MONOGRAPH ON A computer network for afghan high school شبکه کمپیوتری برای لیسه عالی افغان BY Irshad ahmad mehrabi 21-RB-200-375 In partial fulfillment of the requirements for the award of the degree of BACHELOR OF INFORMATION TECHNOLOGY BIT TO RANA University MONOGRAPH ON A computer network for afghan high school شبکه کمپیوتری برای لېسه عالی افغان In partial fulfillment of the requirements for the award of the degree of BACHELOR OF INFORMATION TECHNOLOGY )BIT( TO RANA University PROJECT APPROVAL SHEET The undersigned certify that they have read the following Project Report and are satisfied with the overall exam performance and recommend the project to the Department of Computer Science for acceptance. Title: a computer network for afghan high school Prepared by: MR. irshad ahmad mehrabi Reg No: 21-RB-200-375 Recommended by: Mr. Sayed Hassan Sabit Vice Dean & Project Coordinator Project Coordinator: Mr._________________________________ Name &Signature Dean of BCS Faculty: Mr._________________________________ Name & Signature Vice Chancellor Academic Mr._________________________________ Name & Signature RANA University Management Verification & Stamp: Date. _________________________________ PROJECT EVALUATION SHEET (Decision of the Monograph Evaluation Committee) Assessment Criteria Member 1 Problem Definition: Relevant Yes No clearly phrased Yes No Testable Yes No Research Design: Theoretical Background Yes No Appropriate Research Method Yes No Research Result: Description Analysis Analysis, Interpretation and Conclusion: Clear Yes No Further Comments (Allocate Marks out of 25%) Name of the Committee Member: Sign: Member 2 Problem Definition: Relevant Yes No clearly phrased Yes No Testable Yes No Research Design: Theoretical Background Yes No Appropriate Research Method Yes No Research Result: Description Analysis Analysis, Interpretation and Conclusion: Clear Yes No Further Comments (Allocate Marks out of 25%) Member 3 Problem Definition: Relevant Yes No clearly phrased Yes No Testable Yes No Research Design: Theoretical Background Yes No Appropriate Research Method Yes No Research Result: Description Analysis Analysis, Interpretation and Conclusion: Clear Yes No Further Comments (Allocate Marks out of 25%) Name of the Committee Member: Sign: Member 4 Problem Definition: Relevant Yes No clearly phrased Yes No Testable Yes No Research Design: Theoretical Background Yes No Appropriate Research Method Yes No Research Result: Description Analysis Analysis, Interpretation and Conclusion: Clear Yes No Further Comments (Allocate Marks out of 25%) Name of the Committee Member: Sign: DECLARATION I hereby confess that, the monograph “a computer network for afghan high school ” of the requirements for the Degree of Bachelor of Information Technology (BIT) to RANA University related to my work therefore not submitted for any other degree, diploma fellowship or similar title or prize. Name: irshad ahmad mehrabi Signature: Date: FACULTY CERTIFICATE This is to certify that the project / Monograph titled “a computer network for afghan high school” Submitted in partial fulfillment of the requirements for the degree of “Bachelor of Information Technology to RANA University, Baraki Square, Kabul – Afghanistan is carried out By Mr. irshad ahmad mehrabi Under my direct supervision, guidance and that no part of this report has been submitted for the award of any other degree, diploma, fellowship or other similar titles or prize and that work has not been published in any scientific or popular journals or magazines. FACULTY PARTICULARS DEPARTMENT IN CHARGE Name: Mr. Sayed Hassan Sabit Name: Mr. Abdul Ghafar Omarkhel Qualification: BSC in Mathematic Qualification: M.C.S Computer Science Designation: Vice Dean & Project coordinator Designation: Dean of Faculty ID No: RU-02-101 ID No: RU-02-014 Signature: Date: ACKNOWLEDGEMENT All praises and thanks to Almighty Allah, the source of knowledge and wisdom to mankind, who conferred me with power of mid and capability to take this material contribution to already existing knowledge. All respect and love to him who is an everlasting model of guidance for humanity as a whole. I would like to express the deepest appreciation to the committee chair Mohammad Ebrahim Zain Safi the Chancellor of Rana University, who encouraged me in writing my monograph on “a computer network for afghan high school ” with the attitude and the substance of a genius, he continually and convincingly conveyed a spirit of adventure accordingly. I wish to thank my project supervisor, Mr. mohammad qasim safi whose guidance made my project possible. His encouragement and wisdom made my efforts worthwhile. My heartfelt gratitude also goes to Dean of CS Faculty, Mr. Abdul Ghafar Omarkhel for his