From now on, let us add “Supernet” into our vocabulary. Learn more!

A set of computers and/or computer equipment connected to each other, and that can exchange data and information, all of those make up a network. The Internet is the network of networks. We could even think that the Internet is the “Supernet”, but we have to tread carefully when using frequently debated terms in computing… For that reason, today, we bring to the fore the term “Supernet” (or Supernetwork), of course always taking an approach from a monitoring perspective.

* Warning: what I write below is my way of looking at things from a practical and sincere point of view. This article only endorses me and, in any case, this entry should be read taking into account the learning approach, it does not intend to be official in any way. That said, let’s start from the basics, which is not the same as starting from scratch.

Terms: Supernet and Supernetting

If we have a network and we buy a new computer, we say that “we add it to a network.” If we have a supernet, then “we add it to a supernet.” We even have a specific verb for it. It is very common to use the term Supernetting; however the following terms are also valid (but less used):

• Prefix aggregation
• Route aggregation
• Route summarization

If we get even more specific, technically we will find differences but for the purposes of this post we will deal with it the same way… Do you think it is daring on my part? Well, there is more!

Request for comments

Although we can go a lot further back in time, the Internet was born in the United States of America, originally called Arpanet, in the late 1960s. A technological predecessor could be the landline from which many of the concepts are born, used when planning the “network of networks”. In fact, the wiring itself, the colors that identify the pairs, are very similar, at a physical or hardware level. This includes the similarities in switched connections (or circuit switching). But, obviously, the Internet and data transport in a digital way ended up completely absorbing telephony.

But the Internet needed more than the physical and conceptual foundation or sustenance of the great American telephone companies. Moreover, October 1969 is marked as the birth of the Internet since the first connection between two computers was made… And it was simply that, since it was not yet a common computer network.

The Internet was born, in my opinion, when pioneer Dr. Steve D. Crocker published the first issue of Request for Comment (RFC) on April 7, 1969. In Issue 6 (RFC 6), Steve Crocker recounts his conversation with Bob Kahn about code conversion for data exchange. RFC 11 publishes the connection implementation in the FAT operating system (yes, that’s what it was called), and I fervently believe that this, published in August 1969, is what enabled the feat performed in October of that same year.

Based on this knowledge base, the RFCs were born: gathering a group of people in their twenties who moved among different universities sharing knowledge and cementing concepts, something that we now do by email… In fact, RFC 733 (1977) outlines this technology and the standard for the email is published in RFC 822 (year 1982).

RFCs grew decade after decade: in 1992, RFC 1338 “Supernetting: an Address Assignment and Aggregation Strategy” was published for information purposes. Yes, at first the supernet was just a mere advertisement, not a protocol, and not even a standard.

Just the following year, in 1993, RFC 1518 “breaks” the paradigm of networks by classes. While class A networks allow millions of IP addresses, the next step – class B networks – only allowed 65 thousand IP addresses: between the two of them the “waste” of IP addresses is very high.

For that reason, the Classless Inter-Domain Routing (better known as CIDR) was born, which is an extension of the original IPv4 addressing system that allows more efficient address allocation. The original class-based method used fixed fields for network identifiers, which was wasteful as I said earlier: most organizations that are assigned those addresses (class A and class B networks) never intended to put so many devices on the Internet.

As additional information, this is the origin of CIDR notation, the suffix that accompanies an IP address (there are 32 bits in an IPv4 address, four octets separated by periods) and that allows describing or narrowing down a range of them. For example, for /20 it allows 4096 IP addresses, for /21 2048 IP addresses and so on, as well as all the way around (all powers of base 2, this is important for a supernet as we will see later). All these numbers can be obtained using the IP address calculator included in Pandora FMS. You may also find many of these calculators online, each with its own style, shapes and colors to present the same data.

Flexible like Pandora FMS

CIDR thus changed the fixed fields to variable length fields and this allowed to assign IP addresses better, and in a more refined way. CIDR IP addresses include a number that indicates how the address is divided between networks and hosts.

For example, in the CIDR address 201.249.0.0/19 the /19 indicates that the first 19 bits are used for the identification of the network and the remaining 13 are used for host identification.

