IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
accordance with security requirements, and thus achieves a controlled linkage
between insecure networks and networks requiring protection.
On the other hand, it might become necessary to separate two networks if one
needs to be protected against access from the other and vice versa, if the
network availability in the event of a failure needs to be increased, or if the
load on the individual network segments needs to be decreased.
To prevent manipulation, all network coupling devices must be installed so
that only authorised persons have physical access to them.
Repeaters
Repeaters operate on layer 1 of the OSI model, and simply comprise signal
amplifiers. As a result, they allow the maximum cable length of an existing
network segment to be increased, or several network segments to be linked
together. In an Ethernet network based on coaxial cables, for example,
repeaters can be used to extend the maximum cable length to more than 185 m
and 500 m respectively (for thin and thick Ethernet cables). Observance is
required here of the configuration rules for repeaters, which impose
constraints on the number and arrangement of repeaters.
In the case of twisted-pair cabling, repeaters are often used as central or
decentral network nodes for the purpose of linking individual network
subscribers. As several repeaters need to be connected together in one device
for this purpose, such a device is termed multi-port repeater. Multiport
repeaters are often also identified as hubs or mini-hubs.
The separation thus achieved on layer 1 of the network restricts electrical
errors to just one segment. However, this does not apply to errors occurring on
higher layers (e.g. excessively frequent collisions or broadcast storms). Some
manufacturers now also offer multi-port repeaters which evaluate information
from layer 2 (but do not act as bridges), thus allowing the implementation of
access restrictions. With such devices, for example, it is possible to grant
network access only to certain network users.
Bridges
Connection of networks on layer 2 of the ISO/OSI reference model is
performed using bridges. A bridge connects two networks which generally use
the same logical link control protocol (LLC), but different medium access
control (MAC) protocols. For instance, a bridge can connect an Ethernet with
a Token-Ring network. Such a bridge is termed translation bridge or T-bridge.
This results in three essential advantages:
- The bridge separates collision domains, i.e. performance-reducing
collisions occurring in one segment of a CSMA/CD-based network do not
impair other segments.
- A bridge only routes data packets to another segment if the destination
address of the packets is located in that segment. This restricts the data
traffic to the required segment in each case, thus lowering susceptibility to
eavesdropping.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000