What DHCP does

DHCP, the Dynamic Host Configuration Protocol, is the system that hands out network settings automatically. Every device on a network needs a few things to function: its own IP address, so other devices can find it; the address of the router that leads out to the internet; and the address of a DNS server to look names up. In the old days, someone typed all of that into every machine by hand. On a network of more than a few devices, that quickly becomes a misery of clashes and mistakes.

DHCP does it for them. When a device joins, it effectively calls out “does anyone here hand out addresses?”, and a DHCP server, usually built into your router, answers with a free address and the rest of the settings, lent out for a set period called a lease. The same automatic welcome happens when someone connects over a VPN, dropped onto the office network as if they had just plugged in. The whole exchange, set out in a standard that has barely changed in decades, takes a fraction of a second.

Why “turn it off and on again” so often works

DHCP also quietly explains one of IT support’s oldest pieces of advice. When a device cannot get online and reconnecting fixes it, what often happened was a DHCP hiccup: the device never got a clean address, or its lease got into a muddle. Disconnecting and rejoining forces the whole conversation to start over from scratch, a fresh address is handed out, and everything springs back to life. It is not magic, and it is not nothing. It is DHCP getting a second go.

The same machinery sits behind a few other everyday mysteries: why two devices very occasionally claim the same address and knock each other offline, or why a network that has run out of free addresses to lend suddenly stops letting new devices on.

The bits worth knowing for a business

For the most part DHCP is happily invisible, which is how it should be. Two things are worth a business owner knowing. First, because DHCP is so trusting, a rogue device pretending to be the address-giver can quietly misdirect traffic on a network that has not been set up to prevent it, which is one more reason proper managed equipment earns its keep. Second, the few things that genuinely need a fixed, never-changing address, a server, a printer everyone relies on, certain equipment, are usually best assigned deliberately rather than left to the general pool.

Neither is something to lose sleep over. They are simply the sort of detail a well-set-up network gets right quietly, so that the only thing you ever notice about DHCP is that everything connects the moment you switch it on.

The post DHCP Explained: How Your Devices Get on The Network appeared first on Orbit Computer Solutions.

What SNMP actually does

SNMP, the Simple Network Management Protocol, is the shared language that lets one system keep tabs on all the others. Almost everything on a modern network speaks it: switches, routers, servers, printers, even the battery backup humming away under a desk.

The idea is refreshingly simple. Each device runs a small program called an agent that keeps a running count of how things are going, such as temperature, traffic, spare disk space and how long it has been running. A monitoring system checks in with those agents on a regular schedule and collects the numbers. Devices can also speak up unprompted: when a reading crosses a line that matters, the agent fires off an alert, known as a trap, so trouble surfaces the moment it starts rather than at the next scheduled check.

Why it earns its keep

On paper that sounds like back-office trivia. For a business it is the line between hearing about a problem from your dashboard and hearing about it from your staff.

A network wired up to SNMP and a half-decent monitoring tool is a network somebody can genuinely watch. A disk slowly filling, a line that drops for a few seconds every hour, a device quietly running too hot: each shows up as a trend long before it becomes an outage. It is also how you learn a backup link has quietly taken over before anyone noticed the first one fail. It is the engine underneath every promise of proactive support and round-the-clock monitoring. Take it away, and “we keep an eye on your systems” is mostly a hope. The same readings answer duller but useful questions too: which connection is being saturated at four o’clock, whether an ageing server is on its way out, when it is time to add capacity rather than wait for the first complaint. The same watchful eye covers the devices holding your perimeter, firewall included.

The part worth getting right

There is one catch, and it is a common one. For years SNMP came with a default password of sorts, a community string set to the word public, and plenty of kit still has it untouched. Left that way, it can hand a stranger a tidy summary of your network, and on older versions that information travels with no encryption at all.

The fix is settled: run the current version, SNMPv3, which adds proper authentication and encryption, and change the defaults. A network that is genuinely being looked after has its monitoring turned on and locked down, not one without the other.

None of this is something you should have to think about. But the quiet save, the problem dealt with before it ever reached you, has a name. Whether your own network is set up to make those saves possible is a perfectly fair thing to ask of whoever looks after it.

The post Simple Network Management (SNMP): What It Means (Simplest Form) appeared first on Orbit Computer Solutions.

