Nmap is a tool that needs no introduction. Quite arguably it should be in the hands, or at least the back pocket, of most systems administrators. Nmap can perform network host and service discovery, security scans, OS fingerprinting, and a whole lot more. Zenmap, a highly functional GUI for nmap, helps ease the learning curve by providing a user-friendly interface for both building scans and viewing scan results or reports. Plus, Zenmap is a multi-platform application that runs on Windows as well as Linux and Mac.

The Windows Zenmap GUI

How it works

You can think of Zenmap as a “syntax builder” for nmap. Rather than sitting on top of nmap, it simply sends commands to the platform-specific nmap executable and pipes the output back. This is very useful for nmap beginners who would like to harness the power of nmap while learning some of the deep syntax options it provides.

Zenmap makes it easy to build out command line options like this

The basic operation in nmap is network scanning and Zenmap allows you to perform and save scans as well as the results from those scans. Zenmap uses Profiles, which are basically nmap parameter presets, to specify how scans are performed. It ships with some handy preset profiles, such as Intense scan, which scans hosts with “all advanced/aggressive options,” Quick scan, which scans hosts without those advanced options, and Slow comprehensive scan, which is exactly as it sounds. Budding administrators can choose profiles that match their needs. For example, if your goal is host discovery, Quick scan might do the job. If your goal is to map out every single TCP port, you’ll need to do an Intense scan, all TCP ports at a minimum.

Defining a target

Every scan must be associated to a specific target, which can be a single host, an interval range of hosts, or a full subnet. Nmap uses the following syntax for target definitions:

• Single host: Just a hostname or IP address will do, like localhost or 127.0.0.1
• Interval: Intervals are denoted by a dash in the IP address; for example, if you want to scan 192.168.1.0/24 through 192.168.10.0/24, you would use 192.168.1-10.0-255
• CIDR Notation: Nmap accepts CIDR target specification, like 192.168.5.0/24
• Lists: Separate different targets with a comma; for instance, 10.1.1.0/24, 192.168.1.0/24

Reporting window

Zenmap provides different tabs for reporting on scan results. These tabs either directly report the output of nmap or expand on the output with diagrams and user-friendly reports. The tabs include:

• Nmap output: The piped output of the nmap command sent by Zenmap
• Ports/Hosts: If a host is selected on the left, this will display open and unknown ports. If a service is selected on the left, this will display all hosts for that service
• Topology: A neat diagram of the network topology as understood by Nmap
• Host Details: Displays a condensed report of pertinent host information from the scan

A sample Nmap output window from an Intense scan

Useful tools

Zenmap also ships with some useful tools that can help you track changes between scans and drill down to useful information within long scan results. The Compare Results tool provides an interface for differentiating between two scans, which can be used to monitor daily changes in network topology or available hosts. The Search Scan Results tool is great for finding specific text in results, and the Filter Hosts tool does exactly what you would imagine – it filters hosts, which comes in handy when scanning large subnets or lists of networks.

Saving scans

By going to File > Save Scan, you can save a scan result report in XML or plain text format for later consumption. This comes in handy when you perform a large scan and do not want to repeat the scan again later while reviewing results. The XML format is also very friendly for consumption by third party report generation packages as well as web service reporting.

A sample XML report generated by Zenmap

Custom profiles

Perhaps the best feature of Zenmap is its Profile Editor, which empowers users who are unfamiliar with nmap syntax to build powerful and custom scanning profiles. These profiles can be saved for later use and even exported to other interested admins. The Profile Editor window contains the following tabs:

• Profile: The name and description of your profile
• Scan: The most important tab, where you can specify targets, scan type (TCP, UDP, IP), timing template, and much more
• Ping: Specifies ping behavior. You can suppress pings or build a specific ICMP packet
• Scripting: Include nmap scripts in your scan. Zenmap comes with many useful scripts
• Target: Allows for greater target specification flexibility, including excluded hosts, target list files, and fast scan support
• Source: Specify how you would like the scanner to behave with respect to scanning identity, IP address, port, and interface
• Other: Includes options for verbosity level, TTL, and other scanner behaviors
• Timing: Defines timing profile with respect to maximum scan time, scan delay, and timeouts, among other things

Use the Profile Editor to develop custom profiles that meet your enterprise needs

Saving profiles saves time because it allows the administrator to quickly perform familiar and repetitive scans without specifying the target and options. Using saved profiles also ensures that when comparing two scan results you are working from the same scan options.

Wrapping up

Zenmap is an excellent Windows GUI for nmap and takes the edge off of the learning curve. Administrators who are versed in basic networking will have little trouble jumping into the simple, yet powerful interface that Zenmap offers. Since ZenMap is Open Source, it represents a great cost savings for the budget-strapped admin with excellent community support and regular updates. If you haven’t checked out Zenmap yet, give it a try! Achieving IT security is a moving target, and Zenmap makes it easier to reach your goal.

Zenmap

• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)
• FREE: EMCO MAC Address Scanner (3)

One of the duties of many Windows systems administrator is network management. That is, you may be called to detect, diagnose, troubleshoot and resolve network interface slowdowns.

As your network grows in complexity to include multiple line-of-business (LOB) Web applications, load-balancing configurations, and the like, interface troubleshooting and performance monitoring can easily become extremely cumbersome and complex.

Monitoring an interface with SolarWinds Real-Time Bandwidth Monitor

To assist us in this effort, SolarWinds gives us the Real-Time Bandwidth Monitor. This is a free utility that enables us to monitor network bandwidth utilization statistics for multiple interfaces in real time.

Setting up interface bandwidth monitoring

The Real-Time Bandwidth Monitor software can be installed on any modern 32- or 64-bit edition of Windows desktop and server operating systems.

However, it should be noted that because the interface polling and statistics gathering in this product relies upon Simple Network Management Protocol (SNMP), you need SNMP turned on for any device you will be monitoring, which it will be by default for your network devices.

In some cases, you will prefer to have an SNMP server in place in your domain prior to using this tool.