insight and completion of my project. It is with great honor that I would also like to thank my family, whose names I have not mentioned, how yet supported and helped me in one way or the other. Finally, I just want to thank you for the reading of my thesis which it takes time. Signature Irshad ahmad mehrabi Reg#: 21-RB-200-375 BIT (Bachelor of Information Technology) CHAPTER 1 : introduction Introduction This network has been designed for the Afghan School. The Afghan School, located in the Khushal Khan Mina area of Kabul, provides educational services to the country’s citizens. The school has two branches: one for male students and the other for female students. The Afghan School consists of two buildings, which house the administration, headmaster's office, finance department, library, and computer lab. The school aims to establish a computer network for these two buildings to ensure that its operations are carried out in an organized manner and efficiently, saving time. I have designed this network for the school to ensure it has excellent internet connectivity and can carry out its tasks with complete security and effectiveness. I am trying to build this network with low cost and good quality, while ensuring that it has strong security so that no issues arise for the Afghan school staff. Chapter 2 : Existing and Proposed System Existing system This school have not a computer network or internet is not exist Because we want to create a computer network for this school to get his work faster. The Afghan school did not have a computer network and faced many problems. Therefore, the principal requested that a network be set up for our school. Inadequate Existing Network Problem: In many organizations, the existing network may not be compatible with current technology. This can negatively impact network speed, scalability, and security. Increase in Users Problem: The growing number of users can pose a significant challenge for the network’s capacity and capabilities. Security Vulnerabilities Problem: Network security threats such as hacking attacks, internal threats, and data breaches can cause serious issues for the organization. 4 -Inefficient Data Exchange Problem: If the network does not facilitate efficient data exchange, it can lead to performance degradation and latency issues. I want to create an advanced computer network for this school to solve their problems. Inefficient Data Exchange Problem: If the network does not facilitate efficient data exchange, it can lead to performance degradation and latency issues. Proposed System I think about this project very important for this school manager I trying to make this project successful so that the school principal can manage effectively and easily guide all the staff. I believe this project is very important for the principal of the Afghan school. I will make every effort to complete this project successfully so that the principal can easily manage the school and quickly accomplish both his own tasks and those of the staff. Data Exchange Speed and Volume Solution: By implementing computer networks, the speed of data exchange can be increased. Networks can enable data transfer with higher bandwidth and lower latency, enhancing employee work speed and improving operational efficiency. Network Security Solution: Building computer networks can ensure security measures like firewalls, encryption, VPNs, and traffic monitoring, which help safeguard organizational data and prevent internal and external attacks. User Growth and Network Expansion Solution: Computer network design can offer scalability. To reduce network load, high-capacity hardware such as switches, routers, and servers should be used. Additionally, for horizontal network expansion, VLANs or Load Balancing can be implemented. Technological Advancements and Coordination Solution: The design of computer networks should be aligned with the latest technologies. Implementing wireless technologies (Wi-Fi 6, 5G), cloud services (Cloud Computing), and DNS (domain name system) for horizontal network expansion can help integrate new technologies into the organization's network. Chapter 3 : logical design Logical design In this network, there are two main routers, two switches 24port 2960 , one server, two access points, six laptop computers, twenty-six desktop computers, ten printers, and four wireless phones. A structured network has been designed. Chapter 4 : Physical design Chapter 5 : DHCP DHCP (Dynamic Host Configuration Protocol) DHCP is a network management protocol used on IP networks. It enables devices (known as clients) to automatically receive IP addresses and other essential network configuration details from a DHCP server, making network management more efficient. 