The Internet Protocol Journal - Volume 2, No. 3

Book Reviews

Book Reviews

DHCP

DHCP-A Guide to Dynamic TCP/IP Network Configuration, by Berry Kercheval, ISBN 0-13-099721-8, Prentice Hall PTR, 1998, http://www.prenhall.com/ptrbooks/ptr_0130997218.html First, I should note that this book arrived at the perfect time for me: I am involved in adding Dynamic Host Configuration Protocol (DHCP) support to a software product and needed a quick, thorough understanding of DHCP that went into sufficient detail to support some key design decisions. The book provided me with exactly what I wanted. However, as to whether or not this is a book you should own or even want to read, that is a much more difficult question to answer.

Organization

The author begins with a chapter of general background information. Then, in a logical progression, he goes through an overview of DHCP and on to explicit details of both the client and server aspects of the protocol. In other sections he covers server administration, DHCP and IP Version 6 (IPv6), and the future of DHCP. He then briefly reviews a few available implementations. In supporting sections he covers the relationship between DHCP and the Domain Name System (DNS), specifically Dynamic DNS. In one chapter he discusses the relationship between directory services and DHCP, in particular, the Lightweight Directory Access Protocol (LDAP). He then concludes with three appendices: one lists DHCP vendors, another covers the available DHCP options, and a final appendix provides the DHCP RFCs, RFC 2131 and RFC 2132.

Presentation

Overall, the book is well planned and easy to read. The background information is clearly written and gives sufficient material to assure that even novice readers will not get left behind. The author clearly explains the origins of DHCP in BOOTP and the continuing relationship between the two protocols. He also provides many examples that help make the more difficult aspects of DHCP easier to grasp. The chapters tend to progress in a logical order, making absorption of the fairly technical subject almost easy.

The presentation, however, is somewhat marred by minor errors and omissions. None of these mistakes would confuse an expert, but they will make it harder for the novice to be sure what he or she is to understand. In one example, a client workstation on net 10.0.1.0 is offered, and selects, an address of 10.0.2.32. This scenario is, however, clearly unroutable, and the example only confuses the reader. The author also makes a good effort at defining terms the first time they are used, and then again in an extensive glossary. However, for some reason he never defines two key terms: broadcast and multicast. Since both techniques are core to understanding DHCP, this oversight is difficult to understand.

The chapters on DHCP are fairly exhaustive in their examination of the protocol from overview to minutiae. The roles of clients, servers, and relay agents are well described and documented with sample packets. Each packet field is thoroughly explained and easy to grasp. However, the sections of LDAP and Dynamic DNS could have been presented better. The reader is left with a glimpse of possible relationships between the protocols, but without enough information to really pull it all together. Notably missing is any mention of remote access and the Remote Authentication Dial-In User Service (RADIUS) protocol. DHCP and RADIUS perform similar functions in different situations, and there has been much discussion in the past year or two about use of DHCP to manage RADIUS IP address assignments.

Summary

This book sets out to accomplish a limited goal: informing the reader about the basics of DHCP. A couple of detours along the way provide useful information about related technologies (such as DNS and LDAP). The author makes no assumptions about the user's technical capability and level of knowledge. This is perhaps the book's major strength and its biggest weakness. Because of his assumptions about the reader's technical ability, a lot of space is devoted to giving background and reference information assuring that the reader has the necessary foundation to understand the more complex aspects of DHCP. If the background information and appendices (all of which are available on the net and consist mostly of the RFCs anyway) are removed from the book, little is left: without the appendices there are only 144 pages. Given that the book costs $45, and that the 144 pages are essentially a guided explanation of the RFCs anyway, the technically competent reader might do just as well to download the RFCs and slog through them.

However, for the non-technical reader, or someone who just wants it all in one convenient volume, the author's approach is well worth the cost of the book and the (short) time required to read it. Explanations are clear and concise, terms are well defined, and everything the reader needs to grasp about the complexities of DHCP is right there, in a logical order.

