A useful protocol that's used all the time
by network administrators is ICMP.
Stands for Internet Control Message Protocol.
And it's often used to be able to send
little messages between computers.
An echo request and an echo reply
are a couple of very common examples of this.
You type in ping and an IP address,
what really is happening is an ICP request
is made to another server and hopefully you're
receiving an ICP reply.
We call those a ping request and a ping reply,
but behind the scenes, that's exactly what's happening.
Now this is really useful for troubleshooting.
It's very useful for bad guys to be
able to do reconnaissance of your network as well.
Imagine being able to ping all of the systems
in a particular subnet and find out who responds back.
Sometimes that's not what you want.
That's too much information for the bad guys.
And you'll notice that most firewalls, one of their default
firewall configurations is to disallow
ICMP packets to go through the firewall.
Now, there are other methods of ICMP
that can do things like redirect different network connections.
You could tell a router that that network's no longer
located over here, it's located over in somewhere else.
That might be a legitimate message
or that may be a completely illegitimate message.
That might be the bad guys trying to redirect traffic over
to their machines.
So, usually those are also restricted--
at least those particular ICP types of messages
may be restricted.
And if you ever go out somewhere and you
see that you're trying to ping a device
and you're trying to ping it says,
sorry the destination host you're trying to ping
is unreachable, that's because either that device really
isn't on the network or our security administrator
was very smart and restricted access of ICMP
through the firewall.
No matter how much you try, you're
never going to get a response back.
Another useful network management protocol
is SNMP, that stands for Simple Network Management Protocol.
It's used between devices from a management perspective
to gather details, metrics, about how
those devices are performing.
Very often, you'll have a device that's
in charge has some SNMP software on it that is simply querying
the devices, usually infrastructure
devices in your environment, maybe asking a router,
"hey, on a particular interface, how many
bytes have you seen come into that interface?"
And the router responds back with 210,506 bytes.
Kind of boring.
Kind of very dry, but if you start compiling those metrics
over long periods of time, you can
start to see how much bandwidth might
be going through a router.
And these SNMP queries that can be
done across many different variables.
Many different routers will have hundreds or thousands
of SNMP variables that you could query.
What's the temperature inside of a server?
How many people are connected to the device at this time?
And you can gather a lot of details.
If you're using SNMP Version 1, there's
different versions, three different versions of SNMP
currently, this is the one that was original
and you're really asking for some very specific information
and getting a response and that entire communication
is completely in the clear.
It is not encrypted, it is not verified,
and anybody who happened to be on the network
between those two devices can see exactly what you're doing.
Now in Version 2, we added some additional capabilities.
We could do some data type enhancements
of what we were asking for.
We can ask for many different metrics at one time
and get a big bulk response back.
But there was still no encryption.
There's still, from a security perspective, a real concern
there.
So, SNMP Version 3, which is the latest standard, it's
the one from a security perspective,
you should almost always be insisting on because it checks
the integrity of the message that it really
came from that device, was authenticated to that device,
the message wasn't changed along the way.
So that integrity and authentication
become very, very important.
And it's encrypted.
And the data that's going between the SNMP
device and the reply that we're getting back
is something that nobody can tap into,
to really see what's going on.
And because this SNMP information
can be very detailed about configurations, and status,
and amount of traffic, and a lot of details,
you need to make sure that only you
or people who are specific to understanding how
those devices are running, maybe the manager of those devices,
can only see this data.
This is very, very critical data.
If you know what to look at with SNMP,
you can gather a lot of information
about those devices.
Also from a security perspective,
you should make sure that the devices that
are out there that support SNMP can only
be queried by your SNMP devices that
are out here doing the querying.
You don't want a third party to plug into your network
and instantly be able to gather information via SNMP.
So that's an important security concern,
especially if you're using SNMP with all of your devices
in your environment, to check on the status
and availability of those machines.