Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

TCP/IP is a protocol that was
originally
implemented on Unix platforms but has now become the default network
protocol on Microsoft Windows, Novell NetWare, and Apple Macintosh
computing platforms. TCP/IP is routable and can be used for both
local area networks and wide area networks. You should use TCP/IP if:

• Your network is heterogeneous in character, consisting of different
  computing platforms and operating systems that all need to work
  together.

• You need connectivity with the Internet or want to deploy Internet
  technologies within a corporate intranet environment.

• You want to use the Active Directory component of WS2003. (Active
  Directory requires TCP/IP.)

A full treatment of TCP/IP is beyond the scope of this book. What
follows here is a brief summary of its important features. For more
information, see

TCP/IP Network Administration
by Craig Hunt (O'Reilly).

Some of the advanced features of TCP/IP in WS2003 include:

• Support for APIPA, which allows client computers to be assigned IP
  addresses automatically without the need of a DHCP server. See
  

  Automatic Private IP Addressing (APIPA) later in
  this section for more information.

• Support for dynamic recalculation of TCP window size and the ability
  to use large TCP windows to improve performance when large amounts of
  data are transmitted during a session. See Request For Comment (RFC)
  1323 at www.ietf.org/rfc/ for more information.

• Support for selective TCP acknowledgments to reduce the time
  retransmitting lost packets. See RFC 2018 for more information.

• Support for the TCP Round Trip Time Measurement option of RFC 1323 to
  improve performance over slow WAN links.

• Support for caching of resolved DNS name queries on client resolvers.

• Support for ICMP Router Discovery for discovering router interfaces
  that aren't assigned manually or through DHCP. This
  feature is enabled using the Routing and Remote Access console, and a
  description of the feature can be found in RFC 1256.

• The ability to disable NetBIOS over TCP/IP (NetBT) for specific
  network connections. This feature improves performance when DNS is
  the only name-resolution method in use on the network. This is really
  an all-or-nothing decision, as a WS2003 computer with NetBT disabled
  can use Client for Microsoft Networks to connect to other WS2003
  computers running File and Print Sharing for Microsoft Networks only
  if those computers also have NetBT disabled. Disabling NetBT means
  the computer can no longer use NetBIOS name-resolution methods such
  as WINS servers or

  lmhosts files. In most cases,
  you will not use this feature as most networks will consist of a mix
  of WS2003 and legacy Windows clients and servers. For information on
  how to disable NetBT, see

  WINS later in this
  chapter.

IP Addressing

Each host (computer, network printer, router interface, and so on) on
a TCP/IP network is generally characterized by
three
pieces of information:

IP address

A logical 32 bit address that uniquely identifies the host on the
network. IP addresses are expressed in dotted decimal form and
consist of four octets separated by decimals with each octet ranging
from 0 through 255 (with some restrictions). An example of an IP
address might be 172.16.11.245.

Subnet mask

A 32 bit number that divides the IP address into two partsa
network ID, which uniquely identifies the network that the host
resides on, and a host ID, which uniquely identifies the host on that
particular network. For example, the subnet mask 255.255.0.0, when
applied to the IP address 172.16.11.245, indicates that the network
ID of the host is 172.16, while the host ID of the host is 11.245.

Default gateway

A 32-bit address that identifies the default router interface to
which to send packets that are directed to another network (or, more
accurately, that are directed to a different subnet on a TCP/IP
internetwork) if no other route is specified. The default gateway is
optional and is necessary only on networks consisting of more than
one subnet or when packets are being sent between different networks.

Managing TCP/IP

One aspect of managing TCP/IP is managing IP addresses on your
network. WS2003 lets you assign IP addresses and other TCP/IP
settings in three different ways:

Manually by using static IP addresses

This method is suitable only for small deployments of fewer than a
hundred machines or so. TCP/IP settings must be configured at the
local console of each machine, so this method is unsuitable if the
hosts are geographically separated. Since errors in assigning IP
addresses can cause general problems with network communications,
this method can be a lot of work to troubleshoot.

Automatically by using DHCP

This is the default method for assigning TCP/IP settings on WS2003
machines. It uses one or more Dynamic Host Configuration Protocol
(DHCP) servers, which maintain pools of available IP addresses, which
lease these addresses to client computers that request them. DHCP
should always be used on medium- to large-scale networks that run
TCP/IP. DHCP can also be used by legacy Microsoft Windows platforms
to configure TCP/IP on machines.

Automatic Private IP Addressing (APIPA)

If your WS2003 machine is configured to obtain an IP address by DHCP
but no DHCP server is available on the network, the machine opts for
assigning itself an address using APIPA. This method is an
alternative to using DHCP on small- to medium-scale networks that use
WS2003 and run DHCP. For more information, see the next section.

Automatic Private IP Addressing (APIPA)

APIPA is an
extension

of
DHCP that allows computers to self-configure their IP address and
subnet mask without a DHCP server. The way it works is that a
computer uses APIPA to randomly select a unique IP address from a
block of IP addresses reserved by Microsoft for this purpose. This
reserved IP block covers the address range 169.254.0.1 through
169.254.255.254 and, together with the subnet mask 255.255.0.0,
provides enough addresses for 64,024 hosts running on a single
subnet. In real life, however, APIPA is intended for use on home or
small business networks containing at most a few dozen machines,
because:

• Only the IP address and subnet mask can be assigned using APIPA, and
  not default gateways or other TCP/IP settings that can be provided by
  DHCP servers and that are needed by TCP/IP networks connected to
  other networks or to the Internet.

• Only a single subnet can be created using APIPA, which is not of much
  use in an enterprise-level network.

To configure a computer to use APIPA, simply configure it to obtain
an IP address automatically. Then, when the machine restarts, it
first tries to contact a DHCP server, and if this fails, APIPA then
kicks in and the machine selects an IP address for itself of the form
169.254.

x.y . It then tests the uniqueness of the
address on the network by broadcasting a DHCP-type message to the
rest of the machines on the network to find out if any other machine
is using this address. If no other machine responds saying that it
has taken that address, it assigns the address to itself along with
the subnet mask 255.255.0.0. If, however, another computer claims to
already be using the address, APIPA generates another address at
random until a usable one is found. Then, should a DHCP server later
be installed on the network, computers that used APIPA to select an
address will soon detect the DHCP server and request a new IP address
and other TCP/IP settings from the server.

APIPA can cause problems on large networks, however. For example, if
a DHCP server goes down and client computers can't
renew their leases, they would start using APIPA to assign themselves
addresses. This would result in communications on the network
breaking down because the machines that acquired new addresses using
APIPA would be on a different subnet from those still holding their
leased DHCP addresses. The solution is to disable APIPA entirely,
but, unfortunately, the only way to do this is to use the registry.
You disable APIPA on a specific network adapter by creating a new key
called IPAutoconfigurationEnabled of type
REG_DWORD within the subkey:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\GUID_of_
network_adapter\

and assigning this new key the value 0. Change the value to 1 to
reenable APIPA on the adapter. On a multihomed machine with multiple
network adapters, you can disable APIPA on all adapters by placing
the IPAutoconfigurationEnabled key within the
subkey:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

If there are network connections that aren't being
used on servers (most importantly, domain controllers), they should
either be disabled or have APIPA disabled. Otherwise, clients may get
incorrect IP addresses when querying DNS.

Troubleshooting TCP/IP

WS2003 includes a comprehensive set of command-line utilities for
testing and troubleshooting TCP/IP configurations and networks,
including arp, ipconfig,
nbtstat, netstat,
pathping, ping,
route, and tracert. For more
information on these utilities, see Chapter 5.