21c3 NOC Overview Concepts, Implementation and Hardware Christian Carstensen, Sebastian Werner & The 21c3 NOC Crew The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 1/18
Overview What will we cover: ● Overview ● Networking terms ■ Routing Terms explained ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ■ Recall 20c3 ● Recall 20c3 - Reasons ● Solution strategy ■ Solving the Problems ● Special demands ● Network Services ● BCC Network Layout - Logical ■ Networking requirements ● BCC Network Layout - OSPF ● Hardware ■ BCC Networklayout how it should be ● Implementation ● Internet uplink ■ Networklayout reality ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 2/18
Networking terms ■ Layer 2 OSI Data Link Layer. e.g. Ethernet or 802.11a ● Overview ● Networking terms ● Recall 20c3 - Situation ■ Switch Layer 2 based interconnection device between ● Recall 20c3 - Consequences physical networks ● Recall 20c3 - Reasons ● Solution strategy ● Special demands ■ Layer 3 OSI Network Layer. e.g. IP or IPX ● Network Services ● BCC Network Layout - Logical ■ Router Layer 3 device that connects Layer 2 segments ● BCC Network Layout - OSPF ● Hardware logically ● Implementation ● Internet uplink ■ Layer 4 OSI Transport Layer. e.g. UDP or TCP ● IP Uplink Topology ● IPSEC Realisation ■ LAN Provides physical network connectivity. ● Using and abusing the network ● Sponsors ■ VLAN Devides a LAN into several logical/virtual LANs using the same physical link. ■ Flow based routing Routing Switching on Layer 2 after a route lookup using MAC instead of IP The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 3/18
Recall 20c3 - Situation ■ New Building with unknown problems... ● Overview ● Networking terms ■ about 20 different rooms with specific access profile ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ■ 4 floors interconnected through floor D ● Solution strategy ● Special demands ■ different network hardware arrived ● Network Services ● BCC Network Layout - Logical ■ lack of facility documentation ● BCC Network Layout - OSPF ● Hardware ■ rogue services (dhcp) and hardware (access points!!) ● Implementation ● Internet uplink ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 4/18
Recall 20c3 - Consequences ■ Layer3 networks connected via L2 backbone ● Overview ● Networking terms ■ 2 routers did all routing work ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ■ Initial cabling insufficient ● Solution strategy ● Special demands ■ WLAN got flaky ● Network Services ● BCC Network Layout - Logical ■ DHCP became unreliable ● BCC Network Layout - OSPF ● Hardware ■ A lot of extra work ● Implementation ● Internet uplink ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 5/18
Recall 20c3 - Reasons ■ Many VLANs that got “trunked“ ● Overview ● Networking terms ■ Attacks on flow based routing equipment (TCAM full!) ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ■ Hardware (HP , Foundry) got overload ● Solution strategy ● Special demands ■ Patching cables on undocumented panels is hard ● Network Services ● BCC Network Layout - Logical ■ Too many nodes in the WLAN and too powerful transcievers ● BCC Network Layout - OSPF ● Hardware ■ Lack of network monitoring ● Implementation ● Internet uplink ● IP Uplink Topology ■ Lack of user (available) documentation ● IPSEC Realisation ● Using and abusing the ■ Finally: fatigued NOCpeople... network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 6/18
Solution strategy Keep it simple! ● Overview ● Networking terms ■ Smaller collision domains (Layer2 segments) ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ■ Avoiding tagged (dot1q) / trunked (isl) vlans ● Recall 20c3 - Reasons ● Solution strategy ● Special demands ■ Routing not on L3 switches but on real full-featured routers ● Network Services ● BCC Network Layout - Logical ■ Reduced trust in 802.11b (Do NOT expect it to work!) ● BCC Network Layout - OSPF ● Hardware ■ Focus on 802.11a ● Implementation ● Internet uplink ■ Explicit effort to ensure documentation ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the ■ NOC Help Desk network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 7/18