For instance, you can fire up Server Manager in Windows Server 2008 R2 and install the SNMP Server feature, as shown in the following figure.

Windows Server 2008 R2 – Install SNMP Server feature

Once you have SNMP Server installed, you can configure SNMP-related metadata like the community name and trap destinations by modifying the properties of the SNMP Service Windows service. This process is depicted in the following screen capture.

SNMP Service Windows service

Upon first launch of the application, you are asked to create a monitor. This task includes three pieces of information:

• The IP or hostname of a device (desktop PC, server, switch, router, wireless access point, etc.)
• The SNMP version in use on your network (1,2, or 3)
• The SNMP credentials (community name for SNMPv1 and v2; username, context, and authentication method for SNMPv3)

Configuring the device

The next step in the setup process is selecting the desired interface. If you are connected to a switch, then you will be able to monitor individual port IDs; if you are connected to a Windows server, you can choose among physical and virtual network interfaces.

Selecting an interface to monitor

We are almost finished. The final step in the configuration process is setting threshold values. The percentages that you specify for warning and critical values enable the Real-Time Bandwidth Monitor to give you feedback regarding degrees of bandwidth utilization.

Note in the following screenshot that you can also limit the chart date to a particular time interval or data points (sampling is performed at the half-second rate). Click Launch Monitor to start the monitor. Yes, you can have more than one monitor running on a host computer simultaneously.

Setting threshold values

Monitoring an interface

As you can see in the following screenshot, the monitoring screen is a resizable dialog box that is laid out in a very easy-to-understand manner. Inbound and outbound traffic on the selected interface are color-coded, as is the data line if it exceeds a threshold value.

Monitoring an interface

The line chart is active; you can analyze data points simply by hovering your mouse over them. This is shown in the following screen capture.

Analyzing a data point

You can make use of another of SolarWinds tools (this one is not free) called WAN Killer to simulate loads through monitored network interfaces.

While we are on the subject of related SolarWinds software, the Real-Time Bandwidth Monitor is a “smaller sibling” to their enterprise Orion Network Performance Monitor (NPM) software. NPM is a one-stop solution for automatically discovering and monitoring interfaces in your LAN and WAN environments. You can download a free demo from SolarWinds if you are so interested.

Conclusion

In summary, the SolarWinds Real-Time Bandwidth Monitor gives us systems/network administrators the ability to visualize network bandwidth utilizations on our interfaces. This data is extremely important not only for troubleshooting speed and access problems, but also for application performance tuning and enhancing the overall health of our network. Please feel free to leave your questions in the comments portion of this post.

Real-Time Bandwidth Monitor

• Poll: Are you currently using a monitoring solution? (11)
• FREE: Zenmap: Windows GUI for nmap (0)
• SCOM 2012 review – Part 8: Dashboards (0)
• SCOM 2012 review – Part 7: Linux and JEE monitoring (4)
• Notifications and Custom Commands in Nagwin/Nrpe (0)

We already started to set up our 802.1x wireless network, by installing certificate services and enrolling our NPS server. We now have to configure our ‘Network Policy Server’. We can do this by opening the NPS frontend which you can find in the Administrative Tools folder.

The first thing to check is that NPS has been registered in Active Directory – right click the root NPS node and if it isn’t greyed out, click ‘Register server in Active Directory’. We can now start the NPS wizard, by clicking on the NPS root node, then from the main area, selecting ‘RADIUS Server for 802.1x wireless’ from the pulldown menu, then clicking the ‘configure 802.1x’ link below it.

Network Policy Server – RADIUS configuration

From the next window, we want to select wireless connections, and enter a descriptive name for the policies the wizard will create within NPS. Once we have entered this information, we need to set up a RADIUS client. All your access points will be RADIUS clients (provided that they support this). You will need to supply a friendly name (I used the access point’s hostname) and also its IP address.

Next, we have to supply a shared secret that is common for all access points and the NPS server. The main point is that users will never have to deal with the shared secret. On the first RADIUS client, you can use the ‘generate option’. Make sure to take a note of the generated key.

Generate the shared secret for NPS and RADIUs clients

On the next screen, we should choose MS Protected EAP (PEAP). The following screen in the wizard is of interest, as it will allow you to fine-tune who or what has access to your wireless network. I initially added ‘Domain Users’ and ‘Domain Computers’, however, this would allow employees to join untrusted devices onto our network by entering their AD username & password. In the end I opted for keeping ‘Domain Computers’ to ensure that all managed devices can connect. Then I created an Active Directory group ‘Allowed Wi-Fi users’, so IT can easily allow certain users access by adding them to an AD group.

The good thing about adding domain computers at this stage is that the wireless connection will be established before a user has logged on. This allows users who don’t have cached credentials to log on and you can manage a system remotely while it is sat at the login screen.

Once you have finished the wizard, you should restart the NPS server. NPS is now ready to start authenticating clients, so we move onto the configuration of our access points. Most access points are configured using a web based interface, as mentioned earlier. I’m using a Cisco WAP200. Once on the admin interface, I just navigated to the wireless security settings, selected WPA2-Enterprise, set the encryption to AES, entered the IP address of my RADIUS (NPS) server, and entered the shared secret that we made a note of earlier (You did take a note of it, didn’t you?)

Cisco WAP200 RADIUS configuration

At this point, clients should be ready to connect to the wireless network – I added my Active Directory user account to the ‘Allowed Wi-Fi users’ group and was then able to connect my iPhone after entering my Active Directory credentials and accepting the certificate we generated earlier.

When everything is working fine, I recommend deploying the settings to clients using Group Policy. You will find the required settings under Computer Settings > Windows settings > Security Settings > Wireless Network Policies. You can add additional access points to the RADIUS clients folder in the NPS frontend. Make sure to use the same shared secret as before.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)
• FREE: EMCO MAC Address Scanner (3)

Benefits of using 802.1x for Wi-Fi authentication

If you’re running Wi-Fi to provide access to you enterprise, you need to ensure that it is as secure as possible, and also keep access to the wireless network manageable. At home you probably use a pre shared key (PSK) to grant/restrict access to the wireless network, while this is fine for a network with only a handful of client devices, we need something a bit more durable in the enterprise – Imagine having to change the key on 100+ workstations when a disgruntled employee leaves your business! Using 802.1x / WPA2-Enterprise technology we can control access to our wireless network in a much more granular fashion, by selecting groups of users or computers from active directory that will be granted access – if a user’s AD account is disabled, so is their ability to access the wireless network. We can also use group policy to push out the Wi-Fi settings, completely centralising all aspects of you wireless network deployment.