1- How DHCP Works: DHCP works by assigning IP addresses dynamically to devices when they join a network, which saves network administrators from manually assigning static IPs. Here’s the step-by-step process: 1. -DHCP Discover: - When a device (client) joins the network, it sends out a DHCP Discover message to locate any available DHCP servers on the network. 2-DHCP Offer: - The DHCP server responds with a DHCP Offer message, which includes an available IP address, the subnet mask, the lease time (how long the IP address is valid), and other configuration information (such as the default gateway, DNS servers, etc.) 3. -DHCP Request: - The client then responds with a DHCP Request message to the server, indicating it wants to accept the offered IP address. 4. DHCP Acknowledgment - The DHCP server sends a DHCP Acknowledgment (ACK) message to the client, finalizing the IP address assignment and the lease time. 2components of DHCP - DHCP Server: This is the device that allocates and manages IP addresses and provides network configuration information. - DHCP Client: This is any device on the network (such as a computer, smartphone, or router) that requests an IP address from a DHCP server. -DHCP Lease: The period of time that an IP address is assigned to a client. After this period, the client must renew the lease or the IP address is returned to the pool of available addresses. - DHCP Scope: The range of IP addresses that the DHCP server can assign to clients. 3 -DHCP Messages: - Discover : Sent by the client to find a DHCP server. - Offer : Sent by the server to propose an IP address to the client. - Request : Sent by the client to request the offered IP address. - Acknowledge (ACK) : Sent by the server to confirm the IP address allocation. - NACK (Negative Acknowledge) : Sent by the server if it cannot provide the requested IP address. - Release : Sent by the client to inform the server that it no longer needs the IP address. - Inform : Sent by the client when it needs to request additional configuration parameters, but does not need an IP address. 4. - Types of DHCP - Automatic : The DHCP server permanently assigns a specific IP address to a client from a pool of available addresses. Once assigned, the IP is reserved for the client. - Dynamic : The server assigns an IP address from a pool of available addresses for a limited time (lease time). - (Static) : The DHCP server assigns specific IP addresses to clients based on their MAC addresses (known as DHCP reservation). This is typically used for devices that need a fixed IP (e.g., servers or printers). . Advantages of DHCP - Simplified Configuration : DHCP automates IP address assignment, reducing manual configuration and errors. -Efficient IP Address Management : It dynamically assigns IP addresses, ensuring that IP address usage is optimized. - Flexibility : It supports mobile devices, allowing them to move between networks and still obtain valid IP configurations without manual intervention. - Reduced Network Admin Workload : It eliminates the need for manual configuration of each device’s IP address. - 6. Common DHCP Issues - IP Address Conflicts : If a client receives an IP address that has already been assigned to another device, it can cause network issues. This is typically resolved by proper lease management and DHCP server configuration. - DHCP Server Unavailability : If the DHCP server is down or unreachable, devices won’t be able to obtain IP addresses, leading to network disruptions. - Exhausted IP Pool : If the DHCP server runs out of available IP addresses in its scope (because too many devices are on the network), new devices cannot obtain an IP address. - Lease Expiration : If the client doesn’t renew its lease in time, it may lose its IP address, which could cause network issues until the lease is renewed or reassigned. - 7 DHCP Security Considerations - DHCP Spoofing : A malicious user could set up a rogue DHCP server to assign incorrect IP addresses, causing network disruptions or man-in-the-middle attacks. - DHCP Starvation Attack : This attack involves sending numerous DHCP requests with fake MAC addresses to exhaust the DHCP server’s available pool of IP addresses. - DHCP Snooping : A security feature used in switches to prevent rogue DHCP servers by allowing only authorized DHCP servers to assign IP addresses to clients. 