OS and Network Lab Programs

Network Lab: VoIP

2008-10-31T08:21:00.002-07:00

VoIP

VoIP, or Voice Over IP to give it it's full name, is basically telephony services over the public Internet using TCP/IP. A conventional telephone will have a wired connection to a local telephone switch and will generate a switched connection over the public telephone network. In a VoIP connection, the connection is converted to TCP/IP and then made across the Internet.

VoIP can be used just like a conventional telephone service, so it can be used to connect to other VoIP phones, conventional phones on the PSTN, or POTS (Plain Old Telephone Service), and Mobiles, as shown below. VoIP telephones can be physical phones, that look just like conventional telephones, or they can be 'soft' phones that reside as software on a PC. The PC used in this way requires a sound card with speakers and a microphone, which can be in the form of a headset or VoIP telephone connected to a soundcard or via USB.

One huge benefit VoIP provides is that for some connections there is no cost for calls made. These connections are normally those made to the same network, i.e., another user of the same VoIP service as the originator with call charges incurred when crossing to other networks such as the PSTN or Mobile networks. Charges may also be incurred when connected from one VoIP provider to another. Typically providers will offer quantities of times for monthly fees, in much the same way as fixed fee mobile phone contracts.

Although VoIP has been around for a few years with products such as NetMeeting or MSN, where the remote user had to have the same application as the caller had, there are still issues concerning implementations of the services available which can result in incompatibilties between some providers implementations of VoIP services. The IETF (Internet Engineering Task Force) has been involved in developing a standard for VoIP called SIP (Session Initiated Protocol), which is becoming the accepted protocol for Internet telephony.

VoIP Providers

SIP-based providers:

Sipgate
Provides a geographical telephone number based on conventional UK dialling codes.
Voiptalk
Vonage
Call 1899
Global Village
Requires a Zoom Router or ATA to operate!

Non SIP Providers:

Skype
Skype is an extremely popular VoIP service that uses a proprietry protocol based around P2P technology.

VoIP Hardware

VoIP is an extremely versatile application. It can be used via an application on a PC, thru' a VoIP phone, or even a conventional telephone connected either to a SIP-enabled router or an Analogue Telephone Adapter, or ATA. Some routers are also available that provide an RJ11 socket so that a conventional phone can be connected directly to the router, although an adapter may also need to be used if the telephone has a standard 'BT' or RJ12 plug. Some of these hardware solutions are shown in the diag below.

If you are a Skype user it is possible to obtain phones and routers that are compatible with the Skype service.

VoIP Software

Some VoIP providers supply their own software (Skype especially, as their software is proprietry) but one application that is often recommended is X-Lite.

X-Lite can be at first look complicated to set-up due to the number of options but in reality there are only two areas of configuration that are need to be set up. These are the Network and SIP Proxy setups. The following screendumps show these areas and the settings that are required. The screendumps are for a Sipgate account.

X-Lite Network Setup

Most of the settings on this page can be left at default with just the Firewall IP address being set. Note, this will need to be set to the IP address of the local Network gateway, not the address shown here:

X-Lite SIP Proxy Setup

This screen should reflect the settings required to connect to the VoIP provider. Again, the details shown are for a Sipgate account. The appropriate information will need to be entered for the VoIP provider being used.

VoIP and Firewalls

NAT and software firewalls can cause some disruption to VoIP due to the number of ports that some software requires. Simple NAT found on most domestic Routers does not really cause much disruption but more intelligent security may require some incoming ports to be forwarded to the PC running the software. In some extreme cases, it may be necessary to place the PC as a DMZ host however the risk of doing this cannot be underestimated. If a software firewall is used on a PC, then it may be necessary to configure some rules on that in order to allow VoIP services.

The Skype client generates a random port for it's communication when it is installed and this port may need to be forwarded thru' any firewalls. X-Lite, OTOH, utilizes a number of ports for the SIP (UDP 5060) protocol as well as for the RTP (udp 8000) and RTCP (UDP 8001) protocols used for transporting the audio and video over the network and again, these may need to be forwarded thru' any firewalls or NAT devices that are installed. Other ports above 8001 may also be required.

Additionally, if a STUN (Simple Traversal of UDP Through NAT) server is used there may also be a need to allow the ports necessary for this service as well, these being UDP and TCP port 3478, although some providers such as Sipgate run their STUN server on UDP port 10000. The purpose of a STUN server is to allow STUN aware clients to determine the ports used by the NAT device that it resides behind as well as the type of NAT that is in use by that device.

Further Reading

Network Lab: Connecting an Xbox to Your Cable Connection

2008-10-31T08:21:00.000-07:00

Connecting an Xbox to Your Cable Connection

Microsoft's Xbox system is an awesome games console in it's own right but hook it up to your Network via it's inbuilt network interface and you too can have fun beating up or shooting folks from anywhere, or maybe just outbraking them into the Goddards hairpin at Donnington. All from the comfort of your own home:-)

Ordinarily, a subscription to Microsoft's XBox-Live service is required for on-line gaming with the XBox, but it is possible to use third party systems such as XBConnect and Gamespy, both of which require another PC to be on the same network as the XBox which then, in effect, becomes a proxy for the XBox.

The Physical Connection

But enough of frivolities. Before we can do any of the above your Xbox needs to be connected to either your Cable Modem or your network. The network interface on the Xbox is a conventional DTE 10BaseT interface so can be connected to your broadband network in the same manner as any PC. In other words, a straight CAT5 cable is normally all that is required, although if you are just connecting to a NIC on a PC, then a x-over cable will be necessary. The following diagrams show scenarios for Xboxes where either a straight cable is needed or a x-over cable is necessary.

Scenarios where a straight cable is required to connect an Xbox include connecting direct to external Cable Modems, connecting to Routers and connecting to Hubs:

Scenarios where a x-over cable are required include connecting to some Set Top Boxes (this is usually indicated near the connector on the STB) and where a PC is used as a Gateway machine and no hub or switch is used in the network:

It is also possible to use a wireless connection with an XBox through the use of an Ethernet/802.11x adapter such as an SMC SMC2670W Ethernet/Wireless Adapter or Linksys WET11. This would then allow your XBox to use your existing Wireless Network.

MAC Addressing

If your XBox is connected directly to a Cable Modem or STB there is a need for the Cable Modem or STB to know the MAC address of the Xbox. The MAC address of a device is a 12 digit hexadecimal number that is unique to each ethernet device and NTL configure their cable modems and STBs to only connect to devices whose MAC addresses are known. With an Cable Modem there is a maximum number of two MAC addresses that the Modem can talk to, whereas with an STB the maximum number is five.

With an external Modem, all that is needed to connect an XBox to the modem is that the Modem and PC require switching off and the RJ45 cable removed from the PC and then connected to the XBox. Once done, switch on the Cable Modem and wait for it to synchronize with the Head-end. Finally, switch the XBox on and assuming that your XBox Live set-up is for DHCP, it will obtain an IP address from NTL.

For an STB, you need to configure the MAC address of the XBox via the 'start.ntl' URL, where the MAC can be registered as a device.

It is also possible to clone the MAC address of an exisiting cable connected device via the XBox Live set-up, which will allow use of the XBox without having to switch off modems or add MAC addresses to the STB.

Note: If your XBox resides on your LAN, behind a router or Gateway PC, then the MAC address issues discussed above are irrelevant!

IP Addressing

More often than not your XBox will just need to use DHCP in order to get an address (this is most important when connecting direct to a Cable Modem or STB) but in the instance where a DHCP server is not available, it is possible to set a fixed IP Address via the Xbox Live set-up. This address must be compatible with your existing IP Network addressing and the XBox's default gateway needs to be set as your network's gateway address.

For example, consider a network with a couple of PCs behind a Linksys Router. By default, the Linksys Router will have an address of 192.168.1.1, and the PCs, if using DHCP, will have 192.168.1.100 and 192.168.1.101 respectively. In this scenario, the XBox would get an address via DHCP but if there was a decision to fix it's address, then it also would need an address on the 192.168.1.x network and it's default gateway would be 192.168.1.1. When setting the address on the XBox be aware of existing addreses on the network and avoid use of addresses in any DHCP range used. For the Linksys in our example, this would mean addresses 192.168.1.100 to 192.168.1.149, inclusive.

Some XBox Links

Network Lab: Netgear ME102 Wireless Access Point

2008-10-31T08:19:00.000-07:00

Netgear ME102 Wireless Access Point

Netgear's ME102 802.11b Access Point is a fairly innocuous piece of kit, it being a small Netgear-blue slab with a couple of small LEDs on the the top to show that both power is on and that the wireless service is available. It also features a couple of small antenna. The rear of the unit has sockets for power, an ethernet connection and a USB port for access to the AP's management console.

Basic Setup of the ME102

The ME102 acts as a MAC-level bridge. What this means is that it does not have any concept of TCP/IP or any applications running over TCP/IP so when connected to a network, any devices that connect via wireless can communicate directly with that network, assuming the TCP/IP settings are correct. If there is a DHCP server on the network then any wireless clients will be able to get an IP address from that server, via the ME102. Because of this, the only set-up required for the ME102 to work is to plug in the power supply and connect the ethernet connection to the network using a straight RJ45 cable (supplied with the unit). In order to manage or monitor the ME102, however, it is necessary to use the supplied management software. Two versions are supplied, one that connects via USB to the console and one that can be used across the local network.

Accessing the ME102 USB Management Console

Before considering managing the AP, the necessary connections need to be made. The following diagram shows the ME102 in a typical network where it has a connection to the Router/switch via Ethernet and a connection via USB to one of the networked PCs. Note that the USB connection does not have be permanantly connected for the ME102 to function, nor does it need to be on a separate PC.

The simplest method for accessing the ME102 console is to connect a PC via the USB port. Windows will recognize the ME102 as a new device and will install the necessary drivers. Once that is completed, the USBManager software needs to be installed. On running, the Manager displays a panel showing the both AP's and management utility version numbers. Two buttons are available, Configure and Exit. Clicking Configure shows the AP USB Management Screen, General Configuration.

Here, we specify our ESSID (Extended Service Set ID), which is similar in concept to the Workgroup name used in Microsoft Networking and defines the ID that wireless clients should use when negotiating a connection. In addition, it is possible to specify a channel that the clients will use.

In order to use the SNMP Manager, the AP requires an IP address that matches the network it is connected to. By default, the ME102 has an IP address of 192.168.0.5, which could be an issue if this address is already in use on your LAN! Here we show a modified address.

Wireless networking can be a great convenience but it does have some security issues. The Wireless Encryption Protocol (WEP), whilst not perfect, offers some protection from casual wardrivers and the ME102 offers both 64 and 128-bit WEP Key modes. When WEP is enabled, a number of keys need to be defined. These are comprised of a number of hexadecimal numbers, either 5 0r 13 depending on whether 64 or 128-bit encryption is chosen. Using 64-bit keys makes life easier as the keys are shorter, but it does make the encryption that much easier to break! 128-bit keys are longer, so harder to configure on the clients. The ME102 can hold up to four keys, but will default to the one specified. Wireless clients will need to have the same key set in order to connect to the AP.