Requirements

Before we get started, we will need a few bits and pieces:

• Windows 2008 domain
• Wireless access point (supporting RADIUS/WPA2-Enterprise) In my examples, I’ll be using a CISCO WAP200.
• Laptop with Wi-Fi that is an Active Directory domain member

Installing the NPS and Certificate Services

Firstly, we will need to add the following roles onto a server, or servers to the domain (if you’ve already got servers running these, you don’t need to add them again):

• Active Directory Certificate Services
• Network Policy and Access Services

You can add roles by opening up ‘Server Manager’, selecting ‘roles’, then clicking on ‘add roles’ and following the wizard. The Certificate Services setup will ask you a few questions, if it’s your first time using the Certificate Services role, you’ll just want to select Enterprise & Root CA.

Certificates snap-in

Certificate enrolment

Once we have installed the roles, we will need to enrol our NPS server for a certificate from the server that is running our Certificate Services (CS). To do this, from the server running NPS, we need the Certificates MMC snap-in (Run mmc.exe > file > Add/Remove snap-ins > Certificates) – make sure you set the snap-in to manage certificates for the computer account on the local system. Once the certificates MMC is loaded, we can enrol for a new certificate by right clicking on the Certificates\Personal\Certificates folder, then selecting ‘Request new certificate’ – all being well, we should be able to click next, then tick ‘Active Directory Enrolment’ – we should then see a certificate issued to the server running NPS, issued by our CS.

In part 2 we will continue with our 802.1x wireless setup, by configuring our NPS role and access points.

• Microsoft Exam 70-640 – Active Directory trusts – Sample question (0)
• Microsoft Exam 70-640 – Active Directory trusts (0)
• Microsoft Exam 70-640 – Active Directory Forests and Domains – Sample question (5)
• Microsoft Exam 70-640 – Active Directory Forests and Domains (0)
• How to synchronize Windows Server 2008 with an external time server (6)

Submitted by Ipswitch

Are you a network engineer who is looking for an always-on, service based tool to simplify and secure the transfer of system or configuration files across your network? The WhatsUp Gold free TFTP Server allows you to save time and effort while uploading and downloading files.

WhatsUP Gold free TFTP Server

Features

• Restrict client permissions to the server.
• Transfer and store IOS firmware configurations and images.
• Back-up and restore network device configuration files including Cisco IOS, Juniper, HP, 3Com.
• Supports file sizes up to 4 GB
• Runs as a Windows service, supporting 24×7 server availability
• Restrict TFTP server availability by subnet.
• Define a custom TFTP server root.
• Bind the TFTP server to a single IP address, or opt to bind it to all available addresses on the computer running the tool.

WhatsUp Gold TFTP Server

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: EMCO MAC Address Scanner (3)

Submitted by Igor Vinnykov

As is well known, a MAC address is a unique serial number that identifies the network card and distinguishes it from all others. While most network operations use an IP address to identify the target, some require a MAC address as well. For example, you need to know the MAC address of the remote PC if you need to turn it on remotely using the Wake-on-LAN technology. Under Windows, you can find out the computer MAC address by using the standard ipconfig utility, but it can only work on a local PC. To extract MAC addresses from remote computers, you have to use specialized network utilities and EMCO MAC Address Scanner is one of them.

EMCO MAC Address Scanner

EMCO MAC Address Scanner is a network application designed to extract MAC addresses from PCs located in a corporate network. It allows scanning the entire network and detecting MAC addresses for every discovered PC. Alternatively, you can scan selected workgroups or domains, a range of IP addresses or a particular PC only. Multiple scan operations are performed in parallel to reduce the time required to scan large networks.

During a network scan, the application detects PCs available within the selected workgroups, domains or IP range and tries to extract their MAC addresses. If an attempt to extract such an address fails, the application repeats the attempt using a different MAC detection mechanism. The current version uses the Neighbor Discovery, NetBIOS, WinAPI and WMI methods, and only if all of them fail, the application reports that the MAC address is not detected. Usually, it may happen if you don’t have an administrative access to the remote PC. In this case, you can find the respective error message in the application log and try to resolve the problem by specifying alternate credentials to be used to connect to a particular PC or a group of PCs.

Applying Alternate Credentials

When the network enumeration is complete, the application displays a list of scanned PCs with their MAC addresses. Those PCs that have not revealed their MAC addresses can be rescanned with one mouse click. Once you are satisfied with the result, you can export the collected information to an XML or a CSV file for future use as input for other tools such as the Wake-on-LAN utility, for example.

Export MAC addresses

EMCO MAC Address Scanner

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Some of you might remember Windows XP, one of the predecessors of Windows 7. One of the superior features of this popular operating system was the network icon in the systray. Contrary of Windows 7′s network icon it was able to display the network activity with two little blinking monitors representing inbound and outbound connections.

The main purpose of these monitors were to attract the user’s attention that a network connection was established. The older readers know that, in the good old Windows XP times, dialup connections were the common way to connect to the Internet, and Internet service providers charged by the hour. Computers nowadays are always online, so the blinking monitors have become somewhat obsolete, which is probably why Microsoft replaced them with an admittedly simple network icon.

But I really miss Windows XP’s network icon. The constantly blinking monitors gave me the feeling that my computer is a part of something bigger. The free Network Activity Indicator not only satisfies nostalgia needs, however. The tool can also display the currently used upload and download bandwidth. A single click on its systray icon reveals two graphs that represent upload and download speeds of the immediate past. And, like the Windows XP network icon, the Network Activity Indicator also displays the received and sent packets. However, it would be more useful if the tool showed the amount of transferred data in MB.

