories of systems and services, having readily accessible contact information for vendors and carriers, and clearly defining contingency procedures and lines of responsibility. Periodic training and testing for the disaster recovery team is a way to fine-tune the contingency plan and ensure that all of the components of the plan work when disaster strikes.


Chapter 16: Maintenance and Support Services

16.1 Introduction

With increasing reliance on voice and data networks, telecom and IT managers must become more attuned to the importance of evaluating vendors in terms of their maintenance and support capabilities prior to making major purchase decisions. Over the allowable depreciation period for telecom equipment and information systems, the cost of maintenance and support can easily meet or exceed the original purchase price. Since this hidden cost can consume as much as 20% of the telecom or IT budget, it must be factored into the price-performance equation.

Dozens of individual activities encompass the service and support offerings of carriers, vendors, and third-party firms, including the following:

  • Site engineering, utilities installation, cable laying, and rewiring;

  • Continuous monitoring of the system or network for proper performance, alarm interpretation, initiation of trouble tickets, problem-resolution tracking, and implementation of diagnostic activities;

  • Notification of the appropriate hardware vendor or carrier for service restoration;

  • The repair or replacement of the faulty system or component by a service technician dispatched to the site;

  • Escalation of problems to a higher level of expertise when they cannot be readily solved;

  • Work-order administration, inventory tracking, and maintenance histories;

  • Administration and implementation of equipment moves, adds, and changes;

  • Network design, tuning, and optimization;

  • Systems documentation and training;

  • Preventive maintenance scheduling and implementation.

A variety of other types of support are also available, such as 24-hour telephone (hot line) or Web-based assistance, short-term equipment rental, fast equipment exchange, guaranteed response time, and customized cooperative maintenance plans that qualify the organization for premium reductions if an internal help desk is established to weed out routine problems, most of which are applications related. An increasingly popular support offering is remote diagnostics and network management from the vendor or carrier’s NOC, which performs continuous surveillance of equipment and access lines on a 24/7 basis.

The following are methods of delivery for maintenance and support services, each with its advantages and disadvantages:

  • In-house staff (do-it-yourself);

  • Equipment vendor or communications carrier;

  • Cooperative arrangement between user and equipment vendor or communications carrier;

  • Third-party maintenance firm.

The choice of delivery method hinges on several factors, including the resources of the organization, the type of business it is in, and the talent pool in the locations in which it has a physical presence. Of course, the state of the economy plays an important part in what delivery method is used. When economic growth is slow, for example, companies are under pressure to contain costs and may see outsourcing arrangements as the way to accomplish this and still get the services they need.


16.2 Do-It-Yourself Approach

In recent years, many large organizations have become more self-reliant out of dissatisfaction with the QoS and response time provided by vendors and other maintenance providers. Although the vendor community has become more aware of the service needs of businesses and is attempting to meet these needs with new and flexible programs, backed by SLAs, many are simply too small to have elaborate service programs that can respond quickly when customers experience trouble with their networks. In addition, most equipment vendors lack a nationwide—let alone international—service presence. To do so, they enter into strategic relationships with maintenance firms to ensure that an acceptable level of service and response is available to their customer base.

Many large organizations provide their own maintenance services, if not for high-end systems such as backbone routers and PBXs, then for LAN-attached equipment such as microcomputers, printers, and other peripherals. All such equipment is very sensitive to heat, static electricity, dampness, dust, grease, food and drink, and smoke. An in-house preventive maintenance program can mitigate the damage done by these contaminants, thereby prolonging the useful life of equipment and saving money on vendor-provided maintenance services.

Scheduled preventive maintenance every 100 hours or so can spot such common problems as misaligned heads on disk drives before extensive damage is done to the disks, rendering stored data irretrievable. Preventive maintenance also involves checking air filters and ventilation systems in the data center and wire closets, testing UPSs for proper operation, and periodic inspections for proper electrical grounding.

By performing their own preventive maintenance, many organizations are discovering that they can reap substantial savings in both time and money. Furthermore, the ready availability of technical training, certification programs, and comprehensive troubleshooting guides, as well as relatively inexpensive test equipment, makes faulty subsystems, boards, and chips fairly easy to isolate and fix. Of note is that the FCC’s Part 68 regulations prohibit repair or modification of registered equipment, except by the manufacturer or its authorized service agent. Failure to comply with this rule may void the warranty and possibly FCC registration. [1] Spare parts can be ordered by phone and, in most cases, same-day shipped for delivery the next day. In extreme cases, in-house technical staff can ship the faulty unit to a maintenance firm that can provide a loaner until the original equipment is repaired.

With in-house technical staff and a help desk, most problems can be diagnosed and fixed in a short amount of time, especially if they are applications problems. Users can be up and running again in a matter of minutes instead of waiting hours (or the next business day) for outside help to arrive. But in deciding whether to handle maintenance in-house, the organization must determine if it has the resources, time, and commitment to handle the job. Corporate executives must become “ diagnostic aware” and demonstrate support for the program with a realistic budget and charge telecom and IT managers with responsibility for carrying out the program.

Many companies perceive no risk at all in providing in-house maintenance services, mainly because advances in technology and production processes have combined to greatly increase the reliability of today’s communications products. In addition, many products are now modular in design, permitting fast isolation and easy replacement of faulty components from inventory. Some products even come standard-equipped with redundant power supplies, back-planes, and control logic so when the primary subsystem fails, the secondary subsystem takes over, often without users being aware of the change. While these factors contribute to the timeliness and quality of in-house maintenance, this is not to say that an in-house maintenance program will come cheaply. In fact, an in-house maintenance program requires a substantial investment in technical staff, among other things.

16.2.1 Resource Requirements

A corporate communications department is usually divided into functional areas, with each area staffed to carry out a set of responsibilities; among them, the help desk, technicians, and operations management. There are several reasons for such specialization, including the following:

  • The communications department must be able to provide the best possible response to its user community;

  • The department must have efficient and cost-effective troubleshooting procedures to minimize downtime and conserve expensive labor resources;

  • The department must have systems and network management expertise—a necessity in today’s multi-vendor voice and data communications environment.

These areas virtually demand specialized staff with an up-to-date skills inventory. Failure to divide the communications department into functional areas can jeopardize response to trouble calls and, in extreme cases, prolong the downtime of systems and networks.

16.2.2 User Support

The first level of operations support is the user support position, which is essentially the help desk. This is the first point of contact for users experiencing problems. The responsibilities of this individual or group fall into several categories: trouble reporting; handling move, add, change requests; user training; and record-keeping. This position requires individuals with demonstrated interpersonal communications skills, as well as technical competence in the use of applications, databases, systems, and networks. Usually, there will be several people with different skills manning the help desk to provide appropriate assistance.

Trouble Reporting The help desk handles troubles by doing the following:

  • Screening the problem to ascertain whether the trouble is with the user, application, database, system, or network to determine what level of expertise should be brought to bear on the problem;

  • Instructing users on the proper operation of hardware and software to prevent a recurrence of the reported problems;

  • Preparing and administering trouble tickets to identify, organize, and track problem-resolution activities;

  • Initiating and maintaining log entries to provide statistics on troubles by category on a daily, weekly, or monthly basis;

  • Monitoring trouble report escalation, according to defined response times and escalation procedures;

  • Verifying cleared troubles with users to determine level of satisfaction and service quality.

Users report problems via a “hot line” telephone number or through the help desk application accessible on a Web page (see Figure 16.1) posted on their company’s intranet. Help desk operators are usually able to answer between 50% to 70% of all calls without escalating them to another authority.

Click To expand
Figure 16.1: Users can submit trouble reports from a Web form posted on the company’s intranet. (Source: © 2003 HelpSTAR.com. Reprinted with permission.)

With expert systems in place, help desk operations can become more self-sufficient in handling user problems, even if a particular problem transcends their technical expertise. Basically, expert systems rely on massive databases, often called knowledge-bases, which store the accumulated solutions to a multitude of problems. Technicians, network administrators, or help desk staff can input a symptom, and the expert system will propose a course of action based on the stored knowledge gleaned from past experiences resolving problems. Some expert systems are capable of accepting plain-language input from non-technical people, who will use the plain-language output to restore malfunctioning systems or networks.

The knowledgebase is continually updated with new information from application-and communication experts, making it accessible to others when needed. Whenever the resident expert is unavailable, that accumulated knowledge and expertise can still be applied, translating users’ problem descriptions into workable solutions.

Move, Add, and Change Requests

The help desk also handles move, add, and change requests by doing the following:

  • Processing move, add, and change requests from users, workgroups, and departments;

  • Assigning dates for when the move, add, or change becomes effective and generating a work order;

  • Scheduling technicians so they can go to the right location at the right time to implement the work order;

  • Monitoring the status of work orders to ensure the completion of move, add, and change requests by their due dates;

  • Updating the help desk database to facilitate problem resolution when the problems occur again in the future;

  • Creating service orders for the repair or replacement of components and subsystems by vendors;

  • Maintaining order and receiving logs to track the movement of new equipment and software;

  • Preparing summary reports of all activities on a daily, weekly, or monthly basis.

If a problem is beyond the capabilities of the help desk to resolve, it can be escalated to a higher level of support. In many organizations, the next level of support is a NOC, which provides a global view of all networks and systems. If the problem is occurring on a carrier’s lines, for example, the NOC has the authority to interface with the carrier’s staff by issuing a trouble ticket to resolve the problem.

User Training

The training function of the help desk includes the following:

  • Providing on-the-spot user assistance and training via the help line or through a remote-control “show me” connection, whereby the help desk operator takes over the operation of a remote desktop computer to show the user how to navigate through a database or application;

  • Conducting scheduled training sessions for multiple users, either in a classroom environment or distance-learning arrangement;

  • Interfacing regularly with various department managers to ascertain the training requirements of their staff;

  • Preparing training summary reports on a daily, weekly, or monthly basis.

A potential problem is that help desk staff may lack the qualifications or background to be instructors. When allowed to go unprepared into classroom training settings, inevitably little or no learning is the result. If the communications department cannot find or cannot afford experienced trainers, they must be developed from within. Many times, any shortcomings can be remedied by “train the trainer” sessions, in which help desk staff provide the company’s professional trainers with the necessary information with which to construct courses and deliver them to end users via classroom or on-line sessions.

Recordkeeping

Documentation is an important part of administering systems and networks. This function logically extends to the help desk as well. Essentially, it involves maintaining a central library of all operations logs and reports. This usually is accomplished with the aid of software associated with other help desk functions. Typically, data is entered into various on-line forms, and the forms provide the raw information used by the report generator to issue a set of standard reports. Most software of this type accommodates SQL, so reports can be customized to meet organizational needs. In addition, the information can be exported to other applications, such as spreadsheets, for further analysis and display in various presentation formats, including pie charts, bar charts, and histograms.

Interpersonal Communications Skills

The help desk requires individuals with demonstrated communications and organizational skills, especially the ability to prioritize tasks so that they do not become overwhelmed. A sense of diplomacy and urgency are also very important. As the primary contact point for the user community, the support staff must have well-developed “people” skills so that users feel their problems are being given the attention required. The staff must also be self-motivated and self-directed to a large extent, since the workload is not set by a schedule but rather by the ringing of the phone or continuous e-mails.

Beyond the capacity for self-direction and possessing strong interpersonal communications skills, the support staff should have hands-on experience with a variety of hardware and software. After all, users require assurance that the support person is qualified to effectively handle their problems. Most hardware and software products have little quirks and nuances that are only appreciated through experience. Although this kind of information can be obtained from other support people and may even be available in the knowledgebase for easy retrieval, the need for formal cross-training may be warranted as organizations increasingly move toward multi-vendor and multi-platform environments. This situation becomes especially urgent during rough economic times, when all departments are asked to trim budgets but are expected to maintain their existing capabilities or workloads.

16.2.3 Technical Support

The next level of operations support is the technician, who may be assigned to work with help desk staff or NOC staff, either locally or remotely. The technician’s key function is to provide routine and remedial service for systems and networks through quick, efficient, and cost-effective diagnosis, troubleshooting, and service restoration procedures. The typical job responsibilities of a technician are summarized as follows:

  • Routine monitoring, which involves daily testing and adjustments to keep systems and networks optimized to handle applications efficiently;

  • Remedial maintenance, which involves problem identification, testing, and system or network restoration in response to trouble reports;

  • Preventive maintenance, which involves performing various maintenance procedures on a scheduled basis per manufacturer recommendation;

  • Interfacing with multiple vendors and carriers to isolate problems to a specific product or service;

  • Maintaining test equipment and the spares inventory;

  • Implementing move, add, and change requests;

  • Installing new systems or network components and cables;

  • Documenting all work.

Depending on the size and physical layout of an information system or network, the number of technicians and specialists required, as well as their respective skill levels, will vary. Training is an ongoing activity; in many cases, equipment warranties will not be honored unless in-house technicians have been trained by the vendor and achieve certification on specific products. The duration of such schools vary according to the type of product. A central office digital switch adapted for use on a private network, for example, may require up to 16 weeks of school at the vendor’s location. For a PBX, the training period may last up to 10 weeks; for a key system, 4 weeks; for most desktop computers, 3 days to a full week. Not only must the technician’s travel and living expenses be factored into the cost of in-house maintenance, the organization must be prepared to go without the benefit of that person’s services until training is completed.

16.2.4 Operations Management

The highest level of accountability is the operations manager, who is responsible for all operations procedures and resources and for the continuous availability of all systems and networks. This person may be in charge of the daily operations of the help desk and NOC and may report to a chief information officer (CIO). The typical job responsibilities for an operations manager include the following:

  • Oversight of all maintenance and operations functions, including fault detection; service restoration; vendor relations; software and database modifications; installation activities; moves, adds, and changes; and inventory and spares kit levels.

  • Evaluating system performance to identify any weak links or quality-control problems.

  • Evaluating vendor performance to determine if established standards, service levels, and other contractual obligations are being met.

  • Determining maintenance and equipment budgets in consultation with department heads and executive staff.

  • Determining required equipment to be ordered and any necessary system reconfigurations to accommodate corporate growth and expansion into new markets.

  • Providing technical, administrative, and policy guidance for technical staff and conducting staff performance reviews.

  • Planning, testing, and implementing mission-critical operating procedures, such as disaster recovery scenarios.

  • Establishing required service levels and response times in consultation with other departments.