The main purpose of a supernet is to decrease the size of the route table of routers. For example, instead of a router having 8 individual routes, it may have a single route aggregated from these 8 individual routes. This saves memory and processing resources on the routing devices, thus requiring less space to store their route table and less processing power to search the route table. It also provides stability in networks because fluctuations can be isolated, that is, in one part of the network they do not spread to all parts of the network.

Supernetting and Pandora FMS

From Pandora FMS version NG 731 IPAM was included (abbreviation of Internet Protocol Address Management) which allows to manage, discover, diagnose and monitor hundreds of IP addresses.

Within this feature, the supernet, subnets and even virtual private networks (VLAN) are included, all integrated, with the option to export data in CSV files. Unlike creating VLANs, we can only create supernets manually using IPAM. For that, you have to configure, with the necessary parameters, each of the supernets that you want to have, and later add networks already managed with IPAM that may belong to a VLAN. Although it is a manual process from version NG 758, it includes the ability to quickly addy our data from files in CSV format.

To finish off this post, let’s see what the rules that operate a supernet are.

Supernet Rules

Apart from good practices in network configuration, the established rules must always be followed and enforced to avoid chaos reigning.
The rules for creating supernets are as follows:

• Networks must be contiguous or sequential.
• The number of networks to add must be a multiple of two or “base two”.
• And the rule that is somewhat more complicated: compare the value of the first octet not common from the first block of IP addresses (the smallest) of the list of networks to add against the number of networks to add (see previous point). The value of the first non-common octet must be zero or a multiple of the number of networks to be added.

Before finishing, remember Pandora FMS is a flexible monitoring software, capable of monitoring devices, infrastructures, applications, services and business processes.

Satellite server in remote environment monitoring

Today we will talk about one of the most versatile elements that Pandora FMS Enterprise offers us for monitoring distributed environments, the Satellite server. It will allow you to monitor different networks remotely, without the need to have connectivity directly from the monitoring environment with the computers that make it up. We will describe the typical case of companies that have central headquarters and remote offices, the different things we may find and how the satellite server can help us deploy efficient monitoring in an economic, fast and simple way.

Standard monitoring types

Before getting into the description of the case, let’s remember how monitoring works overall with Pandora FMS. There are two basic types of monitoring, local monitoring and remote monitoring.

The first, which we call local, consists of installing a small software on your devices (servers, mobiles, workstations, etc.) which we call monitoring agent. Agents are in charge of collecting the metrics locally on the machine, packaging them and sending them to the server. In this type of monitoring, communication goes from the agent (monitored device) to the server in a defined time interval, so the server does not have to interrogate the device, it just has an open port through which information is received, and any device that can reach that port will be able to send its data, so communication is “simple”, you just need to make sure that your monitoring server is exposed to all of your agents.

The second form of monitoring is what we call remote monitoring. Remote monitoring means that the monitoring server interrogates the agent to monitor through some protocol (icmp, tcp, snmp, http, wmi, etc). This could go from a simple ping to connecting to the api of a complex tool, such as vsphere, to retrieve information from all virtual machines, esx and datastores running in this environment and their corresponding metrics.

This type of monitoring opens the doors to being able to retrieve large amounts of data requiring little configuration and without the need to install any extra software on the devices, which is wonderful, but it also entails other inconveniences, such as having to guarantee connectivity from the monitoring server to each of the elements to be monitored, taking into account the security criteria to open these communications.

When you have a single headquarters of any size, this is not usually a problem, since you might usually have your devices and applications concentrated in the same place and communications management between environments is usually easier, this situation becomes complicated when you have more than one headquarters or small remote offices.

Description of a distributed environment

Let’s picture a distributed architecture with a headquarters where you have most of your applications and IT equipment, but you also have smaller sites that also have their equipment and applications. We have examples of this infrastructure, highly distributed, in environments like restaurant franchises, supermarkets, banks, retail stores, pharmacies, insurance companies, etc. Where they usually have powerful, well-managed data centers at headquarters, but remote sites lack the space or staff to maintain servers. Most of the time, there are not even permanent technical support staff for the equipment in these locations, so implementing monitoring can be challenging.