Nevertheless, those of you who are still claiming that Windows XP has superior features such as the blinking monitors have no more excuse to keep running an archaic operating system.

By the way, if you search the download link for Network Activity Indicator on its homepage, it is in the upper right corner.

Network Activity Indicator

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Analysts keep preaching the cloud gospel, and it appears that quite a few CIOs have become believers. What many underestimate is that the connection between earth and heaven, respectively the cloud, can sometimes get clogged when too many believers knock on heaven’s door because they all want "to be in" (as Steve Ballmer would express it).

So, before you leave the solid ground of your LAN to find blissfulness in higher spheres, you might want to simulate what happens when the network connection between your clients and the almighty cloud servers becomes slow. The free portable tool TMnetSim Network Simulator enables you to simulate a poor or slow network connection in your lab.

TMnetSim sits between the client and the server and allows only as much network quality as you admit. You can launch the tool either on the client or on the server. It is also possible to run the client and server on the same computer. The configuration for these scenarios is a bit different. The example below explains how you have to set up TMnetSim on the server if you want to test a slow RDP connection.

First, you have to tell TMnetSim to listen to a free TCP port on the server. I used 3390 for this example. Then, you have to configure the destination to which TMnetSim will forward the packets. Since the Remote Desktop Session Host is on the same machine as TMnetSim in this configuration, you can use 127.0.0.1 as the outbound IP address. The RDP port is 3389 by default, which is why you have to use this as the outbound port (see screenshot above).

To connect the RDP client to the RDS host, you can use the IP address of the server. But instead of connecting to the default RDP port 3389, you have to tell your RDP client to connect to port 3390 (see screenshot below) because this is the port where TMnetSim is waiting for packets to be forwarded to the RDS host.

TMnetSim supports two ways to simulate a bad network connection: You can configure the network latency (packet delay), or you can configure packet loss. For packet delays, you can choose between Fixed, Normal, Gaussian, and Markovian. A fixed packet delay gives you a general idea of how a slow network connection affects the performance of the application. But for a more realistic test, you should use one of the three other methods that work with a random network latency that is common in WANs.

The Markovian packet delay is the most realistic method. If you choose this method, you have to configure the Delay Base and the Jitter in milliseconds. The Jitter determines the maximum range the packet delay can vary. For instance, if you use a Delay Base of 1000ms and a Jitter of 200ms, TMnetSim will randomly choose a delay for each packet in the range from 900ms to 1100ms. More information about the different packet delay methods can be found in TMnetSim’s manual.

TMnetSim allows you to configure the network latency for the inbound and the outbound connection, but, to keep things simple, it is enough to use just one method. The configuration example above will let you experience a very jerky RDP connection. With a packet delay of 300ms, I could already feel the difference from a solid LAN connection.

Packet loss is quite common in WANs. TCP can compensate packet losses by retransmitting lost packets. However, this reduces the network’s throughput. Some higher protocols such as RDP have a low tolerance for packet loss. A loss rate of 3% in each direction can break an RDP connection.

After configuring the IP address, the ports, the network latency, and the packet loss, you have to click "Start" to make TMnetSim listen on the Inbound Connection port. As soon as the connection is established, the tool will display some useful data in the lower pane, such as the current packet delay, the bandwidth, or the lost packets. TMnetSim Network Simulator can also capture the packets and copy them to text files.

I tested TMnetSim Network Simulator 2.4.0.0 on Windows 7 and Windows Server 2008 R2.

Do you know of another good network simulator tool?

TMnetSim Network Simulator

(Search for TMnetSim on the page.)

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Dedicated Administrator Connection (DAC) in SQL Server 2008 R2 (3)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)

CommTest is a very simple program but is nevertheless quite useful if you want to test the network speed between two computers. All you have to do is start the tool on both machines and then establish a connection from one of the computers to the other by entering the IP address or the domain name. Make sure that no firewall is in the way or that port 65000 is open.

CommTest will then immediately start uploading and downloading data and test the network speed in KB/s. You can also see the bytes and packets that have been sent and received. The tool is supposed to be able to measure the latency, but that didn’t work when I tried it. This was probably due to the fact that I tested it in a virtual environment and so the latency might have been just too small to be measurable.

I tried CommTest 1.2 on Windows 7 and Windows Server 2008 R2.

If you just want to test the network speed to the Internet, then the online tool speedtest.net is the thing for you.

CommTest

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

The portable utility Wake-on-LAN Packet Sniffer is one of the simplest free tools I have ever tried. All you can do with it is launch it. And then you have to wait. You wait for Magic Packets. Magic Packets are shy creatures, but sometimes you can catch them if you boot up early.

What I mean is, if a PC doesn’t wake up even though you have bombarded the machine with Wake-on-LAN Magic Packet frames, you can boot up the machine manually, launch the Wake-on-LAN Packet Sniffer, and see if the Magic Packets really arrive at the NIC of this PC.

Usually, Wake-on-LAN tools work reliably in LANs. Problems often come up if you want to send Magic Packets across routers. This only works if the routers in your organizations are configured to forward broadcasts containing Magic Packets. Another cause of error can be the NIC, which is either not configured to accept Magic Packets or simply doesn’t support Wake-on-LAN.

These last two errors can’t be ruled out with the Wake-on-LAN Packet Sniffer because you have to use the tool when the PC is already fully awake. Hence, Wake-on-LAN Packet Sniffer also works on boards that don’t support Wake-on-LAN.

In the screenshot, you can see that the tool can even create pictures of these shy creatures. As I explained in my article about the free SolarWinds Wake-on-LAN tool, Magic Packets consist of six bytes of 255 (hex FF) followed by sixteen repetitions of the target computer’s MAC address.

I have tried Wake-on-LAN Packet Sniffer 1.1 on Windows 7 and used the Wake-on-LAN Packet sender of the same vendor (Power Management Software). The ultimate free Wake-on-LAN utility certainly is EMCO WakeOnLan.