8- DHCP in Different Environments - Home Networks : DHCP is often used by routers to provide IP addresses to all connected devices (laptops, smartphones, IoT devices). - Enterprise Networks : DHCP can be configured to work with larger and more complex network topologies, with multiple subnets and more sophisticated options (such as DNS servers, VLAN assignments, etc.). - ISPs : DHCP is commonly used by Internet Service Providers (ISPs) to assign IP addresses dynamically to home broadband routers and modems. DHCP Option DHCP allows the transmission of various options that can be configured to send additional information along with IP address assignment: - Option 3 : Default Gateway - Option 6 : DNS Servers - Option 15: Domain Name - Option 51: Lease Time - Option 66 : TFTP Server Name (used for PXE booting) - Option 67 : Bootfile Name (used for PXE booting) - 10. DHCP Protocol Versions: - DHCPv4 : The most commonly used version of DHCP, which assigns IPv4 addresses. - DHCPv6 : A version designed for IPv6 networks, providing similar functionality but adapted for the larger address space and different structure of IPv6. Conclusion: DHCP is a key protocol in modern networks, automating the assignment of IP addresses and other essential configuration information. It simplifies network management, reduces administrative overhead, and helps ensure smooth and dynamic communication between devices. However, network administrators must consider security issues and the potential for misconfigurations to ensure the network runs efficiently and securely. CHAPTER 6: HSRP HSRP (Hot Standby Router Protocol) is a Cisco proprietary redundancy protocol used to ensure network reliability and minimize downtime in case of router failures. It allows multiple routers (usually two or more) to work together to present a single virtual router (or gateway) IP address to the network. This helps provide high availability and fault tolerance for critical network paths. Key Concepts of HSRP 1. Virtual Router HSRP creates a virtual IP and MAC address that hosts in the network can use as their default gateway. This virtual router is shared by a group of physical routers. Only one physical router actively forwards traffic for the virtual IP at a time. 2. Active Router The router that is currently forwarding traffic for the virtual IP address is called the Active router. It is responsible for responding to ARP requests with the virtual MAC address. 3. Standby Router The Standby router is the one that will take over the forwarding of traffic if the Active router fails. It is continuously monitoring the Active router and will assume the role of the Active router when necessary. 4. HSRP Group HSRP routers are organized into groups, each identified by a unique group number (ranging from 0 to 255). Each group can have its own virtual IP address and associated virtual MAC address. 5. Hello Protocol Routers participating in HSRP exchange hello packets at regular intervals to maintain synchronization and detect the failure of the Active router. If the Active router fails, the router with the highest priority (or the next available router) takes over the Active role. 6. Priority Each HSRP router is assigned a priority value (default is 100). The router with the highest priority becomes the Active router. If there is a tie, the router with the highest IP address becomes the Active router. 7. Virtual MAC Address HSRP routers use a virtual MAC address to respond to ARP requests. The virtual MAC address format is: 00:00:0C:07:AC:xx where xx is the HSRP group number in hexadecimal. For example, for group 1, the MAC address would be 00:00:0C:07:AC:01. HSRP States HSRP routers transition through different states as they negotiate and monitor the status of the network: 1. Initial The router is powered on or reloaded and has not yet participated in HSRP. 2. Learn The router has not yet heard any HSRP hello packets and is learning about the virtual IP. 3. Listen The router has heard hello packets and is aware of the virtual IP address, but it is not currently the Active or Standby router. 4. Speak The router is actively participating in the election process to determine which router will be Active and which will be Standby. 5. Standby: The router is ready to take over in case the Active router fails, but it is not currently forwarding traffic. 6. Active: The router is the Active router and is currently forwarding traffic for the virtual IP. HSRP Timers HSRP routers use timers to maintain their roles and monitor the status of the Active router - Hello Time Default is 3 seconds. This is the interval between each hello packet sent by the Active router. - Hold Time Default is 10 seconds. This is the amount of time the Standby router will wait without receiving a hello packet from the Active router before assuming the Active role. - Dead Time The time a router waits before it determines the Active router has failed (default is 40 seconds). HSRP Versions There are two main versions of HSRP: 1. HSRP Version 1 (HSRPv1): - This version uses the 224.0.0.2 multicast address for hello packets. - It supports up to 256 groups (0 to 255). - It does not support IPv6. 