Cyber Criminals

The typical cybercriminals in the cyber world in the early days were youngsters or hobbyists. Their attacks generally limited to pranks and vandalism. But at present, the cybercriminals become very dangerous. The attackers are individuals or groups. They try to make use of the vulnerabilities for there mission. These criminals are interested in the whole thing as of credit cards, product designs, and anything with some value. The type of cybercriminals are the following:

Amateurs

Amateurs are also called script kiddies. They have only some skills and want to be a hacker. They lack any serious technical expertise and usually use existing tools to initiate attacks. Some of these are just curious and others try to show their skills and cause damage. They are just using basic tools and usually be able to attack very weakly secured system, but the results can be very destructive.

Hackers

A term hacker is first used in the early days of the 1960s. It describes a programmer or somebody who can hack computer code. Usually work secretly and create tools for hacking. They often break into computers or networks to gain access for a variety of reasons. The goal of the break-in determines the categorization of these hackers as white, gray, or black hats. The figure below illustrates the type of hackers.

White Hat Hackers

These are ethical hackers and used their programming skills for good and legal process. They break into networks or computers with the permission of the owners to find weaknesses of these systems to improve security aspects. White hat hackers use their skills to discover network vulnerabilities and report to developers and owners for fixing these issues before the vulnerabilities can make damage.

Black Hat Hackers

The black hat attackers are individuals who take advantage of any vulnerability for illegal missions. Blackhat hackers are unethical hackers. These hackers compromise the network permission for their personal gain. They also attack a network for malicious.

Gray hat hackers

These hackers are between white and black hat attackers. The gray hat attackers may find the vulnerability and report it to the owners of the system to fix the problem and some gray hat hackers publish the facts about the vulnerability on the Internet so that other attackers can exploit it.

Organized Hackers

These are the organization of cybercriminals, which include hacktivists, terrorists and state-sponsored hackers. These criminals are generally groups of skilled criminals focused on control, power and wealth.

Hacktivists

The hacktivists working for making for political statements to create wakefulness to different issues to their rights. Hacktivists publish awkward information about their victims publicly.

State-sponsored

State-sponsored attackers collect intelligence or situate damage on behalf of their government. These attackers are very high and well trained. Their attacks focus on particular goals that are helpful to their government. These attackers are usually members of their countries armed forces.

VLANs Range and Creating VLANs

Different Cisco Catalyst switches support different numbers of VLANs. The number of supported VLANs is sufficient to accommodate the requirements of nearly all organizations. The Catalyst 2960 and 3560 Series switches support VLANs over 4,000. The Normal VLANs

range is numbered from 1 to 1,005 and extended-range VLANs are numbered from 1,006 to 4,094. The figure illustrates the normal range of VLANs on a Cisco switch. The Used of a normal range is used in small- and medium-sized business and enterprise networks.

Normal VLANs Range 

• The normal range VLAN ID is between 1 and 1005.


• IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs.


• IDs 1, 1002, 1003, 1004 and 1005 are automatically created and cannot be removed.


• The VLAN configurations are stored in a VLAN database file, called vlan.dat. The vlan.dat file is saved in the flash memory of the switch.


• The VTP (VLAN Trunking Protocols) helps to manage VLAN configurations between switches. The VTP can only learn and store normal range VLANs.

Extended VLANs Range

• The extended VLANs range enables service providers to extend their infrastructure to a greater number of customers.


• The VLAN ID is between 1006 and 4094.


• The extended range configuration is stored by default in running configurations file instead of the vlan.dat file.


• Support fewer VLAN features than normal range of VLANs.


• VTP not working with extended range VLANs.

Creating VLANs

For normal range VLAN configuring, the configuration is stored vlan.dat file, which is stored in flash memory on the switch.  Flash memory does not require the copy running-config startup-config or Write command. But, other details are usually configured on a Cisco at the same time when VLANs are created; it is best to save running configuration changes to the startup configuration. The figure below illustrates the Cisco IOS command syntax used to add a VLAN to a Cisco switch and give it a name. Naming each VLAN is considered a best practice in switch configuration.





The figure below illustrates the topology where VLAN 10 and 20 are configured on Switch1. We can check using the Syntax Checker show vlan brief command in user exec mode to display the contents of the vlan.dat file.