The fact that the keys are hexadecimal means that each character can be either a number between 0 and 9, or a letter between A and F, so 0A 0B 0C 0D 0E is a vaild 64-bit key, as is 12 34 56 78 90. A valid 128-bit key could be 00 01 02 03 04 05 06 07 08 09 0A 0B 0C or DE AD BE EF FE ED DE AF BE EF DE AD ED. Whatever keys are used (and these are only examples not recommended for general use) they will need to be configured in any client in order to get a connection. Note, however, by default, the ME102 is set to both Open System AND Shared Key, so if only WEP clients are required to connect, then the Authentication Type needs to be set to Shared Key only.

The operational settings of the ME102 can largely be left at default, with the only change you should make is to change the AP's password.

Accessing the ME102 SNMP Management Console

The alternative method of managing the ME102 is to use the supplied SNMP management Utility. The SNMP utility basically has the same configuration options as the USB version except that it has set up options for MAC address locking and can also display statistics.

The SNMP utility is required to be installed on a Windows PC connected to the LAN. When the SNMP utility is run, it scans the network looking for ME102 APs. Once found, the AP will be displayed in a window:

Simply select the AP to manage and click login. Enter the password when prompted and the general configuration screen will now be displayed. As this does not differ from the USB management utility the following sections will concentrate on the MAC 'locking' and statistics offerings.

Limiting Connections by MAC Address

An additional security option with the ME102 is to set it so that only known MAC addresses are allowed to connect via the wireless link. The MAC address is the unique 12 digit hexadecimal number burnt into all network interface cards, and is often called the Hardware Address. To find this address for a particular card, use either ipconfig or winipcfg, depending on your version of Windows, or ifconfig if using Un*x. Once you have the MAC address(es), create a text file on the management PC and enter them, one per line. Save the file, them from within the SNMP manager load this text file. The MAC addresses will appear as shown below:

To enable these MAC addresses, click on Download to AP and also do not forget to click on Apply!

Statistics

For what it is worth, the SNMP Manager can also display some usage statistics that show the number of packets received on both the ethernet and wireless interfaces:

Connecting a Wireless Client

In theory, it should be possible to connect any 802.11b compatible device via the ME102, and this would include devices from manufacturers like Linksys, D-Link and many others. Most of these cards are based on the PRISM specification, and can use the same drivers. Windows installations may be a little less forgiving, however, and you should install the appropriate drivers as supplied with the card. Linux users should consult Jean Tourrilhes's website for info on their wireless NIC. This is an excellent resource, IMHO.

Once a wireless connection is established, then conventional TCP/IP networking takes over. In other words you need a TCP/IP address, a default gateway and some sort of DNS functionality.

Network Lab: The Linksys BEFSR41 Etherfast Cable/DSL Router

2008-10-31T08:18:00.000-07:00

The Linksys BEFSR41 Etherfast Cable/DSL Router

'Instant Broadband' is what it says on the tin, and it does exactly that. The BEFSR41 is a small blue/grey device, just slightly larger than a video cassette. The rear of the unit has a number of RJ45 sockets that offer a single WAN connection and 4 LAN connections. The front of the unit shows link and activity LEDs for each interface.

The Linksys router is also available in a single or 8-port LAN version.

Connecting to Cable Modem

Connecting the Router ot the modem is as simple as connecting a straight RJ45 cable between the WAN port of the Router and the Cable Modem. By default the Router is set to get it's WAN ip address from a DHCP server and this works very well with the NTL servers. One issue that may arise if you change an existing PC for the Linksys is that the Cable Modem will retain the MAC address of the original NIC and it can be troublesome to get the modem to see the Linksys as a new device. Two options are available:

Power off your CM and after powering back on, allow it to re-sync with the head-end before switching on the Router. Note it may be necessary to leave the modem off for 4 hours so that your dhcp lease expires, or,
Configure the Linksys to have the same MAC address as your CM connected PC NIC has. This is known as MAC spoofing or, in Linksys speak, cloning.

Connecting to LAN

By default, the Linksys will have a LAN IP address of 192.168.1.1 and a netmask of 255.255.255.0. This means that unless a PC that is connected to it is set to get an IP address via DHCP, then it will need setting up with an address on the 192.168.0 subnet. Be aware however, that this address must not be 192.168.1.1, nor must it be in the range 192.168.1.100 to 192.168.1.149, as this is the default DHCP scope configured on the router. You also cannot use 0 or 255 as the last number.

Again, a straight RJ45 cable is all that is need to connect a PC up to the Linksys. Four ports are available for the LAN side, although five physically exist. The fifth is actually an uplink port for connecting a hub or switch to the Router. Note that use of the uplink port means that port 1 is not available so in effect you have a 3 port switch in this scenario.

Theoretically, your Linksys connected network may look like the following diagram, which shows two PCs connected to a CM via a Linksys router. Note that both PCs have obtained their IP address from the Linksys, which in turn has got it's WAN address from the NTL dhcp server.

In the scenario where you have more than four machines that you want to connect to the Internet, then you will need to attach further network devices to the Linksys so that the physical limit of the router can be extended. Typically, this is achieved by attaching a hub or switch to the uplink port of the router using a straight RJ45 cable. Alternatively, you could connect a hub/switch to one of the other router ports using a cross-over cable, but there would not be any real gain in doing this.

PCs connected to the additional hub/switch can still use the dhcp service on the Linksys, and will still be part of the 192.168.1.0 subnet. No configuration changes are needed on the router for this to work correctly. The following diagram shows how it works in practice:

Integrating with your existing Network

As previously discussed, by default the BEFSR41 is designed to allow up to four PCs to connect to a Cable Modem or ADSL connection, where the WAN IP address is obtained by dhcp, and the IP addresses for the LAN clients are delivered by the router's own dhcp server range between 192.168.1.100 to 192.168.1.149. If you are moving from an existing gateway system for instance, your IP addresses may not work very well with the default settings of the router. Of course, if the PCs you already have networked are already getting their IP address via dhcp, then it should be just a matter of connecting them to the router and obtaining a new address. Note that you may need to release the old address before attempting to get an address from the router.

Changing the Default Configuration

WARNING. Changing the default settings on your Linksys can reduce the effectiveness of the security offered by the router, and in some instances stop it working all together!

MAC Cloning

Perhaps the first thing you will want to do is to clone the MAC address of the NIC that the Cable Modem has been talking to all this time. The MAC, or Hardware, address of a particular network device, be it a NIC or a router, is unique, and consists of six hexadecimal numbers. The CM 'learns' this MAC address from the device attached to it, i.e., a NIC in a PC and will only talk to that MAC address, until it is reset and has 'forgotten' the original MAC.

Note that it is no longer necessary to clone MAC addresses. If you change from a PC or another router to a Linksys (or any other router) then all you should need to do is power-cycle your cable modem, then power up your new device. I have left the MAC address details in, just in case you decide to do it anyway:-)

Finding the MAC address that the CM 'learns'
The easiest way of doing this is by using whatever facility your currently connected device has for displaying it's NIC MAC address. Make sure the device is connected to the CM service and can connect to Internet services. Run whatever utility your system has for showing the MAC address and make a note of it.
- Win9X
  Use the command winipcfg by selecting Run from the Start Menu. A window will be shown that looks like this:
  
  In Microsoft parlance, the MAC address is displayed as the Adapter Address, but is the same thing.
- WinNT/2000
  With Windows NT/2000 you need to run a DOS command window and typing the command ipconfig /all . Note, that the following output is truncated in order to show the relevant MAC address information, which Microsoft now call the Physical Address.
```
C:\>ipconfig /all

Ethernet adapter Local Area Connection 5:

       Connection-specific DNS Suffix  . : nigs.net
       Description . . . . . . . . . . . : Linksys EtherFast 10/100 PC Card
       Physical Address. . . . . . . . . : 00-E0-98-21-25-4C
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
```
- Linux
  At your shell prompt type ifconfig, which will result in output that will look very similar to that shown in the following screen dump, which shows the output from a two NIC Linux machine where eth0 is attached to an NTL Cable Modem and eth1 is attached to the internal network. Here the MAC address of the NIC is displayed as the HWaddr. This example also shows that it is important to get the correct address, or in other words, the address of the NIC attached to the Cable Modem.
Setting up a PC to access the Linksys Manager
In an ideal world, you do not need to access the Linksys Manager in order to get it operational, but password issues aside, in order to clone your MAC address you have to. Simply connect a PC to one of the LAN ports of the router, and assuming the PC can lease an address, run a web browser set to use a LAN connection and connect to site http://192.168.1.1. A successful connection will result in you being asked for the Linksys Manager password. The default settings for this are Username = nothing, Password = admin. CHANGE THIS PASSWORD!
Once connected you will be faced with the general setup interface of the Linksys. For NTL, ensure that 'Obtain an IP automatically' is selected in the WAN Connection Type section, as shown below. There is no requirement to enter either the Host Name or Domain Name.
Setting the MAC address
The MAC Clone option is accessed via the Advanced configuration option of the Linksys Manager. Click on the Advanced tab, then click on the MAC Addr. Clone tab.
Replace the shown MAC address with the address you got from your original NIC, click Apply, and that should be it. Once you return to the Manager, select the Setup tab and check the WAN MAC address is displayed correctly.
In my experience with the Linksys, using our internal e-smith provided dhcp server, the Linksys never needs a reboot in order to make changes such as MAC changes, but with a Cable Modem, I would suggest you power off the Linksys after making this change, just in case.

Changing the Default 192.168.1.0 Network

Set the LAN address of the Linksys by entering the IP address and Subnet Mask on the main setup screen.

Changing the network number you are using from the default set-up by Linksys is only really necessary if you are connecting an existing LAN to it and that LAN does not use DHCP, or, you just want to be different. It is important to be aware, however, that the Linksys will only support up to a maximum of 253 devices, or, more specifically IP addresses attached to it and this is enforced by the fact that the minimum netmask you can use is 255.255.255.0. If you are using a 10.0.0.0 network with mask of 255.0.0.0, then a reconfiguration of the LAN machines will be necessary. Of course, that reconfiguration is quite simple if dhcp is used where a release and renew of the IP lease is all that would be required.

Note that any change in the Linksys LAN address will also change the Linksys DHCP address, so again a release and renew are necessary to get dhcp machines to get an address on the new network.

Of course, any machines with manually assigned address will need a manual change to use the new network!

Advanced Configuration

All of these options are available on the Advanced menu.

Port Filtering

Linksys Routers, much like many other LAN sharing options, by default, allow all traffic from LAN to WAN. Port Filtering allows the blocking of particular IP addresses or ports so that particular Internet applications will not work. For instance, you may decide that you do not want anyone on your LAN using IRC, so you can the 6667 port for IRC and the Linksys will block that traffic. Note, however, that you cannot set a filter explicitly to an address. Add an address to the Filter IP Range and ALL of it's internet activity will be blocked, set a port to be blocked and all LAN machines will be denied access to that port.