-Richard Perlman, Lucent Technologies
perl@lucent.com

Information Warfare

Information Warfare and Security, Dorothy E. Denning, ISBN 0-201- 43303-6, Addison Wesley, 1999, http://www.awl.com/cseng/0-201-43303-6/ It has been said that "information is power," and they who control the information control the power. Whether the information is broadcast on the evening news, printed in a newspaper, etched on stone tablets, or published on a USENET newsgroup or Internet Web page, we rely on information in our daily lives, and trust that most of the information we receive and process is accurate.

"Information warfare." What images does it conjure up for you? Propaganda wars via pamphlets dropped from airplanes, or "cyber-terrorists" versus the FBI on the Internet or something else entirely? Dr. Denning covers all bases in this, her latest book. The "warfare" of the title is specifically the battle between the good guys and "information terrorists."

This book is a textbook for a course by the same name at Georgetown University. No one, however, should be scared off by this knowledge. This book is incredibly approachable, intended for a broad audience. It is an introduction to information warfare, but really concentrates on computer and network-based information. Anyone involved or interested in computer and network security would benefit from this book. Many sections are self-contained, so a reader can jump back and forth among the sections. All the sections are interesting and informative, and should be to both the highly technical reader as well as those for whom technology is peripheral to their jobs, but who require or desire deeper and broader knowledge of information warfare.

About the Author

Dorothy E. Denning is Professor of Computer Science at Georgetown University. She is a well-known expert in the areas of computer security and cryptography, and has been called as an expert witness to testify before the U.S. Congress. She is the author of over 100 papers on computer and Internet security, and has written three other books in addition to this one: Cryptography and Data Security (a coeditor with Peter Denning), Rights and Responsibilities of Participants in Networked Communities, with Herbert S. Lin, and Internet Besieged: Countering Cyberspace Scofflaws. She is also a frequent contributor to security related publications.

Organization

Information Warfare and Security has three parts. Part 1 starts with a very exciting (and still timely) discussion of the role information warfare played in the Gulf War in the early 1990s. The tone and flavor of this opening chapter continues throughout the book. Randomly put your finger in the book and you will be able to start an enjoyable and interesting read (though I recommend reading beginning to end). Part 1 introduces basic concepts upon which the work is built. Chapters 2 and 3 present a taxonomy of information warfare, relating it to information security and assurance, and suggesting four arenas of activity: play, crime, individual rights, and national security. The author discusses goals, motivations, culture, and concerns. Included is the no doubt apocryphal, but always fun, quote attributed to Secretary of State for War Henry Stimson, upon the 1929 "discovery" of the Black Chamber code breaking operation: "Gentlemen, do not read one another's mail." Part 2 focuses on offense. This section covers topics that, for the most part, will be new to many readers. The chapters cover open source material and privacy (and piracy of information), "social engineering," and its kin. The threat from insiders-legitimate and those who have broken in, gets a thorough treatment. Eavesdropping also is examined, from cellular and pager intercepts, to the mysterious-to-most-people area of traffic analysis, to surveillance, packet-sniffing, and other electronic eavesdropping attacks.

Chapter 8 looks in detail at well-known computer hacking techniques and the tools that implement the attacks. Chapter 9 discusses identity theft, including forged e-mail and stolen accounts, IP-spoofing (stealing the identity of a computer), and Trojan Horse attacks. Finally, Part 2 ends with a chapter dedicated to computer viruses, both real and hoaxes.

Topics discussed in Part 3, "Defensive Information Warfare," will be familiar to most readers who understand computer and network security. Chapter 11 not only describes cryptographic techniques for protecting information, but also covers steganography, or "the practice of hiding a message in such a manner that its very existence is concealed" and anonymity. Chapter 12, "How to Tell a Fake," deals with methods for determining identity or trustworthiness of entities or information. Chapter 13 talks about access control mechanisms, including firewalls, and intrusion detection. Covering vulnerability monitoring and analysis, risk analysis, risk management, and incident response, Chapter 14 possibly should have started Part 3. Devices, mechanisms, and methods should be deployed after an understanding of what is contained in this chapter. Part 3, and the book, end with a chapter dedicated to discussing the role of government in defensive information warfare. Also included are descriptions of recent (1990s) actions, laws, and initiatives of the U.S. Government in this area.

