\chapter{Network management}
\label{ch:network}

This chapter discusses network management. Section~\ref{sec:configuration} describes network configuration management. Section~\ref{sec:performance} studies performance management such as performance metrics, management control, and analysis. Section~\ref{sec:security} describes protocols and programs developed to provide security over the Internet, and network elements used to secure risky areas of networks. Section~\ref{sec:fault} studies fault management, including troubleshooting, fault localization, and testing methods.


\section{Configuration management}
\label{sec:configuration}

Configuration management means initializing and shutting down parts of a network (for example routers, hubs, and repeaters) and reporting the changes. It is also concerned with maintaining, adding and updating the relationships among components and the status of components during network operation. Network traffic patterns and identified bottlenecks that reduce performance must be understood. Nowadays modern components and subsystems can be configured to support many different applications. The same device can be configured to act either as a router or as an end system node or both. When it is decided how a device is to be used, the appropriate software and a set of attributes and values are chosen for that device~\cite[page 481]{b32}. Reconfiguration may be necessary in case of fault isolation or when the network is expanded.

As the network scales up in physical size (capability and complexity), also the management capabilities must be enlarged. The aim is that these actions could be automated. It should also be possible to make on-line changes without affecting the entire element or network~\cite{b24}. Large-scale network management systems must be constructed to support diverse network elements. They must also be extensible and flexible enough to support new elements and the rapid deployment of new highly customized services.

Activities in network management can be divided into three groups~\cite{b10}:
\begin{itemize}
\item Activities, that do not affect the function of an element, 
\item Activities, that affect the function of an element (for example switching off an element in a subnetwork), and 
\item Activities, that make elements to desired activities (for example restarting an element).  
\end{itemize}

Dynamic updating of configuration needs to be done periodically to ensure that the existing configuration is known. This is essential for fault management as well.

Configuration management tools have reporting components. When network configuration changes, users must be informed about new network elements and resources. Configuration management is well organized when all the gathered information and operations are in statistical form.

There is a risk of spending money on hardware and services that remain underutilized. On the other hand the risk of underprovisioning is that there is loss of productivity which reflects to the service level~\cite{b4}. When the network is designed, it is essential to predict the growth of the network. The network should also be prepared to varying volumes of users.

By continuously addressing the cost of maintenance (Mean Time Between Failure (MTBF) and Mean Time To Repair (MTTR) statistics, costs associated with maintaining) the network as a system can be tuned~\cite{b27}.


\subsection{TCP/IP networks}

TCP/IP networks cause more work for system administrators than other networking systems. Administrators have to manually configure each computer for network use when it is added to the network, or when it is moved from one subnet to another. Each computer must manually be assigned a unique IP address and various configuration parameters must be set.

There is a need for tools that automatically assign addresses and set configuration parameters. Some client/server solutions are already available. Client machines find the details of other hosts on the network using the Domain Naming Systems (DNS) protocols, and can be told their network configuration using Bootstrap (BOOTP) protocol. Static allocation of IP addresses to particular machines can be chosen over dynamic allocation using the Dynamic Host Configuration
Protocol (DHCP)~\cite{rfc2132}.


\section{Performance management}
\label{sec:performance}

Performance management is used to evaluate the behavior of managed objects and the efficiency of communications activities. Performance management collects statistical data, analyzes it, and where appropriate predicts trends in the communication between open systems~\cite{b42}. A network management system must be able to provide reports on the efficiency of the system and its current and previous performance. For documentation, reports on a daily, monthly or annual basis are required. Performance management also collects quality of service (QoS) related data, in order to improve QoS.


\subsection{Performance metrics}

Generally, network performance metrics are classified into two areas: network-centric metrics and end-to-end measurements.