The following screen shot shows filtering set up to block the Microsoft Networking ports. This has no effect on clients connected to the router connecting to each other, but does prevent unwanted connections that could be made outside.

Note also, that this screen also contains the settings for remote access, UPnP, and so on. I would recommend the settings shown for most installations, although this example does show IPSec pass-thru' enabled to allow VPN traffic out via the Internet. Enabling this would only be necessary if required, i.e, if you access work from home.

Forwarding

Forwarding, or Port Forwarding to give it its proper name, is used to set the Linksys firewall rules to allow connections from the WAN, i.e., the Internet, to machines on the internal LAN. This could be anything for anything from a Web server to an SSH daemon, as long as you know the ports that are required to support the service.

The screenshot below shows port 80 (http) forwarded to an internal machine with IP address 192.168.3.99, which is running an Apache Web Server. Note that the protocol is set to TCP only, and that no UPnP forwarding or port triggering is necessary.

Any clients wishing to connect to the web server must connect to the external IP address of the router, and not the LAN address of the web server. It is also possible to forward your own domain's www address to your NTL assigned address, or you can use one of the many dynamic DNS services, such as dyndns.org.

DMZ Host

Having a DMZ host takes away what can be a chore setting up individual ports you want to forward for applications discussed earlier. Making a device a DMZ host causes the Linksys to advertise all of the ports that the DMZ host is advertising. Whilst this can be useful for applications such as Microsoft's Netmeeting, it can also reveal services such as FTP and Web and File and Print Sharing, which you may or may not want to advertise and I would recommend only using the DMZ facility as a last resort.

Another security issue with the DMZ facility of the Linksys, is that the DMZ host remains as part of the internal LAN, in the same way as machines with forwarded ports, and can make connections to the other machines on the network. If your DMZ host is compromised, your whole internal network could be as well.

As in the case with a host advertising ports via the forwarding facility of the Linksys, do not make your DMZ host an address that is in the range of the Linksys DHCP service. Use an address such as 192.168.1.20, or 192.168.1.30 instead.

Security Considerations

The Linksys Router does a very good job of providing a protected connection to the Internet. Once changes are made to the router's default configuration, however, it is important to remember that whilst NAT is a very good way of stopping direct connections to your LAN machines, it only actually protects you at the TCP/IP level. Applications such as HTTP or telnet can be exploited and your NAT device will quite happily pass that exploit traffic. As far is it's concerned, if traffic on port 80 is allowed, it can pass. It has no concern with the content of that traffic, merely the act of making sure that connection from a to b is allowed according to it's NAT tables.

For example, I decide to run a web server on a Linux machine that I have configured as the DMZ host on a router. Unbeknownst to me, this Linux machine also has a Telnet daemon running, so when the Linksys configuration sets the Linux machine as the DMZ host, it also advertises it's Telnet port. Stupid idiot that I am, my root password is blank, so if anyone scans my my NTL address for accessible ports, telnet is stting there, wide open and no password. As far as the Linksys is concerned, the telnet traffic is allowed, it does not know that I neglected to set a password on the host so it allows a connection from anywhere to the DMZ host. As the DMZ host is still on my internal network, anyone having access to the DMZ host can now start looking for other machines on the network, or even start messing with the Linksys configuration itself. Again, the Linksys would not be able to tell that the connection it has allowed to the DMZ host is actually about to set up a filter that blocks access to port 80!

It's fairly obvious that Port Forwarding has a distinct advantage over using the DMZ function, as you prevent accidentally leaking services. It is important to remember, tho', that just having a single port, for http say, as opposed to the whole lot, is not the end of the story. Exploits on running services are probably the main method of gaining access to other systems so it is important that any services run are ran in such way as to prevent accidental system access. It is also recommended that you also install a software firewall, such as ZoneAlarm or Tiny Personal Firewall, or at the least an intrusion detection program such as BlackIce, on the host you are forwarding to. For Linux hosts, I would recommend running your chains or tables as if you were actually connected to the Internet, especially, if you place your Linux host as the DMZ host. Of course, this is all irrelevant if your system is compromised, but at least an attempt at prevention is better than the cure, IMO.

Ensure your OS is patched
Nothing more embarrassing than getting hit by an attack that could have been prevented by applying a patch that was released two years ago. This does not necessarily mean that you should apply patches as soon as they are released, however, as some patches may introduce new problems as well as fixing old ones!. Consult the support websites and forums for your system to establish that patch what is required as opposed to what there is.
Ensure the service is patched
Same applies as above. Also consider whether there are any settings that can be set. or even utilities that can be employed that can prevent unwanted egress into your network. For instance, with SSH, you could configure it so that only known host keys can connect, or with Microsoft's IIS use IISLock to disable unwanted services within IIS itself.
Employ Firewall or IDS
On the face, of it, a waste of effort as in order to run your service, you have to open the ports for the service in the firewall anyway! There are also tools available that will disable software firewalls possibly making them doubly superfluous. Use of some firewalls can be useful, however, if they are able to block unwanted access going out of your host to other hosts on your network. If you have to use a DMZ host (such as for Netmeeting), then ensure that only the ports for the application are opened, and not all.
With your other LAN hosts, use a different software firewall to that used on the DMZ host as well. Note, however, there is little protection that you can apply to the Linksys to prevent tampering once your service host is compromised apart from ensuring your password is suitably strong.
Employ Up to Date AntiVirus
If you use an MS host for port forwarding or DMZ host, AV software will prevent Trojans being installed that could be used against your other LAN hosts. Also use AV on your other MS machines.

Network Lab: Sygate Single NIC Gateway

2008-10-31T08:16:00.000-07:00

Sygate Single NIC Gateway

Sygate Technologies produce an Internet Gateway product called Sygate that fits quite nicely with NTL's CM service in the instance where you do not want a dedicated PC Gateway or a Hardware Router. In-built with Sygate is the ability to implement an Internet Router/NAT service using software running on a Windows 95, 98 or NT 2000 PC containing a single Network Card. Sygate do this with the use of a 'virtual' NIC. The real NIC is set-up as your CM facing interface and obtains it's IP address via the normal Windows' DHCP mechanism. The 'virtual' NIC runs on an IP range that is completely different to the IP network allocated by NTL, thus enabling an additional network to run on the same 'network' as your PC -> CM connection. The local machines are set with the 'virtual' IP address of the Sygate server as the default gateway.

Obtaining and Installing Sygate

Syagte is a nice 5MB download from http://www.sygate.com as sygate.exe, which, when run produces a folder within which is the Sygate Home Network program, which actually installs the Sygate server. The installation prompts for either a server or client installation, and server is required if you want this machine to provide Internet access. Once installed Sygate can be configured to provide single NIC capability, DHCP services for your LAN, connection filtering and an add-on firewall function.

Sygate Configuration

After installation and a reboot, Sygate requires licensing information to be entered prior to running. The license key for the 30-day trial version is H1001001 and no other info is required in order to run the trial.

The routing engine of Sygate runs as a background process, and in order to see whether your Internet link is up, or to configure you need to run the Sygate Manager. The default manager screen is shown below:

Configuration is performed from the options available from the Advanced button on the main manger screen. Note that the Firewall, Access Rules and Permissions do not require any configuration by default for simple Internet Sharing.

Configuration
For Configuring the Network Operation of Sygate

Firewall
For access to the Sygate Firewall add-on

Access Rules
For adding access rules for various applications

Activity Log
Er, the activity log!

Permissions
Allow or disallow connection to specified hosts.

Configuring Sygate to provide gateway services to your LAN is simply a case of telling Sygate which interface you are going to use for your Internet Connection, and whether you want to use a single NIC connection. To enable this and then add the Internal IP address that you wish your gateway to be. Note that in the screen dump below , the IP address shown underneath the selected NIC would normally be the address as supplied by NTL's DHCP server. The address shown in the example is one obtained by the Sygate PC NIC from our internal DHCP server, rather than NTL's. Operation, however, is identical.

When Single NIC is enabled, Sygate automatically sets the Gateway IP to 192.168.0.1, and this should be the address set as the client's default gateway.

As can be seen from above the configuration of Sygate is quite straightforward with the options quite clearly labled. For instance, if you want to run a DHCP server internally, enable it here. Sygate will automatically assign a range of IP addresses but you can define your own from the options available from the Advanced button. Note that your DHCP range should be from the same IP subnet as your Sygate server is configured to be on, i.e., if Sygate Gateway IP is 192.168.0.1, then your DHCP range will need to withing the address range for that address, or from 192.168.0.2 to 192.168.0.254 if using the whole range.

Client Configuration

With DHCP enabled on Sygate, your client PCs need to be set to get their address automatically. If DNS is disabled within the TCP settings of the client, then the client should also discover it's DNS server as well as it's default gateway. Applications on the client PC need to be setup as tho' they have a direct connection to the Internet - remember that Sygate only provides NAT facilities, it does not provide proxy services, tho' some applications may need Access Rules defined in order for them to function correctly.

If no DHCP service is configured in Sygate, then client PCs require their TCP/IP settings to be set manually using a unique address from your network. The Gateway and DNS servers should be set to the Gateway address as defined in Sygate, e.g., 192.168.0.1 if using the default address allocated by Sygate. Again, client applications will need to be set as tho' they are connected direct to the Internet.

There is the facility with Sygate to create Client Configuration disks, but in reality, all this does is set the IP address of the client and it is not really needed.

Conclusion

Sygate is an excellent way to share an Internet Connection without needing to buy additional hardware. The machine used for this trial was a Compaq Deskpro P133 with 16MB of RAM, with a single 3COM NIC and performance was suprisingly good. Note, however, Sygate is not free. It's smallest license costs $40, but this only supports three client PCs. More clients mean more cost, with there being a point at the 10 user level where a hardware router such as a Linksys is better VFM. Sygate also does not offer any firewalling capabilities beyond NAT, tho' there is a free Firewall add-on available.

Network Lab: Using e-smith Internet Gateway on the NTL Cable Modem Service

2008-10-31T08:15:00.000-07:00

Using e-smith Internet Gateway on the NTL Cable Modem Service

An excellent system for sharing your Cable Modem connection on your LAN is the e-smith Server and Gateway offering from e-smith, inc.. Based on a very trimmed distribution of RedHat Linux, e-smith offers an extremely effective means of using your Cable connection to the maximum.

Despite the fact that e-smith runs a light version of RedHat, it still provides numerous services to your LAN as well as providing gateway services to the Internet. At it's very basic, e-smith is a Linux Router offering NAT and firewalling (as of Version 4.1) services but with it's ability to also operate as the Proxy, Mail, DNS and FTP servers for your LAN connected machines it can also provide both Intranet/Internet Web servers, both with CGI, PHP and SSL support. In addition Virtual Domains and Information Bays can also be set-up, resulting in an extremely flexible and powerful Internet system.

Perhaps the most outstanding feature of e-smith is it's administration utilities. The majority of the configuration for the system is performed from a web browser running on the internal network nearly all administration tasks can be done from it, with the important configuration available from a text-based configuration tool. You therefore do not need an extensive knowledge of Linux in order to use it, although some knowledge can be useful.

