VPN systems use non-TCP/UDP

VPN systems use non-TCP/UDP protocol, or use privileged low (< 1024) ports (e.g. ISAKMP used by IPSEC uses port 500) that are often blocked by firewalls. This means that VPN clients can be unusable from many places like public hotspots, hotels and many GPRS connections. User mobility and remote access often do not work with a VPN model. The above limitations of the current VPN systems have been the driving force for the authors for the design of N2N. In a nutshell we ask: "Is it possible to have decentralised, network-administrator-free, secure and permanent network access with a single/uniform address regardless of the current user's location, local IP address and network type?".The authors  designed N2N  to give N2N users the ability to create dynamic private networks. As happens with community networks, users should be able to create their own overlay network which other users are invited to join. With VPN the network administrator chooses who may join the VPN and what interactions will be tolerated. N2N is somewhat similar to Hamachi [12], a popular application mostly used for creating private networks on which to play games. With N2N users can choose their IP address and the encryption keys, whereas with Hamachi this is not possible and all the security is delegated to Hamachi, making the whole solution weak from a security point of view.

VPN capable nodes

Media independent handover is an IEEE 802.21standards-based solution that defines access technologyagnostic interworking procedures. The IEEE 802.21working group, initially chaired by Ajay Rajkumarfrom Bell Labs, began work in 2004, resulting in astandard being approved in January 2009.The goal of MIH is to facilitate handovers betweenheterogeneous access networks through the definitionof a core set of services and components that wouldexist within both UE and throughout the network.MIH partitioned the services into three general categories: command, event, and information. Additionally,MIH defines a protocol for communication betweenMIH-capable nodes (e.g., mobile node [MN] to network, or network to network) that allows for coordinated efforts before, during, and after a handover.An MIH-capable node contains an MIH function(MIHF) that provides one or more of the core servicesto the upper layers (MIH users), and expects a minimum set of functions from the lower (link) layers. As shown in Figure 2, MIH users gain access to MIHservices through an MIH service access point(MIH_SAP), whereas MIHF gains access to lower layer

When building a VPN based on p-to-p overlays

When building a VPN (Ferguson et al., 1998) based on p-to-p overlays, connection-oriented (like ATM or frame relay, tunneling-on-IP techniques) scalability is a main problem, while VPNs based on MPLS are used to address scalability issues (as they are purely designed on the basis of connection-less, peer-based architecture). Since, a customer-site in a peer-based architecture requires the peer simply within a single provider-edge router in place of the entire customer-edge/provider-edge routers which are associated with the VPN that results in the reduction of large number of VCs. In addition, MPLS-based VPNs naturally use connectionless approach. The Internet is to be obliged its worth to its fundamental approach which is based on connection-less, packetswitching network topology (i.e., TCP/IP). Thus, it does not require any prior act to make association possible in a flexible and useful way among the hosts. In an IP-based connection-less setup the traditional VPNs require initial connection establishment process over p-to-p, connection-oriented overlay networks. When it utilizes under a connection-less environment it still can not get benefit from the connection simplification and service expandability offered by connection-less network. In contrast, if a connectionless VPN is built, to guarantee the network privacy the use of tunnels and encryptions are not required, hence it eliminates the considerable complications.

numerous ICMP packets have arrived

numerous ICMP packets have arrived within a small time interval; application-specific bufferoverflow attacks to obtain root privilege, such as  subverting an FTP server by a long "MKDIR" command, may require buffering and reassembling several packets before seeing the whole FTP command. A network-based IDS can detect such attacks by matching a sub-string, for example, the "phf" in " GET/cgi-bin/phf?," to identify those network packets as vehicles of a web server attack. When such kinds of potential hostile activities are detected, IDS will alert system administrators and may block the activity. The above examples describe the basic functions of a network based IDS.  In fact, the IDS model can be host-based IDS (HIDS) or network-based IDS (NIDS). HIDS is installed at a host to periodically monitor specific system logs for patterns of intrusions. In contrast, an NIDS sniffs the traffic to analyze suspicious behaviors. A  signature-based  NIDS (SNIDS) examines the traffic for patterns of known  intrusions. SNIDS can quickly and reliably diagnose the attacking techniques and security holes without generating an over-whelming number of false alarms because SNIDS relies on known signatures. However,  anomaly-based NIDS (ANIDS) detects unusual behaviors based on statistical methods. ANIDS could detect symptoms of attacks without specific knowledge of details. However, if the training data of the normal traffic are inadequate, ANIDS may generate a large number of false alarms.