Special demands ■ Entrance needs to be exclusively linked to the Orga Area ● Overview ● Networking terms ■ Network-Jacks for speakers need highly-available uplink ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ■ WLAN (Soekris) need dedicated cabling (PoE!) ● Solution strategy ● Special demands ■ Helpdesk and Public Terminals should have high-available ● Network Services ● BCC Network Layout - Logical uplink ● BCC Network Layout - OSPF ● Hardware ■ Video streams should be privileged ● Implementation ● Internet uplink ■ Projects need “dynamic VLANing” ● IP Uplink Topology ● IPSEC Realisation ■ Wireless Mesh needs WLAN Channel 10 exclusively ● Using and abusing the network ● Sponsors ■ Server storage/housing for projects The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 8/18
Network Services ■ DomainNameService (recursive & authoritative) 82.130.23.35 ● Overview ● Networking terms ■ User DNS Registration ● Recall 20c3 - Situation ● Recall 20c3 - Consequences https://yourname.congress.ccc.de ● Recall 20c3 - Reasons ● Solution strategy ■ DHCP Service https://yourname.congress.ccc.de ● Special demands ● Network Services ● BCC Network Layout - Logical ■ IPSEC Frontend ● BCC Network Layout - OSPF ● Hardware https://illuminatheros.congress.ccc.de ● Implementation ● Internet uplink ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 9/18
BCC Network Layout - Logical Uplink� Uplink� Lützowstr� BCC� 2mbit� 1000SX� bcc.gate� ● Overview Juniper� R� RX ACTI V ITY� LINE� ETHERNET 1000 BASE-LX� LINE� RX ACTI V ITY� ETHERNET 1000 BASE-LX� ETHERNET 100BASE-TX� PORT 3� PORT 2� PORT 1� PORT 0� N� ETWORK� S� STATUS� STATUS� LINK� RX� LINK� RX� LINK� RX� LINK� RX� STATUS� TM� TX� RX� TX� RX� M5� LT� I� nternet� rocessor� P� MGMT� PIC 0/3� PIC 0/2� PIC 0/1� PIC 0/0� CONSOLE� ● Networking terms AUX/MODEM� Uplink Netz� ● Recall 20c3 - Situation Backbone (Gbit SX Trunk)� IPSec� ● Recall 20c3 - Consequences BCC Hausnetz� d57.core� Gbit Netz� ● Recall 20c3 - Reasons PoE� trust.core� Server� Video� NOC� Switch� Wlan Netz� ● Solution strategy l2.core� Kassen Netz� ● Special demands D57� Patch Verkabelung� ● Network Services ● BCC Network Layout - Logical Helpdesk� Saal1� ● BCC Network Layout - OSPF ● Hardware Saal3� ● Implementation Orga� Wireless� c57.core� c91.core� ● Internet uplink Soekris� ● IP Uplink Topology C� Public C� Saal2� Public C� Funk� POC� ● IPSEC Realisation C57� C91� ● Using and abusing the network INFO� ● Sponsors Public B� b90.core� Kasse� CERT� Soekris� Blinken� Art&Beauty� B� Wikipedia� B90.01� Engel� Hackcenter 1� a87.core� a85.core� Soekris� A� Haecksen� Hackcenter 2� Workshop� Lockpick� A85� A87� The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 10/18
BCC Network Layout - OSPF ● Overview ● Networking terms ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ● Solution strategy ● Special demands ● Network Services ● BCC Network Layout - Logical ● BCC Network Layout - OSPF ● Hardware ● Implementation ● Internet uplink ● IP Uplink Topology ● IPSEC Realisation ● Using and abusing the network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 11/18
Hardware ■ Inhouse Internet Uplink: Juniper M7i ● Overview ● Networking terms ■ D57 (Core): Cisco Catalyst 6509 ● Recall 20c3 - Situation ● Recall 20c3 - Consequences ● Recall 20c3 - Reasons ■ C57 (Ebene C): Cisco Catalyst 4507 ● Solution strategy ● Special demands ■ B90 (Ebene B): Cisco Catalyst 4506 ● Network Services ● BCC Network Layout - Logical ■ A85 (HackCenter 1): Cisco Catalyst 6513 ● BCC Network Layout - OSPF ● Hardware ■ A87 (HackCenter 2): Cisco Catalyst 4006 ● Implementation ● Internet uplink ● IP Uplink Topology ■ Access Layer: HP ProCurve 5308xl, Cisco 3750, Cisco ● IPSEC Realisation ● Using and abusing the 3550, Cisco 4908 network ● Sponsors The 21c3 NOC Crew, January 9, 2005 21c3 NOC Overview - p. 12/18
Recommend
More recommend