Wake-on-LAN Packet Sniffer

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Submited by Stephen Schimmel

Network Infrastructure Change Reporter is a network device discovery and auditing tool, which is very similar to all other NetWrix Change Reporter products (offered standalone or as a part of NetWrix Change Reporter Suite). This product scans specified IP ranges for network devices, discovers new devices, reports disappeared devices, and more importantly audits network devices for configuration changes, such as changes in device parameters, routing tables, permissions, firewall rules and everything else exposed through SNMP protocol and device-specific MIB files.

The idea is very simple—it just looks at the available MIB files (many of them are included in the product installation and you can also import MIB files specific to your devices) and polls the managed devices periodically (once a day by default) to see what settings have changed and reports the changes detected since the last scan. The tool is invaluable in diagnosing device issues caused by recent changes (e.g. if you colleague changed something important and forgot to tell this to others – by this Change Reporter will tell you that next morning). It’s also great for automatic documentation of network changes and can be used to perform security and compliance audits.

The reports are sent automatically by e-mail to specified recipients. You can customize the reports by including or excluding certain types of changes (e.g. exclude some config settings that change too frequently and have no relevance to you).

As is the case with most NetWrix products, this product is available in both freeware and commercial editions. The free version only supports audit archiving and reporting for two days (today and yesterday).

Network Infrastructure Change Reporter

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

I am quite aware of the fact that running such a poll on 4sysops won’t reveal representative data. It is not just that I hope I have whetted your appetite for IPv6 with my IPv6 tutorial. It is no secret that some regions, most prominently the emerging markets in Asia, have a bigger interest in deploying IPv6 than do the countries in the west that won’t really suffer from the fact that all IPv4 addresses have been taken. And according to the statistics of my web analysis tool, mostly westerners enjoy reading 4sysops.

You know, about two years ago I recommended to disable IPv6 in your organization mostly for security reasons and for reducing complexity. If you followed my advice, you probably didn’t miss anything since then. IPv6 still plays no significant role on the Internet and in corporate networks.

It is hard to tell what the next two years will bring. As I’ve said before, the fact that more and more mobile phones, tablets, e-book devices, TV sets, etc. require IP addresses could make the introduction of IPv6 interesting also for countries in the west. The sheer number of new Internet devices could mean that NAT (Network Address Translation) will reach its limits earlier than many expect.

One thing is for sure, though—IPv6 won’t come gradually; it will come overnight. It is always like this with these new technologies. Do you remember how IPv4 came to your organization? The Internet technology has been available for decades before suddenly everyone wanted to be connected as fast as possible. I think CompuServe was the first big online service that got connected to the Internet. After that, the other online services didn’t want to fall behind and so within a relatively short time period everyone wanted to be “in,” as Steve Ballmer would express it today.

I think, it will be the same way with IPv6. Who knows, maybe the iPhone 6 will be the first IPv6-only device, and Steve Jobs will once again be the man who made it all possible. The question will be how fast your organization can make the transition from IPv4 to IPv6. This is certainly nothing that can be done on the fly. Thus it might make sense to get ready for the big change before there is a real need for it.

On the other hand, you might just wasting resources if you deploy a technology that increases costs, but not productivity, in your company. If you deployed IPv6 two years ago, as some IPv6 enthusiasts recommended, you most likely did it just for the fun of it. So what will you do?

Note: There is a poll embedded within this post, please visit the site to participate in this post's poll.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Last time, I talked about zone IDs and unique local IPv6 unicast addresses. Today, I will introduce some special addresses. In practice, usually only the networking guys really have to deal with these addresses. But as a Windows admin, you should have at least heard of the terms.

Unspecified address

The IPv6 unspecified address is specified as “0:0:0:0:0:0:0:0″ (or “::” if you have a sense for mathematical beauty). I think, this naming convention is somewhat funny. It reminds me of the “unspeakable word.” But there is also some sense in this because applications use the unspecified address as a variable for, well, an unspecified address. I guess, you won’t see this address often, just like you didn’t have many encounters with the unspecified IPv4 address 0.0.0.0. Note that you can’t assign this address to an interface, which also makes sense because then you would specify it, which is strictly forbidden.

Loopback address

The IPv6 loopback address is almost as beautiful as the unspecified address: ::1. The loopback address for IPv4 127.0.0.1 is comparably ugly and, like its predecessor, is assigned to every host interface and used by applications to communicate with local services via TCP/IP. Packets addressed to the loopback interface must never leave the host.

IPv4-mapped address

Like the loopback address, IPv4-mapped addresses are only used for internal representation on a host. They allow developers to use one API for both IPv4 and IPv6 calls. The syntax of IPv4-mapped addresses looks like this: :FFFF:w.x.y.z, where “w.x.y.z” is the IPv4 address that is represented in the IPv6 address.

6to4 addresses

6to4 is a tunneling technique that allows two IPv6 cable systems to communicate over an IPv4 network (usually the Internet). For this, at least one of the IPv6 systems needs an IPv4 address and a special IPv6 address, the so-called 6to4 address. A computer that has a 6to4 address is called “6to4 host.” This transition technology will mostly likely be used by computers in IPv4 networks to reach IPv6-only hosts. Essentially, the 6to4 address makes the 6to4 host appear on the “IPv6 landscape” even if it is not directly reachable through IPv6 by encapsulating IPv6 packets in IPv4 packets. The IPv4 packets are converted to IPv6 packets and vice versa by a 6to4 gateway. 6to4 addresses have the prefix 2002::/16. The next 32 bits are the IPv4 address of the 6to4 host converted into hex. Since a 6to4 address can only be created by using a unique public IPv4 address, the correspondingIPv6 address is also unique. The last 80 bits are for the local network and the host.

IPv6 multicast addresses

Like in IPv4, IPv6 multicast addresses are used to send the same data to multiple hosts simultaneously. Since multicast-capable software, such as OS imaging tools, typically do all the IP configuration, Windows admins usually are not bothered with the networking details. But if you ever stumble across an IPv6 address that begins with FF, you know what you are dealing with.

