CompTIA Network+ N10-006 Cert Guide (2015)

Environmental Monitor

Components (for example, routers, switches, and servers) making up a computer network are designed to operate within certain environmental limits. If the temperature rises too high in a server farm, for example, possibly because of an air-conditioner outage, components could begin to fail. To prevent such an occurrence, you can use environmental monitors to send an alert if the temperature in a room rises above or drops below administratively configured thresholds. By alerting appropriate personnel about a suspicious temperature variation before it becomes an issue, action can hopefully be taken to, for example, repair an air-conditioning unit or provide extra ventilation, thus preventing a system failure. In addition to monitoring a room’s temperature, some environmental monitors monitor a room’s humidity.

Environmental monitors including power and temperature monitors can alert appropriate personnel in a variety of ways. For example, some environmental monitors can send an alert to a SNMP server. This alert is known as an SNMP trap. Another common notification option allows an environmental monitor to send an e-mail or SMS text message to alert appropriate personnel about the suspect environmental condition.

Having fault-tolerant power options, such as uninterruptible power supplies (UPS), fault-tolerant power circuits into the building, generators, and appropriate converters or inverters for the critical network devices can assist in preventing downtime in the event of a single power failure. Having monitoring systems in place allows you to react and restore redundancy.

Device placement in racks should be done in such a way to allow proper air flow through the systems in the racks. Racks may be two- or four-post racks organized into rows. Free-standing racks may also be used to hold the network systems and devices. A rack-mounted server has rails on the side that allow it to be inserted into a rack. Environmental monitors can trigger an alert about potential damage if the humidity or temperature goes outside of the proper values for network devices and servers.

Loopback Plug

When troubleshooting a network device, you might want to confirm that a network interface is functional (for example, that it can transmit and receive traffic). One way to perform such a test is to attach a loopback plug to a network interface and run diagnostic software designed to use the loopback plug. A loopback plug takes the transmit pins on an Ethernet connector and connects them to the receive pins, such that everything that is transmitted is received back on the interface. Similarly, a fiber-optic loopback plug, as shown in Figure 11-4, interconnects a fiber-connector’s transmit fiber with a connector’s receive fiber. The diagnostic software can then transmit traffic out of a network interface and confirm its successful reception on that same interface.

Figure 11-4 Fiber-Optic Loopback Plug (Photo Courtesy of Digi-Key Corporation [http://www.digikey.com])

Multimeter

When working with copper cabling (as opposed to fiber-optic cabling), a multimeter can check a variety of a cable’s electrical characteristics. These characteristics include resistance (in ohms), current (in amps), and voltage (in volts). Figure 11-5 shows an example of a multimeter.

Figure 11-5 Multimeter

As one example, you could use the ohmmeter function of a multimeter (the resistance feature) to check continuity of an Ethernet cable. If you connect the two leads of a multimeter to two pins of a cable, the resulting resistance is approximately 0 ohms if those two pins are connected, and the resulting resistance approaches an infinite number of ohms if the pins do not connect with one another.

Another common use of a multimeter is to use the voltmeter function (the voltage feature). As an example, you could check leads of an Ethernet cable to see whether DC voltage is being applied to a device needing to receive Power over Ethernet (PoE).

Protocol Analyzer

If you understand the characteristics of the protocols running on your network (for example, understanding the fields in a protocol’s header), a protocol analyzer (also known as a network sniffer) can be a tremendous troubleshooting asset. A protocol analyzer can be a standalone device or software running on a laptop computer. You can use a protocol analyzer to capture traffic flowing through a network switch, using the port mirroring feature of a switch, as described in Chapter 4, “Ethernet Technology.” By examining the captured packets, you can discern the details of communication flows (sessions) as they are being set up, maintained, and torn down. The examination of these captured packets is referred to as traffic analysis, which provides an administrator with valuable insights about the nature of traffic flowing through the veins of the network.