In large organizations, more than one operations supervisor or manager may be required—one for telecom and another for data networks and perhaps others for the corporate intranet, information systems, and database management. In addition, there may be an entire workgroup devoted to maintaining the company’s Web site. If there is an extranet in place to share information among strategic partners, there may be a team dedicated to that operation as well.

[1]As of July 2001, the FCC no longer accepts applications for certification of terminal equipment under 47 CFR Part 68. Part 68 was originally designed to protect wire lines and telecommunications employees from harm, while fostering competition. It called for the phone companies to allow other manufacturers’ terminal equipment to be attached to their wire lines if the terminal equipment complied with Part 68, ensuring that the equipment would not damage the wire lines or harm personnel. The FCC decided that with the speed of technological changes and advances in the telecommunications industry, it would no longer micromonitor each piece of equipment. The Administrative Council for Terminal Attachments (ACTA) is now the body responsible for establishing and maintaining a database of equipment found to be compliant with industry-established technical criteria, establishing numbering and labeling requirements, and establishing filing requirements for certification.


16.3 Reporting Requirements

To justify system upgrades and network expansion, and to determine the requirements for maintenance and support staff, an understanding of the basic maintenance reporting requirements is necessary. The variables that need to be tracked on an ongoing basis include the following:

  • Network equipment replacement and repair;

  • Station equipment replacement and repair;

  • Software and firmware problems and versions;

  • Trunk-related transmission problems on the WAN;

  • Wiring problems on the LAN;

  • Database updates: nature, scope, and frequency;

  • Moves, adds, and changes;

  • Vendor and carrier performance;

  • User-related problems.

The information that is derived from these variables includes the time spent performing the following tasks:

  • Repairing and/or replacing faulty components and subsystems;

  • Testing and debugging software;

  • Monitoring the service quality of telephone companies, inter-exchange carriers, and other types of service providers;

  • Testing/installing wire and cable;

  • Performing moves, adds, and changes;

  • Conducting database modifications;

  • Keeping tabs on vendor response and reliability;

  • Conducting or supervising user training.

The collected information can be used in a variety of ways, such as the following:

  • Determining the spares inventory—types of components and quantities;

  • Predicting the frequency and level of parts replacement or repair;

  • Predicting the turnaround time for parts replacement or repair;

  • Determining the mean time between failures (MTBF) and mean time to repair (MTTR) of critical components and subsystems;

  • Determining the required number and type of labor hours for an appropriate staffing level;

  • Determining required support levels from vendors and carriers;

  • Determining vendor and carrier performance and reliability in terms of response times, speed of problem resolution, and number of calls requiring escalation.

A series of daily and monthly logs should be maintained so that periodic analyses-can be performed. These logs should be structured to incorporate all the factors previously discussed. On a daily basis, the following logs should be run:

  • Trouble activity;

  • Software bugs and alarms;

  • System maintenance;

  • System utilization;

  • Moves, adds, and changes;

  • Vendor notification and escalation.

On a monthly basis, the following reports should be run:

  • Trouble activity summary;

  • Software status;

  • Parts replacement and repair;

  • Preventive maintenance;

  • Vendor performance;

  • Move, add, and change activity summary;

  • Training activity summary.

As noted, the proper maintenance of systems and networks requires accurate record-keeping. Documentation procedures should be strictly enforced regardless of maintenance program—vendor or in-house.


16.4 Equipment Requirements

Along with a well-qualified staff and accurate record-keeping, conducting in-house maintenance requires an inventory of parts, tools, and test equipment.

16.4.1 Spares Inventory

A vital element in any in-house maintenance program is having appropriate types and quantities of components for both spares kits and general inventory. Spares kits are for the provision of on-site replacement for failed components, and their contents are derived both from the user’s experience with hardware problems and any mandatory spares requirements of a vendor service contract. Nevertheless, the following are ways to contain inventory costs:

  • Only order spares that cannot be readily purchased within the timeframe dictated by system or network uptime requirements. For example, if NICs can be bought on-line from a reliable local source for next-day delivery, there may be no need to stock them as spares.

  • Centralize spares, where possible, so that they can be made available to neighboring locations on short notice. This lets a single spare unit cover a wider area. Alternatively, an account with an overnight courier lets a single spare unit cover locations nationwide.

  • Avoid purchasing any equipment that uses hard-to-find or outdated components, or components that are hard to repair, whenever possible.

  • Have a disaster recovery plan in place that allows faulty systems, lines, and services provider networks to be bypassed when they fail. This will allow mission-critical operations to continue until the fault can be repaired or replaced.

Rather than try to keep pace with new products and technologies, many organizations implement in-house maintenance only for the installed base of older products, where the cost savings can be greatest. Not only are the older technologies stable and the need for continuous training eliminated, but spare parts may be acquired in the used equipment market or from other third-party sources at very reasonable prices.

16.4.2 Test Equipment

Test equipment also should be available at each location. A basic starter approach might include the following items, some of which are bundled into the same device:

  • Breakout box;

  • Tone generator;

  • Portable decibel meter;

  • Bit error-rate tester;

  • Data line monitor or protocol analyzer;

  • Power meter with graphical output;

  • Volt-ohm meter;

  • Time-domain reflectometer.

Large maintenance organizations might keep all test equipment in a central location. Technicians sign out equipment from the pool, as they need it. To account for all test equipment, a standard nomenclature is applied for describing the performance of each item and how it is tuned. All items are bar-coded for easy identification and for tracking the movement of items in and out of the pool. Some companies have even set up a reservation system to schedule the use of equipment in advance. If a technician knows a specific oscilloscope will be needed a month from now to do scheduled maintenance, for example, that item can be reserved to be sure it is available when needed.

Information about the movement of equipment in and out of the pool can be tracked in an asset management database. The operations manager has on-line access to the database so information on daily equipment usage can be obtained. This information can be used to determine whether new equipment should be added to the pool to keep up with demand. It can also be used to charge back equipment costs to appropriate departments, workgroups, or projects.

16.4.3 Service and Repair Documentation

In-house technical staff should be equipped with a full reference library of product-specific information regarding all aspects of system operation and service. Generally, the vendor or manufacturer provides a series of manuals documenting system architecture, operation, procedures for installation and service, and other technical and procedural information. Many vendors supply this information on CD-ROM, which can substantially shorten lookup time and, consequently, speed up the fault isolation and restoration process. Supplementary information may be available on the vendor’s secure Web site.

It is very important that arrangements be made to receive all updates and revisions as they are issued to the vendor’s field engineering staff. Some vendors provide this as a value-added service at charge extra. On a quarterly basis, the vendor provides the most up-to-date technical product information on maintaining system or network efficiency and reliability. Written by engineers and field service personnel, with an emphasis on how to more effectively operate and manage the vendor’s products, this information might take the form of technical bulletins, product application notes, software release notes, user guides, and field bulletins.

Other sources of technical reference information, software bug fixes and upgrades, and troubleshooting advice include user forums on such services as America Online and newsgroups on Usenet and other news feeds. Many vendors have set up private chat rooms that are available on their Web sites, making it easier for customers to discuss problems and solutions with each other. This self-help mechanism benefits the vendor in that it helps contain support costs. Vendors have extended the self-help concept to allow customers to configure their own products, select features and options, and then test them for validity before submitting their order on-line.


16.5 Vendor and Carrier Services

From an administrative perspective, the easiest way to obtain service and support is to let the equipment vendor or carrier handle it. There are some key advantages in doing so, which may override cost concerns.

The vendor can bring more resources to bear on a problem with its specialized staff of hardware and software engineers, who are experienced in solving a broad range of problems for an entire installed base of customers—domestic and international. The largest equipment vendors, and some maintenance firms, are able to expedite problem-solving with dial-up links from a NOC to remote customer sites. Using advanced predictive maintenance tools, customer systems can be monitored and analyzed to identify potential problems before they affect system performance. When something goes wrong with a system that is being monitored, the vendor tries to solve the problem remotely, such as reinitializing the inoperable system. Failing that, technicians are dispatched to the scene immediately with the right spare parts and information to correct the problem. Such an arrangement is roughly equivalent to having the vendor on call 24 hours a day, 7 days a week. This capability is especially important to large companies with international locations.

Most vendors offer a range of basic service agreements. Forty-hour-a-week service-is sufficient for most companies, with a time-and-materials provision for emergency service after normal business hours. There are also standard agreements for 24-hour, 7-day-a-week service. The price differential between the two plans may be quite high, as much as 30%. Most firms offering maintenance and support services will customize a service agreement to include performance guarantees, specifying such things as response time to trouble calls and penalties for given levels of downtime. Typically, penalties take the form of credits on future maintenance service billing.

Depending on the scope and complexity of service needs, it might be advantageous to retain a consultant to perform a needs assessment of maintenance and support requirements and, based on the findings, issue an RFP to ensure that the most qualified firm is selected. Another technique entails paying service firms a fee to perform the needs analysis with the understanding that, in the process, they are competing for the contract.

There is another way to obtain the level of maintenance and support services economically, but this usually involves taking more responsibility for diagnosing problems before calling in the vendor or maintenance firm. Such services usually require the customer to implement a help desk, which is staffed by personnel who can determine the cause of routine problems and offer solutions that will get the user up and running quickly. This minimizes unnecessary equipment downtime, saves the vendor unnecessary interactions with the customer, and eliminates unnecessary maintenance charges. The help desk can reduce overall maintenance charges by as much as 25%. In standardizing reporting procedures and structuring maintenance charges uniformly over its entire customer base, the vendor or maintenance service provider can reduce its own costs and pass the resulting savings onto its customers.

Another way that maintenance and support services can be obtained economically is through a master contract. Instead of negotiating each service option and getting the paperwork approved at several points within the vendor organization, the user signs one master contract. Each option is selected off the master list and initialed. This simplifies service administration, which benefits both the vendor and user.


16.6 Maintenance Firms

Many organizations, for one reason or another, are not willing or able to increase their involvement in maintenance and support activities, even if it qualifies them for substantial discounts. Nor can they afford to completely turn over management of their networks to a single vendor. For such firms, bargains abound among maintenance providers, and many do not base discounts on user participation via help desks. Instead, they provide whatever services customers need when the trouble call is placed.

Price and breadth of equipment coverage are the principal reasons companies opt for the services of maintenance firms. Generally, these firms are more open to negotiation on such matters as price and the types of equipment to be serviced. But this option can also entail the greatest amount of risk to uninformed users.

While cost savings and equipment coverage are important, care must be taken not to sacrifice service quality. Anything less is not only shortsighted but will end up costing more in the long run in terms of lost production due to downtime from inoperable equipment and/or unusable software. Before choosing this type of vendor, it is wise to inquire about response times, particularly for the organization’s remote locations. It is also necessary to check into how many customers the service firm supports at these locations, ascertain the staffing levels, and determine the locations of the nearest spare parts inventories. All of this information can be used to confirm vendor statements about response times.

The more types of equipment the maintenance firm supports, the better. This provides users with more flexibility in future equipment selections, since it eliminates the need to contract with other service firms. In a mixed-vendor environment, a maintenance provider who can handle everything eliminates finger-pointing among competing vendors. Before making a decision, however, it is a good idea to check the firm’s references and make inquiries about the ability of the vendor to work with prime vendors, who may be servicing mission-critical systems still under warranty.

A vendor’s capability to perform remote diagnostics will limit unnecessary downtime and save money over the life of the contract. The vendor should also have a computerized spare parts management system. After all, qualified technicians are of little value unless extensive spare parts inventories and a parts distribution network are in place to ensure fast delivery of the right parts on a moment’s notice.

If the maintenance firm can provide computer-generated reports on equipment service histories and reliability factors, by product line as well as by customer location, the information can be used to determine future equipment selections. And if the vendor’s computerized inventory and dispatch system is also used for billing, so much the better because there will be less chance of errors that tie up staff time with invoice reconciliation.

The maintenance firm should also have regional repair and refurbishment facilities, where equipment and printed circuit boards can be fixed or rebuilt. Oftentimes, this is a more economical alternative than purchasing new units. The company should also offer a warranty on items sent in for repair. A limited 90-day warranty is the norm.

Some maintenance vendors even stage new equipment and perform thorough systems-level testing before installing it on customer premises. If any problems are revealed, they can interface directly with the equipment vendor to resolve them. Meanwhile, the customer is saved from protracted dealings with a recalcitrant equipment vendor, while being spared the burden of having to deal with malfunctioning equipment.

Some companies may have doubts about the service claims of a particular maintenance firm but cannot resist the promise of big cost savings. One way to deal with this dilemma is to use the service firm on a trial basis at select sites to determine its response times and QoS. Upon demonstrating satisfactory performance, the company can gradually turn over more sites, rather than give out all of the available service business at once. The rationale of this strategy is to keep rewarding the vendor for good performance while, in the process, providing more incentive to perform. Many times such strategies will not be workable. The alternative is to stick with short-term contracts with the maintenance vendor to minimize risk until a consistent level of high performance is demonstrated.


16.7 Cooperative Maintenance Programs

The cooperative approach to maintenance, whereby in-house staff work right alongside primary vendors and third-party maintenance firms, can yield compelling benefits. Oftentimes such arrangements produce a synergistic effect among the various players that manifests itself in performance of the highest quality, resulting in maximum equipment uptime that, in turn, ensures a high level of satisfaction among the numerous users and work groups of the organization.

Such arrangements usually require that the customer establish a help desk to minimize trouble calls for routine problems. This allows the customer to keep maintenance costs in line by using experienced staff to perform first-level maintenance. Staff members are vendor-certified to assume responsibility for primary equipment service, responding to trouble calls and performing first-level troubleshooting and repair. The vendor acts as a support backup and as the primary escalation point for service.


16.8 Cabling Considerations

Another aspect of maintenance and support has to do with cabling. Although not the most glamorous aspect of maintenance and support, these are probably one of the most planning intensive, especially when tying together multiple floors in city office buildings or tying together multiple buildings in a campus environment.

When a new system or network is installed, invariably some wiring already exists, and there is strong economic incentive for its continued use. When new wiring is installed, the desire to make it as useful as possible in future feature and capacity expansions must be balanced against the initial installation cost.

16.8.1 Premises Wiring

There are typically several hierarchical layers of wiring that merit attention. With PBX installations, for example, these layers include the following:

  • The telephone carrier’s distribution frame or demarcation point. The termination of the carrier circuits on the premises and also the termination of carrier responsibility for the wiring (often, this is simply a series of terminal blocks through which user CPE is attached to carrier circuits).

