Running a network

What it is

Keeping a network running is mostly careful routine, and much of it is on the exam. Physically, equipment sits in racks measured in rack units (1U is 1.75 inches, 44.45 mm). A UPS (a battery unit) rides through short power cuts and gives a generator time to start, and PDUs share power out to each device. Hot and cold aisles keep air moving, and temperature, humidity and fire suppression are watched. Processes keep it known: change management means every change is requested, assessed, approved, scheduled and recorded, with a way to roll it back. Documentation covers physical and logical diagrams, IP address records and an asset inventory, and life-cycle tracking flags kit reaching end of life or end of support. For monitoring, SNMP lets a monitoring server poll devices and receive traps (alerts); use SNMPv3, which adds authentication and encryption. Flow data such as NetFlow shows who talked to whom, syslog gathers logs, and a baseline shows what normal looks like. For disaster recovery, the RPO is how much data you can afford to lose and the RTO is how long you can afford to be down. MTBF is the average time between failures, and MTTR the average time to repair. A hot site can take over at once, a warm site has hardware but needs data and setup, and a cold site is space and power only. Plans are tested, often with a tabletop exercise.

How defenders stop it

• Route every change through change management, with a tested way to roll it back
• Put critical kit on a UPS, and test the generator and failover rather than just owning them
• Use SNMPv3 rather than v1 or v2c, and record a baseline so you can spot what isn't normal
• Agree an RPO and RTO for each system, and prove backups work by restoring them

Try it yourself

Find a change that slowed a network in the slow network lab