Solicited-node address

A special type of multicast address are the solicited-node addresses, which have the prefix FF02::1:FF00:0/104. Solicited-node addresses are used for neighbor discovery, which I already discussed in my article about the new IPv6 features. If a host needs to know the MAC address that belongs to a certain IP address, it won’t use an ARP broadcast like in IPv4. Instead, it would use multicast to contact only those hosts that listen to the solicited-node addresses where the last 24 bits are identical to the ones in the IP address that has to be resolved.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

In the last post of this IPv6 tutorial, I introduced link-local and site-local IPv6 addresses. The problem with local-use unicast addresses is that they are not unique because they can be reused. Everything is fine as long as duplicate addresses are in networks of different organizations (sites). However, within in an organization, local-use addresses can also be assigned multiple times.

IPv6 zone ID

The purpose of zone IDs is to distinguish these addresses. For instance, if host A has two NICs that are connected to two different links (subnets), the same local-link address could have been used for NIC 1 on host A and on host B that is on the link of host A’s NIC 2. To distinguish this ambiguous link-local address, host A uses the interface index of NIC 1 as the zone ID for the local IP address.

For site-local addresses, the operating system uses the site ID (also called the scope ID). If a host is only connected to one site, this ID is always 1.

You can display the interface indexes on a host with the command “netsh interface ipv6 show address level=verbose”. If you launch the ipconfig command, you can see the local-link and site-local addresses with their zone IDs. The syntax for identifying the zone is address%zone_ID. This is an example of a link-local IP address with zone ID 11: fe80::bd0f:a8bc:6480:238b%11.

Note that the zone ID is only known at the local host that assigned it. I think in practice you will seldom be bothered with zone IDs as you don’t have to configure them manually.

Unique local IPv6 unicast address

Even with the use of zone IDs, you should probably avoid having ambiguous IP addresses in your network. Instead of site-local addresses, you can work with unique local IPv6 unicast addresses. These local-use addresses are also not routed across the Internet; however, like global IPv6 addresses, they are unique. Well, more or less, as you will soon see.

The prefix of unique local IPv6 unicast addresses is FC00::/7. The eighth bit is the Local flag and is set to 1 for local addresses. A Local flag with 0 has not yet been defined. Perhaps this could be a way to make local IPv6 addresses global? Anyway, until IPv6, creators have made up their mind, the prefix of unique local IPv6 unicast addresses is FD00::/8. Don’t worry if you don’t really understand this; all you really have to know about unique local IPv6 unicast addresses is this:

The next 40 bits are for the global ID and are randomly set. The following 16 bits are the subnet ID, which you can use for hierarchical addresses within your organization. As usual, the last 64 bits are the interface ID.

The trick with the random global ID is that it makes it somewhat unlikely for duplicate local addresses to occur on a site or even in the networks of two merging organizations. Actually, the probability that two organizations use the same global ID for their unique local IPv6 addresses is 1/2⁴⁰=9.1 10^-13. Winning the Lotto jackpot is a few magnitudes more likely. However, what the IPv6 creators didn’t take into account is that Murphy’s Law rules in all networks. Hence, “relatively unique local IPv6 unicast addresses” would probably have been a better name.

In the next post in this IPv6 tutorial, I will discuss the special IPv6 addresses: unspecified address, IPv4-mapped address, 6to4 addresses, IPv6 multicast address, and solicited-node address.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

In the last post of this IPv6 tutorial, you learned about the different address types and the new public IP addresses, the global unicast addresses. Today I will introduce the so-called local-use, unicast addresses, which are those IPv6 addresses that are not routed across the public Internet. There are two types of local-use, unicast addresses: site-local addresses and link-local addresses.

Site-local addresses

Site-local addresses are equivalent to private IP addresses in IPv4. The address space reserved for these addresses, which are only routed within an organization and not on the public Internet, is 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. In IPv6, the first 10 bits of a site-local address are set to 1111111011, which is why these addresses always begin with FEC0. The following 54 bits are the subnet ID, which you can use in your organization for hierarchical routing, and the last 64 bits are the interface ID, which is the part that has to be unique on a link (local network on which hosts communicate without intervening routers). Thus, the prefix of a site-local address is FEC0::/10.

Note:  Site-local addresses have been deprecated, but existing implementations can still continue use them. Thus, they will probably stay around for a while. The proper way to work with private addresses in IPv6 is the use of unique local addresses which I will discuss in my next post.

Link-local addresses

From IPv4, you might know APIPA (Automatic Private IP Addressing) or AutoNet. Whenever automatic IP configuration through DHCP fails, Windows automatically assigns an autoconfiguration address in the range 169.254.0.1 to 169.254.255.254, which allows the computer to communicate with other machines on the link. In IPv6, link-local addresses always begin with 1111111010 (FE80).

Unlike site-local addresses, link-local addresses are never forwarded by routers and therefore can only be reached on the link. This is the reason why the next 54 bits are set to 0. The last 64 bits are set randomly by the operating system.

There is an important difference between IPv6 link-local addresses and IPv4 APIPA addresses. Once a PC receives an IPv4 address from a DHCP server, the APIPA address is no longer reachable. However, with IPv6, a network interface always has a link-local address even if you assign another IPv6 address manually or if the NIC receives an IPv6 address from a DHCP server. This means that computers on a link can always communicate through IPv6 using link-local addresses, which is not the case in IPv4 because APIPA addresses are not in the same subnet as private or public IPv4 addresses. Thus, if the local DHCP is unavailable, the computers can still access local services through IPv6 but won’t be able to reach the Internet or services in other links.

In the next post of this IPv6 tutorial, I will talk a little about the zone ID and unique local IPv6 unicast addresses.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

In my last post in the IPv6 series, you learned the IPv6 address syntax. Today, I will introduce the different types of IPv6 addresses.

IPv6 address types

There are three general types of IPv6 addresses: unicast, multicast, and anycast.

Unicast addresses

You know unicast addresses from IPv4. A unicast address is the most common form of an IP address and is assigned to one network interface.