  • The user’s incoming circuit distribution frame, a place where cross-connection between carrier lines and user CPE can be made. PBX cut-through or bypass lines used to answer or originate calls when a PBX fails may be attached here, in front of the PBX (this is normally placed with the carrier’s demarcation point and may be omitted if there is only one CPE destination for all lines).

  • The user’s telephone equipment, linked to the incoming circuit distribution frame on one side and to the private network or intermediate distribution frame on the other. The station pairs from the telephone system exit this equipment.

  • The intermediate private-network wiring distribution frame, where the telephone system station pairs are connected to terminal blocks or panels for matching with the building wiring.

  • Riser cables, which terminate in the intermediate distribution frame and link it to, for example, horizontal distribution panels on floors.

  • Horizontal distribution, or wiring-closet, panels that take riser connections and distribute them to the actual station wiring.

  • Outside wiring, serving the combined functions of riser cables or horizontal distribution cables where the run must exit a building and transit an outdoor space.

  • Station wiring, which links the horizontal distribution panel with the instruments.

The structured nature of the wiring process is designed to achieve an important goal—permit restructuring of the system without actually stringing new wiring or performing extensive rewiring to accommodate moves, adds, and changes. Virtually the same considerations apply to hub-based LANs.

16.8.2 Cable Plant as an Asset

In a properly designed wiring system, each cable pair should be viewed as a manageable asset, which can be manipulated to satisfy any user requirement. Individual cable pairs should be color-coded for easy identification. Cables should be identified at both ends by a permanent tag with a serial number. This permits the individual pairs to be selected at either end with a high degree of reliability and connected to a patch panel or punch-down block as appropriate to implement moves, adds, or changes.

Patch panels and punch-down blocks should be designed to segregate different functions or circuit types to expedite the easy location of pairs. Data and voice connections, for example, can be terminated in different areas of the panel or block to avoid confusion. Many panels and blocks are precolored or have color tagging capabilities, which can assist in locating pairs later.

The cabling used in wiring a telephone system or LAN depends on the requirements of the devices being used, and the formal distribution plan that the telephone system and/or computer vendor provides. Formal plans, such as IBM’s Cabling System or AT&T’s Premises Distribution System, compete with similar plans by nearly every major vendor. All of these plans have the common goal of establishing a wiring strategy, which will support present needs and future growth. The in-house technician (or maintenance firm) should be familiar with these cabling schemes.

There are a number of asset management applications available that keep track of the wiring associated with connectors, patch panels, and wiring hubs. These cable management products offer color maps and floor plans that are used to illustrate the cabling infrastructure of one or more offices, floors, and buildings. Managers can create both logical and physical views of their facilities and even view a complete data path simply by clicking on a connection.

Some products provide complete cable topologies, showing the locations of the cabling and connections, providing views of cross-connect cabling, and showing network diagrams by floor, as well as patch panels and racks. Work orders can be generated for moving equipment or rewiring, complete with a picture of the connections. With this information, the network administrator knows where the equipment should go, what needs to be disconnected, and what should be reconnected. The technician can take this job description to the location and perform the changes.

Other products provide a CAD interface, enabling equipment locations and cable runs to be tracked through punch-down blocks, multi-conductor cables, and cable trays. In addition, bill-of-materials reports can be produced for new and existing cable installations.

Cable management applications can be run as standalone systems or may be integrated with help desk products, hub management systems, and network management platforms. When coupled with a hub management system and help desk, a high degree of automation can be brought to bear on the problem resolution process. When the hub management system detects a media failure, the actual cable run can be extracted from the cable management application and submitted along with a trouble ticket generated by the help desk. When the hub management system is integrated with a network management platform such as Hewlett-Packard’s OpenView, all of this activity can be monitored from a single management console, which expedites problem resolution.

16.8.3 Cable Planning

To determine if existing wiring can be used to support new system installations requires the preparation of a complete wiring plan, preferably before the start of system installation. The plan acts not only as a guide to the installation process but as a check on capacity and planning that can be carried out before installers appear and begin working. In the case of a PBX, for example, the plan should associate each instrument with a complete path back to the station wiring on the PBX, through all panels, horizontal feeds, and risers. During this process, the capacity of each trunk/riser should be checked one last time, and additional cabling run as needed. Spare pairs on each cable can be identified for possible future use.

As with station cabling, there are many factors to consider in deciding whether to purchase new or continue to use existing house cabling. The high cost of large-paired distribution (300-, 400-, 600-, or 900-pair) cabling and its installation make the lease or purchase of existing cabling cost-effective. As with station cabling, the labor costs for identifying, reterminating, and documenting the existing cable remains. This cost increases as the number of pairs increase, as does the probability of an error. Because existing cabling often introduces unknown factors, such as pair counts, condition, and destination, many interconnect companies prefer to install new cabling. This cabling is much easier to document, install, and cutover because it is not being used.

A building under construction is the ideal environment for cable planning because it can be done according to the company’s needs without concern for the requirements of an existing cable plant. Moreover, factors that hamper installation in an existing building are not present in a building under construction (i.e., cosmetic concerns, disruption of office personnel, and inaccessible areas). This allows attention to be focused on meeting the needs of each possible telephone instrument or terminal location.

Many companies specialize in cable installation and may be contracted on a per-project basis through a bidding process. Some cabling contracting companies only install cabling; others both install and maintain cable networks. Because of the complexity of a cable network, it is convenient to deal with only a single company—one that endeavors to become familiar with the organization’s current and future cabling requirements.

If information systems and communications networks constitute a strategic resource to a company, so must its wiring. The proper planning for each wiring and rewiring of a facility can preserve these resources intact for the support of future applications. Improper wiring and poor record-keeping often leave no recourse but to fully rewire a facility—a task that is often far more expensive than new installation.

16.8.4 Wireless Extension

Wireless technology is becoming a widely accepted part of the enterprise technology portfolio. It lets businesses create a new, fully configured network or extend an existing wired network in minutes, without having to run cables between desktops and hubs. Wireless technology offers all the functionality of current LANs— information exchange and high-speed connection—but without the constraints of wires, even allowing users to roam throughout the office while maintaining a wireless connection to the company’s network and the Internet.

An AP provides the connection between one or more wireless client devices and a wired LAN. The AP is usually connected to the wired LAN via a Category 5 cable connection to a hub or switch. Client devices communicate with the AP over the wireless link, giving them access to all other devices through the hub or switch, including a router on the other side of the hub, which provides access to the Internet, VPNs, and corporate intranet (see Figure 16.2).

Click To expand
Figure 16.2: A simple configuration showing the relationship of the AP to the wired and wireless segments of the network.

An AP that adheres to the 802.11b standard for operation over the unlicensed 2.4-GHz band supports a wireless link with a data transfer speed of up to 11 Mbps, while an AP that adheres to the 802.11a standard for operation over the unlicensed 5-GHz band supports a wireless link with a data transfer speed of up to 54 Mbps. Both use Ethernet protocols and are referred to as Wi-Fi networks.

APs can even be connected to each other, or be connected via specialized wireless-bridges, to create daisy-chained networks. This extends the reach of wireless links to ensure campus coverage, for example, and allows users to roam over greater distances without breaking the connection. APs can also be connected to outdoor routers for full mesh connectivity between buildings.


16.9 Operating Systems

Maintenance and support are not just essential activities for systems and networks, but software and operating systems as well. Corporate acceptance of the open source Linux operating system, for example, only came about as the result of vendors taking support issues seriously and investing millions of dollars in support infrastructure. Such investments are required because Linux is not yet familiar to many IT departments.

Linux got its start in many organizations as a tactical solution without the approval or support of corporate IT, pulling limited duty for departmental Web, file, and print serving, often right under the nose of an unsuspecting CIO. But that role is rapidly changing. Server vendors have been beefing up Linux, addressing long-neglected performance, migration, and security issues. Large enterprises have duly noted the change and are now more tolerant of Linux. But CIOs and IT managers, accustomed to the high-quality vendor support they get with Unix and mainframes, often found that the same level of support for Linux was lacking.

Many users have installed their own Linux systems, either by downloading it for free off the Internet or purchasing a packaged distribution for a nominal fee from a Linux supplier like Red Hat. Others have installed one of the Open Source database management systems for Linux. So why go with mainstream hardware vendors at all? One reason is that mainstream vendors offer an alternative to traditional Linux suppliers, an alternative that can add value in terms of hardware, software, and integration services. Now that these vendors are also strengthening their support for Linux, this has raised the comfort level of IT departments that may have been hesitant to risk their business applications on the perceived vagaries of the Open Source community.

Recognizing that access to technical support is key to the adoption of Linux among businesses, vendors are now competing with each other to offer support services for all major Linux distributions, including 24/7 support, professional services for large-scale projects, education, and on-line services. Meanwhile, IT departments are hiring more application developers, systems administrators, and help desk personnel with Linux expertise.

Potentially, Linux represents an opportunity for businesses to cast off proprietary platforms and high license fees. Open Source advocates often tout the cost savings that Linux can bring to enterprise users, but there may be hidden costs that must be factored into the total cost of ownership (TCO) equation, such as the skill levels of current IT staff, which determines the extent to which outside support is required. Companies also need to consider the complexity of the applications and the amount and cost of migrating from a legacy environment, which may necessitate extra costs for consulting and integration services.


16.10 Conclusion

For many organizations, basic survival hinges on the proper functioning of communication systems and networks, more so as the organization seeks to enlarge market share by expanding into new product areas or establishing a presence in new locations. At the least, a problem-free environment ensures full return on investment for all technology acquisitions. While many organizations have in-house staff to perform ongoing maintenance and support, others prefer to outsource these functions.

Many traditional maintenance firms have long recognized this trend and have expanded their services from simple repair-and-return operations to on-site maintenance in multi-vendor network and data center environments, even offering plans that encompass systems that are out of warranty. This type of outsourcing arrangement allows their business clients to focus on their core strengths, instead of getting bogged down in the details of maintaining systems and networks.


