Switches
An ethernet switch is a device that provides a central connection point for cables from workstations, servers, and peripherals. In a star topology, twisted-pair wire is run from each workstation to a central switch/hub. Most switches are active, that is they electrically amplify the signal as it moves from one device to another. The predecessor of the switch was the hub, which broadcasted all inbound packets out all ports of the device, creating huge amounts of unnecessary network traffic. Modern switches build a port map of all IP address which respond on each port, and only broadcasts on all ports when it doesn’t have a packet’s target IP address already in its port map.
Switches are:
- Usually configured with 8, 12, or 24 RJ-45 ports
- Often used in a star or tree topology
- Available as “managed” or “unmanaged”, with the later less expensive, but adequate for smaller networks
- direct replacements for hubs, immediately reducing network traffic in most networks
- Usually installed in a standardized metal rack that also may store network servers, bridges, or routers
Repeaters
Since a signal loses strength as it passes along a cable, it is often necessary to boost the signal with a device called a repeater. The repeater electrically amplifies the signal it receives and rebroadcasts it. Repeaters can be separate devices or they can be incorporated into a concentrator. They are used when the total length of your network cable exceeds the standards set for the type of cable being used.
A good example of the use of repeaters would be in a local area network using a star topology with unshielded twisted-pair cabling. The length limit for unshielded twisted-pair cable is 100 meters. The most common configuration is for each workstation to be connected by twisted-pair cable to a multi-port active concentrator. The concentrator amplifies all the signals that pass through it allowing for the total length of cable on the network to exceed the 100 meter limit.
Bridges
A bridge is a device that allows you to segment a large network into two smaller, more efficient networks. If you are adding to an older wiring scheme and want the new network to be up-to-date, a bridge can connect the two.
A bridge monitors the information traffic on both sides of the network so that it can pass packets of information to the correct location. Most bridges can “listen” to the network and automatically figure out the address of each computer on both sides of the bridge. The bridge can inspect each message and, if necessary, broadcast it on the other side of the network.
The bridge manages the traffic to maintain optimum performance on both sides of the network. You might say that the bridge is like a traffic cop at a busy intersection during rush hour. It keeps information flowing on both sides of the network, but it does not allow unnecessary traffic through. Bridges can be used to connect different types of cabling, or physical topologies. They must, however, be used between networks with the same protocol.
Routers
Routers are the traffic directors of the global internet. All routers maintain complex routing tables which allow them to determine appropriate paths for packets destined for any address. Routers communicate with each other, and forward network packets out of or into a network. Here’s an example:
You want to search for something on the internet using a search engine. You open a browser on your workstation. The browser opens to a blank page (not usually the default, but appropriate for this example). You type “http://www.google.com” into the URL (Universal Resource Locator) address line of the browser. The browser software packages up the URL you typed, and sends it with a request for an IP address to the DNS (Domain Name Server) that has been set in your network adapter’s configuration. The domain server returns an IP, such as 74.125.67.103 (actual address returned by DNS for google.com on June 7th, 2011).
The browser ships the request for that IP address off to the network card, which bundles the request into an ethernet packet, destined for 74.125.67.103. The network card sends the packet to the gateway of your network, which opens the header of the packet, and makes a determination that the packet is traveling out of your network, in search of 74.125.67.103. Your network’s router has routing tables which it has been building from communicating with other routers, and potentially augmented with “static routes”, which are specific paths added by your network’s administrators to make the task of accessing certain networks easier, or faster, or in some cases, not possible. In this case, I find that my router knows about another router at my ISP(Internet Service Provider), which in turn has several more routers that are all on networks of which I am just a small node, much like finding an atom of a molecule of a piece of dust on a rock on a moon of a planet of a sun of a galaxy of the universe.
In any case, the packet gets passed from router to router, each time moving out of the subnets of the packet sender, towards a router that will know where the desired server is. The packet finally reaches the router of the network at 74.125.67.103, which dutifully delivers the packet to the server at that IP address. The server carefully crafts a response, and sends a reply back, which follows the same process to get the response “Yes. Go ahead” back to the requester. Whew. And that’s just the initial request.
While bridges know the addresses of all computers on each side of the network, routers know the addresses other routers which in turn know about their own networks. Routers can even “listen” to entire networks to determine which sections are busiest – they can then redirect data around those sections until traffic congestion clears.
So, routers are network gateways. They move network packets from one network to another, and many can convert from one network protocol to another as necessary. Routers select the best path to route a message, based on the destination address of the packet. The router can direct traffic to prevent head-on collisions, and is smart enough to know when to direct traffic along back roads and shortcuts.
If you have a LAN that you want to connect to the Internet, you will need to purchase a router. In this case, the router serves as the forwarder between the information on your LAN and the Internet. It also determines the best route to send the data over the Internet.
Firewalls
A firewall is a networking device that is installed at the entrance to a LAN when connecting a networks together, particularly when connecting a private network to a public network, such as the internet. The firewall uses rules to filter traffic into and out of the private network, to protect the private network users and data from malevolent hackers.
Firewalls are either hardware or software, depending on their intended use. A firewall used to protect a network is a hardware device that should be installed in the network between the router and the network. Almost all hardware firewalls will have at least two ports, labeled “Trusted” and “Untrusted”. These terms imply the true nature of the firewall’s responsibility to the private network. The public network is connected to the untrusted network port, and the private network is connected to the trusted port.
Firewall rules are usually simple, consisting of a verb, either allow or deny, the direction of the traffic, either inbound or outbound, and an address or other network traffic identifier. Firewall rules are cumulative, so general rules may be specified, and exceptions added as necessary. Some examples are:
- Allow outbound all (all private network users can do anything on the public network)
- Deny inbound all (default setting to prevent all traffic from the public or untrusted port, to the private port)
- Allow inbound port 80 (allow internet web traffic to come into network to find web servers)
- Allow inbound port 80 destined to 170.200.201.25 (allow inbound web traffic to a specific web server on your private network)
- Deny inbound from 201.202.1.1/24 (deny all inbound traffic from a specific IP address or range of addresses)
Software firewalls are commonly included in modern workstation and server operating systems. They operate in a similar way as hardware firewalls, except that they filter traffic in and out of the machine itself. These software firewalls are typically unnoticed by machine users, and only need attention occasionslly when an internet-connected application don’t work as expected. The software firewall should always be considered a “suspect” in such cases. The problem is easily resolved, by setting an exception rule in the firewall for the software that is attempting to communicate.