We can use a series of VLAN IDs which can be entered separated by commas and we can also use a range of VLAN IDs separated by hyphens using the vlan vlan-id command. For example, use the following command to create VLANs 10, 20, 30, 40, and VLANs 50-60.

switch1(config)# vlan 10, 20, 30, 40

switch1(config)# vlan 50-60

Tagging Ethernet Frames for VLAN Identification

The Layer 2 devices use Ethernet frame header information to forward packets without having routing tables. Usually, Ethernet frame header does not contain any information about VLAN, so, when Ethernet frames arrive in a trunk, information about its VLAN must be added. This method called tagging. The standard for VLAN tagging is IEEE 802.1Q. The 802.1Q header includes a 32-bits tag inserted inside the original Ethernet frame header, specifying the VLAN to which the frame belongs. When the switch receives an Ethernet frame on a port in access mode and assigned a VLAN, the switch inserts a VLAN tag into the received frame header, calculates the FCS again, and sends out the tagged frame to the trunk port. The figure below illustrates different fields of VLAN tag:

• Type– Type field is 16 bits field also called the tag protocol ID (TPID) value. For Ethernet, it is set to hexadecimal 0x8100.


• User priority– It has a 3-bit value that supports service implementation.


• Canonical Format Identifier (CFI)– This is a 1-bit identifier that enables Token Ring frames to be carried across Ethernet links.


• VLAN ID (VID)– It is 12-bit VLAN identification number that supports up to 4096 VLAN IDs.

Native VLANs and 802.1Q Tagging

Tagged Frames on the Native VLAN

Some devices that support trunking, insert a VLAN tag to native VLAN traffic. If a port configured on 802.1Q trunk receive a tagged frame with VID and the same as the native VLAN, it drops the frame. So when configuring a switch port on Cisco switch, configure devices that they send untagged frames on the native VLAN. Other vendor devices, routers, non-Cisco switches, and servers support tagged frames on the native VLANs.

Untagged Frames on the Native VLAN

When a trunk port receives untagged frames, it forwards these untagged frames to the native VLAN. If there are no devices associated with the native VLAN and also there are no other trunk ports, then the switch dropped the frame. During configuring an 802.1Q trunk port, a default Port VLAN ID is assigned the value of the native VLAN ID. All untagged traffic coming in and out the 802.1Q port is forwarded based on the PVID. For example, if VLAN 10 is configured as a native VLAN. The PVID is 10 and every untagged frame is forwarded to VLAN 10. If the native has not been configured, the PVID value for native VLAN is 1. Because the default native VLAN is 1.

Voice VLAN Tagging

To Support Voice over IP a separate voice VLAN is required. Port that connects Cisco IP phone can be configured to use two separate VLANs. One for voice and another for data traffic. The link between IP phone and switch work like trunk to carry both voice and data VLAN traffic. The Cisco IP Phone has three-port 10/100 switch. These ports give dedicated connections to these devices:

1. Port-1 – This port connects the IP phone to the switch or other VoIP devices.


2. Port-2 – This port is an internal 10/100 interface that carries the IP phone traffic.


3. Port-3 - This is an access port which connects to a PC or other device.

On the switch, the switch port is configured to send CDP packets that instruct an attached IP phone to send voice traffic to the switch in one of the following ways, depending on the type of traffic:

1. In a voice VLAN tagging with a Layer 2 class of service priority value.


2. In; an access VLAN tagging with a Layer 2 class of service priority value.


3. In an access VLAN, untagged without a Layer 2 class of service priority value.

Controlling Broadcast Domains with VLANs

Network without VLANs

In the default configuration, when a switch receives a broadcast frame on the ingress ports of the switch it forwards the frame out all ports excluding the port where the broadcast frame was received. Because the whole network is configured in the same subnet and no VLANs are configured therefore all ports are working in the same broadcast domain. As shown in the figure; when the host 1 sends out a broadcast frame, switch S2 receives the broadcast frame and sends that broadcast frame out all of its ports except ingress port. Ultimately the whole network receives the broadcast for the reason that the network is one broadcast domain.

Network with VLANs

Figure 2 illustrates the segmented network with VLANs; the network has been segmented using two VLAN, VLAN 10 and VLAN 20. The IT department is assigned VLAN 10 and the admin department has assigned VLAN 20. When a broadcast is sent from the IT department computer; Host-1, Host-2, and Host-5  to switch S2; the switch forwards that broadcast frame only to those switch ports configured to support VLAN 10 and Trunk port. Same as when computer from admin department sent a broadcast frame; the switch forwards the frame to port that is configured for VLAN-20 and trunk port.