Previous Section
< Day Day Up >
Next Section

Acronyms

A-J

AAL | ATM adaptation layer
ABATS | automated bit access test system
ABM | Accunet bandwidth manager (AT&T)
ABR | available bit rate
AC | address copied
ac | alternating current
AC | access control
ACD | automated call distributor
ACK | acknowledgement
ACL | access control list
ACP | access control point
ADCR | alternate destination call routing (AT&T)
ADM | add-drop multiplexer
ADN | advanced digital network (Pacific Bell)
ADPCM | adaptive differential pulse code modulation
AES | advanced encryption standard
AI | artificial intelligence
AIOD | automatic identification of outward dialed calls
AM | amplitude modulation
AMI | alternate mark inversion
ANI | automatic number identification
ANR | automatic network routing (IBM Corp.)
ANSI | American National Standards Institute
AP | access point
APC | access protection capability (AT&T)
API | application programming interface
APPC | advanced program-to-program communications (IBM Corp.)
ARB | adaptive rate based (IBM Corp.)
ARCnet | attached resource computer network
ARP | address resolution protocol
ARS | action request system (Remedy Systems, Inc.)
AS | autonomous system
ASCII | American standard code for information interchange
ASIC | application specific integrated circuit
ASN.1 | abstract syntax notation 1
ASP | application service provider
ASTN | alternate signaling transport network (AT&T)
AT&T | American Telephone & Telegraph
ATIS | Alliance for Telecommunications Industry Solutions
ATM | asynchronous transfer mode
ATM | automated teller machine
AUI | attachment unit interface
AWG | American wire gauge
B2B | business to business
B8ZS | bipolar eight zero substitution
BBS | bulletin board system
BCP | business continuity plan
BECN | backward explicit congestion notification
Bellcore | Bell Communications Research
BER | bit error rate
BERT | bit error rate tester
BGP | border gateway protocol
BIOS | basic input-output system
BMC | block multiplexer channel
BMS-E | bandwidth management service-extended (AT&T)
BOC | Bell operating company
BootP | Boot Protocol
BPDU | bridge protocol data unit
BPS | bits per second
BPV | biploar violation
BQB | Bluetooth qualification body
BQTF | Bluetooth qualification test facility
BRI | basic rate interface (ISDN)
BSC | binary synchronous communications
CA | call agent
CAD | computer-aided design
CAM | computer-aided manufacturing
CAN | campus area network
CAP | competitive access provider
CAR | committed access rate
CASE | computer-aided software engineering
CATV | cable television
CBR | case-based reasoning
CBR | constant bit rate
CBQ | class-based queuing
CBT | computer-based training
CCC | clear channel capability
CCITT | Consultative Committee for International Telegraphy and Telephony
CCR | customer-controlled reconfiguration
CD | carrier detect
CD | compact disk
CD-ROM | compact disk-read only memory
CDP | content delivery provider
CDPD | cellular digital packet data
CDR | call detail record
CEO | chief executive officer
CERT | computer emergency response team
CHAP | Challenge Handshake Authentication Protocol
CI | component interface
CIO | chief information officer
CIR | committed information rate
CIS | Center for Internet Security
CISSP | certified information systems security professional
CLEC | competitive local exchange carrier
CLEI | common language equipment identifier
CLI | command line interface
CMI | common information model
CMIP | Common Management Information Protocol
CMOS | complementary metal oxide semiconductor
CNMS | central network management system
CO | central office
COA | care-of-address
CON | concentrator
COPS | common open policy system
CoS | class of service
CPE | customer premises equipment
CPU | central processing unit
CRC | cyclic redundancy check
CSA | certified security administrator
CSE | certified security engineer
CSMA/CA | carrier sense multiple access with collision avoidance
CPE | customer premises equipment
CSMA/CD | carrier sense multiple access with collision detection
CSO | chief security officer
CSU | channel service unit
CTI | computer-telephony integration
CTS | clear to send
CTO | chief technology officer
DA | destination address
DACS | digital access and cross-connect system (AT&T)
DAP | Demand Access Protocol
DAS | dual-attached station
DASD | direct access storage device (IBM)
dB | decibel
DBMS | database management system
DBU | dial backup unit
dc | direct current
DCE | data communications equipment
DCE | distributed computing environment
DCF | data communications function
DCN | data communication network
DCS | digital cross-connect system
DDS | digital data service
DDS/SC | digital data service with secondary channel
D/E | debt/equity (ratio)
DEC | Digital Equipment Corp.
DECT | digital enhanced cordless telecommunication
DES | data encryption standard
DFSMS | data facility storage management subsystem (IBM Corp.)
DHCP | Dynamic Host Configuration Protocol
DID | direct inward dial
DIF | digital interface frame
DiffServ | differentiated services (IETF)
DIP | debtor in possession
DLCI | data link connection identifier
DLL | data link layer
DLSw | data link switching (IBM Corp.)
DM | distributed management
DME | distributed management environment
DMI | desktop management interface
DMP | dynamic multipathing
DMTF | Desktop Management Task Force
DNS | domain name system
DoD | Department of Defense (United States)
DOD | direct outward dial
DOS | disk operating system
DOV | data over voice
DS0 | digital signal: level zero (64 Kbps)
DS1 | digital signal: level one (1.544 Mbps)
DS1C | digital signal: level one C (3.152 Mbps)
DS2 | digital signal: level two (6.312 Mbps)
DS3 | digital signal: level three (44.736 Mbps)
DSL | digital subscriber line
DSLAM | digital subscriber line access multiplexer
DSN | defense switched network
DSP | digital signal processor
DSSS | direct-sequence spread-spectrum
DSU | data service unit
DTE | data terminal equipment
DTMF | dual-tone multifrequency
DTR | dedicated token ring
DTU | data transfer unit
DWDM | dense wavelength division multiplexing
DXI | data exchange interface
ECSA | Exchange Carriers Standards Association
ED | ending delimiter
EDI | electronic data interchange
EDRO | enhanced diversity routing option (AT&T)
EEOC | Equal Employment Opportunity Commission
EEROM | electronically erasable read-only memory
EFT | electronic funds transfer
EGP | External Gateway Protocol
EIA | Electronic Industries Association
EISA | extended industry standard architecture
EMAIL | electronic mail
EMI | electromechanical interference
EMS | element management system
EP | extension point
EPS | encapsulated postscript
ESCON | enterprise systems connection (IBM Corp.)
ESF | extended super frame
4GL | fourth generation language
FA | foreign agent
FAQ | frequently asked questions
FASB | Financial Accounting Standards Board
FASTAR | fast automatic restoral (AT&T)
FAT | file allocation table
FC-AL | Fibre Channel–Arbitrated Loop
FC | Fibre Channel
FC | frame control
FCC | Federal Communications Commission
FCIA | Fibre Channel Industry Association
FCS | frame check sequence
FDD | frequency division duplexing
FDDI | fiber distributed data interface
FDL | facilities data link
FECN | forward explicit congestion notification
FEP | front-end processor
FFDT | FDDI full-duplex technology
FHSS | frequency-hopping spread-spectrum
FIFO | first in first out
FM | frequency modulation
FOD | fax on demand
FRAD | frame relay access device
FRF | Frame Relay Forum
FS | frame status
FT1 | fractional T1
FTP | File Transfer Protocol
FTS | Federal Telecommunications Service
FX | foreign exchange
GAAP | generally accepted accounting procedures
GIAC | global information assurance certification
GMT | Greenwich mean time
GNU | GNUs not UNIX
GPL | general public license
GPRS | general packet radio service
GUI | graphical user interface
HA | home agent
HDLC | high-level data link control
HP | Hewlett-Packard Co.
HASP | Houston Automatic Spooling Program
HEC | header error check
HFC | hybrid fiber coax
HIPAA | Health Insurance Portability and Accountability Act
HPR | high-performance routing (IBM Corp.)
HSM | hierarchical storage management
HSTR | high-speed token ring
HSTRA | High-Speed Token Ring Alliance
HTR | high-speed token ring
HTTP | Hypertext Transfer Protocol
HTTPS | Hypertext Transfer Protocol over SSL
HVAC | heating, ventilation, and air conditioning
IAB | Internet Activities Board
IAD | integrated access device
IANA | Internet Assigned Numbers Authority
ICMP | Internet Control Message Protocol
ICP | integrated communications provider
ICS | intelligent calling system
ID | identification
IDDD | international direct distance designator
IDP | Internetwork Datagram Protocol (Xerox Corp.)
IEEE | Institute of Electrical and Electronic Engineers
IESG | Internet Engineering Steering Group
IETF | Internet Engineering Task Force
IF | intermediate frequency
IGP | Interior Gateway Protocol
IIS | Internet information server (Microsoft Corp.)
IKE | Internet key exchange
IMA | inverse multiplexing over ATM
IMS/VS | information management system/virtual storage (IBM Corp.)
ILEC | incumbent local exchange carrier
IMA | inverse multiplexing over ATM
IN | intelligent network
I/O | input/output
IOC | interoffice channel
IP | Internet Protocol
IPsec | Internet Protocol with security
IPX | Internet packet exchange
IR | infrared
IRC | Internet relay chat
IRQ | interrupt request
IRR | internal rate of return
IS | information system
ISA | industry standard architecture
ISC2 | International Information Systems Security Certification Consortium
iSCSI | Internet-protocol small computer system interface
ISDN | integrated services digital network
ISL | interswitch link
ISO | International Organization for Standardization
ISOC | Internet Society
ISP | Internet service provider
IT | information technology
ITR | intelligent text retrieval
ITU | International Telecommunication Union
ITU-TSS | International Telecommunication Union-Telecommunications Standardization Sector (formerly CCITT)
JPEG | Joint Photographic Experts Group


K-Q

K (Kilo) | one thousand (e.g., Kbps)
KB | kilobyte
L2TP | Layer 2 Tunneling Protocol
LAN | local area network
LANE | local area network emulation
LANRES | LAN resource extension and services (IBM Corp.)
LAT | local area transport (Digital Equipment Corp.)
LATA | local access transport area
LAVC | local area VAX cluster (Digital Equipment Corp.)
LBO | line buildout
LCD | liquid crystal display
LCN | local channel number
LD | long distance
LDAP | Lightweight Directory Access Protocol
LEC | local exchange carrier
LED | light emitting diode
LEO | low Earth orbit
LIB | label information base
Li-Ion | lithium ion
LL | line loopback
LLC | link level control
LMDS | local multipoint distribution service
LMI | link management interface
LSB | least significant bit
LSI | large-scale integration
LSP | label switched path
LSR | label switch router
LU | logical unit (IBM Corp.)
LUN | logical unit number
M (Mega) | one million (e.g., Mbps)
MA | mobility agent
MAC | media access control
MAC | moves, adds, changes
MAN | metropolitan area network
MAU | medium access unit
MAU | multiple access unit
MAU | multistation access unit
MB | megabyte
MCA | Micro Channel Architecture (IBM Corp.)
MCU | multicast unit
MD | mediation device
MDS | multipoint distribution service
MES | master Earth station
MF | mediation function
MGC | media gateway controller
MGCP | Media Gateway Control Protocol
MI | management interface
MIB | management information base
MIC | Management Integration Consortium
MIF | management information format
MII | media independent interface
MIPS | millions of instructions per second
MMDS | multichannel multipoint distribution service
MPLS | multiprotocol label switching
ms | millisecond
MTBF | mean time between failure
MTSO | mobile telephone serving office
MTTR | mean time to response
MTTR | mean time to repair
MTU | maximum transfer unit
MVC | multicast virtual circuit
MVPRP | multivendor problem resolution process
NACK | negative acknowledgement
NAP | network access point
NAS | network attached storage
NAT | network address translation
NAU | network addressable unit (IBM Corp.)
NAUN | nearest active upstream neighbor
NCP | Network Control Program (IBM Corp.)
NCP | network control point
NDS | Novell directory services
NE | network element
NEBS | new equipment building specifications
NEF | network element function
NetBIOS | network basic input/output system
NFS | network file system
NIC | network interface card
NiCd | nickel cadmium
NiMH | nickel metal hydride
NIPC | National Infrastructure Protection Center
NIST | National Institute of Standards and Technology
NIU | network interface unit
NLM | NetWare Loadable Module (Novell Inc.)
nm | nanometer
NM | network manager
NMS | NetWare Management System (Novell, Inc.)
NMS | network management system
NNI | network-to-network interface
NNM | Network Node Manager (Hewlett-Packard Co.)
NNTP | Network News Transport Protocol
NNX | exchange number
NOC | network operations center
NOS | network operating system
NPA | numbering plan area
NPC | network protection capability (AT&T)
NPV | net present value
NSA | National Security Agency
NSOC | network security operations center
NTP | Network Time Protocol
OAM&P | operations, administration, management, and provisioning
OC | optical carrier
OC-3 | optical carrier signal: level three (155 Mbps)
OCR | optical character recognition
ODBC | open database connectivity (Microsoft Corp.)
OEM | original equipment manufacturer
OEO | optical-electrical-optical
OID | object identification or identifier
OLE | object linking and embedding
OLTP | on-line transaction processing
OMA | object management architecture
OMF | object management framework
OMG | Object Management Group
OOF | out of frame
OOP | object-oriented programming
OPX | off-premises extension
ORB | object request broker
OS | operating system
OS/2 | operating system/2 (IBM Corp.)
OSF | Open Software Foundation
OSF | operations systems function
OSFI | open system fabric initiative
OSI | open systems interconnection
OSPF | open shortest path first
OSS | operations support system
OTDR | optical time domain reflectometry
PA | preamble
PAD | packet assembler-disassembler
PAP | Password Authentication Protocol
PAR | peak-to-average ratio
PARC | Palo Alto Research Center
PAT | port address translation
PBX | private branch exchange
PC | personal computer
PCAMI | PC Asset Management Institute
PCI | peripheral component interconnect
PCM | pulse code modulation
PCS | personal communications service
PDA | personal digital assistant
PDN | packet data network
PDS | premises distribution system (AT&T)
PDU | payload data unit
PDU | protocol data unit
PEM | privacy enhanced mail
PGP | pretty good privacy
PHB | per hop behavior
PHY | physical (layer)
PIM | Protocol Independent Multicast
PKI | public key infrastructure
PnP | plug and play
PoE | power over Ethernet
PoP | point of presence
PoS | point of sale
PPP | Point-to-Point Protocol
Pps | packets per second
PRI | primary rate interface (ISDN)
PSN | packet-switched network
PSP | Power Saving Protocol
PSTN | public-switched telephone network
PTT | Post Telephone & Telegraph
PU | physical unit (IBM Corp.)
PVC | permanent virtual circuit
QAF | Q adaptor function
QC | quality control
QoS | quality of service
QRW | quasi-random word


R-Z

RADIUS | remote-access dial-in user service
RAID | redundant arrays of inexpensive disks
RAM | random-access memory
RAS | registration, admission and status
RBES | rule-based expert systems
RDBMS | relational database management system
RF | radio frequency
RFC | request for comment
RFI | radio frequency interference
RFI | request for information
RFP | request for proposal
RFQ | request for quotation
RIF | routing information field
RIP | Routing Information Protocol
RISC | reduced instruction set computing
RJE | remote job entry
RMON | remote monitoring
ROI | return on investment
ROM | read-only memory
RP | rendezvous point
RPC | remote procedure call
RPR | resilient packet ring
RSVP | resource ReSerVation Protocol
RTCP | Real-Time Control Protocol
RTL | remote terminal loopback
RTNR | real-time network routing (AT&T)
RTP | Rapid Transfer Protocol (IBM Corp.)
RTP | Real-Time Protocol
RTS | request to send
RX | receive
SA | source address
SAN | storage area network
SAR | segmentation and reassembly
SAS | single-attached station
SCNA | security certified network architect
SCSI | small computer systems interface
SD | start delimiter
SDH | synchronous digital hierarchy
SDK | software development kit
SDLC | synchronous data link control (IBM)
SDM | subrate data multiplexing
SDN | Software Defined Network (AT&T)
SEC | Securities & Exchange Commission
SF | superframe
SFD | start frame delimiter
SFT | system fault tolerance
SIG | special interest group
SIIA | Software & Information Industry Association (formerly, Software Publishers Association)
SIP | Session Initiation Protocol
SLA | service-level agreement
SLIP | Serial Line Internet Protocol
SMBIOS | system management basic input/output system
SMDI | simplified message desk interface
SMDR | station message detail recording
SMDS | switched multimegabit data services
SMI | storage management initiative
SMR | specialized mobile radio
SMS | short messaging service
SMS | systems management server (Microsoft)
SMT | Station Management
SMTP | Simple Mail Transfer Protocol
SNCP | storage networking certification program
SNIA | Storage Networking Industry Association
SNMP | Simple Network Management Protocol
SNA | systems network architecture
SoIP | Storage over Internet Protocol
SONET | synchronous optical network
SPA | Software Publishers Association
SPX | synchronous packet exchange (Novell, Inc.)
SQL | structured query language
SRTLB | source-route translation bridging
SS7 | signaling system 7
SSA | serial storage architecture (IBM Corp.)
SSCP | systems security certified practitioner
SSCP | system services control point (IBM Corp.)
SSCP/PU | system services control point/physical unit (IBM Corp.)
SSID | service set identifier
SSL | secure sockets layer
SSP | storage service provider
STA | spanning tree algorithm
STC | serving test center
STDM | statistical time division multiplexing
STP | signal transfer point
STP | Spanning Tree Protocol
SVC | switched virtual circuit
SWC | serving wire center
T1 | Transmission service at the DS1 rate of 1.544 Mbps
T3 | transmission service at the DS3 rate of 44.736 Mbps
TC | topology change
TCA | topology change acknowledgement
TCN | topology change notification
TCO | total cost of ownership
TCP | Transmission Control Protocol
TDD | time division duplexing
TDM | time division multiplexer
TDMA | time division multiple access
TDR | time domain reflectometry
TIF | tag image-file format
TIMS | transmission impairment measurement sets
TKIP | Temporal Key Integrity Protocol
TMN | Telecommunications Management Network
TMS | transport management system
ToS | type of service
TPDDI | twisted-pair distributed data interface
TSANet | Technical Support Alliance Network
TSR | terminal stay resident
TTRT | target token rotation time
TTS | transaction tracking service
TX | transmit
UBR | unspecified bit rate
UDP | User Datagram Protocol
UDP/IP | User Datagram Protocol/Internet Protocol
U/L | upper/lower
UAS | user-agent server
UML | unified modeling language
UNE | unbundled network element
UNI | user-network interface
UPS | uninterruptible power supply
URI | uniform resource identifier
URL | universal resource locator
USB | universal serial bus
UTP | unshield twisted-pair
VAN | value-added network
VAR | value-added reseller
VBR | variable bit rate
VBR-nrt | variable bit rate – nonreal time
VBR-rt | variable bit rate – real time
VC | virtual circuit
VCI | virtual circuit identifier
VCR | video cassette recorder
VG | voice grade
VF | voice frequency
VLBRV | very low bit rate voice
VLSI | very large-scale integration
VMS | virtual machine system (Digital Equipment Corp.)
VOFDM | vector orthogonal frequency division multiplexing
VoFR | voice over frame relay
VoIP | voice over Internet Protocol
VP | virtual path
VPI | virtual path identifier
VPN | virtual private network
VSAT | very small aperture terminal
VT | virtual terminal
VT | virtual tributary
VTAM | virtual telecommunications access method (IBM Corp.)
WAN | wide area network
WATS | wide area telecommunication service
WBEM | Web-based enterprise management
WBT | Web-based training
WDM | wavelength division multiplexing
WEP | wired equivalent privacy
WFQ | weighted fair queuing
Wi-Fi | wireless fidelity
WLAN | wireless local area network
WPA | Wi-Fi protected access
WSF | workstation function
WWN | world wide name
WWW | World Wide Web
XID | exchange identifier
XNS | Xerox Network System (Xerox Corp.)
ZBTSI | zero byte time-slot interchange


