As data transfer technology progresses, so do cable types. Category 6 UTP copper cable is commonly used today in ethernet installations where 1000BaseT (or gigabit ethernet) systems are required. Cat 6 cable has a certified bandwidth of 250 MHz (500 MHz for Cat6a). Category 6 cable is a newer version of Category 5 and 5e cable wherein the wire pairs are bonded together and there is a separator to keep each pair of wires the same distance apart and in the same relationship to each other. The four twisted pairs in Cat 6 cable are also twisted within the overall cable jacket.
Category 7 cable is much different from its predecessors. It has an overall shield and individual pairs are shielded:
Shields on individual pairs are required to reduce cross talk (FEXT, NEXT). It also requires special shielded connectors called GG45 plugs and jacks. Pinouts and color codes are the same as gigabit ethernet (Category 5e and 6) however, Category 7 (ISO 11801 Class F) jacks and plugs also have to contacts on the corners of the connector or jack. This allows better shielding. A small switch in the jack senses when a category 7 type connector is inserted and switches to the corner contacts, thus keeping jacks and patch panels backwards compatible with Category 5/6 cables.
Category 7 cable is rated for 600 MHz bandwidth (1000 MHz for 7a) which translates to 10 GB ethernet. This was previously the domain of fiber cable. Copper cable has some advantages over fiber; lower propagation delays, requires less complicated equipment, copper is less expensive than fiber and more durable. It is nice to have the flexibility to use copper cable on 10 GB ethernet for runs of 100 meters or less. Longer runs still require fiber.
Category 7 and 7a cable looks remarkably similar to the older Belden multipair “computer cable” pressed into service as audio trunk cable seen so often in older studio installations.
Most broadcast facilities have an engineering department or service and an IT department or service which are separate. There is often a fuzzy line between what machines belong strictly to engineering and what belongs to IT. There are several different systems that have network interfaces but are not generally considered computers and fall squarely in the engineering department. These include such equipment as transmitters, satellite receivers, EAS machines, IP based audio routers and audio consoles and IP audio CODECS. In many cases, windows based automation systems and servers also fall under the responsibility of the engineering department.
As the recent incidents of network intrusions into vulnerable EAS machines shows, after installation, steps must be taken to secure networked equipment from malicious or accidental intrusions. The aforementioned EAS intrusion was bad but it could have been much worse.
Anything with a network interface can be exploited either internally or externally and either by purpose or accident. The threat plain looks like this:
Every unauthorized network access incident falls somewhere on this plain. An unauthorized network intrusion can be as simple as somebody using the wrong computer and gaining access to back end equipment. It can also be the hacker or cracker from a foreign country attempting to breach a fire wall.
Basic network security falls into these categories:
Physical security of machine or server room
Security against internal accidental or malicious use
Security against external intrusion
Protection against malicious software exploitation
The first category is the easiest to understand. Physical security means securing the server room through locking doors and preventing crawl over/under entries. Security cameras and monitoring is also a part of physical security. Something that is often neglected is extended networks that bridge to transmitter sites. Non-maned off site facilities that have network access are a vulnerable point if multiple clients or tower tenants have access to the same room. Locked equipment racks and video cameras are two ways to secure non-maned transmitter sites. Also, when using good quality, managed switches at transmitter sites, switchport security features can be enabled and unused switchports shutdown.
Accidental or malicious internal intrusions can be reduced or eliminated with proper password policies. The first and most important password policy is to always change the default password. There are lists of default router and switch passwords available online. The default passwords for EAS machines and other equipment is published in owner’s manuals and most broadcast engineers know them by heart. Always change the default password, if you do nothing else, do this.
Other password policies include such things as minimum password length, requiring special characters, numbers and both upper and lower case letters. Even taking those steps, passwords are still vulnerable to dictionary attacks. To prevent a dictionary attack, the login attempts should be limited to five or so with a thirty minute freeze out after the attempt limit is reached.
External intrusion can come from a number of different sources. Unsecured WIFI is the easiest way to gain access to a network. Always secure WIFI with WPA or WPA2 AES encrypted pre-shared key. This will keep all but the most determined intruders out. Other external threats can come from man in the middle attacks. IP bridges and WIFI must always be encrypted.
External attacks can also come over the wired network. Most small routers have default network and password settings. I have started moving away from using 192.168 internal networks. Router firewalls and personal software firewalls are effective but not foolproof. Software updates need to be performed regularly to be effective. One recently discovered exploit is UPnP, which is enabled on many home and small office routers. UPnP (Universal Plug-n-Play) SSDP (Simple Service Discovery Protocol) can be exploited of exposed to the public network side of the router. ShieldsUP! by Gibson Research Corporation is a good evaluation tool for router exploits, leaks and phone homes. They also have links to podcasts and youtube videos.
Disabling unused features on routers is a good security policy. Features such as DHCP, DNS, SNMP, CDP, HTTP server, FTP server etc are all vulnerable to exploitation of one form or another. Turning off those protocols that are not in use will eliminate at least a portion of those threats.
Finally, worms, bots, viruses and other malicious software can come from anywhere. Even reputable websites now have drive-bys in linked advertizing banners. Non-windows operating systems are less vulnerable to such programs, but not immune. All windows machines and servers that are in anyway connected to the internet need to have updated antivirus software. Keyloggers can steal passwords and send them to bad places where people have nefarious intent.
There are entire books, standards and upper level classes taught on network security. This less than 1,000 word article barely brushes the surface, as the titles says, these are but a few very basic ways to implement a security policy. It is important for technical managers and engineers to learn about, understand and implement security policies in broadcast facilities or suffer the consequences of complacency.