Obtaining and Installing E-Smith

The e-smith distribution is available for free download from the e-smith website and it is only available as an iso image, so you will need to be able to extract this image to a CD. Once you have your extracted e-smith CD, you can either boot your intended machine direct from the CDRom, or you can create a boot disk on floppy by using the included rawrite utility in the dosutils directory. Further details on the installation of e-smith are also on the e-smith downloads page.

It is important to note two things when considering e-smith. The first is that installing e-smith will wipe the hard disk of the target machine, so make sure there is not data on the disk that you want, and the second is that e-smith has partial support for some hardware, so check the compatibility list to make sure you can use it.

Installation Considerations For NTL Cable Modem Service

During the installation process for e-smith you will be asked a couple of questions regarding your IP address settings, your hostname and your domain.

As regards the IP address allocation, you should enable your external facing interface to use the DHCP client with the (send ethernet address as client id) option selected. I find this option works 100% of the time. It is entirely optional to enable DHCP for the internal LAN, I choose not to, but you may prefer to do so. If you do, remember to set your LAN PCs to contact a DHCP server for their address, which they will get from your e-smith server.

As far as your hostname and domain settings are concerned, I would recommend setting the hostname as your NTL account name and the domain to ntlworld.com. My own set-up reflects the fact that I have my own domain registered and if you also have your own domain, then I would set your e-smith domain to be that instead as one consequence of specifying ntlworld.com as your domain is that www.ntlworld.com will resolve to your e-smith server. To some this may be an improvement, but to others it could be a major issue. If this is an issue you can bypass the e-smith proxy for this host within the setup of your browser.

During the configuration after installation, e-smith will also ask if you are using an Dynamic DNS facility, and I can thoroughly recommend the services available from Dyndns. In practice this enables me to advertise my public facing web service as http://nigs.homeip.net, rather than my currently assigned hostname from NTL. The e-smith setup for Dyndns requires your Dyndns username and password so that your dynamic hostname is updated automatically by the e-smith server in the event that your NTL assigned IP address changes for some reason.

Something else to consider is your Cable Modem's association with the MAC address of the Network Adapter connected to it. If you go thru' the process of installing an e-smith machine from scratch to replace an existing system attached to the Cable Modem, i.e., different PC and different Network cards, then you may need to reset your Modem so that the existing NIC's MAC address is deleted and the modem can re-learn your new MAC address. A method of avoiding the re-setting of the modem involves editing one of the e-smith template files so your NIC has the same MAC address of the original NIC connected to the modem.

On the subject of NICs, it is important to know that e-smith only supports PCI network adapters, and you will need two of them.

Editing NIC config to avoid CM re-boot

e-smith uses templates in order to build the necessary system files and these templates take the configuration set in the manager systems and applies them to the correct file. On a conventional RedHat system, the network configuration files are held in the /etc/sysconfig/network-scripts directory. e-smith also has it's network files in this directory but they are derived from the data contained in the template files located in /etc/e-smith/templates/etc/sysconfig/network-scripts. For each NIC, there is an ifcfg-ethX directory within here that e-smith uses to create the ifcfg files contained in the normal directories. Two files exist in these directories, template-begin and template-end. In order to 'spoof' the MAC address of the NIC that the Cable Modem thinks you have you need to add the line:

MACADDR=00DEADBEEF00

(where 00DEADBEEF00 = the 12 digit MAC address of your original NIC - see 'Finding Your IP Address', elsewhere)

to the template-begin file in the relevant directory, so e-smith uses this to set the hardware address of the original NIC.

Of course, you can avoid doing this by pin-resetting your modem.

Setting up e-smith initial configuration

After you have booted the system for installation, e-smith will guide you through the necessary steps to transfer the files from CD to the hard disk. Once complete, the system will reboot and automatically display the configuration screens. The default main menu of the console administrator is shown below, however, the first time e-smith is run, it bypasses this screen and allows you to set your configuration.

The e-smith admin console.

Use the arrow keys to select an option, this press return

As can be seen, most of the options are self explanatory

The display available when 1 is selected in the main menu

Basic e-smith configuration, such as Network settings, domain name, etc., can be done by selecting option 2 from the main menu. It is possible to check your config, without the danger of inadvertantly changing the config, by selecting item 3.

The Review Config screen covers a couple of screens worth of information so it necessary to page up and down thru' it to see all the settings.

At the top is shown the ethernet adapter assignment for the system. It just so happens that both my adapters are the same type, but you may use different ones without problems (assuming they are supported by e-smith. Notice also that my assignment shows as being 'swapped'. By default, e-smith assumes eth1 is connected to the Internet but gives the option to change this to eth0 as this is my CM facing interface.

The external network are settings are shown below. Here, I have specified my system as beiing a dedicated gateway and server, which gives the most flexibilty, and also told e-smith to use the DHCP client to get the IP address. Just below this are the details of the Dyndns service used. The username and password for this service are also shown here, but I have chosen to not let you see that!

Paging down to see the rest of the configuration reveals the internal Network settings. Note that I have the internal DHCP facility turned off, but you may prefer to enable it.

Below this are the details for your domain and hostname. I use my own domain and have the hostname of e-smith set to gatekeeper. I do not use an external proxy as NTL's transparent proxy will trap traffic heading for Port 80 anyway. To avoid the NTL cache specify an external, public, proxy to use and ensure it runs on any other port rather than 80. I also choose to send status reports to e-smith, hence reports is set to on.

Console mode refers to the behaviour of e-smith when you logon as admin. In auto mode the main menu is displayed automatically.

This is as much configuration that is possible from the admin console. For further configuration, you need to use the e-smith manager from a web browser.

Once configured, reboot your system and, all being well, it will connect to NTL's network, via the modem.

A word about passwords

By default the administrator account has no password, and you will need to specify one. The username is admin and you need to set the password up to be fiendishly difficult for someone else to guess, as this password also allows root access to the system. I recommend you create a password containing a combination of upper and lower case letters and numbers. For example, take the words drum and bass, then join them together and change some characters to uppercase or numbers or add some punctuation, thus 'drum and bass' becomes Drum&B4ss. Your e-smith system will only recognise the first 8 characters of the password, so the password will end up being truncated to Drum&B4s. Note, this is only an example, I do not recommend you actually use this password!

An alternative method of generating a password is to select a suitably long song title and take the first letter of each word in the title. For example, 'The Far Out Son of a Lung', by the Future Sound of London, results in the letters tfosoal, which we can change to be something like TF0$oa1. Again, I do not recommend you use this example for your own password, but hopefully, you get the idea.

Configuration using e-smith manager

To access the e-smith manager, open a web browser on one of your LAN machines and enter the URL of your server, e.g., http://gatekeeper.nigs.net:980/. You will be prompted for the admin username and password, and entering them correctly will produce the index page for the manager interface:

Windows 2000 and ICS

2008-10-31T08:14:00.000-07:00

Windows 2000 and ICS

Microsoft made a huge number of changes to their Desktop systems with the advent of Windows 2000 with nowhere the least of them made in the networking department. Still not perfect by any means, but a major step forward from the Win9x days, IMHO. One important improvement that Win2k has over Win9x is that you no longer have to reboot the PC when you change the IP address, but the improvements made to ICS over Win98SE/ME are astounding compared to that small feat! Essentially, if you install two Network Adapters in a Windows 2000 machine, Windows will allow one of them to be used for sharing it's network connection with the other adapter then being pre-set to connect to an private network. Easy.

System Requirements

An Internet service on a gateway machine can be processor intensive, depending both on the Gateway and Clients users' Internet Usage. This is probably more of an issue on a Windows machine than a Linux machine due to the fact that you need to have the WIndows environment up within Windows in order to use the sharing capabilities, whereas with Linux this is not normally necessary. As Windows requires Windows to be running (!), there is a great temptation to use the ICS machine as a workstation as well, but this can cause serious performance issues when clients want to use the ICS machines services. At minimum, I recommend at least a 300Mhz system with at least 128MB of RAM. If, for whatever reason, you need to use the ICS machine as a workstation as well, then I'd suggest doubling both of those.

Like most Internet Gateways, a Windows 2000 machine requires that it has two ethernet adapters installed, at least one of which must have a 10BaseT interface and connect to the Cable Modem using a straight RJ45 cable. The other adapter should connect to your internal network by whatever method used by the private LAN, be it RJ45, Thin/Thicknet or whatever. The information contained here uses 10baseT connectivity throughout. Like ALL gateways, it must also be switched in order for any LAN clients to be able to contact the outside world. If you do not want this situation then the only alternative is to purchase an all-in-one Gateway/Router/Firewall such as a Linksys or SMC Barricade (see the page on routers;-)).

As far as TCP/IP settings for the ICS machine, the CM attached NIC should have it's address DNS server set to be obtained automatically. The other NIC will be set, by ICS, to 192.168.0.1, so there is no need to configure anything for this. Note tho' that if you already have an address configured on NIC2 then this will be overridden when the other NIC is enabled as shared.

Enabling Sharing

As previously stated, adding two NICs to a Windows 2000 machine adds the facility for one of them to be a shared device that other machines on a private network can also use. Consider a Windows 200o machine that contains two Local Area connections, shown as 5 and 7 in the following screen dump. Connection 5 is connected to the Local LAN and 7 is connected to the Cable Modem, which is the interface on which sharing will be enabled.

Selecting the properties for Connection 7 reveals the adapter and protocol settings. All protocols except TCP/IP should be unticked on this interface, as shown below. Notice that two tabs are available in the Properties. The Sharing tab is added automatically by Windows when two network interfaces are present.

The properties for TCP/IP need to be set for DHCP (or, 'Obtain an IP address automatically' is ticked). In addition, DNS server addresses will also need to be set as automatic. This ensures that your ICS machine will get it's IP settings from NTL's DHCP server.

Selecting the Sharing tab reveals a single option - Enable Internet Connection Sharing for this connection.

When ICS is enabled, Windows prompts a warning about changing the local LAN IP address to 192.168.0.1. Comfirm that you want sharing enabled on the interface, and setup is complete!

The TCP/IP properties for the local LAN are reset to that shown below. No changes should be made to these properties, lest ICS is disrupted.

Client TCP/IP Setup

Enabling ICs automatically sets your network to use 192.168.0.0 as it's network number. The hosts on your network must also use this network number as part of their IP address, with the host part being a number between 2 and 254 (1 cannot be used as the ICS machine already has that address!). ICS does provide a DHCP server, so the simplest method for getting the client PCs to connect is to set them for automatic address and DNS servers. This will result in the client PCs having both default gateway and DNS server as 192.168.0.1.

In some instances, DHCP does not work particularly well with ICS and it may be necessary to configure the client machines manually. In this case, the client needs to have the following settings:

IP address is specified as 192.168.0.101 with a mask of 255.255.255.0
The Gateway Address is set to 192.168.0.1
DNS Servers are set to 194.168.4.100 and 194.168.8.100 (these are NTL's DNS servers)

Subsequent machines added to the Network will also require identical settings, bar the assigned IP Address which will require the final digit to be unique. For example, addresses 192.168.0.102, 192.168.0.150 and 192.168.0.200 are all valid addresses that can be used. I would avoid using addresses in the range 192.168.0.2 to 192.168.0.100 in order to avoid any address conflicts in the event the Windows DHCP server allocates an IP address that has already been set manually on a different machine.