The ports that connect both switches S1 and S2 are trunks and have been configured to support all the VLANs in the network. When S1 and S2 receive the broadcast frame on a port from VLAN-10. The switch forwards that broadcast frame out of the only other port configured to support VLAN 10; which is trunk port. When VLANs are configured on a switch, the transmission of unicast; multicast, and broadcast traffic from a host in a particular VLAN is limited to the devices that are in that VLAN. The VLAN create multiple broadcast domains in the switch so the broadcast can be controlled with creating multiple broadcast domains.



 

Types of VLANs

There are different types of VLANs used in networking. Some VLAN is defined by classes of traffic and some other are defined by the specific function that they serve. Each switch has a default VLAN.

Default VLAN

VLAN-1 is the default VLAN in Cisco switches. After initial boot up process, the switch loads the default configuration and all switch ports became a part of the default VLAN (VLAN-1). The switch port that is the part of the default VLAN work in the same broadcast domain.  The figure below illustrates the default VLAN of a Cisco switch, the show VLAN brief command was executed on a switch running the default configuration. You can see that all ports are assigned to VLAN 1 by default. There is no difference between the features and function of VLAN1 and other VLAN; excluding that it cannot be renamed or deleted. By default, all Layer 2 control traffic is associated with VLAN 1.

Data VLAN

A data VLAN is also referred to as a user VLAN. It is used to separate the network into different groups of users or devices. Data VLAN is used to forward user-generated traffic. It is also separate voice and management traffic from data traffic.

Native VLAN

A native VLAN is assigned to an 802.1Q trunk port that was created for backward compatibility with old devices that don’t support VLANs just like a hub. Frames belonging to the native VLAN are not tagged when sent out on the trunk links so older devices can simply understand these frames. Frames received untagged on the trunk links are set to the native VLAN. The trunk is the links between switches that maintain the transmission of traffic connected with more than one VLAN. An 802.1Q trunk port supports traffic coming from many VLANs (tagged traffic); with traffic that does not come from a VLAN. Tagged traffic is traffic that has a 4-byte tag inserted in the original Ethernet frame header; specifying the VLAN to which the frame belongs. The 802.1Q trunk port places untagged traffic on the native VLAN, which by default is VLAN 1.

Management VLAN

The separate VLAN for management like monitoring, system logging, SNMP, and other sensitive management jobs is best practice in networking. It also ensures that bandwidth for management will also be available even when user traffic is high. VLAN 1 is the management VLAN by default. To create the management VLAN, the switch virtual interface of that VLAN is assigned an IP address and subnet mask, which management remotely via HTTP, Telnet, SSH, or SNMP. Because the out-of-the-box configuration of a Cisco switch has VLAN 1 as the default VLAN, VLAN 1 would be a bad choice for the management VLAN.

If your organization uses voice over IP (VoIP), a separate VLAN is needed. This will save bandwidth for other applications and ensure VoIP quality. The Voice Over  Internet Protocol (VoIP) traffic requires, assured bandwidth to ensure quality, transmission priority, ability to be routed around congested areas on the network and delay of less than 150ms across the network. To meet these requirements, the entire network has to be designed to support VoIP.

Router File System

Benefits of VLANs

VLANs make it simple to plan a network to maintain the goals of an organization. The most important benefits of  VLANs are as follows:

Security

Security in one of the primary benefits of VLANs. it makes possible that the hosts that have sensitive data are separated from the rest of the network. The separation decreases the possibility of confidential information breaches. The figure below illustrates that management, sells and IT section are totally separate from each other, so they can’t access each other’s files. 

Cost

VLANs reduce the cost of the network and make possible of more efficient use of existing hardware and bandwidth because segmenting a network into smaller VLAN is cheaper than creating a routed network with routers.

Better Network Performance 

Dividing flat Layer 2 networks into multiple broadcast domains reduces unnecessary traffic on the network and help increase network performance. VLANs manage traffic very efficiently so that your end users experience better performance. The administrator will have a smaller amount of latency problems on the network and more reliability for important applications.

Shrink Broadcast Domains 

Division of large network into smaller VLANs reduce devices in the broadcast domain. As shown in the figure above, total nine hosts working in this network but only three hosts are in broadcast domains.

Improved IT staff efficiency 

VLANs make network management very easy for IT staff because users with related network requirements share the same VLAN.

Simpler Project and Application Management 

VLANs combined users and network devices to support both business and geographic requirements.

Simplified Administration for the Network Manager

VLAN simplifies network management. Grouping of users into the virtual networks, make it easy to set up and control network policies at a group level.

Easy Troubleshooting

Network troubleshooting can be simpler and faster because of different user groups are segmented and isolated from one another. If the network administrator knows that complaints are only coming from a different subset of users, the network administrator will be able to quickly narrow down where to look to find the issue.