Previous Section
< Day Day Up >
Next Section

Index

Numbers

10BaseT, 6–10
adapters, 7
data-encoding schemes, 6
defined, 6
hubs, 8–9
limitations, 6
management, 9–10
media, 7
media connections, 7–8
performance, 6–7
UTP wiring, 6
See also LANs
100BaseT. See Fast Ethernet
1000BaseT. See Gigabit Ethernet


Previous Section
< Day Day Up >
Next Section

Index

A

Access gateways, 119
Access protection capability (APC), 362
Access routers, 109, 378
Accounting management, 255
Active caching, 72
Adaptive differential pulse code modulation (ADPCM), 155–56, 191
defined, 195
PCM voice conversion to, 195
Adjunct switch, 173–74
Advanced Encryption Standard (AES), 312
Agents, 29–39
applications, 29–30, 34–39
applications management application, 35
behavior, 32–34
capacity planning and reporting application, 36–37
collaboration, 34
defined, 29
event manager, 50
fault management application, 35–36
file, 41
intelligent, 31–32
list of, 30–31
management, 260–61
performance management application, 34–35
programmatic solutions, 32–34
scheduler, 48–49
security management application, 38–39
task manager, 51–52
template solutions, 32
Web traffic management application, 37–38
See also LAN administration
Alternate destination call routing (ADCR), 361
Alternate mark inversion (AMI), 207
Alternate signaling transport network (ASTN), 360
American Standards Institute (ANSI), 22
Antivirus data security, 320
AppleTalk, 355
Applications management, 35
ARCnet, 18, 19–20, 27
configuration illustration, 20
defined, 19
distributed star arrangement, 20
hubs, 19–20
nodes, 19
products, 19
See also LANs
Asymmetric encryption, 311
Asynchronous transfer mode. See ATM
ATM, 231–39
ABR, 233
addresses, 235
applications, 231–32
backbones, 238
CBR, 232
consolidation solution, 232
defined, 231
inverse multiplexing over, 236–39
layers, 236
private networks, 235
protocol model, 236
QoS, 232–34
QoS mechanisms, 286
QoS reservation, 286
scalability, 231
traffic shaping, 234
UBR, 233
VBR, 232
virtual circuits, 234–35
See also High-speed packet networks
ATM Forum, 235
Attached Resource Computer Network. See ARCnet
Attachment unit interface (AUI), 7
AutoCAD files, 341
Automated Bit Access Test System (ABATS), 216–17
Automated operations, 68–69
Automatic identification of outward dialed calls (AIOD), 178
Available bit rate (ABR), 233


Previous Section
< Day Day Up >
Next Section

Index

B

Backbone network, 191–93
defined, 191
private networking, 191–92
public networking, 192–93
See also TDM infrastructures
Backbone routers, 109
Backups
automated, 68–69
dial, 371–72
ISDN, configuration, 370
SANs for, 80
T1, via ISDN, 369–70
Backward explicit congestion notification (BECN), 228, 229
Big Sister, 281, 282
Bindery data reporting, 47–48
Biometrics, 306–9
defined, 307
fingerprint recognition, 307–9
typing rhythms, 309
See also Security
Bipolar eight zero substitution (B8ZS), 196, 212–13
Bit error rate tester (BERT), 218
Boot Protocol (BOTP), 131
Border Gateway Protocol (BGP), 110–11, 355
Bridge protocol data units (BPDUs), 102
Bridges, 60, 100–106
beacon interval, 134
broadcast SSID, 134
conclusion, 124–25
configuring, 130–31
data rate, 133
frequency, 134
local, 101
logs, 147
OSI model and, 101
packet encryption, 135–36
performance monitoring, 142–44
range, 134
remote, 101
root, 136
routers vs., 106
RTS/CTS, 134–35
source-route, 102, 103
source-route translation, 102, 105–6
time, 136
translation, 102, 103–5
transparent, 101, 102–3
uses, 100–101
in wireless network, 129
BrightStor, 91–92
BroadbandSWAT, 350
Broadcast zones, 87
Business gateways, 119
Bus topology
network availability, 57
network reliability, 56–57


Previous Section
< Day Day Up >
Next Section

Index

C

Cabling, 397–401
planning, 399–400
plant as asset, 398–99
premises wiring, 397–98
wireless extension, 400–401
Caching, 71–72
active, 72
applications, 71
defined, 71
passive, 71–72
types, 71–72
Call accounting systems, 164–70
benefits, 165
call costing, 168–69
call detail records, 167–68
Centrex, 179
configuration illustration, 166
functions, 164–65
operation, 165–67
outsourcing, 169
polling, 166
Web-based reporting, 169–70
See also Voice systems
Callback security systems, 328–29
Call costing, 168–69
Capacity planning and reporting, 36–37
agent capabilities, 36–37
defined, 36
Carrier restoration services, 361–62
ADCR, 361
APC, 362
customer controlled reconfiguration, 362
EDRO, 361–62
NPC, 361
SAFER, 361
T1.5 reserved service, 362
See also Restoration
Carrier sense multiple access with collision detection (CSMA/CD), 2, 5
Carrier testing services, 216–17
Central network management system (CNMS), 257
Central processor, PBX, 153
Centrex, 177–81
AIOD, 178
brand names, 177
CPE, 178–79
defined, 177
DID features, 177
DOD, 178
features, 178
IP, 179–81
See also Voice systems
Certified information systems security professional (CISSP), 333
Challenge Handshake Authentication Protocol (CHAP), 329, 330
Channel service units. See CSUs
CIM-SAN-1, 92
Circuit switches, 119
Clear channel capability, 195–96
CSUs, 212–13
T1 multiplexer support, 195–96
Collocation facilities, 69–70
Command line interface (CLI), 218
Committed access rate (CAR), 348
Common Information Model. See CIM-SAN-1
Common Management Information Protocol (CMIP), 275
Common open policy system (COPS), 292
Competitive access providers (CAPs), 368–69
Computer Emergency Response Team (CERT), 325
ConfigMaker, 347–48
CAR and, 348
defined, 347
NAT feature, 347–48
wizards, 347
Configuration management, 255
Console
agent interaction, 30
defined, 29
messages, 50
text viewer, 49–50
See also LAN administration
Constant bit rate (CBR), 232, 233
Consumer-class routers, 108
Cooperative maintenance programs, 396–97
CSU-DSUs
bit errors, 220
conclusion, 224
on DDS circuit, 210
dedicated, 220
diagnostic information, 219
disaster recovery, 221–22
integrated solutions, 218–20
interface card, 219
interface/data rate translation support, 216
line learning features, 222
loopbacks, 213
management, 221
monitors, 214
multiple interfaces, 208
network specification adherence, 214
protocol analyzers, 220–21
service-level management, 222–23
standalone, 220
user-controlled diagnostics, 217
CSUs
bipolar violation removal, 211
circuit maintenance, 214–16
clear channel capability, 212–13
defined, 109–10
deployment illustration, 211
diagnostics, 213–14
ESF, 216
functionality, 209–16
impairment testing, 216
“keep-alive” signal, 212
line build out (LBO), 210
positioning, 207
user equipment interface, 212
Customer controlled reconfiguration, 362
Customer premises equipment (CPE), 178–79
administration systems, 179
call accounting system, 179
Centrex answering consoles, 179
Centrex phones, 178
IP Centrex, 180–81
message desk, 179
PC-based attendant workstations, 178–79
See also Centrex
Cyclical redundancy check (CRC), 4, 214


Previous Section
< Day Day Up >
Next Section

Index

D

Data communication network (DCN), 276
Data encryption. See Encryption
Data-link control (DLC) layer, 177
Data protection, 62–70
automated operations, 68–69
hardware solutions, 62–63
off-site storage, 69–70
RAIDs, 65–67
server blades, 67–68
software solutions, 63–65
Data terminal equipment (DTE), 20
loopback, 214
tests, 214
Dedicated token ring (DTR), 17
Dense wave division multiplexed (DWDM) fiber, 79
DesignXpert, 343, 345–46
Device libraries, 339–40
defined, 339
illustrated example, 339
See also Network documentation tools
Dial backup, 371–72
DDS, 373–75
defined, 371–72
illustrated, 372
Dial backup units (DBUs), 376
Differentiated Services (Diff-Serv), 110, 111–12, 239, 294
defined, 111
implementation, 112
PHB, 112
stateless approach, 111
See also Routing protocols
Digital cross-connect systems (DCSs), 183, 198–205
administration terminal, 204
based on space division switching, 199
carrier-provided service, 201
carrier-provided service subscription, 203
carrier-provider service selection, 202–4
control system, 200
customer-controlled reconfiguration, 199–202
defined, 198
functions, 198
groom-and-fill functions, 199
memory, 204
network implementation, 204–5
network management tasks, 204–5
node location, 204
shared, 199
in T-carrier environment, 198
See also TDM infrastructures
Digital data services (DDSs), 208–9
availability rate, 218
defined, 208
dial backup, 373–75
with secondary channel (DDS/SC), 209
Digital Encryption Standard (DES), 311–12
Digital interface frames (DIFs), 359
Direct inward dialing (DID), 177, 178
Direct outward dialing (DOD), 178
Disk/drive controls, 309–10
Disk duplexing, 64–65
defined, 64
disadvantage, 65
performance advantage, 64–65
Disk mirroring, 63
Disk pooling, 94
Disk recovery, 64
Distributed Management Task Force (DMTF), 92
Do-it-yourself maintenance/support, 382–90
operations management, 389–90
preventative maintenance, 383
resource requirements, 384
technical support, 388–89
user support, 384–88
Domain name servers, 131
Domain name system (DNS), 37
DSUs, 374
defined, 207
multiple, backups, 374
Dual tone multifrequency (DTMF) tones, 329
Dynamic Host Configuration Protocol (DHCP), 108, 131, 245–46
defined, 355
IP administration by, 245–46
for organization, 246
Dynamic multipathing (DMP), 94


Previous Section
< Day Day Up >
Next Section

Index

E

EcoSYSTEMS, 350–52
defined, 350–51
EcoPREDICTOR, 351
EcoSCOPE, 351–52
EcoTOOLS, 351–52
historical trending reports, 352
Electronically erasable read-only memory (EEROM), 153
Element management systems (EMSs), 100
Encryption, 310–18
asymmetric, 311
cryptographic methods, 310–11
defined, 310
deployment issues, 316–18
DES, 311–12
implementation recommendations, 312–16
improper configuration, 317
key management automation, 314
key management implementation, 314
keys, dynamic, 313
keys, retiring, 314
keys, safeguarding, 313
keys, session, 313–14
keys, weak, 317–18
symmetric, 311
VPN vulnerability, 318
See also Security
Enhanced diversity routing option (EDRO), 361–62
Enterprise systems connection (ESCON), 79, 81
Equipment requirements, 391–94
service/repair documentation, 393–94
spares inventory, 392
test equipment, 392–93
See also Maintenance and support
Error logs, 147
Ethernet, 2–6, 27
defined, 2
error statistics, 143–44
frame format, 2–4
frame format comparison, 3
media access control, 4–5
See also LANs
Event notification, 50–51
console messages, 50
e-mail messages, 50
pager messages, 51
processing, 51
Extended super frame (ESF), 189
ANSI T1.403, 215
CSU, 216
defined, 214
original, 215
performance data, 216
Extranets, 249–53
accessibility, 249
advantages, 249–50
building, 250
defined, 244, 249
ICPs, 250
IP addressing for, 242
large, 252
management, 250–51
outsourcing, 250
performance criteria, 250
security, 251
tactical information aggregation, 252–53
uses, 249
See also IP networks


Previous Section
< Day Day Up >
Next Section

Index

F

Fabric switches, 86
Facilitative protocols, 119–24
H.323, 119–22
MGCP, 123–24
SIP, 122–23
See also Gateways
Facilities data link (FDL), 214
Fast Automatic Restoration (FASTAR), 363
Fast Ethernet, 10–11
compatibility, 10
defined, 10
media choices, 10–11
media-independent interface (MII) specification, 11
See also LANs
Fault management, 35–36
defined, 35, 255
reconfiguration, 59
Fault management agent capabilities, 35–36
Fault-tolerant PVC, 366
Fault-tolerant trunking, 366
FDDI, 18, 21–26, 27–28
architecture, 22–24
concentrators (CONs), 25
defined, 21
dual-attached stations (DASs), 25
dual-ring topology, 25
equipment classes, 25
failure protection, 26
layers illustration, 23
MAC, 24
operation, 21–22
physical layer (PHY), 23–24
physical media dependent (PMD), 22–23
self-healing capability, 26
single-attached stations (SASs), 25
station management (SMT), 24
topology, 24–26
TTRT, 22
See also LANs
Fiber distributed data interface. See FDDI
Fiber network restoration, 362–65
FASTAR, 363
SONET, 363–65
See also Restoration
Fibre Alliance, 92
Fibre Channel, 12, 79, 82
bandwidth, 83
as device interconnection, 82
SANs, 84
Fibre Channel-Arbitrated Loop (FC-AL), 85, 88
Fibre Channel Industry Association (FCIA), 92
File agents, 41
File Transfer Protocol (FTP), 242
Filters
applying, 144–47
multicast address, 145
node address, 145–46
protocol, 146–47
Fingerprint recognition, 307–9
Firewalls, 320–25
configuring, 323
defined, 320
packet filtering, 320, 321
physical location, 323
proxies, 320–22
rule set, 324
software, 325
solutions, 322–23
See also Security
Forward explicit congestion notification (FECN), 228, 229
Fractional T1 (FT1), 184, 218
Frame relay, 225–31
access devices (FRAD), 230
advantages, 226–27
any-to-any connectivity, 226
charges, 229–30
congestion control, 228–29
defined, 225–26
introduction, 226
OSI reference model and, 226
speed, 225–26
throughput/delay, 226
types of circuits, 227–28
voice over (VoFR), 230–31
See also High-speed packet networks
Fresnel zone, 130