First, what a trunk is

To see why DTP matters, you need the idea of a trunk, and for that you need VLANs.

A VLAN, or virtual LAN, is a way of slicing one physical network into several logical ones. The guest wifi, the staff computers, the card terminals and the security cameras can all share the same switches and cabling while behaving as though they sit on separate networks that cannot see each other. It is one of the most common and most useful boundaries in any building’s network.

Most ports on a switch carry just one VLAN. These are access ports: the computer on a desk belongs to the staff VLAN and nothing else. The links between switches, though, have to carry every VLAN at once, kept apart by a small label stamped onto each frame as it crosses. A link like that is a trunk, and the labelling follows an open IEEE standard, 802.1Q. Trunks are how a building full of switches still manages to behave like a tidy set of separate, isolated networks. Those same inter-switch links are also where spanning tree does its quiet work, keeping a redundant path from becoming a loop.

What DTP was built to do

Configuring every trunk by hand, port by port, is tedious work, especially across a large site. Cisco’s answer, years ago, was to let the switches arrange it among themselves. Dynamic Trunking Protocol, DTP for short, is a Cisco protocol that lets two switches negotiate whether the link between them should become a trunk, and how it should be labelled, with nobody configuring either end.

A port taking part in DTP sits in one of a handful of modes. In dynamic desirable it actively asks the far end to form a trunk. In dynamic auto it waits to be asked, and agrees if it is. Stand a desirable port next to an auto port, or two desirable ports together, and a trunk forms on its own. The two static modes, access and trunk, pin the port as one or the other, and a separate command can switch the negotiation off altogether. For a long time the out-of-the-box default on many Cisco switches was one of the dynamic modes, which means a switch taken fresh from the box is often willing to strike up a trunk with whatever appears on the wire.

The exact default has shifted over the years and varies by model and software version, so the honest answer to “is DTP active here?” is almost always “check, do not assume”. Plenty of live networks still have ports sitting in a dynamic mode without anyone ever having chosen it. For an engineer wiring a comms cabinet, that automatic behaviour really is convenient. The trouble is who else gets to ask.

Where the convenience becomes a hole

DTP has no meaningful idea who it is talking to. It assumes the device at the other end of the cable is a co-operative Cisco switch. There is nothing that says it has to be.

If a port is sitting in a dynamic mode, a laptop running the right tool can speak DTP back to the switch, announce itself as a switch, and negotiate a trunk. The instant that trunk comes up, the laptop stops being a single device on a single VLAN and starts receiving the traffic of all of them. The neat separation between guest wifi, internal systems and payment devices simply dissolves for that machine. This is the best-known form of an attack called VLAN hopping, and the DTP-driven version is known as switch spoofing.

None of this is hard or hypothetical. Picture the steps. Someone finds a live network socket that nobody is watching: a point in a meeting room, an unused desk in reception, the port behind a screen in a waiting area. They plug in a laptop. A free tool such as Yersinia sends the DTP frames. The switch, still in its helpful default, agrees to form a trunk. And the visitor now has a view of every VLAN on that switch. It is a standard opening move in physical penetration tests, precisely because it works so often. There is a second VLAN-hopping trick, known as double tagging, that abuses the native VLAN rather than DTP, but switch spoofing is the one DTP serves up directly.

Why a business should care

It is tempting to file all this under things for the IT team to fret about. But the reason those VLANs exist is almost always a decision the business has already made, even if it was never written down as a security policy.

Keeping card-payment devices apart from everything else is frequently a hard requirement under standards like PCI DSS, not a nice-to-have. Separating guest wifi from internal systems is the entire reason guest wifi is its own VLAN in the first place. Corralling cameras, door entry and other internet-connected gadgets onto their own segment is how a cheap device with sloppy firmware is stopped from becoming a route into everything important. When DTP lets someone trunk in, all of that quietly comes undone. The segmentation you depend on, and may well be audited against, turns out to be optional for anyone who can reach an unguarded socket.

It also sidesteps most of the controls people assume will protect them. A locked server room does nothing about a network point in an open meeting room, and a firewall sitting at the edge of the network never sees the traffic that is hopping between VLANs inside it. Put plainly: a single unattended port in a reception area should never be a master key to the whole network. Where DTP has been left switched on, that is sometimes exactly what it is.