2. HSRP Version 2 (HSRPv2): - This version uses the 224.0.0.102 multicast address for hello packets. - It supports up to 4096 groups (0 to 4095). - It introduces some improvements in security, such as authentication. - HSRPv2 also supports IPv6 addresses. HSRP Configurations Benefits of HSRP 1. Redundancy and High Availability: HSRP ensures that if one router fails, another router can quickly take over, minimizing network downtime and improving fault tolerance. 2. Load Sharing (with variations like GLBP): Although HSRP itself is typically designed for failover, other protocols like GLBP (Gateway Load Balancing Protocol) can be used to share the load between multiple routers, providing additional redundancy and efficient use of resources. 3. Simplicity: HSRP is relatively simple to configure and does not require complex routing protocols or changes to the IP addressing scheme. Limitations of HSRP 1. Cisco Proprietary: HSRP is proprietary to Cisco, so it may not be compatible with non-Cisco devices unless they support a similar protocol (e.g., VRRP - Virtual Router Redundancy Protocol). 2. Single Active Router: HSRP, by default, only allows one router to be the Active router at any time. In certain situations, this may not be the most efficient use of network resources. 3. No Load Balancing: In its basic form, HSRP does not provide load balancing between the routers; it only provides failover capability. However, features like GLBP or VRRP can address this need. Conclusion HSRP is an essential protocol for ensuring network resilience and high availability in Cisco networks. It provides router redundancy and ensures that network traffic can continue to flow smoothly even if one router fails. Understanding how to configure HSRP and leverage its features effectively is crucial for maintaining a reliable and fault-tolerant network infrastructure. Chapter 7: DNS DNS (Domain Name System) The Domain Name System (DNS) is a hierarchical and decentralized naming system that translates human-readable domain names into machine-readable IP addresses, enabling users to access websites and other resources on the internet. DNS plays a vital role in the functioning of the internet by making it easier for people to navigate online, as we typically access websites by their domain names rather than by their numerical IP addresses ( 192.0.2.1). Key Concepts of DNS 1. Domain Names: A domain name is a human-readable address used to identify websites or other services on the internet. The domain name is divided into different levels: - Top-Level Domain (TLD): The last part of the domain name, such as .com, .org, .net, .gov, etc. It can also be a country code, like .us, .uk, .in. - Second-Level Domain (SLD): The part before the TLD, like example in example.com. - Subdomains: Additional subdivisions under the domain name. For instance, mail.example.com or blog.example.com are subdomains of example.com. 2. DNS Records: DNS records are entries in the DNS database that provide information about domain names and their corresponding IP addresses. The most common types of DNS records include: - A Record (Address Record): Maps a domain name to an IPv4 address. - AAAA Record (IPv6 Address Record): Maps a domain name to an IPv6 address. - CNAME Record (Canonical Name Record): Used to alias one domain name to another (e.g., www.example.com to example.com). - MX Record (Mail Exchange Record): Specifies the mail servers responsible for receiving email for the domain. - TXT Record: Used for storing text information, often for verification purposes, such as SPF records for email authentication. - NS Record (Name Server Record): Specifies the authoritative name servers for a domain. 3. DNS Hierarchy: The DNS system is organized in a hierarchical manner, with each level of the domain name corresponding to a different level in the DNS database: - Root DNS Servers: The topmost level in the hierarchy. They contain information about the authoritative name servers for each TLD. - TLD Name Servers: Responsible for knowing the authoritative name servers for each domain within a specific TLD (e.g., .com or .org). - Authoritative Name Servers: The servers that hold the DNS records for a particular domain, providing the final response to DNS queries. 4. DNS Resolution Process: The process by which a DNS query is resolved involves several steps: 1. User Initiates a Query: When a user types a URL (e.g., www.example.com) into their browser, the browser checks if the domain name has been previously resolved (cached). 2. Querying the Recursive Resolver: If the domain name is not cached, the query is sent to a recursive resolver (typically operated by the user's ISP or a public DNS service like Google DNS). 