Network-centric metrics are
\begin{itemize}
\item Robustness of the network elements. These metrics are important in designing components of the network, and in tracking the long-term robustness of the network.
\textit{Uptime}
\textit{Mean-time-between-failures (MTBF)}
\textit{Mean-time-to-repair (MTTR), etc.}
\item Router and switch metrics. These metrics deals with operations of routers and switches; queuing packets, processing them, and placing them on the appropriate outbound link queue.
\textit{Offered load}
\textit{Dropped traffic and retransmissions}
\textit{Average queue lengths (to assess the queuing delays and potential dropped packets at a router).}
\item Link metrics. These metrics describe the network capacity.
\textit{Bandwidth}
\textit{Utilization, etc.}
\item Metrics for the routing sub-system. These metrics describe the impact of the routing traffic and fluctuations on the network performance.
\textit{The rate of route change (characterizes the stability of the network system)}
\end{itemize}

End-to-end metrics are
\begin{itemize}
\item End-to-end latency and jitter
\item Effective throughput, usually measured as a function of the packet size and the window size
\item Packet loss
\end{itemize}

In general, network service providers are interested in the network-centric metrics in providing the best possible service. Application developers and users, however, are generally more concerned about the performance of their specific application over the network, rather than the aggregate performance characteristics. The tools and techniques required to measure performance characteristics in these two categories are different. In the Internet performance analysis it has been difficult to define metrics, that reflect both perspectives~\cite{b43}.


\subsection{Performance management control}

Performance management control is responsible for controlling the performance of a network. It includes such areas as, network traffic management policy, traffic control, traffic administration, performance administration, execution of traffic control, and audit reporting~\cite[page 56]{b34}.

The traffic control needs resources. Usually a separate control station is needed to collect and analyze traffic statistics. There should be a method to link a control station so that the traffic information is collected from the network. Controlling the traffic is, however, a reliable and cost effective method to find out problems before they exist. Traffic controlling can be limited to the most important parts of the network~\cite{b2}.

Performance management is also related to the configuration management. It is easier for the operator to plan modifications of the network, when the use of the network is known. Operator finds out which connections and services are used and which are needed.


\subsection{Analysis}

Performance analysis is involved in the analysis of performance data of an entity~\cite[page 56]{b34}. Analysis becomes more important, when the networks increase in size and in complexity. Analyzers are used for traffic monitoring, protocol analysis and statistics collection and interpretation. Analyzers are understood as troubleshooting tools, but they should be used as proactive indicators as well.

The tools available today gather and display volumes of detailed data rather than interpret and highlight the meaning of the data. Many of these tools also look at a single element rather than the network as a whole. Data becomes information when it is organized, correlated and presented in ways that make clear its meaning, helping the network manager make the best decisions~\cite{b16}. The network management problem thus becomes an information management problem. It is important to analyze the network up to date. Managers must also predict future trends based on historical network trends and business information.

Until the introduction of expert systems, alarms and events were checked manually by the operators. Now expert systems are tested in the automation of this process. There are several artificial techniques that can be used, such as Rule-Based Reasoning (RBR), Bayesian Networks (BN), Neural Networks (NN), Case-Based Reasoning (CBR), Qualitative Reasoning (QR) and Model-Based Reasoning (MBR)~\cite{b1}.


\section{Security management}
\label{sec:security}

Security management covers such areas as detecting, tracking and reporting security violations, and creating, deleting and maintaining security-related services such as encryption, key management, and access control. Distributing passwords and secret keys to bring up systems is also a function of security management~\cite[page 12]{b34}.

As computer-based communications and networks that link open systems continue to expand, security management becomes critical. Nevertheless, standardization of security properties has developed slowly. Network management must provide proactive management of security and integrate it with protocols, such as IPSec and services, like VPNs. Security of devices and networks must be compared to possible threats and risks. If the risks are high, the devices and the networks must be provided with more reliable secure properties.


\subsection{Protocols and programs for network security}

Table~\ref{tab:protocolsandprograms} describes protocols and programs, that are developed to provide security over the Internet. Secure-HTTP (S-HTTP) is an application-level protocol that provides security services across the Internet. It provides confidentiality, authenticity, integrity, and non-repudiability. S-HTTP is limited to the specific software that is implementing it, and it encrypts each message individually~\cite{b30}.

\begin{table}[htb]
\begin{tabular}{|c|c|}\hline
\textbf{Level}			& 	\textbf{Protection Used}\\\hline
Application-level 		&	 S-HTTP, SSH, stelnet, S/MIME\\\hline
Transport-level (TCP, UDP) 	& 	SSL, PCT\\\hline
Network-level (IP) 		& 	IPSec\\\hline
\end{tabular}
\caption{Protocols and programs developed to provide security over the Internet}
\label{tab:protocolsandprograms}
\end{table}

Secure Shell (SSH) and Secure telnet (stelnet) are programs that allow you to log in to remote systems and using an encrypted connection. SSH uses public-key cryptography to encrypt communications between two hosts, as well as for user authentication.