Turning it off, and trunking on purpose

The fix is well established and costs nothing but a little attention. The rule of thumb is that a port should always be told what it is, and never left to work it out by negotiation.

For the ports that people actually plug into, that means fixing them as access ports with switchport mode access, so they stay in a single VLAN and stop speaking DTP altogether. For the real links between switches, it means declaring them trunks deliberately with switchport mode trunk and then adding switchport nonegotiate, which turns DTP off on that link so it will not auto-trunk with whoever asks. While you are in there, it is good practice to move the native VLAN off the default VLAN 1 and onto an unused one, which closes the double-tagging door at the same time.

Confirming the current state is just as quick: a look at a port’s settings, with a command like show interfaces switchport, tells you which mode it is in and whether negotiation is on, and monitoring can flag a port that has negotiated a trunk it never should have. On an estate of any size, that check belongs in the standard build for every switch, not a one-off tidy-up.

This is not fringe or paranoid advice. Disabling features you do not use and changing insecure defaults is the heart of secure configuration, one of the five controls in the UK’s Cyber Essentials scheme, and turning DTP off specifically is set out in Cisco’s own hardening guidance and in essentially every serious switch baseline. On a network built by someone who knows the terrain, DTP is simply off, and trunks exist only in the handful of places they were deliberately created.

The pattern worth noticing

DTP is a small instance of a much larger theme. Networks are full of features designed in a more trusting time and left on by default because they smoothed the path for whoever installed the kit, back when the only things that ever plugged in were other trusted devices. Open offices, public spaces and a market full of cheap attack tools changed the threat. The defaults, very often, did not change with it.

You do not need to know which features those are. Working that out is the job of whoever designs and maintains your network. What is reasonable is to expect that the question has been asked at all, and that the convenient defaults have been switched off wherever they quietly trade your security for someone else’s saved ten minutes. If you cannot say for certain whether that has happened on your own network, it is worth finding out.

The post Cisco Dynamic Trunking Protocol (DTP): The Default Worth Turning off appeared first on Orbit Computer Solutions.

The switch: the office’s internal post room

A switch connects the devices inside your network to each other. The computers, printers, phones, servers and wifi access points all plug into it, and its job is to move data between them quickly and only to the right place. When your laptop sends a document to the printer down the hall, the switch is what makes sure it reaches that printer and not everyone else’s screen.

Think of it as the post room of the building. It knows which desk is which, takes an internal envelope, and delivers it straight to the right recipient without bothering anybody else. It is fast, it is local, and it has no real interest in the world outside the building. A bigger office simply has more switches, or larger ones, all doing the same neighbourly job. Wire several together with a spare link for resilience, though, and something has to stop that redundancy becoming a loop.

The router: the office’s front door to the world

A router does something different. It connects your network to other networks, above all to the internet. Where a switch moves traffic within the building, a router decides how traffic gets between buildings, and finds a path out to wherever it is heading. Every time someone loads a website or sends an email beyond the office, it leaves through the router.

If the switch is the internal post room, the router is the front door and the mailroom that deals with the outside world. It handles everything coming in and going out, works out where external post should be sent, and is usually where your firewall and your connection to your internet provider live. There is generally just one main one, and it is the thing that genuinely matters on the morning “the internet is down”.

Why the distinction is worth knowing

In a small office the two often arrive fused into a single unit. The box your internet provider supplies is usually a router, switch and wifi access point rolled into one, right down to handing out every device’s address, which is exactly why the words get muddled. That is perfectly fine when you are small. It tends to stop being fine as you grow, when one shared box is trying to do three demanding jobs at once and doing none of them especially well.

The practical value of telling them apart is that it makes problems, and upgrades, far easier to reason about. Slow file transfers between machines in the office point at the switching side. Trouble reaching the outside world points at the router or the connection. Keeping the guest wifi separate from the till system, or adding a resilient backup internet line, are decisions about how those boxes are arranged. You do not need to design any of that yourself. But knowing there are two jobs here, not one, is the difference between a network that was thrown together and one that was actually planned.

The post Routers and Switches Explained: What Each One Actually Does appeared first on Orbit Computer Solutions.