If some technology is implemented such as a site-to-site vpn, a sd-wan or dedicated communication between your sites, there is hardly any problem, you may have your monitoring environment at your headquarters and from there “attack” your remote devices. Well, the problem is that these solutions are expensive and require implementation and management, and if they are not already implemented, their implementation can become very complicated (and expensive). It is in these cases where the satellite server becomes essential, since it combines the versatility of remote monitoring with the communication behavior of local monitoring.

Using the Satellite Server

The Satellite Server consists of software that will be in charge of doing the remote checks on your network. Let’s say that in our restaurant, for example, it will do network scans, monitor each of the restaurant’s devices through different protocols, store these data and then pack them and send them to the main Pandora FMS server as if it were a local agent, so the headquarters/remote headquarters communication is simplified. You just have to make sure that a single device, the Satellite Server, can communicate with Pandora FMS server, in that sense from the remote headquarters to the main headquarters to send the data packets. Remote checks will always be done from within the local network without the need to expose any of the services, devices or applications of your remote headquarters.

Even if you want to make use of hybrid monitoring (local and remote monitoring) in your remote headquarters, you may install software agents on your devices and point them to our satellite so that it becomes the single delivery point between your remote headquarters and your headquarters.

In addition, the Satellite Server has remote configuration, so once deployed, it can be managed and configured from your main monitoring environment, being able to add new metrics, alert systems, policies and more configurations without having to access your remote headquarters, all from your Pandora FMS web console at your headquarters.

Regarding its deployment, the Satellite Server is a very light software especially compared to a full Pandora FMS installation, so the hardware requirements for monitoring remote sites are really low, it can even be deployed in a Raspberry Pi, which is a very cheap and compact device, or failing that, you may use any of the resources that are already deployed at the headquarters, such as a data server, to deploy your Satellite.

As you can see, monitoring remote sites using the satellite server simplifies a huge deal the configuration necessary for monitoring, helping you save money and implementation time that without a tool like this would be a lot higher and more complex.

Today we discussed only one of the typical cases, which is one of the most common ones, to describe the performance and the usefulness of a satellite server, but it is not only valid for remote locations, it is useful in many other ways, such as load balancing, making checks at the same point from different locations (very useful in monitoring web pages) or even for monitoring complex environments such as Kubernetes or Openshift, where many of the services are not exposed to the outside, such as databases or backend services, and that you could monitor if you deployed a pod with the satellite within the network and directly attacking these services, for example.

Do you already know what a web firewall is? Let us tell you about it.

There’s something that humans and machines have in common, and no, it’s not the disappointment suffered by the final season of Game of Thrones, or, well, at least not only that. What we have in common is that we need protection. You know, animals need it too, and plants, but if you’ve gotten this far, it seems that you’re interested in computers, networks and all these pretty modern “geek” things, so today we’ll talk about that kind of protection.

Just as you would protect your dog, your ficus or yourself, you have to protect your computer. The world is a place full of dangers and risks and the Internet is not far behind. It’s like in Crystal Jungle, only instead of people carrying guns around, we’ll find hunched over users willing to collect information from your computer, networks, and troll you in any possible way.

Remember: “The night is dark and harbors errors”. And horrors too.

The Internet also hosts them, so to protect our beloved computer, we must make use of a “Web Firewall”. What is this “Web Firewall”?

A “Web Firewall” is a system that is intended to protect our private network and block unauthorized access or attacks from other networks. In turn, it allows incoming and outgoing traffic between computers on the same network. That is, it is like the door of your house, or, worth the analogy, a half-open blind that only lets in a specific amount of breeze according to your personal comfort.

But not only that, it can be our beloved ally, protector of what we love the most, since through configurations you may limit, encrypt or decrypt this traffic. Here’s another lucid analogy: Maybe, in your day to day, you have to go to a clandestine meeting whose members no one should know. It is similar with your computer, you may encrypt your traffic so that you cannot access the most relevant data.

The web firewall, capable of such feats, can be implemented in hardware or software. If it’s well configured, it will be an advantage when it comes to protecting your networks, so it’s vitally important to understand how it works and how you may get the most out of it.

How does a web firewall work?

Outline of a firewall on a computer network

It is usually located at the junction point between two networks. Each network or computer can have its own firewall. This can limit the consequences of an attack, as you can prevent damage from spreading from one network to another. The sooner the spread of evil is tackled, the better.