Network Lab: Windows XP and ICS

2008-10-31T08:12:00.000-07:00

Windows XP and ICS

Xp was another step forward by MS with ICS. Again, like Windows 2000, if you install two Network Adapters in a Windows XP machine, Windows will allow one of them to be used for sharing it's network connection with the other adapter then being pre-set to connect to a private network. Easy.

The setup requirements for ICS, be it with XP, 2000 or 98 are pretty much the same with most of the differences being in the location of the necessary setup screens. Consequently, this page looks very similar to that of the 2000 ICS setup.

System Requirements

Like most Internet Gateways, a Windows XP machine requires that it has two ethernet adapters installed, at least one of which must have a 10BaseT interface and connect to the Cable Modem using a straight RJ45 cable. The other adapter should connect to your internal network by whatever method used by the private LAN, be it RJ45, Thin/Thicknet or whatever. The information contained here uses 10baseT connectivity throughout. Like ALL gateways, it must also be switched in order for any LAN clients to be able to contact the outside world. If you do not want this situation then the only alternative is to purchase an all-in-one Gateway/Router/Firewall such as a Linksys or SMC Barricade (see the page on routers;-)).

As far as TCP/IP settings for the ICS machine are concerned, the CM attached NIC should have it's address and DNS server set to be obtained automatically. The other NIC will be set, by ICS, to 192.168.0.1, so there is no need to configure anything for this. Note tho' that if you already have an address configured on NIC2 then this will be overridden when the other NIC is enabled as shared.

Clients that wish to use the ICS server need to have their TCP/IP properties set to automatic also. ICS will enable both a DHCP and a DNS service that the clients can use these to obtain their address, gateway and DNS server. Detailed below are two diagrams showing deployment of ICS using XP, the first where a single client is connected to an ICS host using an CAT5 x-over cable and the second, where more than one client is connected to the ICS gateway via a hub or switch.

1 Clients connected via a hub" border="0" height="287" hspace="0" vspace="0" width="609">

Enabling Sharing

As previously stated, adding two NICs to a Windows XP machine adds the facility for one of them to be a shared device that other machines on a private network can also use to connect to other networks. Consider a Windows XP machine that contains two Local Area connections, shown as Local Area Connection and LAC 2 in the following screen dump. LAC2 is connected to the Local LAN and Local Area Connection is connected to the Cable Modem, which is the interface on which sharing will be enabled.

Note that it is possible to change the labels for these icons, so it can be useful to change your shared NIC to a friendlier name such as Cable_Shared or NTL for example.

Selecting the properties for Local Area Connection reveals the adapter and protocol settings. All protocols except TCP/IP should be unticked on this interface, as shown below. Notice that there are now three tabs available in the Properties. ICS is set via the Advanced tab.

Selecting the Advanced tab reveals two configuration areas, Internet Connection Firewall (ICF) and Internet Connection Sharing (ICS). For ICS, there are two options. The first enables ICS operation and allows client PCs access to the Internet. The second determines whether remote operations are possible on the ICS connection. If the ICS machine is not being used as a workstation, then this option can be enabled so that client machines can administer the ICS connection.

On XP, there is no longer a warning that the LAN connection will be set to 192.168.0.1, and after OK is clicked, the network configuration dialogue is closed. Note however, that the icon for the shared connection is now slightly different. The labels of the icons have now also been changed in the following screenshot so as to more reflect their use.

ICS Server TCP/IP Setup

The properties for the TCP/IP protocol on the NTL need to be set for DHCP (or, 'Obtain an IP address automatically' is ticked). In addition, DNS server addresses will also need to be set as automatic. This ensures that your ICS machine will get it's IP settings from NTL's DHCP server. These are actually the default settings for a NIC installed in XP.

The Advanced Button near the bottom of the panel leads to a further panel of options which enable further configuration of the TCP/IP settings, if necessary. The initial screen just informs that the NIC is set to DHCP.

The DNS tab is largely blank, and there is no need to make any changes to this.

The Wins tab details the configuration for the Windows Name service, WINS and also the configuration of the NetBIOS service. You can leave the settings blank on the WINS address list, but on the NetBIOS configuration I would suggest setting this to disabled, as shown.

The last tab, Options, has, at the time of writing just one option, TCP/IP Filtering. This allows setting of filters for specific ports and protocols. You can leave these at default, but it is important to note that by default, windows has little protection from the nastier Internet traffic, so you should look at some form of firewall. Kerio, ZoneAlarm, Outpost, Sygate, etc., all support ICS networking. Ideally tho', the firewall should be installed before connecting your PC to the Net!.

The TCP/IP properties for the local LAN NIC are reset to that shown below when sharing is enabled on a NIC on the sytem. No changes should be made to these properties, lest ICS is disrupted. All other TCP/IP configuration should also be left at default. This includes Microsoft Client and File and Print Sharing, assuming you wish to share files between the ICS machine and the clients.

Client TCP/IP Setup

In some instances, DHCP does not work particularly well with ICS and it may be necessary to configure the client machines manually. In this case, the client needs to have the following settings:

IP address is specified as 192.168.0.101 with a mask of 255.255.255.0
The Gateway Address is set to 192.168.0.1
DNS Servers are set to 194.168.4.100 and 194.168.8.100 (these are NTL's DNS servers)
Sometimes it is necessary to configure NTL's servers manually even if the client has leased an IP address from the ICS machine. If ICS is set-up correctly and the clients have valid 192.168.0.x addresses but are not able to access the Internet, then set NTL's servers as shown below:

Subsequent machines added to the Network will also require identical settings, bar the assigned IP Address which will require the final digit to be unique. For example, addresses 192.168.0.102, 192.168.0.150 and 192.168.0.200 are all valid addresses that can be used. The MS DHCP server will not allocate an address that it sees is already being used on the network.

An XP machine connected via ICS setup on an XP machine will also show an Internet Gateway Icon in The Network Connections window. Here we see Droid as the Internet Gateway as seen by an XP client machine. Note, this icon only appears when XP is the ICS provider.

This icon can be viewed as another Network connection for the local machine, so it is possible to view it's properties and, if granted access, manage the ICS connection remotely. This is a global option so if enabled, it will allow all users to change the status of ICS. The properties of such an Internet Gateway is shown below.

Note that, unless allowed to do so, it will not be possible to disable or view the properties of the ICS connection.

Network Lab: Installing a Dedicated PC as a Gateway device

2008-10-31T08:09:00.000-07:00

Installing a Dedicated PC as a Gateway device

This tutorial assumes that you have an existing LAN and wish to connect a gateway device to it in order to share your Cable Modem connection, although this could also easily apply to a dial-up or ISDN connection.

Choosing the Gateway Machine

The choice of PC for your Gateway will largely depend on the Operating System you want to use, and the functionality you want your Gateway to provide. Some rough guidelines are detailed in the following table.

OS	Services	Hardware Required	Observations
Linux	Routing and Firewall	16Mhz 486 PC, floppy drive and 16MB RAM	For use with floppy based Linux distributions, such as LRP and Freesco
Linux	Routing and Firewall, with Proxy	16Mhz 486 PC, floppy drive, 16MB RAM and HD for caching	Can be used with floppy based Linux distributions, such as LRP and Freesco, but can also benefit from a full Linux distribution
Win9x	Routing and Firewall, with Proxy	16Mhz 486 PC, 16MB RAM and HD for caching	Slightly underpowered but capable of providing simple connectivity using something like AnalogX under Windows, or Qmail and Squid under Linux.
Win9x, Win NT, Linux	Routing and Firewall, with Proxy	75Mhz Pentium PC, floppy drive, 32MB RAM and HD for caching	More capable of supporting multiple proxies, email services, etc.. using something like Net Proxy under Windows.
Win9x, Win NT, Linux	Routing and Firewall with Proxy, local e-mail storage	166Mhz Pentium PC, floppy drive and 64MB RAM and large HD	More capability to run fully fledged Internet Services for your LAN. e-smith installed on this spec PC is possible.

It should be noted that these are only guidelines and are based purely on my own personal thoughts. Whatever OS you choose, it will always benefit from more memory, processor speed and hard disk space. Linux, however, is more than capable of providing full internet services on lower end specification machines, whereas Windows OS's do require that much more performance if required to provide more than just an Internet gateway.

Installing your Gateway Machine

Regardless of the OS selected for your Gateway, your Gateway machine will require the installation of two network cards, both capable of supporting at least 10MB ethernet. One will be required to connect to your Cable Modem via a straight CAT5 cable. The other will require a connection between it and your internal network. I would also recommend considering the following points:

Use network adaptors that are suitable for your environment. If you only have PCI slots available in your machine, then you will have to use PCI cards, naturally. Also consider compatibility with your existing set-up when considering the speed of your adapter.
Consider installing your OS from scratch, after installing all of the required hardware. In this way you can reduce the amount of unnecessary software that is installed on your system, whilst at the same time install support for your network devices.
On a related note, once you have unstalled your OS apply any relevant patches that are available for your chosen system.
Make sure you are able to recognise which adapter is which from a network point of view. Under Linux, your cards will probably be identified as Eth0 and Eth1, whereas, under Windows, the cards will be identified by name, and if you have two cards the same, it can be difficult telling them apart. It is convention that your Eth0 adapter is the one that connects to your Cable Modem, but in reality, it can be either.
For Linux and 3Com adapters, consider switching off Plug and Play for these devices by using the 3Com DOS utility.
If you are installing Linux as a dedicated Internet Gateway, then you need to consider a) the services that you want to use, and b), how secure those services are. Most services can be helped in their security protection by simply including tcpwrappers in your selected software at install time, but applications such as Apache, Squid, DNS and Sendmail do not normally run under tcpwrappers and have their own mechanisms for preventing abuse.

Assigning Network Protocols

On your Gateway, you will have two network card instances with each one having an independent IP address assignment. Your Cable Modem facing NIC will need to be set to automatically obtain an IP address, so normally nothing will need to be changed for this from the default settings if using Windows variants, but you may require additional software loaded for other other operating systems, i.e., for Linux you may need to install Pump or the dhcp client, dhcpcd, either of which are normally installed along with most default installations of RedHat, Mandrake and SUSE.

Your LAN facing NIC, however, will need to an have an address manually set in order to function with the rest of the machines on your network. Once you have selected the IP address range for your network, you need to select one of the address for your gateway. Either .1 or .254 are good numbers to use, as it then leaves the whole of the intervening numbers for your other hosts.

For example, if the network number is 192.168.0.0, then this will allow us to use the numbers 192.168.0.1 through 193.168.0.254 for our hosts. If 254 is used as the gateway's address, then each of the other machines can be allocated addresses such as 192.168.0.10, 192.168.0.20, 192.168.0.30, etc.. When setting these other machines, you need to specify the address of your gateway as the Default Router. This tells the PC's IP stack to use your gateway as the route for all your non-local traffic.