Protocol analyzers come in a wide range of features and costs. Wireshark is a free software program that can make your laptop act like a protocol analyzer. Protocol analyzers can assist in identifying details such as top talkers, top destinations, top protocols in use, and quantity of traffic on the network. You can download your free copy of Wireshark from http://www.wireshark.org. Figure 11-6 shows the Wireshark application.

Figure 11-6 Wireshark Protocol Analyzer Software

WiFi Analyzer

Software running on a general-purpose computer or on a specialized device can perform wireless analysis of WiFi signals. This type of tool would be used as part of a wireless site survey after WiFi has been implemented to create a heat map of the wireless airspace.

Looking-Glass Sites

A looking glass server on the Internet allows users to connect to view the routing information from that server’s perspective. These are normally related to Border Gateway Protocol (BGP) routes. There are hundreds of thousands of routes in BGP. Using a looking-glass site could assist an engineer in verifying that changes he made to his local BGP router configuration are having the desired effect on the BGP routes on the Internet. To find a BGP looking-glass site, use Google to search for “BGP looking glass.”

Speed Test Sites

There are many speed test services that can assist in verifying throughput from a local computer to an Internet site. One example is speedtest.net. Using sites such as this can assist when determining whether the overall connection to the Internet is slow or if it is just a specific site or server that is slow to respond.

Punch-Down Tool

When terminating wires on a punch-down block (for example, a 110 block), an insulated wire is inserted between two contact blades. These blades cut through the insulation and make electrical contact with the inner wire. As a result, you do not have to strip off the insulation.

However, if you attempt to insert the wire between the two contact blades using a screwdriver, for example, the blades might be damaged to the point where they will not make a good connection. Therefore, you should use a punch-down tool, which is designed to properly insert an insulated wire between the two contact blades without damaging the blades.

Throughput Tester

Networks often perform differently when they are under a heavy load, as opposed to little or no load, which might be the case if you are mocking up a design in a test-bed environment (which is a test network isolated from a production network). Also, you might simply want to verify a network’s maximum throughput. Either scenario could benefit from a throughput tester.

A throughput tester is a network appliance that typically has multiple network interfaces and can generate high volumes of pseudo-random data. You could, for example, connect a throughput tester to a proposed network that has been mocked up in a test bed to observe how the network performs under a heavy load. Also, you can attach a throughput tester to a production network to determine the actual throughput of that existing network. Figure 11-7 shows an example of a throughput tester appliance.

Figure 11-7 Throughput Tester (Photo Courtesy of NSS Labs [http://www.nsslabs.com])

Time Domain Reflectometer/Optical Time Domain Reflectometer

Suppose that you have been troubleshooting a network cable (either copper or fiber optic), and you determine that there is a break in (or physical damage to) the cable. However, identifying exactly where the break exists in a long length of cable can be problematic. Fortunately, you can use a time domain reflectometer (TDR) for copper cabling or an optical time domain reflectometer (OTDR) for fiber-optic cabling to locate the cable fault.

Both light and electricity travel at speeds approaching 3 * 10⁸ meters per second (approximately 186,000 miles per second), although the speeds are a bit slower and vary depending on the medium. A TDR can send an electric signal down a copper cable (or an OTDR, a light meter, which sends light down a fiber-optic cable), and when the electric signal (or light) encounters a cable fault, a portion of the electric signal (or light) reflects back to the source. Based on the speed of electricity, or light, in the medium and on the amount of time required for the reflected electric signal or light to be returned to the source, a TDR or an OTDR can mathematically determine where the cable fault lies. Figure 11-8 shows an example of an OTDR.

Figure 11-8 Optical Time Domain Reflectometer (Photo Courtesy of Coral-i Solutions [http://www.coral-i.com])

Toner Probe

If you are working on a punch-down block and attempting to identify which pair of wires connect back to an end-user’s location (for example, someone’s office), you can use a toner probe. A toner probe allows you to place a tone generator at one end of a connection (for example, someone’s office), and use a probe on a punch-down block to audibly detect to which pair of wires the tone generator is connected.

