信息安全管理3.ppt

VLAN（Virtual LAN），翻译成中文是“虚拟局域网”。LAN可以是由少数几台家用计算机构成的网络，也可以是数以百计的计算机构成的企业网络。VLAN所指的LAN特指使用路由器分割的网络——也就是广播域。 广播域，指的是广播帧所能传递到的范围，亦即能够直接通信的范围。二层交换机只能构建单一的广播域，不过使用VLAN功能后，它能够将网络分割成多个广播域。 通过增加子网数目可以构建更多的通路，减轻信息流量拥塞。将网络拆分成多个由交换机、路由器所连接的子网，这样可以划分冲突域和广播数据包，进而提高网络性能。 If the worm successfully infects a web server, it uses the HTTP service to propagate itself to clients that browse the web server’s pages. Upon infecting a victim server, the worm creates a MIME-encoded copy of itself named README.EML and traverses the directory tree searching for web-related files such as those with .HTML, .HTM, or .ASP extensions. Each time the worm finds a web content file, it appends a piece of JavaScript to the file. The JavaScript forces a download of README.EML to any client that views the file via a browser. Some versions of Internet Explorer will automatically execute the README.EML file and allow the worm to infect the client. The IE vulnerability issue here is the same as in the email propagation mechanism; that is, IE 5.5 SP1 or earlier is vulnerable to the Automatic Execution of Embedded MIME Types“ problem. Allowing JavaScript in the browser enables the worm to take advantage of the IE vulnerability. The worm is network aware and propagates via open file shares. It will copy itself to all directories, including those found on a network share, for which the user has write permission. Nimda copies itself into a MIME encode file with a .eml or .nws extension (readme.eml or readme.nws) Enables sharing of drive c: Creates a guest account on the system and adds it to the administrator group The worm will search the shared drives for executables, and attach itself to each executable it finds. Any other host that accesses the share and loads one of these files can become infected. 网络故障排查 一、故障分层排查法 1、了解故障现象，收集信息，判断是用户的使用问题还是网络连接问题 2、根据现象给故障分层，到底属于网络层还是应用层问题， 3、根据分层查找故障原因，可以使用对应的命令或网管工具来检测。 4、制定执行排障计划，对较大的排障过程一定要作记录，以便作故障分析和对可能产生的新故障的原因分析 故障案例分析 1、网卡指示灯亮，但托盘区显示网络电缆没有插好 网卡灯亮说明网卡硬件安装正常，但