Note, it is also possible to set your internal machines' IP addresses by using your own dhcp server, in which case, your windows machines will need to have their IP settings set to automatic and your Un*x systems will require a dhcp client. Some Internet Sharing Software will provide this facility.

In addition, you may want to setup some file or print sharing within your LAN. In order to use these services, you will need to install Microsoft Networking Client and File & Print Sharing on the machine you want to share drives on. Be warned, you probably do not want to run Microsoft Networking on the Cable Modem connected interface and you should not have it bound to that NIC.

Network Lab: Converting an existing CM connected PC to a Gateway Device

2008-10-31T08:08:00.000-07:00

Converting an existing CM connected PC to a Gateway Device

Converting your existing PC to be an Internet Gateway simply requires that you install both a second ethernet card into your PC and some software that will enable your other machines to use your PC as an Internet Gateway.

Selecting and Installing a Second Ethernet Card

The same criteria that you used to select your first ethernet card should also be applied to your second one, with one subtle difference. I would recommend that your second card be a 10/100 card as this will provide more flexibilty in your choice of network hardware. There is very little monetary difference between 10MB and 100MB network equipment so if your budget can stretch that little bit, go for it. Note, however, this will not necessarily improve your Internet experience as your network will be choked by that 512k connection anyway. There is also a trade-off here as well. Most 10/100 cards tend to be PCI bus only so in order to use 100M networking you may need a spare PCI slot in your PC.

First you need to shutdown your PC, and this has to be the hardest part of the exercise. Well, it is if you are like me and run your PC all the time! Assuming you have got over that shock, remove the case, then remove the blanking plate adjacent to the slot that you are going to insert your new card. Ensure it is firmly in and secure it with a retaining screw if necessary. Replace the lid and then connect an RJ45 cable between your new card and your network device - we'll assume it is a hub, but it could be a switch. If you don't have a hub or a switch and just wish to connect another single PC, then you will need an RJ45 cross-over cable between them instead. Restart your PC and depending on your OS, your card will either be automatically installed and the correct drivers loaded, or, you will need to manually load the relevant files to support your card.

Installation under Windows

If you network card is Plug and Play, and your PC BIOS supports PNP, then Windows will automatically start the hardware installation wizard when the machine is booted. In this case, it is just a matter of following the prompts and ensuring that you have the necessary driver disk inserted into the appropriate drive. Windows already has a number of network card drivers included in it's list of supported hardware but it is always beneficial to use the most up to date drivers, and these may well be contained on the disks that came with your card.

In the case where your card is not PNP, or you are using NT3.51 or NT4, then you will need to run the install hardware wizard manually from within Control Panel by double clicking the 'Add New Hardware' icon. Alternatively, your card may come with an install or setup program that will install the necessary driver files.

Installation under Linux

Over the years Linux has had an uneasy relationship with Plug and Play devices, and generally the PNP function of any card should be disabled if possible. Newer Linux Kernels, however, may not require this and it may be worth consulting the appropriate help files on your Linux system for the definitive answer as to whether you do need to disable PNP.

Traditionally, network adapter support within Linux is performed by the use of modules that are loaded as part of the kernel. Older Linux kernels required that the kernel itself be edited and recompiled in order to add new hardware modules, but kernels above version 2.0 allow for the manual adding and installation of modules without this unnecessary chore. There are a number of commands available within Linux to manipulate modules and, in addition, most Linux variants come with system utilities that allow installation of new modules without the need to hack the system files directly. If you have the inclination, I would suggest that you investigate the 'manual' method of installing additional modules as this will help in your understanding of the way your Linux system is held together.

Connecting your Devices to your Gateway PC

If you have not already connected your PC to the Cable Modem, then use a straight RJ45 Cat5 Cable only to connect between the two, as you would have done previously. Any other cable will either not work or may cause problems. The Link LED on your Cable Modem may or may not come on when the connection is made as this is dependant on your card. Netgear cards will show a Link light whatever the state of the tcp/ip settings of the card, whereas 3Com cards may not actually show any link indication until the tcp/ip properties have been set through the DHCP negotiation.

The devices you add to your LAN will require some sort of physical connection to the internal NIC of your gateway, be it directly, via a hub, or thru' a 10base2 daisy-chain if you intend to use this network type. For RJ45 connections then you will either need a straight Cat5 cable if your Gateway connects to your LAN via a hub or a switch, or a cross-over Cat5 cable if you just have a single PC connected to your Gateway.

Assigning IP Addresses

On your Gateway, you will have two network card instances with each one having an independent IP address assignment. Your Cable Modem facing NIC will need to be set to automatically obtain an IP address, so your tcp/ip settings will need to be set to reflect this. If your are retaining the existing CM connected interface, then this should require no changes to the original configuration.

Your LAN facing NIC, however, will need to an have an address manually set in order to function with the rest of the machines on your network. Assuming you already have an IP address range in use on your network, then you can leave these settings as they are. However, it is common practice to set LAN gateways with either .1 or .254 as their address, as it then leaves the whole of the intervening numbers for your other hosts.

If you are not already doing so, then you should set your LAN IP addresses to one of the designated privately assigned number ranges, as this will avoid routing issues with any host on the Internet that just happens to have your IP addresses assigned to them.

The address ranges designated as privately assigned are as shown in the following table. Note that it is highly unlikely that a home network will require thousands or millions of addreses, but it is still possible to use the Class A and B address ranges for your internal network without any penalty. It is very common for the 192.168 address range to be used within a home network as it is very easy to manage.

Network	Class	Available address Range	Available number of Hosts
10.0.0.0	A	10.0.0.1 -> 10.255.255.254	Millions;-)
172.16.0.0	B	172.16.0.1 -> 172.31.255.254	Thousands;-)
192.168.0.0	C	192.168.0.1 -> 192.168.255.254	254 per network

Ultimately, you will have something that, logically, looks like the following network diagram, with each of the private PCs being connected to the same Hub via RJ45 cables. Each PC also has a static IP address allocation that is derived from one of the private address ranges. Notice that the first three parts of the private addresses are the same. Both PC1 and PC2 have been set-up with 192.168.3.254 as their default gateway, i.e., they will use this address to connect to other networks. Note, however, without some NAT and routing software this setup will not actually work at present!

Setting the Gateway software

In order for us to use the network we have just built we need to look at installation of some gateway or proxy software

There are two main requirements for your Gateway's software. It must provide NAT and it really ought to have some sort of firewall in place. If your Cable connected PC already had firewall software installed then you should be able to re-use this albeit with some minor modifications to allow your LAN machines access to the outside world. As some added value it may well be worth considering some Proxy software as well, although if you are using your gateway machine as a workstation then this could cause some performance issues.

Network Lab : Win98 and ICS

2008-10-31T08:05:00.000-07:00

Win98 and ICS

If you have a PC running Windows 98 SE or above (this includes Windows 98 ME and Windows 2000) then it is possible to use Internet Connection Sharing as included by Microsoft with these versions of the OS.

Whilst ICS is not the most functional of methods available for Internet Sharing, it has the advantage that it is relatively easy to set up and is free. Quite a number of folks use it quite happily but it can cause performance problems and can be a pain to set up for unusual TCP/IP ports for software such as games, PCAW and VPN services, for example.

System Requirements

System requirements for ICS vary. It is possible to run it on a relatively low-spec machine such as a 200 or 300MHz machine, but use the PC for anything else and network response will suffer, both for the ICS machine itself and for all the clients using it for Internet services. Having said that, faster machines can also suffer with performance problems when using ICS, again more so when the machine running ICS is used as a workstation as well.

In order for your PC to be used for ICS with a Cable Modem, the PC needs to have two ethernet cards installed. One connects to the Cable Modem and the other connects to your local network by whatever architecture being used. The Modem connected interface should be set for TCP/IP protocol only and should be set to get an IP address automatically. The Network facing NIC requires manual setting to have the address 192.168.0.1 with a subnet mask of 255.255.255.0, but it can also have other services installed as well, such as Microsoft Networking if required. All of the client PCs are required to automatically get their TCP/IP address, which they will get from the ICS DHCP server running on the gateway PC.

The following diagram shows logically how everything connects together in an RJ45 environment.

If you only have one PC to connect with the ICS gateway, the PCs can be connected together using an RJ45 Cross-over cable (assuming RJ45 is being used).

IP Address Configuration

There are three separate TCP/IP configurations you need to consider:

ICS PC to Cable Modem
In Control Panel, dbl-click on the Network Icon, or right-click on Network Neighborhood on the desktop and select Properties. Select Properties for the TCP/IP settings for the NIC connected to your modem. Ensure that:
1. IP Address is set to 'Obtain an IP address automatically'.
2. DNS is disabled
3. There are no Gateways set.

ICS PC to Local Network
Using the same methods outlined above, select the interface connected to the local network. Ensure that:
1. IP address is specified as 192.168.0.1 with a mask of 255.255.255.0
2. DNS is disabled
3. There are no gateways set

Network PC
Any PCs attached to the Network should have the same settings shown, which are actually identical to the Modem connected NIC in the ICS machine. Note, however that the client PCs will probably not find an address until ICS is set up and running on the gateway.
1. IP Address is set to 'Obtain an IP address automatically'.
2. DNS is disabled
3. There are no Gateways set.

Setting up ICS on the Gateway PC

In order to set up ICS on the Gateway machine, run the ICS Networking Wizard, which configures ICS based on the responses given. The first screen is the introduction:

And the second asks whether to change the Home Networking settings, or to create a boot disk. Select the Home Network Settings, and the wizard will continue through the settings.

The next screen asks whether ICS should be set up for a server or client. Select Direct Connection to ISP and select the adapter to use. This must be the adapter that is connected to the Modem.

If you are setting up a Client PC, then select Connection via another PC on the Network.

Set the next screen to determine the Local Network connection and to enable it for Internet Sharing. Again, it is important to select the correct interface.

The following two screens determine the Microsoft Network options that you want to set on the Local Network. If the default Workgroup name is kept, that all devices on the local network need to be in this workgroup as well.

Finally, the ICS wizard asks if you wish to create an ICS startup Disk. Select yes, only if you want to create one, otherwise, selecting 'No' finishes the ICS Wizard.

Testing Everything Works

Once the Gateway PC is rebooted the first thing to check is that an IP address has been set on the Modem connected adapter - run winipcfg from the Start/Run dialog box. If this has an IP address that starts with 169, then the address negotiation failed and Windows has allocated a default. This should only really occur if the NIC attached to the CM has physically changed. In this case, power off the modem, then turn it back on again. Wait for it to negotiate with the head-end and then reboot the gateway machine.

Assuming that the connection from Gateway to Internet is correct, then boot up one of the client PCs. Again, use winipcfg (or whatever utility is available on the OS of the client PC) to check that an address of 192.168.0.x is set, where x is any number from 2 to 254. If this is the case then try pinging the gateway machine using ping 192.168.0.1 from a DOS command prompt.