Secure Multipurpose Internet Mail Extension (S/MIME) is an encryption standard used to encrypt electronic mail, or other types of messages on the Internet. It is an open standard developed by RSA Data Security Inc.

Secure Socket Layer (SSL) is an encryption method developed by Netscape to provide security over the Internet. SSL is a protocol layer that is located between the network layer and applications, so that, in theory, it can be used with any application. However, it is vulnerable to poor application design. It provides data encryption, server authentication, message integrity, and optional client
authentication for a TCP/IP connection~\cite{b30}.

The Private Communication Technology (PCT) protocol is developed by the Microsoft Company to be used mainly in their Internet Explorer browser.

IP Security Architecture (IPSec) provides a standard security mechanism and services to the currently used IP version 4 (IPv4) and to the new IP version 6 (IPv6). IPSec is less dependent of individual applications than SSL. It provides IP-level encryption by specifying two standard headers: IP Authentication Header (AH) and IP Encapsulating Security Payload (ESP). IP Authentication Header provides strong integrity and authentication. It computes a cryptographic authentication function over the IP datagram and uses a secret authentication key in the computation. IP Encapsulating Security Payload provides integrity and confidentiality for IP datagrams. It encrypts the data to be protected and places it in the data portion of the IP Encapsulating Security Payload.  However, these mechanisms do not provide security against traffic analysis.  Any specific protocol for key management is not provided by the architecture, only requirements for such systems to be used in conjunction are described~\cite{b35}.


\subsection{Access control tools}
\label{subsec:accesscontroltools}

Hubs, routers and firewalls can be used to limit the access to the networks or the parts of the networks.

\textbf{Hubs} used in LANs are provided with simple security properties. Hubs protect sensitive data on the network by checking destination addresses on each packet and sending readable packets only to authorized nodes. Hubs automatically detect and/or disable unauthorized log-on attempts and record the events at the management station. Hubs also track changes involving users and devices on the network, giving the manager a complete record. These security level operations can be restricted to a date or a time period.

\textbf{Routers} are provided with security properties as well. A router handles packets up through the IP layer. The router forwards each packet based on the packet's destination address, and the route to that destination is indicated in the routing table~\cite{b33}. Routers can improve network security, but also introduce new problems: Routing protocols are susceptible to security attacks, and routing mistakes may allow the entrance of unauthorized personnel into the network. Unlicensed remote and local operations of routers must be prevented by using usernames.

Traffic can be controlled with packet filtration based on the access control lists. On the access control lists it is defined what addresses and protocols to each interface can be routed. Properties such as network address translation (NAT), port address translation (PAT), and logging of events and alerts can be attached to the router. However, it has not been possible to expand the capacity of traditional routers as cost-effectively as the capacity of PC workstations or the network traffic volume~\cite{b12}.

\textbf{Firewall systems} control connections between closed networks and outside world. There are two major approaches used to build firewalls: packet filtering and proxy services. Packet filtering systems route packets between internal and external hosts, but they do it selectively. They allow or block certain types of packets in a way that reflects a site's own security policy. The type of router used in a packet filtering firewall is known as a screening router.

Proxy services are specialized application or server programs that run on a firewall host: either a dual-homed host with an interface on the internal network and one on the external network, or some other bastion host that has access to the Internet and is accessible from the internal machines. These programs take users' requests for Internet services (such as FTP and Telnet) and forward them, as appropriate according to the site's security policy, to the actual services. The proxies provide replacement connections and act as gateways to the services. For this reason, proxies are sometimes known as application-level gateways~\cite{b57}.