Multicast addresses

Multicast addresses are also known in IPv4. These addresses identify multiple network interfaces / hosts. A typical use of multicast addresses in a Windows environment is the deployment of OS images to multiple hosts, simultaneously.

Anycast addresses

This is a new address type in IPv6. Like a multicast address, an anycast address identifies multiple interfaces; however, while multicast packets are accepted by multiple machines, anycast packets are delivered only to one interface (host). This address type allows for services that are provided by multiple servers where only one server has to respond. In routing, anycast addresses are used to route packets to the closest routers.

And what about broadcast addresses? They no longer exist in IPv6. Broadcasts are replaced by multicast messages. I will say something about this IPv6 technique in a later post.

IPv6 knows five different unicast address types: global unicast addresses, link-local addresses, site-local addresses, unique local IPv6 unicast addresses, and special addresses.

Global unicast addresses

A global unicast address is simply what we call a public IP address in IPv4—that is, an IP address that is routed across the whole Internet. You can make out a global unicast address easily: The first three bits are set to 001. Thus, the address prefix of a global IPv6 address is 2000::/3 because 0010000000000000 is 2000 in hex. However, in the future, the IANA (Internet Assigned Numbers Authority) might delegate currently unassigned portions of the IPv6 address space. Hence, 2000::/3 won’t always be the prefix for global unicast addresses.

(Note: The diagram is from Microsoft’s “Introduction to IP Version 6.”)

The next 45 bits are the so-called global routing prefix. This is the part that is assigned to organizations. The following 16 bits are for the subnet ID, which you can use for hierarchical addressing in your network. The last 64 bits indicate the interface ID, which is the part of the IPv6 address that must be unique within a subnet. You know what this means, right? You can have 65,536 (=2¹⁶subnets), and each subnet can have 18446744073709551616 (=2⁶⁴) computers. I hope you have an efficient OS deployment tool.

In my next post, I will cover the site-local addresses and link-local address.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Now that you know about the new features of IPv6, it is time to have a closer look at the practical details. In this post, I will give a short summary about the IPv6 address syntax. It is essentially a condensed version of the corresponding part in Microsoft’s white paper “Introduction to IP Version 6.”

Colon-hexadecimal representation

An IPv6 address consists of 128 bits and is presented in eight 16-bit blocks. Each 16-bit block is converted to a four-digit hexadecimal number. Blocks are separated by colons.

Example: 2001:0DB8:0000:2F3B:02AA:00FF:FE28:9C5A

Leading zero suppression

Because IPv6 addresses are quite long, the leading zeroes within a 16-bit block can be removed, but each block must have at least a single digit.

Example: 2001:DB8:0:2F3B:2AA:FF:FE28:9C5A

Zero compression

A contiguous sequence of 16-bit blocks set to 0 can be replaced with the so-called double colon (::). Zero compression can only be applied once in an IP address. To determine how many blocks have been omitted, you just have to count the remaining blocks and subtract this number from 8.

Example: FE80:0:0:0:2AA:FF:FE9A:4CA2 can be zero compressed to FE80::2AA:FF:FE9A:4CA2.

IPv6 prefix

IPv6 prefixes are used to express IPv6 subnets, routes, and address ranges. The syntax of IPv6 prefixes looks like this: address/prefix-length. It is comparable to the Classless Inter-Domain Routing (CIDR) notation for IPv4 (for instance, 192.168.0.0/16 represents a Class B subnet): Subnet masks are no longer used in IPv6.

Example: 21DA:D3:0:2F3B::/64 represents a subnet of 2⁶⁴ addresses, where the first 64 bits are fixed and the last 64 bits are variable.

Admittedly, IPv6 addresses look somewhat complicated compared to the relatively simple IPv4 addresses. Rest assured that typos in IPv6 addresses will knock down quite a few systems once IPv6 starts replacing IPv4. But this is the price of the large address space. I guess, we will get used to it. In my next post, I will discuss the different types of IPv6 addresses. I promise that things won’t get easier.

In the next post of this tutorial I will say some general words about the IPv6 address types and I will introduce the most address type, the global IPv6 unicast address.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

Submitted by Igor Vinnykov

If you’ve ever tried to use Wake-on-LAN technology, you may know that its configuration can be confusing sometimes. You have to enable WOL in BIOS and motherboard settings and correctly specify the WOL command parameters. Wake-on-LAN utilities (see a review for one of them) usually allow waking up one remote PC and require that you specify its IP and MAC addresses in order to generate and send a magic packet to it. In order to wake up multiple PCs, you have to write scripts to detect MAC addresses of remote PCs and execute a WOL utility to send the magic packet to every PC. A free Wake-on-LAN tool from EMCO is specially designed to wake up multiple remote PCs and allows automating all required operations.

Free Wake On LAN utility – EMCO WakeOnLAN FREE

Automated Wake-on-LAN

By using EMCO WakeOnLan Free, it’s really easy to wake up remote PCs, because all the configuration steps that you have to perform manually when using other utilities are automated here. In order to initiate Wake-on-LAN, you only have to select target PCs and press one button to start the operation. The application has an automatic network scanning feature that allows detecting PCs available in the Active Directory and workgroups and selecting them as targets for the Wake-On-LAN operation. All detected PCs are displayed in the visual interface according to the network structure, including groups and organization units, so that you can save time by selecting an organization unit node in the domain as a Wake-On-LAN target if you need to wake up all PCs in this unit. You can also create custom grouping for the PCs which should be turned on simultaneously.

Automatic MAC addresses detection

Another time-saving advantage of the EMCO WakeOnLan Free is an automatic MAC addresses detection. During a network scan, the application tries to retrieve MAC addresses for every detected PC sequentially applying four different methods until the MAC address is retrieved. In case of failure (for example, due to insufficient permissions on a remote PC), you can find the error message and troubleshooting instructions in the Application log and try to repeat retrieving the MAC address after following the suggested troubleshooting steps. Such automatic detection of MAC addresses for remote PCs can save you a lot of time and simplify your WOL configuration if you need to wake up remote PCs in a large network.