3. Root Server Lookup: If the recursive resolver doesn't have the answer, it queries a root DNS server to find the authoritative name server for the relevant TLD. 4. TLD Server Lookup: The resolver then queries the *TLD name server* to find the authoritative name server for the domain. 5. Authoritative Server Lookup: Finally, the resolver queries the authoritative name server for the domain, which returns the corresponding IP address (or other DNS records). 6. Caching and Response: The IP address is returned to the user's browser, and it is cached by both the browser and the recursive resolver for future use. 5. DNS Caching: To improve speed and reduce the load on DNS servers, DNS responses are cached at various points in the resolution process: - Browser Cache: The browser caches DNS information to avoid repeated lookups. - Recursive Resolver Cache: DNS resolvers cache information to respond quickly to repeated queries. - Authoritative Server Cache: The authoritative server may also cache DNS information, though it typically has more up-to-date records. 6. Types of DNS Servers: - Recursive Resolver: A server that queries other DNS servers to resolve a domain name. - Authoritative Name Server: A server that stores the actual DNS records for a domain and provides definitive answers. - Caching Resolver: A type of recursive resolver that stores DNS records temporarily to speed up subsequent queries. 7. DNS Security (DNSSEC): DNS Security Extensions (DNSSEC) are designed to protect against certain types of attacks, such as cache poisoning. DNSSEC adds digital signatures to DNS records, which are verified by resolvers to ensure the integrity and authenticity of the responses. 8. Public DNS Services: Some well-known public DNS providers include: - *Google DNS (8.8.8.8 and 8.8.4.4)* - *Cloudflare DNS (1.1.1.1 and 1.0.0.1)* - *OpenDNS (208.67.222.222 and 208.67.220.220)* 9. Dynamic DNS (DDNS): Dynamic DNS is a service that allows users to automatically update their DNS records when their IP address changes. This is especially useful for home networks or for applications like remote access. 10. Reverse DNS Lookup: A reverse DNS lookup (rDNS) is the process of determining the domain name associated with an IP address. It’s the opposite of the standard DNS lookup, which maps domain names to IP addresses. Example of DNS Resolution: When you type www.example.com into your web browser: 1. The browser checks its local DNS cache for the IP address. 2. If not found, the browser queries the recursive DNS resolver. 3. The resolver asks the root DNS server which TLD server is responsible for .com. 4. The TLD server tells the resolver which authoritative server handles example.com. 5. The authoritative server responds with the IP address of www.example.com. 6. The IP address is returned to the browser, which then makes the connection to the server hosting the website. Importance of DNS: - Usability: DNS abstracts the complexity of IP addresses, making it easier for users to access resources online using simple, memorable domain names. - Scalability: DNS enables the internet to scale by providing a decentralized way to manage domain names and associated resources. - Load Balancing and Redundancy: DNS can be configured to provide multiple IP addresses for a single domain, enabling load balancing and fault tolerance. Conclusion: The Domain Name System is a critical component of the internet's infrastructure, enabling users to access websites and services by translating domain names into IP addresses. DNS helps simplify navigation, provides scalability, and supports the reliable operation of the global internet network. Understanding how DNS works is essential for anyone involved in networking, website administration, or cybersecurity. Chapter 8 : port security Port Security refers to the protection of network access ports from unauthorized access, misuse, or security threats. In a networking context, this typically pertains to securing switch ports in a Local Area Network (LAN) from potential attacks or unauthorized devices. Port security is a critical element of network security because physical network ports are often entry points for unauthorized access. Key Aspects of Port Security: 1. Port Security Mechanisms -Static MAC Address Binding: This involves assigning a specific MAC address to a port. Only the device with the assigned MAC address can communicate through that port. If any other device tries to connect, the port is blocked. - Dynamic MAC Address Learning: The switch learns MAC addresses dynamically and limits the number of MAC addresses allowed on a port. If the number of addresses exceeds the limit, it can shut down the port or trigger other actions. - Sticky MAC Address: A combination of static and dynamic learning, where the switch "sticks" the dynamically learned MAC address to the configuration, meaning the address is retained across reboots. - Port Security Violation Actions: The switch can take different actions if a violation is detected: - Protect: The switch drops packets from unauthorized devices, but doesn’t log the violation. - Restrict: Similar to protect but also generates a log and sends an alert. - Shutdown: The most severe action; the port is disabled, and an alert is sent. This is often the default violation action. 