There are three ways to put various firewall components together:

\begin{itemize}
\item{Dual-homed host architecture}

A dual-homed host architecture is built around the dual-homed host computer, a computer that has at least two network interfaces. Such a host could act as a router between the networks these interfaces are attached to; it is capable of routing IP packets from one network to another. Systems inside the firewall can communicate with the dual-homed host, and systems outside the firewall (on the Internet) can communicate with the dual-homed host, but these systems can not communicate directly with each other. IP traffic between them is completely blocked.

The diagram below shows the network architecture for a dual-homed host firewall. The dual homed host sits between, and is connected to, the Internet and the internal network~\cite{b57}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall1}
\caption{Dual-homed host architecture}
\label{fig:firewall1}
\end{center}
\end{figure}

\item{Screened host architecture}

Whereas a dual-homed host architecture provides services from a host that is attached to multiple networks (but has routing turned off), a screened host architecture provides services from a host that is attached to only the internal network, using a separate router. In this architecture, the primary security is provided by packet filtering. For example, packet filtering is what prevents people from going around proxy servers to make direct connections. The diagram below shows the network architecture for the screened host architecture~\cite{b57}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall2}
\caption{Screened host architecture}
\label{fig:firewall2}
\end{center}
\end{figure}

\item{Screened subnet architecture}

The screened subnet architecture adds an extra layer of security to the screened host architecture by adding a perimeter network that further isolates the internal network from the Internet. There are two screening routers, each connected to the perimeter net. The perimeter network is another layer of security, an additional network between the external network and the protected internal network. The perimeter net offers an additional layer of protection between attackers and the internal system. One screening router sits between the perimeter net and the internal network, and the other sits between the perimeter net and the external network (usually the Internet). To break into the internal network with this type of architecture, an attacker would have to get past both routers. The diagram below shows the network architecture for the screened subnet architecture~\cite{b57}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall3}
\caption{Screened subnet architecture}
\label{fig:firewall3}
\end{center}
\end{figure}

\end{itemize}


\section{Fault management}
\label{sec:fault}

Physical network problems account more than half of all network problems. Locating the origins of such problems as fiber cut, the earth is incorrect, adapter is broken or incorrectly joined, costs network providers time and money. Network management systems have also traditionally focused on the logical connection between the end user and the network destination, since many network problems have been a result of errors created by software applications~\cite{b24}. Finding and repairing failures of software applications is usually difficult, for example in such a case that the workstation sends but does not receive packets, too many collisions occur or frames are too short or too long.

Fault management is troubleshooting, fault localization, isolation and correction. Today, the process of fault management needs to be automated. Rapid and accurate correction of network problems has to be created by the network or by the end user. Even if the entire network was violated, the network management application should work.

Expert\label{expertsystems} systems provide an efficient and cost effective way of automating network fault management. By automating fault management, problems and possible diagnosis can be done faster and more efficiently. However, real-time performance represents a problem for expert systems~\cite{b8}. Bounds on response times are difficult to establish. There are also risks pushing the limits of automation through the introduction of new or only partially proven technologies.


\subsection{Transferring information}

There are two mechanisms of transferring network management information from a managed entity to a manager: \textbf{polling} and \textbf{sending alerts} (messages are initiated by managed network elements). Advantages and disadvantages exist within both methods. Most network management systems use an optimal combination of alerts and polling in order to maintain advantages of each and eliminate disadvantages of pure polling~\cite{rfc1224}.

Most systems poll the managed objects, search for error conditions and illustrate the problem in graphical format or as a textual message. Disadvantages of polling are the response time of problem detection and the increased volume of network management traffic. Having to poll many management information base (MIB) variables per machine on a large number of machines is itself a problem. The ability to monitor such a system is limited. Polling many objects on many machines increases the amount of network management traffic flowing across the network. It is possible to minimize this through the use of hierarchies (polling a machine for a general status of all the machines it polls). Anyway, the response time will be a problem~\cite{rfc1224}.

If a system fails shortly after being polled, there may be a significant delay before it is polled again. During this time, the manager must assume that a failing system is acceptable. While improving the mean time to detect failures, it might not greatly improve the time to correct the failure. The problem will generally not be repaired until it is detected.

