Glossary
Multi-Tech Systems, Inc. RouteFinder RF850/860 User Guide (PN S000400E)
182
Cryptography
–
The art and science of using mathematics to secure information and create a high degree of
trust in the networking realm. See also public key, secret key.
CSR (Certificate Signing Request)
– The form used to obtain a certificate from a CA. A CSR generates a
formatted certification. This request is located on the web site of all certificate authorities. Another way to
generate a CSR is to use a utility such as Microsoft IIS or OpenSSL.
Datagram
– The unit of transmission at the ISO Network layer (such as IP). A datagram may be encapsulated
in one or more packets passed to the data link layer. A datagram is a self-contained, independent entity of data
carrying sufficient information to be routed from the source to the destination computer without reliance on
earlier exchanges between this source and destination computer and the transporting network.
CefaultRoute
– A routing table entry that is used to direct packets addressed to networks not explicitly listed in
the routing table.
DES (Data Encryption Standard)
– A secret key encryption scheme; contrast with “public key”. DES is an
NIST standard for a secret key cryptography method that uses a 56-bit key.
Destination Port Number ZZZZ
–
All the traffic going through the firewall is part of a connection. A connection
consists of the pair of IP addresses that are talking to each other, as well a pair of port numbers. The destination
port number often indicates the type of service being connected to. When a firewall blocks a connection, it will
save the destination port number to its logfile.
Port numbers are divided into three ranges:
•
The Well-Known Ports are those from 0 through 1023. These are tightly bound to services, and usually
traffic on this port clearly indicates the protocol for that service. For example, port 80 virtually always
indicates HTTP traffic.
•
The Registered Ports are those from 1024 through 49151. These are loosely bound to services, which
means that while there are numerous services "bound" to these ports, these ports are likewise used for
many other purposes. For example, most systems start handing out dynamic ports starting around 1024.
•
The Dynamic and/or Private Ports are those from 49152 through 65535. In theory, no service should be
assigned to these ports.
DHCP (Dynamic Host Configuration Protocol)
–
An IETF standard for dynamically allocating and managing a
pool of IP addresses, allowing a smaller number of addresses to serve a much larger number of users.
Digital Signature
– The encryption of a message digest with a private key. Digital signatures
are based on
public-key cryptography, which was first introduced by Whitfield Diffie and Martin Hellman of Stanford University
in 1976. Until 1976 there was only conventional cryptography, which uses the same key to both scramble
(encrypt) and unscramble (decrypt) information. Public key cryptography is based on two keys, a private key
and a public key.
Where conventional cryptography is a one-key system for both locking (encrypting) and unlocking (decrypting) a
message, public key cryptography uses different keys for locking and unlocking.
In public-key systems, one key can be kept private while the other key is made public. Knowing the public key
does not reveal the private key.
DMZ (De-militarized Zone)
–
A special LAN on the public network side of a firewall to allow a single WAN
router to support both private (VPN) and public access to resources. A DMZ allows a single WAN router to
support both private (VPN) and public access to resources. Using a DMZ allows one IP Address (computer) to
be exposed to the Internet. Some applications require multiple TCP/IP ports to be open. A DMZ allows just one
computer to be exposed for that purpose. It is recommended that you set your computer with a static IP if you
want to use DMZ.
DNAT (Dynamic NAT)
– Used to operate a private network behind a firewall and make network services that
only run there available to the Internet.
The use of private IP addresses in combination with Network Address Translation (NAT) in the form of
Masquerading, Source NAT (SNAT), and Destination NAT (DNAT) allows a whole network to hide behind one or
a few IP addresses preventing the identification of your network topology from the outside. With these
mechanisms, Internet connectivity remains available, while it is no longer possible to identify individual
machines from the outside. By using Destination NAT (DNAT), it is still possible to place servers within the
protected network/DMZ and make them available for a certain service.
In DNAT, only the IP address – not the port – is translated. Typically, the number of externally visible IP
addresses is less than the number being hidden behind the NAT router.