2. Security Benefits - Prevents Unauthorized Access: Port security restricts unauthorized devices from accessing the network by controlling the MAC addresses that can be associated with each port. - Mitigates MAC Flooding Attacks: In a MAC flooding attack, an attacker sends a flood of frames with random source MAC addresses to overload the switch's MAC address table. Port security helps mitigate this by limiting the number of MAC addresses allowed on a port. - Protects Network Resources: By preventing unauthorized devices, port security ensures that sensitive resources or data are not exposed to external attackers or rogue devices. 3. Types of Port Security - Access Ports: These are the ports that connect to end devices (computers, printers, etc.). Port security on access ports ensures that only authorized devices can connect. - Trunk Ports: These ports connect switches together, usually carrying traffic from multiple VLANs. Port security can also be configured on trunk ports to prevent unauthorized VLAN hopping or other attacks. - Voice VLANs: Ports that are designated for voice communication (such as IP phones) can also have port security settings to restrict unauthorized devices. 4. Port Security Configuration 5. Port Security Violation Recovery - Manual Recovery: An administrator can manually re-enable a port after a security violation, using commands like shutdown and no shutdown in configuration mode. - Automatic Recovery: Some switches can be configured to automatically recover from a violation after a certain period. 6. Limitations of Port Security - Scalability: Port security is generally better suited for smaller networks. For large networks, managing individual ports and MAC addresses may become cumbersome. - MAC Address Spoofing: If an attacker can change their MAC address to match a legitimate device, they might bypass port security restrictions. - Dynamic Changes: When devices like laptops or mobile phones connect and disconnect frequently, managing static MAC address bindings can be cumbersome. 7. Port Security in Modern Networks - In large, modern enterprise environments, port security is often part of a broader security strategy that includes techniques like 802.1X (port-based network access control), which authenticates users before granting access to the network. - The integration of network access control (NAC) systems with port security enhances the ability to enforce security policies Port security is a powerful feature for controlling who can connect to a network, helping to secure a local network from unauthorized access, but it needs to be managed properly to avoid false alarms and ensure network availability. Chapter 9 : conclusion Conclusion This network is designed for Afghan schools to help school administrators and all employees perform their tasks quickly and efficiently. The network uses the DHCP protocol to automatically assign IP addresses to all employees, ensuring they never face any issues with connectivity. In this network, we have implemented two routers to ensure redundancy. In case one router encounters a problem, the HSRP protocol enables the backup router to automatically take over, providing uninterrupted internet access. The HSRP protocol ensures that if one router fails, the switches automatically connect to the second router for internet access. Additionally, we have integrated DNS to automatically resolve the user names to IP addresses, so employees won’t face any issues. This feature simplifies the network and enhances usability. For security, we use port security to safeguard the network. All employees can send and receive documents securely, ensuring that all data is protected and no security vulnerabilities exist. This network is crucial for Afghan schools, and it will, God willing, resolve all of the school’s challenges, enabling tasks to be completed efficiently and without any problems. Resource Kozierok. Charles M, The TCP/IP guide (san Francisco : starch press 2005), 95. Donahue. Gary A, network warrior (Sebastopol : O'Reilly media 2007), 103. Cole.Eric, network security bible (Hoboken: wiley publishing 2005),74. https://www.pluralsight.com/ https://www.netacad.com https://www.udemy.com https://www.youtube.com