Throughout, the book is seasoned with stories infowar stories, if you will and background information, allowing the novice not only to understand, but also to enjoy learning what is contained within.

A Book for the Lecture Hall or Armchair

It is not surprising that Information Warfare and Security so thoroughly covers the space of information warfare theory, measures, and countermeasures, not because it weighs in at over 500 pages, but because it was written as a text for a course that had to cover all of this material. What may be surprising to readers unfamiliar with Dr. Denning is that such complete coverage could be done in such an easy-to-read way. I have no doubt that this book is and will continue to be useful and effective in the classroom. In addition, the reader studying for accreditation in a field requiring this knowledge, or the professional wanting to "brush up," "fill in," or just "kick back," will find much here to commend itself. -Frederick M. Avolio, Avolio Consulting fred@avolio.com

Cryptonomicon

Cryptonomicon, Neal Stephenson, ISBN 0-380-97346-4, Avon Books, 1999. http://www.cryptonomicon.com/main.html It isn't often that you find reviews of works of fiction in these pages, but Cryptonomicon deserves special treatment. Neal Stephenson's latest work is a 918 page science fiction World War II thriller that I couldn't put down. You have to love a novel that has plot points that depend on the technical details of prime number theory, Pretty Good Privacy (PGP), public key infrastructure (PKI), Secure Shell (SSH), Global Positioning System (GPS), secure e-mail, and other Internet applications. Truly this is an epic novel of techno-epic proportions.

The story takes places during both World War II and modern times. The contemporary action revolves around an offshore data haven created by a Silicon Valley startup with the usual coterie of managers, venture capitalists, lawyers with class action suits, marketeers, and nerds that you'll easily recognize. These entrepreneurs think nothing of flying across the Pacific to attend a meeting and then flying home to get in some quality family time.

The war setting revolves around a small group of code crackers who travel around the globe planting misinformation behind German and Japanese lines. The two groups are literally related: the modern generation is the progeny of the wartime crackers. Both groups are going after hidden caches of gold, among other things, buried near the Philippines.

Technology

There is much technology here for any self-respecting computer geek to digest. Think of Tom Clancy playing with the latest laptops and the Internet rather than with the latest guns. There is even an appendix describing the technical details of one of the crypto algorithms using synchronized decks of playing cards (a key plot point in the book). Stephenson blends in descriptions of undersea cable laying and salvage operations with the cracking of the Enigma [1] codes and hunting down German submarines. At one point, the code cracking wartime division has to change its numerical designation because it can be factored into two prime numbers too obvious.

One of my favorite scenes happens early in the book, when the modern day principals of the crypto firm are meeting some of their backers and potential clients for the first time. The firm's engineer (using the built in pinhole camera of the laptop) programs his UNIX laptop to surreptitiously capture a photo of whoever is using the keyboard during a demo of the firm's crypto technology, but hides his program in a way that any UNIX hacker would appreciate. He then e-mails the collected digital photos to a friend to try to confirm their identity.

Balance

Unlike Clancy, this book has characters with some depth to them and doesn't overdo the technology. The relationship of the war and modernday periods is nicely tied together in the end, and the familiarity of the modern day business relationships is sometimes almost too painful to read.

-David Strom, publisher of Web Informant
david@strom.com


Would You Like to Review a Book for IPJ?

We receive numerous books on computer networking from all the major publishers. If you've got a specific book you are interested in reviewing, please contact us and we will make sure a copy is mailed to you. The book is yours to keep if you send us a review. We accept reviews of new titles, as well as some of the "networking classics." Contact us at ipj@cisco.com for more information.