There are several motivations for building VPN’s

There are several motivations for building VPN's, but a common thread in each is that they all share the requirement to "virtualize" some

portion of an organization's communications – in other words, make some portion (or perhaps all) of the communications essentially

"invisible" to external observers, while taking advantage of the efficiencies of a common communications infrastructure.

The base motivation for VPN's lies in the economics of communications.  Communications systems today typically exhibit the

characteristic of a high fixed-cost component, and smaller variable cost components which vary with the transport capacity, or bandwidth,

of the system.  Within this economic environment, it is generally financially  attractive to bundle a number of discrete communications

services onto a common high capacity communications platform, allowing the high fixed-cost components associated with the platform to

be amortized over a larger number of clients.  Accordingly, a collection of virtual networks implemented on a single common physical

communications plant is cheaper to operate than the equivalent collection of smaller physically discrete communications plants, each

servicing a single network client.

So, if aggregation of communications requirements leads to a more cost-effective communications infrastructure, why not pool all these

services into a single public communications system?  Why is there still the requirement to  undertake some form of partitioning within

this common system that results in these "virtual private" networks?

VPN Client User Guide for Windows

The principal goal of this paper is to provide best-practice information to interested parties for designing and implementing

Enterprise IP Security (IPSec) virtual private networks (VPNs). The SAFE white paper for large enterprises and the SAFE

white paper for small, midsize and remote user networks are both available at the SAFE Web site: http://www.cisco.com/go/

safe. These documents were written to provide best-practice information on network security designs. They include some

element of VPN configurations and design guidance. This document continues the discussion, examining specific design

considerations and best-practice recommendations for IPSec VPNs in networks today. Although you can read this document

without having read either of the two security design documents, it is recommended that you read the document most

appropriate to your network size before you read this document. For example, a business with a large network might look

at the enterprise SAFE white paper before reading this document. This exercise will frame the VPN conversation within the

context of overall security design. SAFE represents a system-based approach to security and VPN design. This type of

approach focuses on overall design goals and translates those goals into specific configurations and topologies. SAFE is based

on Cisco products and those of its partners.

This document begins with an overview of the architecture, and then details the specific designs under consideration. The

following designs are covered in detail:

• Remote-user VPN designs

• Small-network VPN design

• Medium-network VPN design

• Large-network VPN design (with extranet connectivity)

• Distributed large-network VPN design

A ZDDP tribofilm experiment consists of the following:

A ZDDP tribofilm experiment consists of the following:

1. The test chamber containing lubricant is heated while rotating the ball and disk in pure rolling with no applied load until the test temperature is reached.

2. Motion is then halted and the glass window is loaded against the stationary steel ball. An interference image of the window/ball contact is captured for subsequent analysis to determine the spacer layer thickness.

3. The glass window is withdrawn from the steel surface and a rubbing test carried out for a set duration at the set temperature. In this, the steel ball is loaded against the steel disk and the two are rubbed together in mixed rolling/sliding at low rolling speed to produce mixed or boundary lubrication. This generates a ZDDP tribofilm on the rubbed track of both the steel ball and steel disk.

4. Motion is then halted, the glass window loaded against the rubbed track on the stationary steel ball, and an interference image of the window/ball contact is captured. By comparison with the initial image, interference colors present can be used to determine the thickness of any solid-like tribofilm formed on the track.

5. Procedures 3 and 4 are then repeated over a total test time of several hours to obtain a series of interference images and thus maps of the variation of ZDDP tribofilm thickness on the ball over time.

It is important to note that the tribopair that forms the ZDDP film is the steel ball/steel disk sliding contact. The glass window is only loaded against the stationary ball to displace any supernatant oil and measure the thickness of the residual solid-like film present and this is done without rinsing or cooling the ball in any way and without removing it from the test apparatus.