I had mentioned in a prior post (click on link for description) that my field project during my Master in Information Technology here at Ecole Centrale Paris could be a network physical mapping software. Well, this is now confirmed.
Our three-strong team (+ 1 project supervisor: Simon ‘Garf’, a computer science Ph.D. student and graduate from Ecole Centrale Paris; + 1 business plan advisor: Olivier Ezratty; + 1 software modeling advisor: Dominique Sauquet; + 1 sponsor company: we’re looking for sponsorship: if you work in a computer networks company and may provide some technical expertise, feel free to contact me) made up of Jean-Sébastien (well..by telephone
), Pierre and I recently gathered to kick-off the project. The present post is a debriefing of our thoughts, since we thought it could be interesting to see how people challenged our technical decisions.
We started with housekeeping issues such as project management tools and the work breakdown: my mates are not in favour of a plain vanilla blog, so we decided to MAYBE go for a wiki; on the responsibility side, Jean-Sébastien will deal with software engineering & development breakdown, Pierre with computer networking issues and relations with technical experts, and I with the business plan and handling relations with potential clients that will help us develop the functional specs. We will all take part of all processes: writing a rather brief business plan to help us keep in mind that the software has a market (if it actually has one), meet with potential clients, take part of technical meetings, develop the software, etc. On this latter point, I should be assigned with parts of the user interface, which is fine since it’s a rather simple part and I’m a beginner in software programming.
Technically speaking, Jean-Séb and Pierre had priorly thought of potential solutions to our problem: we plan to map networks. That’s right. But…isn’t security one of the major purposes for having a network? So why would a computer network allow our software to actually draw a map of it?
Here’s a list of the potential outcomes of our problem, provided that our application architecture is so far based on a Live CD (a CD on which one may write data) we would insert on one of the network’ machines:
* Provided that the Live CD would already detect the IP address of the machine it’s running on and that a private IP address starts may start like this (see picture on your right) 192.168.[XXX].[XXX], we may first write a software that would ping all IP addresses network possibilities. Provided that 000<=XXX<=256, that’s 65 536 possibilities. Jean-Sébastien having tested detection time (3 sec. when there’s no firewall, 30 secs. when there’s security), this solution would cost between 54 hours (if no firewall at all) and 546 hours (if highly secured) – lowered down to respectively 30 minutes and hours considering that a 100-strong multi-threading is feasible. This is reasonable. There should however exist a more elegant outcome like limiting the search to between 5 and 45 minutes. But then, we couldn’t certify effective results unless we give the software clear instructions like “scan the nearest addresses first, and extend your range”. Feasible.
* A second option could be to insert, further to the master Live CD, a slave Live CD on a second machine in a nearby sub-network. Both CDs would send a traceroute message to each other, mapping out the path between themselves. We could repeat the operation until the network’s entirely mapped. Probably effective, but not so time efficient: it costs someone to monitor mapping operations, and SME CFOs (also doing the CIO job) we target probably have other things to do. This is however an option we’ll explore.
* A third option relies in slightly changing the software’s aim and making it a tool to help firewall settings. The Live CD would send an nmap request to all neighbouring ports, enabling the mapping of all used and useful ports in the sub-network – which can really help an administrator configure a firewall. This option doesn’t anyways prevent us from searching and mapping the IP addresses, MAC addresses and masks of the network machines, as primarily defined.
* A fourth option could be to focus on Windows-powered companies with a domain name networks. Indeed, such networks are regulated by a domaine controller, which constantly (every 30 secs.) sends a message saying “I’m your domain controller” to all the devices plugged on the network. Therefore, provided that the only way to infiltrate the domain controller is through Windows, we would just have to collect data.
Four last, not uninteresting things (Our Market, The Competition, Legal Disclaimer, So What?):
1) Our Market: Provided that our software won’t technically fit huge, complex MNC networks, we first decided to remain in the less than 200 machine companies range. But most probably, a company with 200 network devices already have a network administrator, who would already have purchased a router – hence making the results provided by our software sort of less certain. Consequently, our market will probably be the 5 – 50 headcount range companies. I have to thing about it more, but that’s already a huge market, even if we only focus on the Paris region (although we plan to write the software in English).
2) The Competition: We’ve decided to thoroughly look at the following software to see what has been done in the past and which functions still remain unimplemented:
http://www.10-strike.com/lanstate/ – LanState has many many features, but it is probably too broad a software and not enough a mapping software to be competing with our project
http://www.microsoft.com/mom/evaluation/overview/default.mspx – MS
Operations Manager, a network monitoring software; needless to say, we’re Microsoft’s number one enemy as Paul Allen recently stated (just kidding);
http://nagios.org/ – an open-source networks administrator, pretty hard to set up;
http://www.neon.com/ls1.shtml?gclid=COOvsMe3q4cCFSV-Qgod729v6Q – very serious competition in many respects;
http://insecure.org/nmap/ – free, open source, and it works pretty well;
http://www.i2g.fr/ – for physical networks mapping (cemetaries, electricity, gas, etc.);
http://www.quaternet.fr/whatsup/whatsup.asp – for very small networks (<=10 machines) only.
3) Legal Disclaimer: we’re not hackers, we want to empower our clients with the appropriate physical mapping tools. Anyways, this wouldn’t be of any interest to us: in France, breaking in into someone’s office and stealing a laptop costs 1 year in jail whilst penetrating and stealing information through the Internet costs 5 years in jail and up to 200Keuros (250 K$). Food for thought…
4) So What? – We plan to make, upon completion of the software prototype, of this project an open-source project available to the free software online community for programmers from all over the world to build on what we would’ve done in 4,5 months.
There you go with the network mapping software project’s first review. I’ll keep you readers posted. Ideas most welcome, both on the technical and business sides.
If you’ve got a footstep in a small or medium company and you fell such a software may help, please contact me so that if you help us with devising the funtional specifications, we’ll assist you in the deployment of the software for free.