Previous Section
< Day Day Up >
Next Section

Index

G

Gateways, 116–24
access, 119
applications, 117–19
business, 119
circuit switches, 119
cluster controller emulation, 118
conclusion, 125
defined, 116
e-mail system interconnection, 118
facilitative protocols, 119–24
functionality in OSI model, 117
Internet/PSTN interconnectivity, 118
IVR/announcement, 119
protocol conversion software, 116
residential, 119
SNA, 117
trunking, 118
for voice applications, 118–19
voice over ATM, 118
Generators, 74
Gigabit Ethernet, 11–13, 79
defined, 11
Fibre Channel, 12
full duplex support, 11
functional elements, 12
initial applications, 13
over copper, 12
standards summary, 13
See also LANs
Global Dispatch, 37
Global Information Assurance Certification (GIAC), 333
Graphical SNMP tools, 269–70


Previous Section
< Day Day Up >
Next Section

Index

H

H.323, 119–22
capability exchange feature, 122
codec specification support, 121
defined, 119
gatekeepers, 120
multicast units (MCUs), 121
network topology, 120
protocol stack, 120
SIP vs., 123
terminals, 119
Hard zones, 86
Help desk, 52
Hierarchical storage management (HSM), 44–45, 77–79
in SANs, 79
solutions, 77
storage virtualization, 79, 94–96
High-speed packet networks, 225–54
ATM, 231–39
conclusion, 253–54
frame relay, 225–31
introduction, 225
IP, 239–53
High-speed token ring (HSTR), 17–18
autonegotiation and, 18
backbone segment, 18
defined, 17
mixing, 17
See also Token ring
Hubs
10BaseT, 8–9
ARCnet, 19–20
SAN, 85–86


Previous Section
< Day Day Up >
Next Section

Index

I

Imaging, 94
Infiniband, 82–83, 84
Information logs, 147
Information system (IS) management, 73
Integrated access devices (IADs), 184
inverse multiplexing, 378
T1 line bandwidth bundling, 185
Integrated communications providers (ICPs), 250
Integrated help desk, 52
Integrated Services Digital Network (ISDN), 18–19, 196–97
channel types, 196
functionality, 196
multiplexer support of, 197
PRI, 197
T1 backup via, 369–70
Intelligent agents, 31–32
Intelligent calling systems (ICSs), 375
Interactive voice response (IVR)/announcement servers, 119
Internet Assigned Numbers Authority (IANA), 243
Internet Engineering Task Force (IETF), 243
Internet Protocol with security (IPsec), 115
Internet service providers (ISPs), 7
Internet Society (ISOC), 243
Intranets, 244–48
defined, 243–44
development costs, 246–47
implementation decision, 245
IP address administration and, 245–46
as risk-free proposition, 245
uses, 244
Intrusion detection systems, 326–27
Inverse multiplexing, 373
Inverse multiplexing over ATM (IMA), 236–39, 378–79
advantage, 236–37
bonded multiple T1 access lines, 237, 238
defined, 136
IP Centrex, 179–81
CPE, 180–81
defined, 179–80
expansion, 181
illustrated, 180
See also Centrex
IP networks, 239–53
addressing, 241–42
extranets, 249–53
intranets, 244–48
management, 243
NAP, 240
network address translation, 241
operating characteristics, 240
QoS standards, 291
services on Internet, 242–43
See also High-speed packet networks
IP PBXs, 170–72
administration, 170–72
CallManager, 171–72
Cisco, 170–72
defined, 170
managed services, 172
vendors, 170
See also PBXs
IP routing table, 132
iSCSI, 93–94


Previous Section
< Day Day Up >
Next Section

Index

K

Key/card systems, 305–6


Previous Section
< Day Day Up >
Next Section

Index

L

Label switch paths (LSPs), 114
Label switch routers (LSRs), 114
LAN administration, 29–53
agents, 29–39
bindery data reporting, 47–48
conclusion, 53
console, 29, 30
console text viewer, 49–50
integrated help desk, 52
introduction, 29
monitoring, 41
network activity tracking, 50–52
printer management, 42–43
process scheduling, 48–49
software distribution automation, 39–40
storage management, 43–47
tool set, 30–31
virus scanning, 41–42
LAN restoration planning, 55–75
conclusion, 75
data protection, 62–70
generators and, 74
introduction, 55
network availability, 57–58
network reliability, 55–57
recovery options, 58–60
SANs, 73
server capabilities, 60–62
servers on the WAN, 70–73
spare parts pooling and, 74–75
surge suppressors and, 74
UPSs and, 73–74
LANs, 1–28
10BaseT, 6–10
ARCnet, 18, 19–20
development, 1
Ethernet, 2–5
Fast Ethernet, 10–11
FDDI, 18, 21–26
geographically-distributed, 59
Gigabit Ethernet, 11–13
internets, 377–79
introduction, 1–2
reconfigurations, 58
StarLAN, 18, 20–21
token ring, 13–18
Layer 2 Tunneling Protocol (L2TP), 355
Least significant bits (LSB), 216
LEC restoration services, 366–68
alternate serving wire center, 367
customer reconfiguration, 368
dynamic rerouting, 367
emergency access, 368
preferred call forwarding, 367
remote call forwarding, 367
self-healing fiber rings, 367
Link performance management, 207–24
carrier testing services, 216–17
conclusion, 224
CSU functionality, 209–16
digital data services, 208–9
disaster recovery, 221–22
FT1, 218
integrated protocol analyzers, 220–21
integrated solutions, 218–20
introduction, 207–8
service-level, 222–23
SNMP and, 221
user-controlled diagnostics, 217
Load balancing, 70–71
algorithms, 70–71
performance improvement, 70
systems, 63
Local area networks. See LANs
Local exchange carriers (LECs), 358
Logical link control (LLC) sublayer, 4
Logical unit number (LUN)
mapping, 94
masking, 88, 94, 96
Logs, 147
Loopbacks, 218
defined, 213
DTE, 214
frame relay PVC, 214
network, 214


Previous Section
< Day Day Up >
Next Section

Index

M

Maintenance and support, 381–403
cabling, 397–401
conclusion, 402–3
cooperative programs, 396–97
do-it-yourself, 382–90
equipment requirements, 391–94
firms, 395–96
introduction, 381–82
operating systems, 401–2
operations management, 389–90
reporting requirements, 390–91
resource requirements, 384
technical support, 388–89
user support, 384–88
vendor and carrier services, 394–95
Maintenance rerouting, 71
Management agents, 260–61
Management information base (MIB), 261–62
browsers, 262
defined, 261
editors, 262
object list, 261
tool kits, 261–62
See also Simple Network Management Protocol (SNMP)
Management station, 259–60
Manchester encoding, 6
Media access control (MAC), 4–5
data encapsulation/decapsulation, 4–5
defined, 4
media access management, 5
See also Ethernet
Media Gateway Control Protocol (MGCP), 123–24
connection model, 123
connection networks, 124
defined, 123
as internal protocol, 124
MGCs, 123
physical endpoint examples, 123
SS7 and, 124
Media-independent interface (MII) specification, 11
Medium access unit (MAU), 8
Mesh networks, 59
Mirrored servers, 64
Mirror site, 69
Mobile IP, 136–38
broadcasts, 137
control agent advertisements, 138
host redirects, 137–38
lifetime, 137
registration requirement, 137
relay protection, 137
timestamps, 137
Mon, 281–83
asynchronous event support, 282
defined, 281
extensibility, 281–82
parallel tasking support, 283
Monitoring
disk use, 43–44
file use, 41
performance, 142–44
remote, 263–69
Multicast addresses, filtering, 145
Multicast virtual circuits (MVCs), 227–28
Multiplexers, 184–91
bit-oriented, 191
byte-oriented, 190–91
ESF use, 189
points of differentiation, 187–91
PRI-equipped, 197
statistical time division, 185–87
T1, 189
time division, 185
types of, 185
See also TDM infrastructures
Multiprotocol Label Switching (MPLS), 110, 114–16, 238
defined, 114
labeling, 114
LIB, 114
LSPs, 114
LSRs, 114
routers, 115
security, 116
See also Routing protocols
Multirouter traffic grapher (MRTG), 280


Previous Section
< Day Day Up >
Next Section

Index

N

Name server zones, 87
National Infrastructure Protection Center (NIPC), 325
NetProwler, 39
NetView, 342
NetViz Professional, 346
NetWare bindery, 47
Network access point (NAP), 240
Network address translation (NAT), 108, 241, 355
Network attached storage (NAS), 81
Network control points (NCPs), 359
Network design tools, 342–46
approaches, 343
bill of materials, 344–46
defined, 342
DesignXpert, 343, 345–46
NetViz Professional, 346
Network Inspector, 345
network simulation, 344
NetZoom, 346
topology information, 342
Visio Professional, 345
See also Network planning/design tools
Network documentation tools, 338–42
defined, 338
design conversion, 342
device library, 339–40
drag-and-drop technique, 338–39
drill-down capability, 338
starting projects and, 341–42
See also Network planning/design tools
Network Inspector, 345
Network interface cards (NICs), 7
Network management, PBX, 163–64
Network management systems (NMSs), 255–84
account management, 255
central (CNMSs), 257
conclusion, 284
configuration management, 255
evolution, 256–57
fault management, 255
introduction, 255–56
minimal, 258
open source management tools, 277–84
performance management, 256
security, 331–32
security management, 256
SNMP, 258–69
SNMP on wireless networks, 270–73
TMN, 273–77
vendors, 284
in wired world, 257–58
wireless, 271–73
Network modeling, 372–73
Network News Transport Protocol (NNTP), 242
Network operation centers (NOCs), 192
Network planning/design tools, 337–56
built-in intelligence, 337
conclusion, 355–56
introduction, 337–38
network documentation, 338–46
network-specific, 346–52
systems design, 352–55
Network protection capability (NPC), 361
Network reliability, 55–57
bus topology, 56–57
ring topology, 56
star topology, 55–56
Networks
activity tracking, 50–52
availability, 57–58
backbone, 191–93
high-speed packet, 225–54
IP, 239–53
mesh, 59
securing, 303–10
simulation, 344
telecommunications management, 273–77
Network security management, 301–35
conclusion, 334–35
data encryption, 310–18
firewalls, 320–25
introduction, 301
intrusion detection, 326–27
network, 303–10
policy-based, 330–31
remote access, 327–30
security training, 334
system, 331–33
threat assessment, 301–2
virus protection, 318–20
workplace, 302–3
Network security operations center (NSOC), 324
Network-specific tools, 346–52
BroadbandSWAT, 350
ConfigMaker, 347–48
EcoSYSTEMS, 350–52
for IP net design, 347–48
for network performance prediction, 350–52
for wireless net design, 348–50
WirelessSWAT, 348–50
See also Network planning/design tools
Network Time Protocol (NTP), 355
NetZoom, 346
Node addresses, filtering by, 145–46


Previous Section
< Day Day Up >
Next Section

Index

O

Off-site data storage, 69–70
OpenNMS, 279–80
Open Shortest Path First (OSPF), 109, 110
Open source management tools, 277–84
Big Sister, 281, 282
defined, 278
FAQs, 278
mon, 281–83
multirouter traffic grapher (MRTG), 280
OpenNMS, 279–80
risk factors, 283–84
Round Robin Database (RRD), 280–81
sample, 278–83
from strategic perspective, 278
See also Network management systems (NMSs)
Open System Fabric Initiative (OSFI), 92
OpenView, 68, 342
automated operations and, 68
Storage Node Manager, 90
Operating systems, maintenance/support, 401–2
Operations management, 389–90
Orchestream software, 292
OSI reference model, 99–100
application layer, 100
bridge functionality and, 101
data link layer (DLL), 99–100
gateway functionality in, 117
network layer, 100
physical layer, 99
presentation layer, 100
routers and, 107
session layer, 100
transport layer, 100


Previous Section
< Day Day Up >
Next Section

Index

P

Packet data network recovery, 365–66
Packet filtering, 320, 321
Packet over SONET (PoS), 238
PacketShaper, 294–96
bandwidth management, 294
behavioral variables tracking, 294
defined, 294
implementation costs, 295
large-scale deployments, 295–96
traffic classification features, 295
traffic control options, 295
uses, 296
PacketWise, 293–94
Partitioning, 60
Passive caching, 71–72
Password Authentication Protocol (PAP), 329, 330
Passwords, 304–5
characteristics, 304
systems, 304
See also Security
PBXs
capabilities transparent to user, 152
centralized, 156–58
central processor, 153
components, 152–56
defined, 149
distributed, 156–58
features under user control, 151
generations, 150–51
historical perspective, 149–52
illustrated, 150
IP, 170–72
matrix, 153–56
memory, 153
voice trunking, 232
wireless systems, 172–77
Performance management, 34–35
agent capabilities for, 34–35
defined, 34, 256
Performance monitoring, 142–44
Ethernet error statistics, 143–44
radio errors, 143
throughput, 142–43
Permanent virtual circuits (PVCs), 213, 227, 228, 231
fault-tolerant, 366
looped back, 213
Point-to-Point Protocol (PPP), 329, 330
Policy-based QoS management, 288–90
capabilities, 288–89
defined, 288
as software solutions, 289–90
Policy-based security, 330–31
Polling, 166
Port address translation (PAT), 355
Power over Ethernet (PoE), 130
Premises wiring, 397–98
Printer management, 42–43
defined, 42
printer catalog, 42
tasks, 42
Private networking, 191–92
Process scheduling, 48–49
Protocol analyzers, 220–21
downside, 221
functions, 220
Protocol data units (PDUs), 271
Protocol Independent Multicast (PIM), 110, 112–14
rendezvous point (RP), 112
streaming content, 113
See also Routing protocols
Protocols, filtering by, 146–47
Proxies, 320–22
Proximity cards, 306
Public networking, 192–93
Public-switched telephone network (PSTN), 100