The essential thing that you must know for the operation of the web firewall is that the totality of information and traffic that goes through our router and that is transmitted between networks is analyzed by it. If the traffic complies with the rules you have configured for it, it can enter or leave your network. If the traffic does not meet those certain rules, then it will be blocked from reaching its destination.

There are several methods by which you may filter the traffic of the firewall, for example, configuring it as you please. Remember that a good firewall configuration is paramount. If the lock on your front door was badly designed and anyone could open it, bad people could get in and steal, this is the same thing.

Let’s take a look at some of the filtering methods we’ve been provided by our dear friend, the Web Firewall.

Traffic filtering methods

• Firewall policies: They allow you to block certain types of network traffic.
• Anti-spam firewall: It protects against spam, phishing, etc.
• Antivirus firewall: It protects the internal network against attacks that come from the Internet or wan.
• Content filtering: It allows you to block some types of web content.
• WAP Managed Service: It allows you to control wap devices.
• DPI services: It allows you to control specific applications.

There are a few types of firewalls to highlight, these can be software or hardware, and, if we investigate a little more, we will find others that are somewhat more defined.

Types of web firewall

• Gateway application level: It applies security mechanisms for specific applications.
• Gateway level circuit: It applies security mechanisms when a tcp or udp connection is established.
• Packet filtering: At network level as an IP packet filter.
• Personal: It is installed as software on your computer.

Using a firewall has lots of advantages. We already discussed some, with lots of examples and tremendous analogies, even so, we are going to list the most obvious ones:

Advantages of using a firewall

• It blocks access to computers and/or applications to our networks.
• It allows you to control and restrict communications between the parties under your settings.
• It optimizes communication between internal network elements, helping to reconfigure security settings.
• It establishes reliable perimeters.
• Protection of intrusions and private information.

Nothing is perfect, and web firewalls, despite their fiery name, well, they aren’t either. These also have some notable limitations:

Limitations of a web firewall

• It cannot protect itself from attacks whose traffic does not go through it.
• It cannot protect threats made by insider attacks or negligent users.
• It does not protect against service security flaws and protocols whose traffic is allowed.
• It cannot protect against attacks on the internal network through files or software.

There are many firewall systems, if we use Linux, the one commonly used is Iptables. Yes, it sounds weird, we don’t like weird sounding things and since we don’t like weird things we use the firewall… Hmm… before entering a self-destructive paradox, we will try to understand what this“Iptables” is through a simple explanation.

What is Iptables?

Linux has a firewall system included in its kernel called Iptables, although its configuration can be a bit complex. Its default configuration is to allow everything to enter and exit.

With a suitable Iptables configuration you will be able to filter which packages, data or information you want to enter and which ones you do not. Just like the previous example about the inputs.

To work with Iptables you need administrative permissions so you will have to use sudo. You will have to choose wisely what you let in and what not, and, for this, an adequate knowledge of the commands that you can use in this system is necessary. The following examples are only intended to teach a basic configuration to understand the logic of the web firewall, but for a more correct and complex configuration, I recommend adding information by searching the Internet, specialized books or colleagues in the world.

Some commands to understand Iptables

sudo iptables -P INPUT DROP

-P = Anyone who wants to access the computer
INPUT = We ignore it
DROP = We ignore it

With this command nobody will be able to enter your computer, in fact you neither… so it is not the most appropriate one.

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

The first line tells us that our own computer (lo = localhost) can do whatever it wants.

Before, we said that this was like a house, if we have siblings, parents or children and they leave, we want them to be able to get in again, right? Well that’s what we do with the second line, all the connections that come out of our computer will be allowed by Iptables.

sudo iptables -A INPUT -p tcp –dport 80 -j ACCEPT

With this command, anyone can see the websites that our computer has.

-j ACCEPT = Accept or allow
-dport 80 = Traffic to port 80
-p tcp = make it tcp
-A INPUT = that is incoming

These would be some basic examples of how Iptables works. That is, just to understand the basics of its operation. Like I said, I recommend digging deeper and diving into more information to make an acceptable setup.

And just like Game of Thrones ended, this article also does it, although much better (what a crappy last season), so I only have to say goodbye and wish you to have a good day. AH! And to recommend you to use Pandora FMS, which despite not being a web firewall, is a tool that will also help you protect yourself by collecting information.