Wake-On-LAN for large networks

EMCO WakeOnLan Free was designed to be used in large corporate networks that may include different subnets. In such networks, both the network hardware and the Wake-on-LAN utility should be configured properly to guarantee WOL packets delivery. EMCO WakeOnLan Free provides different options for transmitting WOL packets, which include unicast and directed broadcast methods. You can select the appropriate method depending on your network configuration. Also, there is another option that can be extremely helpful for large networks. By default, the application is set to send Wake-On-LAN packets to multiple PCs in parallel to reduce the time required to wake them up. However, if multiple PCs are started simultaneously, it can cause a power peak. To prevent it, you can configure the application to limit the number of WOL packets sent per second.

If you are looking for a way to fully automate the wake-up tasks across the organization, the Professional version of EMCO WakeOnLan is the right choice allowing you to schedule WOL tasks and execute them automatically on a defined date and time.

EMCO WakeOnLan Free

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

There are so many good free packet sniffers. Most noteworthy are Network Monitor, Wireshark , and SmartSniff. IPMon is a much simpler tool. Although it does not even allow you to view the payload of IP packets, this free IP monitoring tool can be useful in situations where a full-blown packet sniffer would be overkill.

IPMon, which belongs to the NT Toolkit suite, is available as a command line utility and GUI tool (IPMon+) for Windows, Linux, FreeBSD, and OS X. The utility monitors all IP traffic on local network interfaces.

What I like is that repetitive traffic is grouped. Thus if a remote computer connects to multiple ports on the local host, IPMon only displays it as one connection. In a way, the tool works like netstat and similar tools. The main difference is that IPMon works with the WinpCap driver, so it will see packets even if they are blocked by the firewall. It operates on a lower level and as such is more accurate. Another advantage is that you get a timestamp for each connection. This can be quite helpful for troubleshooting client-server communication where you only want to know if certain connections are established or not when you perform certain actions.

IPMon+ displays the protocol (TCP, UDP, ICMP, ARP), the source and destination IP, the source and destination ports, and the transmitted bytes. You can filter the ports according to protocols and ports. Also useful is that you can copy / paste from the output (e.g. into Excel) as well as sort output by clicking on columns.

Note that IPMon requires the WinPcap network driver on Windows. All the other operating systems usually already include the pcap libraries.

IPMon

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)

In the last post of this series, I discussed the new IPv6 features Quality of Service (QoS), hierarchical addressing, and the new address space. In this post, I talk about some of the new IPv6 features that are most relevant for Windows admins.

Mandatory IPsec support

The IPv6 specification mandates support for IPsec (Internet Protocol security). IPv6 supporters often claim that this will improve overall security on the Internet. Since IPsec for IPv4 is optional, proprietary VPN solutions are ubiquitous. However, I believe, the main reason why IPsec deployments are rare is because configuration is relatively complicated. Thus, I doubt somehow that we will see significantly more IPsec deployments because of IPv6.

But what is most disappointing for me is that IPv6 doesn’t encrypt all kinds of IP traffic. While IPsec implementation is mandatory for IPv6, IPsec deployment is not. Besides, IPsec is essentially a solution for securing connections among sites; it is not a P2P encryption solution.

In my view, it is unbelievable that we are now introducing a new network protocol with a huge amount of effort but will still send data in clear text across the Internet. The inventors of IPv4 couldn’t foresee that secure data transmission would be an issue since their protocol was just intended to allow data transfers between educational institutions. No one really could imagine that the whole planet will use this form of communication in the future.

The IPv6 creators had the chance to correct this shortcoming of the Internet protocol and ensure that any kind of network traffic is encrypted by default. It is really a pity that they didn’t use this once-in-a-lifetime chance.

(Simplified) automatic address assignment

This is perhaps one of the features that will affect the work of Windows admins the most. Much of the documentation talks of “simplified” address assignment, but I somehow think this new feature will cause confusion among admins in the beginning. In an IPv4 network, a computer’s automatic address assignment means that a DHCP server is involved.

IPv6 still knows DHCP-based address assignment (also called stateful address configuration), but now hosts can also configure themselves with IPv6 addresses (stateless address configuration). There are two types of stateless configurations. Hosts can derive an IP address from a prefix (the first part of an IPv6 address that belongs to your organization) advertised by a local router, and they can assign themselves so-called link-local addresses (addresses that are not routed), which they can use to communicate with other nodes on the link (local network). Scary, isn’t it?

Neighbor discovery

The Internet Control Message Protocol for IPv6 (ICMPv6) will replace the Address Resolution Protocol (ARP). You probably know that ARP is used to determine the link layer address (MAC address in the case of Ethernet) from the IP address. The main problem of ARP is that it uses broadcasts, which disturbs all hosts on the link (LAN). By contrast, IPv6 uses Neighbor Solicitation multicast messages for neighbor discovery. Instead of sending a broadcast message to all nodes on the link, only the so-called solicited node multicast IPv6 address is contacted. The first 104 bits of the solicited node multicast are fixed (FF02::1:FF00:0/104), and the last 24 bits are equivalent to the last 24 bits of the IP address that has to be resolved. Since only nodes that share the last 24 bits in their IP address will listen to the solicited node address, fewer hosts are disturbed.

Extensibility

This is my favorite new IPv6 feature. While the IPv4 header only supports 40 bytes for options, the size of the IPv6 extensions is only constrained by the size of the IPv6 packet. IPv6 supports multiple so-called extensions headers that can be added after the IPv6 header. These extensions headers have no maximum size, which makes future enhancements of the protocol quite flexible. My hope is that this feature will be used for mandatory encryption of all IP packets.

Next, I will introduce the IPv6 address syntax.

• FREE: Zenmap: Windows GUI for nmap (0)
• FREE: SolarWinds Real-Time Bandwidth Monitor (0)
• Set up a 802.1x in a Active Directory domain – Part 2 (5)
• Set up an 802.1x Wi-Fi network in a Windows Active Directory domain – Part 1 (0)
• FREE: WhatsUp Gold TFTP Server (0)