Previous Section
< Day Day Up >
Next Section

Index

Q

Quality of service (QoS), 79
adding, to frame and IP, 287–88
in ATM, 232–34, 285–87
IP network standards, 291
parameters, 287
policy-based management, 288–90
priorities, 290
reservation, 286
for TCP/IP networks, 287–88
Queuing, 72–73
priority, 72
weighted fair (WFQ), 72


Previous Section
< Day Day Up >
Next Section

Index

R

Radio errors, 143
RADIUS, 327, 328
RAIDs, 65–67
benefits, 65
categories, 65–66
hybrid solutions, 67
Level 0, 65
Level 1, 65
Level 2, 65–66
Level 3, 66
Level 4, 66
Level 5, 66
Level 6, 66
Level 10, 66
Random access memory (RAM), PBX, 153
Real-time network routing (RTNR), 360
Reconfiguration, 58–59
as fault management scheme, 59
mechanisms, 58
Recovery
access failure, 366
options, 58–60
packet data network, 365–66
Redundant arrays of inexpensive disks. See RAIDs
Redundant carrier systems, 357–60
cable, building, signal diversity, 360
digital interface frames (DIFs), 359
network control points (NCPs), 359
power systems, 359
real-time network routing (RTNR), 360
signal transfer points (STPs), 358–59
switching systems, 358
Remote-access dial-in user service (RADIUS), 317
Remote access security, 327–30
callback systems, 328–29
CHAP, 329, 330
link level protocols, 329–30
measures, 327–28
PAP, 329, 330
PPP, 329, 330
RADIUS, 327, 328
See also Security
Remote monitoring. See RMON; RMON2
Reporting requirements, 390–91
information use, 390–91
logs, 391
task time, 390
variables, 390
See also Maintenance and support
Request for proposal (RFP), 343
Residential gateways, 119
Resilient packet ring (RPR), 109
Resource Reservation Protocol (RSVP), 110, 111
Restoration
carrier, services, 361–62
fiber network, 362–65
LEC, services, 366–68
satellite-based, 376–77
T1, 369–73
WAN, planning, 357–80
Ring topology
network availability, 58
network reliability, 56
RMON, 263–67
alarms, 263
alarms group, 266
defined, 263
Ethernet history group, 265
Ethernet statistics group, 264
filter group, 266
history control group, 265
host table group, 265
host top N counters, 265
implementing, 263
notification (event) group, 266–67
packet-capture group, 266
probes, 263
specification, 264
traffic matrix group, 267
See also Simple Network Management Protocol (SNMP)
RMON2, 267–69
defined, 267
enhanced capabilities, 269
functions, 268
traffic flow and, 268
See also Simple Network Management Protocol (SNMP)
Root configuration, 132
Round robin, 70
Round Robin Database (RRD), 280–81
Routers, 106–16
access, 109
backbone, 109
bridges vs., 106
conclusion, 125
consumer-class, 108
defined, 106
MPLS, 115
OSI model and, 107
types of, 108–9
Routing
automatic, 370–71
dynamic, 107
static, 107
types of, 107–8
Routing Information Protocol (RIP), 109, 110
Routing protocols, 109–16
BGP, 110–11
Diff-Serv, 110, 111–12
MPLS, 110, 114–16
OSPF, 109, 110
PIM, 110, 112–14
RIP, 109, 110
RSVP, 110, 111


Previous Section
< Day Day Up >
Next Section

Index

S

SAN management, 88–92
BrightStor, 91–92
interoperability, 92
OpenView Storage Node Manager, 90
Tivoli Storage Network Manager, 88–89
VisualSAN, 89–90
Satellite-based restoration, 376–77
Scheduler agents, 48–49
defined, 48
job completion information, 49
job implementation, 49
Security
among multiple companies, 318
biometrics, 306–9
conclusion, 334–35
costs, 318
disk/drive, 309–10
employees and, 315–16
extranets, 251
firewalls, 320–25
hacker tools and, 315
intrusion detection, 326–27
key/card systems, 305–6
MPLS, 116
network, 303–10
network management system, 331–32
passwords, 304–5
personnel, 332
policy-based, 330–31
product selection, 314–15
remote access, 327–30
SANs, 87–88
single-point logon, 305
testing, 315
testing, with social engineering techniques, 315
threat assessment, 301–2
training, 334
workplace, 302–3
Security management, 38–39, 301–35
agent capabilities, 38–39
defined, 38, 256
Serial Storage Architecture (SSA), 82
Server blades, 67–68
Servers
error logs, 147
fault-tolerant, 62
mirrored, 64
restoration capabilities, 60–62
unmirrored, 64
as valuable resource, 62
Service-level agreements (SLAs), 222, 296–99
availability, 298
compliance, 298–99
defined, 296
financial penalties, 299
key issue, 297
latency, 297
packet loss, 298
performance metrics, 297–98
popularity, 296
Service-level management, 222–23
Service quality management, 284–300
adding, to frame and IP, 287–88
ATM role, 284–87
conclusion, 299–300
hardware solutions, 293–96
introduction, 285
policy-based, 288–90
SLAs, 296–99
software solutions, 290–93
Service/repair documentation, 393–94
Service set identifiers (SSIDs), 131, 269
Session Initiation Protocol (SIP), 122–23
defined, 122
message requirements, 123
network components, 122–23
speed, 123
Signaling system 7 (SS7), 124
Signal transfer points (STPs), 358–59
Simple Mail Transfer Protocol (SMTP), 242
Simple Network Management Protocol (SNMP), 9, 256
advantages, 259
components, 259
components relationship, 260
for CSU-DSU management, 221
default password, 269–70
defined, 258
flexibility, 258
get-bulk request, 171
get-next operation, 271
graphical tools, 269–70
management agents, 260–61
management station, 259–60
mechanics, 258–69
MIB, 261–62
performance, 270–71
platform support for wireless, 271–73
as request/response protocol, 259
RMON, 263–67
RMON2, 267–69
TDM devices and, 184
traps, setting, 147–48
use of, 258
on wireless networks, 270–73
See also Network management systems (NMSs)
Single-point logon, 305
Small computer system interface (SCSI), 81, 82
Smart cards, 306
SNIA, 92
SMI, 92
SNCP, 97
Software defined network (SDN), 159
access control points (ACPs), 160
architecture, 161
See also Virtual private networks (VPNs)
Software distribution automation, 39–40
Source-route bridging (SRB), 102, 103
Source-route translation bridging, 102, 105–6
defined, 102, 105
illustrated, 106
path establishment, 105
See also Bridges
Spanning tree algorithm (STA), 102
Spanning Tree Protocol (STP), 138–42
in conventional bridges, 139
forwarding delay, 140–41
functioning of, 139
hello time, 140
local port cost, 141
local port priority, 141
message timeout, 141
in multibridge environments, 139
ports, 141
ports of active connected repeaters, 141–42
priority, 140
protocols status, 142
Spares inventory, 74–75, 392
Split-access flexible egress routing (SAFER), 361
StarLAN, 18, 20–21
architecture, 21
defined, 20–21
See also LANs
Star topology
network availability, 57–58
network reliability, 55–56
Station message detail recording (SMDR), 166
Statistical time division multiplexers (STDMs), 185–87
advantages/drawbacks, 186
for asynchronous traffic, 189
defined, 185
deployment, 188
peak traffic handling, 185–86
TDM comparison, 187
variable length frames, 186
See also Multiplexers
Statistical time division multiplex (STDM), 183
Storage area networks (SANs), 28, 45–46, 79–92
advantages, 79–81
architecture, 79
for backups, 80
components, 84–85
for data-intensive environments, 81
defined, 45, 79
early implementations, 82
evolution, 81–84
Fibre Channel, 84
hubs, 85–86
illustrated, 80
IP, 93
local/regional, 45–46
LUN masking, 88
management, 88–92
management interoperability, 92
metro-area, 83
move to, 45
security, 87–88
subnets, 88
switches, 86
zoning, 86–87
Storage management, 43–47
disk use monitoring, 43–44
hierarchical, 44–45
need, 43
outsourcing, 46–47
SANs, 45–46
Storage Management Initiative (SMI), 92
Storage Networking Certification Program (SNCP), 97
Storage over Internet Protocol (SoIP), 93
Storage service providers (SSPs), 46–47
cost savings, 47
defined, 46
leverage, 46
monitoring software, 47
needs addressed by, 46–47
Storage virtualization, 79, 94–96
appliance, 95–96
defined, 94
host, 94–95
storage, 95
technology, 94
Subnet masks, 131
Subnetworks, 60
Subrate data multiplex (SDM), 193
Surge suppressors, 74
Switched multimegabit data service (SMDS), 109
Switched virtual circuits (SVCs), 227, 228, 231
Switches
adjunct, 173–74
circuit, 119
fabric, 86
SAN, 86
single-stage space-division, 154
three-stage space-division, 155
Switching matrix, 153–56
control, 153
single-stage space-division, 154
three-stage space-division, 155
See also PBXs
Symmetric encryption, 311
Synchronous optical network (SONET), 79, 82, 109
for disaster recovery, 363–65
embedded management channels, 364
System fault tolerance (SFT) levels, 48
Systems design, 352–55
Systems network architecture (SNA), 117
Systems security certified practitioner (SSCP), 333


Previous Section
< Day Day Up >
Next Section

Index

T

T1 restoration, 369–73
automatic routing/rerouting, 370–71
backup via ISDN, 369–70
dial backup, 371–72
inverse multiplexing, 373
network modeling, 372–73
T1.5 reserved service, 362
Target token rotation time (TTRT), 22
Task manager agent, 51–52
TCP/IP
cross-platform nature, 244
infrastructure, 245
stacks, 244
TDM infrastructures, 183–206
backbone network, 191–93
clear channel capability, 195–96
conclusion, 205–6
data support, 195
DCSs, 183, 198–205
fast-packet infrastructure, 184
ISDN, 196–97
multiplexers, 184–91
public/private network interoperability, 193–94
voice compression, 194–95
Telecommunications management network (TMN), 273–77
benefits, 274
DCN, 276
defined, 273
framework, 274
functional architecture, 275
management tasks and, 275
manager, 273
NEs, 276, 277
object model, 273
object-oriented techniques, 277
physical architecture, 275–77
standards, 274–75
telecommunications resources, 275–76
Temporal Key Integrity Protocol (TKIP), 317
Test equipment, 392–93
Testing, 96
carrier, services, 216–17
impairment, 216
Text viewer, 49–50
Threat assessment, 301–2
Throughput, 142–43
Time division multiplexers (TDMs), 185
bit/byte formats, 190
defined, 185
deployment, 188
modularity and, 189
STDM comparison, 187
See also Multiplexers; TDM infrastructures
Timestamps, 137
Tivoli Enterprise Console (TEC), 88
Tivoli Storage Network Manager, 88, 89
Token ring, 13–18, 27
advantages, 14–15
dedicated, 17
defined, 13
disaster protection, 16
frame format, 15–16
high-speed, 17–18
liabilities, 15
multistation access unit (MAU), 13
operation, 16
star topology, 14
See also LANs
Topologies, 55–57
bus, 56–57
ring, 56, 58
star, 55–56, 57–58
Topology change notification (TCN), 102, 103
Traffic shaping, 234
Transaction tracking service (TTS) levels, 48
Translation bridging, 102, 103–5
C bit set, 104
defined, 102
MTU field, 104
for software gateway creation, 105
See also Bridges
Transmission Control Protocol/Internet Protocol (TCP/IP), 42
Transparent bridging, 101, 102–3
BPDUs, 102
defined, 101
STA, 102
TCN, 102, 103
See also Bridges
Transport management system (TMS), 193
Traps
defined, 147
setting, 147–48
See also Simple Network Management Protocol (SNMP)
Trunking gateways, 118


Previous Section
< Day Day Up >
Next Section

Index

U

Ultrawideband (UWB), 127–28
Uninterruptible power supplies (UPSs), 73–74
defined, 73
generators vs., 74
Unmirrored servers, 64
Unshielded twisted-pair (UTP) wiring, 6
Unspecified bit rate (UBR), 233
User support, 384–88
interpersonal communication skills, 387–88
move, add, change requests, 386
recordkeeping, 387
training, 387
trouble reporting, 384–86
See also Maintenance and support


Previous Section
< Day Day Up >
Next Section

Index

V

Variable bit rate (VBR), 232
Vendor and carrier services, 394–95
Very low bit rate voice (VLBRV), 195
Very small aperture terminals (VSATs), 377
Virtual Connection Services (VCS), 172
Virtual private networks (VPNs), 108, 158–64
advantages, 159–60
architecture, 160–61
automatic number identification (ANI), 162
billing options, 162–63
defined, 158
exchange number sharing, 162
features, 161–62
flexible routing, 162
history of, 159
local, service, 164
location screening, 162
network management, 163–64
originating call screening, 162
partitioned database management, 162
SDNs, 159, 160, 161
service providers, 160
vulnerability, 318
Viruses
multiplier effect, 319
protection, 318–20
scanning, 41–42
threat of, 319
Visio Professional, 345
VisualSAN, 89–90
Performance Manager, 90
VisualSAN Network Manager, 89–90
Voice compression, 194–95
Voice over ATM gateways, 118
Voice over frame relay (VoFR), 109, 230–31
Voice over IP (VoIP), 100
Voice systems
call detail reporting, 164–70
centralized vs. distributed, 156–58
Centrex, 177–81
historical perspective, 149–52
IP PBXs, 170–72
managing, 149–82
PBX components, 152–56
VPNs, 158–64
wireless PBX, 172–77


Previous Section
< Day Day Up >
Next Section

Index

W

WAN restoration planning, 357–80
carrier restoration services, 361–62
competitive access providers, 368–69
conclusion, 379–80
DDS dial backup, 373–75
dial backup units, 376
fiber network restoration, 362–65
intelligent calling systems, 375
introduction, 357
LAN internets, 377–79
LEC restoration services, 366–68
packet data network recovery, 365–66
redundant carrier systems, 357–60
satellite-based restoration, 376–77
T1 restoration, 369–73
WANs
caching, 71–72
load balancing, 70–71
queuing, 72–73
servers on, 70–73
Wavelength division multiplexers (WDMs), 193
Web-based reporting, 169–70
Web traffic management, 37–38
Weighted fair queuing (WFQ), 72, 291
Weighted round, 71
Wide area networks. See WANs
Wired equivalent privacy (WEP), 130, 312–13
Wireless fidelity (Wi-Fi), 127
innovation, 127
network popularity, 128
protected access (WPA), 317
Wireless infrastructure
conclusion, 148
configuration details, 130–36
filter application, 144–47
introduction, 127–30
logs, 147
management, 127–48
mobile IP, 136–38
performance monitoring, 142–44
SNMP traps, 147–48
Spanning Tree Protocol (STP) and, 138–42
Wireless PBX systems, 172–77
adjunct switch, 173–74
applications, 173
base station, 174–75
call handoff scenario, 176–77
components, 173–76
concept, 172
distribution hub, 176
frequency bands, 176
illustrated configuration, 174
telephone handset, 175–76
See also PBXs
WirelessSWAT, 348–50
defined, 348
features, 348–49
graphical reports, 350
Wizards, 40
Workplace security, 302–3
World wide names (WWNs), 87
World Wide Web (WWW), 242


Previous Section
< Day Day Up >
Next Section

Index

X

X.25 protocol, 225
error protection, 226
OSI reference model and, 226
speed, 225


Previous Section
< Day Day Up >
Next Section

Index

Z

Zero byte time-slot interchange (ZBTSI), 212
Zones, 86–87
broadcast, 87
hard, 86
name server, 87
See also storage area networks (SANs)


Previous Section
< Day Day Up >
Next Section

List of Figures

Chapter 1: Local Area Networks

Figure 1.2: Functional elements of Gigabit Ethernet.
Figure 1.3: Token ring configured in a star topology through the use of MAUs.
Figure 1.4: Format of IEEE 802.5 token and frame.
Figure 1.5: ARCnet configuration incorporating both passive and active hubs.
Figure 1.6: Via encapsulation, FDDI can carry Ethernet and token-ring frames as data, providing a multiprotocol backbone network.
Figure 1.7: FDDI layers and their relationship to the seven-layer OSI reference model.
Figure 1.8: FDDI dual-ring topology with three types of interconnecting devices.
Figure 1.9: Self-healing capability of FDDI’s dual-ring topology.