A toner probe, therefore, comes in two pieces: the tone generator and the probe. Another common name for a toner probe is a fox and hound, where the tone generator is the fox, and the probe (which searches for the tone) is the hound. Some network devices have built-in troubleshooting tools, such as a voice-enabled Cisco router that can produce test tones.

Configuration Management

Configuration management (CM) focuses on maintaining up-to-date documentation of a network’s configuration. As a result, CM helps ensure consistent configuration practices across network devices. CM encompasses a variety of procedures, including the following:

Asset management: Asset management, as related to networks, is a formalized system of tracking network components and managing the lifecycle of those components. As an example, Cisco defines the Cisco Lifecycle Services maintenance model, which defines distinct phases in the lifecycle of a network asset using the acronym PPDIOO, which stands for the following:

Prepare

Plan

Design

Implement

Operate

Optimize

Baselining: When troubleshooting a network issue, one of the first things you should do, after clearly defining the problem, is to gather information. This information might come from diagnostic commands you issue on network routers or switches, as a couple of examples. Information contained in the output of those diagnostic commands might include a link’s bandwidth utilization, a router’s CPU utilization, or a switch’s memory utilization. For those numbers to be meaningful, however, you need to have previously collected similar data when the network was operating properly. The collection of such data under normal operating conditions is known as baselining. With comprehensive baseline data in your possession (which might include data collected at different times of the day and different days of the week), you can better notice any deviations from the norm when analyzing the data you collect when a problem exists on a network.

Cable management: Designing and troubleshooting large networks requires documentation about a network’s existing cable (that is, copper and fiber-optic cable) infrastructure. This documentation might include a diagram of a network’s conduit system (if nearby buildings are interconnected), locations of punch-down blocks, and a listing of the sources and destinations of a network’s cable runs that includes a consistent numbering system to clearly identify different cable pairs. Documentation including labels should be considered for ports, systems, circuits, and patch panels. A standardized naming convention can assist in identifying where a connection is, based on its name.

Change management: When you make a change in a network, such as upgrading the operating system on a router requiring a network outage of 15 minutes, realize that your actions could impact a business’s operation. Therefore, many large companies institute a change management system, which is commonly in the form of software used by network administrators to alert other network administrators about an upcoming network change (for example, an Internet access outage required to swap out a router). Then, when other network administrators receive that notification, if they know of a conflict, where the planned network outage would impact a critical network function at a critical time (for example, a planned Internet outage might be scheduled for a time when a company is conducting a webcast for its customers), they can give feedback to the originator of the change notification. The two network administrators might then choose a different time to implement the planned change. Other changes that may need to occur include updates to firmware, drivers, vulnerability patches, or reverting to a previous version of software in the event of a problem or incompatibility with the current system. All of these changes should be managed through a well-documented change control process. Change requests should be well documented, including the configuration procedures that will be used, what devices will be worked on, what the rollback process is if there is a problem, and the potential impact of the change. Changes should be formally approved by management and communicated to all parties involved before being implemented.

Network documentation: Although having an up-to-date collection of network documentation is vital for effective network troubleshooting, be aware that having outdated network documentation can be worse than having no documentation at all. For example, if you attempt to troubleshoot an issue by relying on outdated (and therefore inaccurate) network documentation, you could make incorrect assumptions about which switch ports were connected to which end-user stations. As a result, you could draw erroneous conclusions.

Therefore, take care to ensure the ongoing upkeep of a complete set of network documentation. Although the elements that make up this set of documentation can vary from network to network, the following are some of the more common elements:

Contact information: In larger networks, where different devices fall under different administrative authorities, you need to be able to quickly reach a responsible party to respond to an event. In addition, you should have ready access to contact information for a network’s service provider, which might also include the circuit ID of a service provider’s incoming WAN link.