There are problems attached also to the second method, sending alerts: There is a possibility to lose of critical information and to over-inform the manager. An ideal management system would generate alerts to notify its management station of error conditions. However, alerts cannot usually be delivered when the managed entity fails or the network experiences problems. It is important to remember that failing machines and networks can not be trusted to inform a manager that they are failing. The manager should periodically poll to ensure connectivity to remote stations, and to get copies of alerts that were not delivered by the network~\cite{rfc1224}.

Alerts in a failing system can be generated so rapidly that they impact functioning resources. An "open loop" system in which the flow of alerts to a manager is fully asynchronous can result in an excess of alerts being delivered. There may be a situation where all available network bandwidth into the manager is saturated with incoming alerts, thus preventing the manager from disabling the mechanism generating the alerts. Methods are needed to limit the volume of alert transmission and to assist in delivering a minimum amount of information to a manager. Alarm correlation is done by filtering secondary alarms, e.g. using expert systems\footnote{Expert systems are discussed briefly on page~\pageref{expertsystems}}.

Many management tools also \textbf{log} events with different formats and different sources. These events should later be correlated using time stamp to identify the source of the problem. Also topology information is needed to identify the precise location of the problem.

Many devices have buffers reserved for logs.  When a buffer becomes full, new logs are written over the oldest ones. If the buffer becomes full quickly, some important logs may disappear before they are noticed.  Buffers also consume disk space that could be used for other purposes.


\subsection{Troubleshooting and fault localization}

Several diagnostic tools are used for troubleshooting and fault localization purposes. These include ifconfig, arp, netstat, ping, nslookup, dig, ripquery, traceroute, and etherfind~\cite[pages 260--262]{b33}.

\textbf{The packet inter net groper (ping)} tests whether a remote host can be reached. It sends an internet control message protocol (ICMP) loopback request packet to a target IP address. The receiver accepts the loopback request and issues a loopback response to the initiator of the Ping command. It cannot be determined with echo-response which one of the possible routes is violated, because loopback request and loopback response may use different routes. Ping can only be used to determine whether the target IP-address is available or not. Another usage of ping is to measure the response times of different packet sizes~\cite[page 33]{b4}.

Unlike ping, \textbf{traceroute} forces every router to send back an ICMP-control message. Most Traceroute applications send a sequence of User Datagram Protocol (UDP)-packets to a randomly selected UDP-port~\cite{b2}. Sometimes the firewalls filter these packets from the main traffic, in which case the tracing ends.

After detecting a fault, operators should as soon as possible find the root cause of the problem. Clearly defining the problem helps to isolate the root cause from symptoms~\cite{b22}. Operators must also determine what troubles it causes and to whom.

At first it is useful to find the parts of the network, where the fault can not be, by eliminating processes. These parts can be neglected. If the problem is very serious and difficult, the network can be divided into smaller parts to be inspected one by one. Connectivity tests are also used to find the violated devices. At the same time it can be detected whether the fault is local or widespread. By testing the data integrity it can be found out if a part of the packets are lost by transmission. Delays are also to be tested, because some faults result from excessive delays~\cite{b2}.


\subsection{Testing}

\textbf{Measuring the accessibility} of devices helps us to collect information about the status of the network. In general, some points are selected to measure connections. Measurements are done by a control device. After measurements, the results are interpreted.

Measuring the accessibility is not a complete method. For example, controlling only routers is not enough. If the router has been set up so that it gives preference to packet switching, it will send packets normally even if it is heavily loaded and perhaps can not answer to messages of the controlling device. Another example is that two devices that can be reached might not have a connection with each other.

Another method of testing is to \textbf{control routing tables}. Routing should change only when the topology of the network changes. If there are changes at other times, there is probably
something wrong with the network.

Routing tables express the topology of the network. Finding out the network topology from routing tables is more difficult than controlling accessibility~\cite{b2}. In order to get information from routing tables of routers, routers must be Simple network management protocol (SNMP) compatible, dynamic routing tables must support sending request or routing information must be tapped from a routing protocol. These requirements are not necessarily realized although SNMP is a commonly used protocol. Analysis of the routing tables can concentrate on the parts of the network which are most susceptible to failures.