If the local Ping works, then, from the client, try pinging a site on the Net, for instance ping www.bbc.co.uk. If this responds OK, then it should be just a case of running your browser in order to use the Net from the Client PC

Lab exam 4

2008-10-22T22:59:00.000-07:00

#include<unistd.h>
#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<sys/types.h>
#include<sys/stat.h>
#include<sys/msg.h>
#include<fcntl.h>
typedef struct msgbuf {
long mtype;
char mtext[128];
} message_buf;
int main()
{
int pid,msqid,msgflag,key = 1,FD, i, c, length;
char ch[2];
message_buf sbuf,rbuf;
msgflag = IPC_CREAT 0666;
FD = open ("a.txt",O_RDONLY); // OPEN THE FILE a.txt

printf("\nIn process 1.\n");

/* to get the size of the file */

struct stat file_status;
if(stat("a.txt", &file_status) != 0)
{
perror("could not stat");
}

/* To read the entire file */
read(FD,sbuf.mtext,file_status.st_size);

printf("Message to be send : %s",sbuf.mtext);

length = strlen(sbuf.mtext)+1; // SIZE OF THE MESSAGE BUFFER
msqid = msgget(key,msgflag); // CREATE QUEUE
sbuf.mtype = 1; // MESSAGE TYPE

msgsnd(msqid,&sbuf,length, IPC_NOWAIT); // SEND MESSAGE

printf("\tMessage send \n");

/* Creating a new process */
pid = fork();
if(pid == 0)
{
printf("\nIn process 2.\n");
/* Recieving Message */
if(msgrcv(msqid,&rbuf, 128, 1, 0) < 0)
printf("Error");
c=0;
/* To count the no. of words */
for(i=0;i<length;i++)
{
if(
if((rbuf.mtext[i] == ' 'rbuf.mtext[i] == '\n')&&(rbuf.mtext[i] != ' 'rbuf.mtext[i-1]!= '\n'))
c++;
}
printf("\tNo. of words = %d \n",c);
}
}

Shared Memory

2008-10-16T18:58:00.000-07:00

shmserver.c

#include<stdio.h>
#include<unistd.h>
#include<string.h>
#include<sys/shm.h>

int main()
{
int shmid;
char *shm;
shmid = shmget( 5678,7,IPC_CREAT|0644 );
shm = shmat( shmid,NULL,0);
strcpy( shm,"HELLO WORLD");
printf("Written string to shared memory.\n");
while( shm[0] != 'printf( "Exiting Server\n");
}

shmclient.c

#include<stdio.h>
#include<unistd.h>
#include<string.h>
#include<sys/shm.h>

int main()
{
int shmid;
char *shm;
shmid = shmget( 5678,7,IPC_CREAT|0644 );
shm = shmat( shmid,NULL,0);
shm[5] = '\0';
printf( "Output = %s\n",shm);
shm[0] = '}

Sample Output

Lab exam question no.3

2008-10-10T08:46:00.000-07:00

/*
Three process p1,p2 & p3.
p1 is to create a named pipe & to send a string through that pipe,
p1 should read the msg thrgh keyboard.
p2 is to read msg frm named pipe and to reverse string.
now create a pipe and send the reversed string to the pipe
process p3 read the reversed string from the pipe
ok this is the question??
*/

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>

int main()
{
int pid,fd[2],fdo,i,len;
char msg[20],temp;
mkfifo("fifo",0777); // creating a named pipe
fdo = open("fifo",O_RDWR); // opening the named pipe.
pipe(fd); // creating a pipe.

printf("In Process 1.\n\tEnter a message : ");
scanf("%s",msg);
len = strlen(msg); // length of the message

/* write the message to the named pipe */
printf("\tWriting %s to a named pipe\n",msg);
write(fdo,msg,len);

pid=fork();
if(pid == 0)
{

printf("\nIn Process 2\n\tReading from named pipe.\n");
read(fdo,msg,len);
printf( "\tMessage read : %s\n", msg);

for(i=0;i<len/2;i++)
{
temp = msg[i];
msg[i] = msg[len-1-i];
msg[len-1-i] = temp;
}
printf("\tWriting %s to a pipe.\n",msg);
write(fd[1],msg,len);

}

else if(pid>0)
{

pid = fork();

if(pid == 0)
{
printf("\nIn Process 3\n\tReading from the pipe.\n");
read(fd[0],msg,len);
printf("\tMessage read from pipe : %s\n",msg);
}
printf("\n");
}
}

/*
A sample output.

dipin@dipin-desktop:~/programs$ ./a.out
In Process 1.
Enter a message : dipinkrishna
Writing dipinkrishna to a named pipe

In Process 2
Reading from named pipe.
Message read : dipinkrishna
Writing anhsirknipid to a pipe.

In Process 3
Reading from the pipe.
Message read from pipe : anhsirknipid

dipin@dipin-desktop:~/programs$

*/

Lab exam question no.2

2008-10-10T08:45:00.000-07:00

/*
Three process p1,p2 & p3.
p1 should read the msg thrgh keyboard and send it to a message queue.
p2 is to read msg frm the message queue and to reverse string.
now create a pipe and send the reversed string to the pipe
process p3 read the reversed string from the pipe
ok this is the question??
*/

#include <sys/types.h>

#include <sys/ipc.h>

#include <sys/msg.h>

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#define MSGSZ 128

/*

* Declare the message structure.

*/

typedef struct msgbuf {

long mtype;

char mtext[MSGSZ];

} message_buf;

main()

{

int pid;

int msqid; // Used to store the message queue id.

int msgflg = IPC_CREAT | 0666;

key_t key;

/* pointers to send and recieve message buffer.*/
message_buf sbuf,rbuf;

size_t buf_length;

int fd[2],i;

char msg[20],temp;

/*

* Get the message queue id for the

* "name" 1234, which was created by

* the server.

*/

key = 1234; // A default key is used.

printf("In process 1\n\tEnter the message : ");
scanf("%s",sbuf.mtext);

/* Creating a message queue. */

printf("\n\tmsgget: Calling msgget(%#lx,\%#o)\n",key, msgflg);

if ((msqid = msgget(key, msgflg )) < 0)
{

perror("\tmsgget");
exit(1);

}

else

printf("\tmsgget: msgget succeeded: msqid = %d\n", msqid);

/*

* We'll send message type 1

*/

sbuf.mtype = 1;

buf_length = strlen(sbuf.mtext) + 1 ;

/*

* Send a message.

*/

if (msgsnd(msqid, &sbuf, buf_length, IPC_NOWAIT) < 0)
{

printf ("\n\t%d, %d, %s, %d\n", msqid, sbuf.mtype, sbuf.mtext, buf_length);
perror("\tmsgsnd");
exit(1);

}

else

printf("\n\tMessage: \"%s\" Sent\n", sbuf.mtext);

pipe(fd);

pid = fork(); // Create the process p2.

if(pid==0)
{

printf("\nIn process 2.\n");
/*

* Receive an answer of message type 1.

*/

if (msgrcv(msqid, &rbuf, MSGSZ, 1, 0) < 0)
{

perror("\tmsgrcv");

exit(1);

}

/*

* Print the answer.

*/

printf("\tMessage recieved : %s\n", rbuf.mtext);

buf_length=buf_length-1;

/* Reverse the message */

for(i=0;i<buf_length/2;i++)
{
temp = rbuf.mtext[i];
rbuf.mtext[i] = rbuf.mtext[buf_length-1-i];
rbuf.mtext[buf_length-1-i] = temp;
}
printf("\tWriting %s to a pipe.\n",rbuf.mtext);
write(fd[1],rbuf.mtext,buf_length);
}

if(pid > 0)
{
pid = fork(); // Create the process p3.

if(pid == 0)
{

printf("\nIn process 3.");

/*
Read from the pipe.
*/
read(fd[0],msg,buf_length-1);
msg[buf_length-1]='\0';
printf("\n\tMessage read from the pipe : %s\n",msg);
}
}

}

/*
A sample ouput.

dipin@dipin-desktop:~/programs$ ./a.out
In process 1
Enter the message : dipinkrishna

msgget: Calling msgget(0x4d2,01666)
msgget: msgget succeeded: msqid = 0

Message: "dipinkrishna" Sent

In process 2.
Message recieved : dipinkrishna
Writing anhsirknipid to a pipe.

In process 3.
Message read from the pipe : anhsirknipid
dipin@dipin-desktop:~/programs$

*/

Lab exam question no.1

2008-10-10T08:37:00.000-07:00

write an c program to create 3 processers p1 p2 p3 , process p1 is to read a message through the keyboard and to write that message in a pipe after filtering the vowels process p2 is to read that message from the pipe and to write that message into a named pipe process 3 is to read that message queue and to display that in screen

#include<stdio.h>
#include<sys/types.h>
#include<sys/stat.h>
#include<fcntl.h>

int main()
{
int pid,fd[2],fdo,i;
char s[10],msg[20],ch[2];
mkfifo("fifo",0777);
fdo = open("fifo",O_RDWR);
pipe(fd);

printf("In Process 1 \n Enter a message : ");
scanf("%s",msg);

for(i=0;msg[i]!='\0';i++)

{

if(msg[i]!='a' && msg[i]!='e' && msg[i]!='i' && msg[i]!='o' && msg[i]!='u' && msg[i]!='A' && msg[i]!='E' && msg[i]!='I' && msg[i]!='O' && msg[i]!='U')
{
write(fd[0],msg[i],1);
printf("%c",msg[i]);
}

}
write(fd[1],"\0",1);
pid=fork();
if(pid == 0)
{

printf("\nIn Process 2 : writing from pipe to a named pipe.\n");
read(fd[0],ch,1);
while(ch[0]!='\0')
{
write(fdo,ch,1);
read(fd[0],ch,1);
}
}

else if(pid>0)
{

pid = fork();

if(pid == 0)
{
printf("\nIn Process 3 \nThe message from the named pipe is : \n");
read(fdo,ch,1);
while(ch[0]!='\0')
{
read(fdo,ch,1);
printf("%c",ch[0]);
}
}
printf("\n");
}

}

Program to sent a message by process p1 and to recieve that message by process p2.

2008-10-09T21:27:00.000-07:00

#include <sys/types.h>

#include <sys/ipc.h>

#include <sys/msg.h>

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#define MSGSZ 128

/*

* Declare the message structure.

*/

typedef struct msgbuf {

long mtype;

char mtext[MSGSZ];

} message_buf;

main()

{

int pid;

int msqid; // used to store the message queue id.

int msgflg = IPC_CREAT | 0666;

key_t key; // used to store the key for the msg queue.

message_buf sbuf,rbuf; // pointers to the message buffers.

size_t buf_length; // used to store the msg buffer size.

/*

* Get the message queue id for the

* "name" 1234, which was created by

* the server.