Policies: When debate arises concerning activity on a network and the way the network is configured to handle various traffic types, a network administrator can benefit from having a set of written internal operating procedures, policies, and standards in place. These policies, such as an acceptable use policy, a security policy, or a quality of service policy, should have received approval by an authority within an organization (for example, the chief information officer [CIO]), rather than coming directly from the enforcing party (such as a network administrator). Policies regarding backups and restores for critical systems and the configurations of network devices such as routers should also be part of the written policies and procedures.

Network maps and diagrams: A collection of network maps should include both a map of a network’s physical topology and a map of a network’s logical topology. For example, a physical topology map shows such information as circuit IDs, port numbers, fiber pairs, and locations of network devices. Conversely, a logical topology map might show a network’s VLANs. A port scanner can be used to identify devices on the network with listening ports, such as a web server on TCP port 80, or an FTP server on port 21. IP network address space used and specific subnets in use should also be documented.

Documentation: Documentation about vendors, including contact information, should be readily available. Warranty information about network assets should also be maintained and updated on a periodic basis as new assets are added and old assets are retired.

Wiring schemes: Network documentation should include information about the wiring within and between buildings. For example, what conduit systems exist, and how many copper pairs are in the riser cable interconnecting the first and second floors? How are pairs of fiber-optic cables numbered? Wiring scheme documentation should, therefore, complement a network’s physical topology map.

Although this section addressed some of the more common elements of configuration management, realize that configuration management entails any network activity (from documentation to using best practices) that helps ensure consistent configuration practices, helps document a network’s configuration, or helps preserve device configurations in the event of a device failure.

Monitoring Resources and Reports

Network administrators routinely monitor network resources and review reports to be proactive in their administration. For example, a potential network issue might be averted by spotting a trend (for example, increasing router CPU utilization or increasing bandwidth demand on a WAN link). Monitoring resources and reports come from various sources, such as a syslog server, a Simple Network Management Protocol (SNMP) server, Event Viewer logs found on a Microsoft Windows server, or packet captures from a network sniffer. This section introduces you to these resources for monitoring network information.

SNMP

The first Request For Comments (RFC) for SNMP came out in 1988. Since then, SNMP has become the de facto standard of network management protocols. The original intent for SNMP was to manage network nodes, such as network servers, routers, and switches. SNMP Version 1 (SNMPv1) and SNMP Version 2c (SNMPv2c) specify three major components of an SNMP solution, as detailed in Table 11-1.

Table 11-1 Components of an SNMPv1 and SNMPv2c Network-Management Solution

As depicted in Figure 11-9, an SNMP manager (an NMS) can send information to, receive request information from, or receive unsolicited information from a managed device (a managed router, in this example). The managed device runs an SNMP agent and contains the MIB.

Figure 11-9 SNMPv1 and SNMPv2c Network-Management Components and Messages

Even though multiple SNMP messages might be sent between an SNMP manager and a managed device, consider the three broad categories of SNMP message types:

Get: An SNMP get message retrieves information from a managed device.

Set: An SNMP set message sets a variable in a managed device or triggers an action on a managed device.

Trap: An SNMP trap message is an unsolicited message sent from a managed device to an SNMP manager, which can notify the SNMP manager about a significant event that occurred on the managed device.

SNMP management software can make requests for each of the MIB objects from an SNMP agent. This can be referred to as an SNMP walk because the management software is logically “walking” the entire MIB (also often called the tree) to gather information from the agent. SNMP offers security against malicious users attempting to collect information from a managed device, change the configuration of a managed device, or intercept information being sent to an NMS. However, the security integrated with SNMPv1 and SNMPv2c is considered weak. Specifically, SNMPv1 and SNMPv2c use community strings to gain read-only access or read-write access to a managed device. You can think of a community string like a password. Also, be aware that multiple SNMP-compliant devices on the market today have a default read-only community string of public and a default read-write community string of private. As a result, such devices, left at their default SNMP settings, could be compromised.