Chapter 2: LAN Administration

Figure 2.1: Information flow between console and agent.

Chapter 3: LAN Restoration Planning

Figure 3.1: A fault tolerant hub-based network.

Chapter 4: Storage Network Management

Figure 4.1: Hierarchical data storage spanning magnetic disk, optical disk, and tape options.
Figure 4.2: A simple SAN spanning the WAN under the supervision of a centralized management system. The access links at each location can be multiples of T1 at 1.544 Mbps (NxT1), a T3 at 45 Mbps or an optical carrier link at 155 Mbps (OC-3). Carrier-provided Ethernet services between 10 Mbps and 1 Gbps can be used as well.
Figure 4.3: For metro-area SANs, SONET/DWDM systems offer the highest resiliency of any transport technology. Even if a fiber gets cut or a node on the ring fails, data gets to its proper destination with very little loss. Data integrity is ensured using higher-level protocols like TCP/IP.
Figure 4.4: Tivoli Storage Network Manager’s event destinations screen.

Chapter 5: Managing Bridges, Routers, Gateways

Figure 5.1: Bridge functionality in reference to the OSI model.
Figure 5.2: Source-route translation bridging, from token ring to Ethernet.
Figure 5.3: Routers operate at the network layer of the OSI reference model.
Figure 5.4: In PIM, streaming content goes out the server one time and is replicated at the RP to reach the nearest subscribers who have specifically requested the stream. This method of content delivery reduces the processing burden of the source server and conserves network bandwidth.
Figure 5.5: A label-switched route is defined by fixed-length tags appended to the data packets. At each hop, the LSR strips the existing label and applies a new label, which tells the next hop how to forward the packet. These labels enable the data packets to be forwarded through the network without the intermediate routers having to perform a complex route lookup based on destination IP address.
Figure 5.6: Gateway functionality in reference to the OSI model.
Figure 5.7: The H.323 protocol stack.
Figure 5.8: Basic H.323 network topology.

Chapter 6: Managing the Wireless Infrastructure

Figure 6.1: The role of a bridge in a wireless network.
Figure 6.2: Relationship of visual line of sight to the Fresnel zone.
Figure 6.3: This four-way handshake occurs between the sending node and the access point or bridge. Its purpose is to minimize the chance of data collisions at the access point or bridge when multiple nodes have data to send.
Figure 6.4: Replay protection via the nonces handshake between a mobility agent and a home agent.

Chapter 7: Managing Voice Systems

Figure 7.1: The PBX as the cornerstone of the corporate voice network. (ACD = automatic call distributor, KTS = key telephone system, SDN = software-defined network, ISDN = integrated services digital network, WATS = wide area telecommunication service, OPX = off-premises extension, FX = foreign exchange, SMDR = station message detail recorder.)
Figure 7.2: Architecture of a single-stage space-division switch. Because the single-stage space division switch always has a path available for the interconnection of inputs to outputs, it may be considered nonblocking. This scheme is acceptable only for small configurations. As the number of cross-points increases to accommodate system growth, the matrix becomes less efficient.
Figure 7.3: The architecture of a three-stage space-division switch. In this type of switch, the probability of blocking is substantially reduced. Although blocking can be further reduced by adding more switching matrices via multiple stages, blocking cannot be eliminated entirely.
Figure 7.4: Centralized system architecture with two local PBXs.
Figure 7.5: Distributed system architecture with multiple PBXs over a wide area.
Figure 7.6: The architecture of AT&T’s Software Defined Network.
Figure 7.7: A typical configuration of a call accounting system. A backup modem is used for polling over the PSTN if the TCP/IP network is unavailable.
Figure 7.8: Detailed view of how the PC poller is configured.
Figure 7.9: A typical wireless PBX system in the corporate environment. In this case, workers can roam between the office and home using the same handset. When the handset moves within range of the local cellular service provider, the signal is handed off from the wireless PBX to the cellular carrier’s nearest base station.
Figure 7.10: An IP gateway connects to the Class 5 central office switch using the industry standard GR-303 interface to extend the reach of Centrex features via the IP.

Chapter 8: Managing the TDM Infrastructure

Figure 8.1: A comparison of TDM and STDM.
Figure 8.2: The interconnectivity potential of a TDM-based T1 multiplexer. (Note: The CSU at each end of the T1 link may be integrated into each multiplexer as a module.)
Figure 8.3: Comparison of processing delay with bit- and byte-oriented multiplexers. With the byte-oriented multiplexer, there is a slight processing delay while the bits are assembled into bytes.
Figure 8.4: DS1 transport via a CO multiplexer and a 3/1 DCS.
Figure 8.5: Typical CCR arrangement, whereby the corporate subscriber manages bandwidth groom-and-fill functions of the DCS network by issuing instructions to the carrier’s central control center from an on-premises terminal.

Chapter 9: Managing Link Performance with CSU-DSUs

Figure 9.1: The original digital signal from a terminal’s serial data output (a) is translated into a bipolar format through AMI (b). The unshaped bipolar waveform is first reduced to a 50% bipolar waveform and then filtered (c), producing an output spectrum with zero energy at the data rate and reducing high-frequency components that may interfere with other services sharing the same cable binder. The output spectrum of a 9.6-Kbps transmission, for example, will exhibit no energy at either dc or 9,600 Hz and will peak at 4,800 Hz.
Figure 9.2: An application of DDS/SC. The secondary channel provides the means through which the diagnostic controller can poll location 3. At the same time, the host, using the primary channel, may poll location 1 for normal production data.
Figure 9.3: An integrated CSU-DSU on a DDS circuit.
Figure 9.4: Deployment of CSUs and regenerators along a T1 span.
Figure 9.5: B8ZS is a line-coding scheme that substitutes a known pattern for eight consecutive zeros. B8ZS maintains the ones-density rule at relatively little bandwidth overhead.
Figure 9.6: A comparison of how the 193rd bit is used in SF (D4) and ESF formats.
Figure 9.7: Frame relay service-level validation from Visual Networks’ Visual UpTime.

Chapter 10: Managing High-Speed Packet Networks

Figure 10.1: A simplified view of virtual circuits through an ATM network.
Figure 10.2: ATM protocol model in relation to the OSI reference model and SONET physical layer protocols.
Figure 10.3: IMA allows the use of bonded multiple T1 access lines into and out of the service provider’s ATM network, rather than forcing companies to use more expensive T3 access lines at each location. This makes it cost-effective for mid-size companies to take advantage of ATM services to support a variety of applications.
Figure 10.4: The network address translation capability of a proxy server allows the creation of subnets with private IP addresses that are locally administered and never exposed to the public Internet. In addition to conserving scarce IP addresses, this capability enhances security by hiding the private IP addresses from public view over the Internet through the use of one or more public IP addresses.

Chapter 11: Network Management Systems

Figure 11.1: Each type of device on the network may have its own EMS, which reports to a central network management system (CNMS) that integrates, prioritizes, and permits analysis of information from multiple element managers.
Figure 11.2: Relationship of SNMP components.
Figure 11.3: MIB Walk from SolarWinds.Net is used to search the SNMP tree for a target device and dump the value of each object identifier (OID). This tool is commonly used to find out what MIBs and OIDs are supported on a particular device. MIB Walk uses a database of MIB information to determine the plain language name for each OID and the MIB to which it belongs.
Figure 11.4: The Ethernet statistics window accessed from Enterasys Networks’ NetSight Element Manager. This window would be used to view a detailed statistical breakdown of traffic on the monitored Ethernet network segment. The data provided applies only to the interface or network segment, either wired or wireless.
Figure 11.5: Physical architecture of the TMN.
Figure 11.6: Tobi Oetiker’s RDDTool showing packet-loss/round-trip delay.
Figure 11.7: Big Sister by Aeby Graeff showing alarms.

Chapter 12: Managing Service Quality

Figure 12.1: In this depiction of QoS reservation, bursty VBR traffic does not cause cell delay for CBR traffic because it is assigned a low-priority (QoS 2) partition of the switching fabric. In this scheme, time-sensitive video traffic always has the right of way.
Figure 12.2: With WFQ, a router’s incoming traffic is classified and arranged in a queue structure according to its type before being released to the network. In this way, WFQ provides consistent response time to heavy and light network users alike without the addition of more bandwidth.

Chapter 13: Managing Network Security

Figure 13.1: The Sony FIU-710 connects to the client via a USB cable and processes, encrypts, and stores fingerprint templates internally rather than in a server or desktop database. If the unit is disconnected from the computer, access is denied.
Figure 13.2: The role of the FIU-710 in the authentication process using a digital certificate.
Figure 13.3: Hackers can use a tool like APSniff to discover essential information about wireless access points, which enables them to more easily break into corporate networks.
Figure 13.4: A firewall protects the enterprise network (trusted) from a variety of attacks emanating from untrusted networks such as the Internet, thereby safeguarding mission-critical resources.
Figure 13.5: Operation of a packet-filtering firewall: (1) inbound/outbound packets are examined for compliance with company-defined security rules; (2) packets found to be in compliance are allowed to pass into the network; (3) packets that are not in compliance are dropped.
Figure 13.6: An implementation of a proxy application.
Figure 13.7: Firewall software for individual computers allows users to control their own level of security. Shown is ZoneAlarm from Zone Labs, which is available for download at the company’s Web site.
Figure 13.8: Network Mapper is an open-source utility developed by Insecure for network exploration or security auditing.

Chapter 14: Network Planning and Design Tools

Figure 14.1: From a library of network shapes (left), items are dragged and dropped into place as needed to design a new node or build a whole network (right). (Source: © 2003 Visio Corp., a division of Microsoft Corp.)
Figure 14.2: Details about network equipment can be stored using custom property fields. Device-specific data for each network shape keeps track of asset, equipment, and manufacturer records that can be accessed from within network diagrams. (Source: © 2003 Visio Corp., a division of Microsoft Corp.)
Figure 14.3: A design tool, such as DesignXpert from NetFormx provides workspace into which objects can be dragged-and-dropped from a device library to start the network design process. ( Source: © 2003 Netformx. Reprinted with permission.)

Chapter 15: WAN Restoration Planning

Figure 15.1: Self-healing SONET-compliant fiber-ring topology. In this scenario, if the inner ring is cut or fails, traffic is rerouted in the opposite direction on the outer ring. The SONET equipment at node D changes the direction of the traffic.
Figure 15.2: Dual points of entry for connections into a building provide protection from cable cuts.
Figure 15.3: Configuration for ISDN backup for a T1 private line.
Figure 15.4: Dial backup communications link between multiplexer nodes.
Figure 15.5: Devices that provide IMA now support trunk group failure protection, allowing communication to continue despite the failure of one or more access lines in the trunk group. (In the bottom diagram, the failed line is indicated with an X.)

Chapter 16: Maintenance and Support Services

Figure 16.1: Users can submit trouble reports from a Web form posted on the company’s intranet. (Source: © 2003 HelpSTAR.com. Reprinted with permission.)
Figure 16.2: A simple configuration showing the relationship of the AP to the wired and wireless segments of the network.


Previous Section
< Day Day Up >

List of Tables

Chapter 1: Local Area Networks

Table 1.1: A Summary of Gigabit Ethernet Standards for Various Media Specification Transmission Facility Purpose Source: IEEE 802.3z Gigabit Task Force.

Chapter 6: Managing the Wireless Infrastructure

Table 6.1: Sample Antenna Alignment Test Results

Chapter 7: Managing Voice Systems

Table 7.1: Select PBX Features under Direct User Control
Table 7.2: Select PBX Capabilities Transparent to the User

Chapter 9: Managing Link Performance with CSU-DSUs

Table 9.1: Primary and Secondary Channel Bit Rates of DDS with Secondary Channel Primary Channel Secondary Channel
Table 9.2: Diagnostic Information Provided by the Integrated Router/CSU-DSU

Chapter 10: Managing High-Speed Packet Networks

Table 10.1: ATM Quality of Service Categories
Table 10.2: ATM Adaptation Layer Functions AAL Application Examples Notes

Chapter 12: Managing Service Quality

Table 12.1: QoS Mechanisms Included with ATM QoS Mechanism Description Applications
Table 12.2: Selected QoS Mechanisms for Frame Relay Networks QoS Mechanism Description Applications
Table 12.3: Selected QoS Mechanisms for TCP/IP Networks QoS Mechanism Description Applications