*/

key = 1234; // key is assigned a default value.

printf("\nmsgget: Calling msgget(%#lx,\%#o)\n",key, msgflg);

if ((msqid = msgget(key, msgflg )) < 0)
{

perror("msgget");

exit(1);

}

else

printf("msgget: msgget succeeded: msqid = %d\n", msqid);

/*

* We'll send message type 1

*/

sbuf.mtype = 1;

printf("msgget: msgget succeeded: msqid = %d\n", msqid);

(void) strcpy(sbuf.mtext, "Did you get this?");

buf_length = strlen(sbuf.mtext) + 1 ;

/*

* Send a message.

*/

if (msgsnd(msqid, &sbuf, buf_length, IPC_NOWAIT) < 0) {

printf ("%d, %d, %s, %d\n", msqid, sbuf.mtype, sbuf.mtext, buf_length);

perror("msgsnd");

exit(1);

}

else

printf("Message: \"%s\" Sent\n", sbuf.mtext);

/* Create a new process to receive the message */

pid = fork();

if(pid==0)
{

/*

* Receive an answer of message type 1.

*/

if (msgrcv(msqid, &rbuf, MSGSZ, 1, 0) < 0)
{

perror("msgrcv");

exit(1);

}

/*

* Print the answer.

*/

printf("Message recieved :%s\n", rbuf.mtext);
}

exit(0);

}

Interprocess Communication (IPC), Pipes

2008-10-08T00:03:00.001-07:00

We have now began to see how multiple processes may be running on a machine and maybe be controlled (spawned by fork() by one of our programs.

In numerous applications there is clearly a need for these processes to communicate with each exchanging data or control information. There are a few methods which can accomplish this task. We will consider:

Pipes
Signals
Message Queues
Semaphores
Shared Memory
Sockets

In this chapter, we will study the piping of two processes. We will study the others in turn in subsequent chapters.

Piping in a C program: <stdio.h>

Piping is a process where the input of one process is made the input of another. We have seen examples of this from the UNIX command line using |.

We will now see how we do this from C programs.

We will have two (or more) forked processes and will communicate between them.

We must first open a pipe

UNIX allows two ways of opening a pipe.

popen() -- Formatted Piping

FILE *popen(char *command, char *type) -- opens a pipe for I/O where the command is the process that will be connected to the calling process thus creating the pipe. The type is either ``r'' - for reading, or ``w'' for writing.

popen() returns is a stream pointer or NULL for any errors.

A pipe opened by popen() should always be closed by pclose(FILE *stream).

We use fprintf() and fscanf() to communicate with the pipe's stream.

pipe() -- Low level Piping

int pipe(int fd[2]) -- creates a pipe and returns two file descriptors, fd[0], fd[1]. fd[0] is opened for reading, fd[1] for writing.

pipe() returns 0 on success, -1 on failure and sets errno accordingly.

The standard programming model is that after the pipe has been set up, two (or more) cooperative processes will be created by a fork and data will be passed using read() and write().

Pipes opened with pipe() should be closed with close(int fd).

Example: Parent writes to a child

int pdes[2];

pipe(pdes);

if ( fork() == 0 )

{ /* child */

close(pdes[1]); /* not required */

read( pdes[0]); /* read from parent */

.....

}

else

{ close(pdes[0]); /* not required */

write( pdes[1]); /* write to child */

.....

}

An futher example of piping in a C program is plot.c and subroutines and it performs as follows:

The program has two modules plot.c (main) and plotter.c.
The program relies on you having installed the freely gnuplot graph drawing program in the directory /usr/local/bin/ (in the listing below at least) -- this path could easily be changed.
The program plot.c calls gnuplot
Two Data Stream is generated from Plot

y = sin(x)
y = sin(1/x)

2 Pipes created -- 1 per Data Stream.
°Gnuplot produces ``live'' drawing of output.

The code listing for plot.c is:

/* plot.c - example of unix pipe. Calls gnuplot graph drawing package to draw

graphs from within a C program. Info is piped to gnuplot */

/* Creates 2 pipes one will draw graphs of y=0.5 and y = random 0-1.0 */

/* the other graphs of y = sin (1/x) and y = sin x */

/* Also user a plotter.c module */

/* compile: cc -o plot plot.c plotter.c */

#include "externals.h"

#include <signal.h>

#define DEG_TO_RAD(x) (x*180/M_PI)

double drand48();

void quit();

FILE *fp1, *fp2, *fp3, *fp4, *fopen();

main()

{ float i;

float y1,y2,y3,y4;

/* open files which will store plot data */

if ( ((fp1 = fopen("plot11.dat","w")) == NULL) ||

((fp2 = fopen("plot12.dat","w")) == NULL) ||

((fp3 = fopen("plot21.dat","w")) == NULL) ||

((fp4 = fopen("plot22.dat","w")) == NULL) )

{ printf("Error can't open one or more data files\n");

exit(1);

}

signal(SIGINT,quit); /* trap ctrl-c call quit fn */

StartPlot();

y1 = 0.5;

srand48(1); /* set seed */

for (i=0;;i+=0.01) /* increment i forever use ctrl-c to quit prog */

{ y2 = (float) drand48();

if (i == 0.0)

y3 = 0.0;

else

y3 = sin(DEG_TO_RAD(1.0/i));

y4 = sin(DEG_TO_RAD(i));

/* load files */

fprintf(fp1,"%f %f\n",i,y1);

fprintf(fp2,"%f %f\n",i,y2);

fprintf(fp3,"%f %f\n",i,y3);

fprintf(fp4,"%f %f\n",i,y4);

/* make sure buffers flushed so that gnuplot */

/* reads up to data file */

fflush(fp1);

fflush(fp2);

fflush(fp3);

fflush(fp4);

/* plot graph */

PlotOne();

usleep(250); /* sleep for short time */

}

void quit()

{ printf("\nctrl-c caught:\n Shutting down pipes\n");

StopPlot();

printf("closing data files\n");

fclose(fp1);

fclose(fp2);

fclose(fp3);

fclose(fp4);

printf("deleting data files\n");

RemoveDat();

}

The plotter.c module is as follows:

/* plotter.c module */

/* contains routines to plot a data file produced by another program */

/* 2d data plotted in this version */

/**********************************************************************/

#include "externals.h"

static FILE *plot1,

*plot2,

*ashell;

static char *startplot1 = "plot [] [0:1.1]'plot11.dat' with lines,

'plot12.dat' with lines\n";

static char *startplot2 = "plot 'plot21.dat' with lines,

'plot22.dat' with lines\n";

static char *replot = "replot\n";

static char *command1= "/usr/local/bin/gnuplot> dump1";

static char *command2= "/usr/local/bin/gnuplot> dump2";

static char *deletefiles = "rm plot11.dat plot12.dat plot21.dat plot22.dat";

static char *set_term = "set terminal x11\n";

void

StartPlot(void)

{ plot1 = popen(command1, "w");

fprintf(plot1, "%s", set_term);

fflush(plot1);

if (plot1 == NULL)

exit(2);

plot2 = popen(command2, "w");

fprintf(plot2, "%s", set_term);

fflush(plot2);

if (plot2 == NULL)

exit(2);

}

void

RemoveDat(void)

{ ashell = popen(deletefiles, "w");

exit(0);

}

void

StopPlot(void)

{ pclose(plot1);

pclose(plot2);

}

void

PlotOne(void)

{ fprintf(plot1, "%s", startplot1);

fflush(plot1);

fprintf(plot2, "%s", startplot2);

fflush(plot2);

}

void

RePlot(void)

{ fprintf(plot1, "%s", replot);

fflush(plot1);

}

The header file externals.h contains the following:

/* externals.h */

#ifndef EXTERNALS

#define EXTERNALS

#include <stdio.h>

#include <stdlib.h>

#include <math.h>

/* prototypes */

void StartPlot(void);

void RemoveDat(void);

void StopPlot(void);

void PlotOne(void);

void RePlot(void);

#endif

Exercises

Exercise 12733

Setup a two-way pipe between parent and child processes in a C program. i.e. both can send and receive signals.

Program to print the odd numbers by parent process & even numbers by child process.

2008-10-07T23:53:00.000-07:00

#include<stdio.h>
#include<unistd.h>

int main()
{
int array[10],pid,i=0;

printf("Enter 10 numbers : ");

while(i<10)
{
scanf("%d",&array[i]);
i=i+1;
}

pid = fork();

if(pid == 0)
{

printf("In child processn");
printf("Even numbers are : ");
i=0;

while(i<10)
{
if(array[i] % 2 == 0)
printf("%d",array[i]);
i++;
}

}

else if(pid>0)
{
printf("nIn parent processn");
printf(Odd numbers are : ");
i=0;

while(i<0)
{
if(array[i] % 2 != /0)
printf("%d ",array[i]);
i++;
}

}

}

Use fork() system call to create a child process & print the ids of parent & child.

2008-10-07T23:51:00.000-07:00

#include<stdio.h>
#include<unistd.h>

int main()
{
int pid;
pid = fork();
if(pid==0)
printf("Process id of child process : %d",getpid());
else if(pid>0)
printf("Process id of parent process : %d",getpid());
}

Program to create a file ' Student.txt '. Enter the details(name,Id,Marks) of 5 students. Write the data into the file & display it.

2008-10-07T23:49:00.000-07:00

#include<stdio.h>
#include<unistd.h>
#include<fcntl.h>
#include<string.h>

int main()
{
int fd,i;
char marks[5] , id[4] , name[30] , ch[2];
fd = open("student.txt" , O_CREAT | O_RDWR , 0777);

for(i=0;i<5;i++)
{
printf(" \nEnter the details of student no. %d\n ",i+1);

printf("\nEnter name : ");
scanf("%s",name);
write(fd,name,strlen(name));
write(fd,"\n",1);

printf("\nEnter id : ");
scanf("%s",id);
write(fd,id,strlen(id));
write(fd,"\n",1);

printf("nEnter total mark : ");
scanf("%s",marks);
write(fd,marks,strlen(marks));
write(fd,"\n",1);

}

fd = open("student.txt",O_RDONLY);

for(i=0;i<5;i++)
{
c=-1;
do
{
c=c+1;
read(fd,ch,1);
name[c]=ch[0];
}while(ch[0]!='\n');

name[c]='\0';
c=-1;

do
{
c=c+1;
read(fd,ch,1);
id[c]=ch[0];
}while(ch[0]!='\n');

id[c]='\0';
c=-1;

do
{
c=c+1;
read(fd,ch,1);
marks[c]=ch[0];
}while(ch[0]!='\n');

marks[c]='\0';

printf("Name : %s\nId : %s\nTotal marks : %s\n",name,id,marks);
}
}

A program to find the sum of n numbers using cmdline arguements. Write another program and use exec() system call to run the above program.

2008-10-07T23:46:00.000-07:00

#include<stdio.h>
#include<stdlib.h>

int main(int a, int *ip[ ])
{
int sum=0;
while(a>1)
{
sum = sum + atoi(ip[a-1]);
a--;
}
printf(“sum = %d”,sum);

#include<unistd.h>

int main()
{
execl(“./sum.out”,” “ ,”1”,”2”,”3”,”4”,”5”,NULL);
}

My Ubuntu

2008-10-07T23:44:00.000-07:00