With the advent of fiber optic cables starting in the 1980’s, the majority (one estimate says 99%) of this country’s overseas communications are carried by undersea cables. These are interesting system constructions, being first redundant and second, self healing. Glass fiber stands themselves are fairly fragile. Bundling several together then sinking them in the ocean can create mixed results. Deep ocean bottoms are often very rugged, containing mountains, canyons and fault lines. Thus the submarine cables used have to be pretty rugged.
There is a common misconception that fiber optic cables do not need repeaters. That is not true, while they do not need as many repeaters as copper cable, repeaters are still required approximately every 40-90 miles (70-150 km) depending on the cable type. These active devices are another failure point. Overall, it is a complex system.
Cross-section of a submarine fiber optic communications cable:
2. Mylar tape
3. Stranded metal (steel) wires
4. Aluminum water barrier
6. Copper or aluminum tube
7. Petroleum jelly
8. Optical fibers
It weights about 7 pounds per foot, which is pretty hefty.
There are a couple of interactive maps on line that have detailed information about where these cables go, date in service and data capacity. My favorite is Greg’s Cable Map which is a google map with cable data over layed with a downloadable KML file:
This shows a new cable called the “Emerald Express” which is going into service in 2013. Throughput is reported as 60 Tbps, which is moving right along. As noted on the map, this is more of a schematic diagram connecting two shore side points. The path the cable takes is an estimate and the actual geographical location may (is likely to) be different. Click on any line on the map for cable information. Most cables have their own web page and Wikipedia article.
Another undersea cable map is the Telegeography Submarine Cable Map, which has many of the same features noted above:
Just in case you were wondering, as I often do, how a TCP/IP connection is being routed to any given place. For fun, I tried a trace route to a known server on Guam and found the results interesting:
Approximately 231 ms round trip route from NYC to LA to Guam and back, which is over 8,000 miles (12,850 km). A few of the intermediate routers did not answer and I tried this several different times; the same routers time out. This missing information looks to be small steps, not large ones. So, which cable goes directly from LA to Guam? Possibly the China-US Cable Network (CHUS) (picture above). At 2.2 Tbps and landing at San Luis Obispo, that is the likely candidate for the cable that carried my data.
As a general exercise, it is kind of fun, although it may be harder to figure out a particular route to say London or Berlin because there are many more different possibilities.
Route latency is something to keep in mind when planing out AOIP connections for remotes and other interactive type connections between studio and remote location. Almost nothing is worse than that half second delay when trying to take phone calls or banter back and forth with the traffic reporter.
Wireless IP Ethernet (802.11) technology has been around for a while. Many know it as “WIFI” but you could also call it “WLAN” or something similar. Like many other Ethernet technologies, WLAN relies on a spoke and hub connection system. The hub being the wireless access point or router and the individual hosts (PC’s, tables, phones, etc) being the end point for each connection. In a wired network, it is usually some type of switch that forms the center of the network data distribution system.
With a wireless mesh network or ad hoc network (802.11s), each wireless device can connect to any other wireless device within range. In this type of peer to peer network, there is no central access point, although something can act as an internet gateway or there can be several gateways. This type of topology functions much like the public network (AKA the internet), where there are many different paths to any one (major) destination. If any one of those paths goes down, another route is quickly found.
This technology was developed by several vendors for military communications systems and for OLPC (One Laptop Per Child) programs in Africa and other places. Each link acts to extend the boundaries of the network, thus the more users there are, the more useful the network becomes.
Advantages of mesh networking:
Networks are self forming; once the nodes are configured and can see other network nodes, the the network automatically forms
Networks are self healing; if one node drops off line, traffic is automatically routed to other nodes. If the node comes back up, it is included back into the network
High fault tolerance; in areas where many nodes exist and can see each other, the failure of any single node does not effect the rest of the network
Low cost to deploy; mesh networks use standard off the shelf WLAN (802.11) devices. Choice of software will dictate which hardware will work the best
Crowd sourced infrastructure; as each network node is owned by an individual, the cost and responsibility is shared among the community
Several specific routing protocols have been developed for the network side of the system. Hazy Sighted Link State Routing Protocol (HSLS), BATMAN, OLSRHWMP and others. These work well with the existing 802.11 a/b/g wireless network hardware currently available.
On the host side, a good IBSS capable wireless network adapter is needed, which many of the newer ones are. Several of the software programs have lists of WLAN adapters that work with their software. Open Garden is a free App for Windows, Mac OSX, Android, and they are working on an iOS version. This leaves out certain devices like tablets and iPhones for now.
Since existing wireless adapter drivers do not yet support mesh networking, usually an additional piece of software is needed. There are several interesting ones, including HSMM-MESH, which was developed by Amateur Radio operators. Open source programs for Linux, Free BSD and other are available as well as commercial versions for Windows.
I was thinking that this might be useful for broadcast applications. For obvious reasons, this type of system would work best in densely populated urban and suburban areas, which is exactly the type of area that LPFM licenses might be hard to come by. For those who do not have the time or wherewithal to apply for an LPFM license, or for those that simply don’t get a license due to scarcity of available channels, this could be a great way to cover a neighborhood or section of a city. The more people that participate in the mesh network, the stronger the network becomes. Additionally, by using FCC type accepted part 15 FM and AM transmitters as broadcast nodes, carrier current transmitters and leaky coax systems, the presence of the mesh network can be advertized to potential listeners, including directions on how to take part.
Wireless LAN bridges or broadband internet connections can act as a backbone between distant nodes.
For bandwidth efficiency sake, AOIP services should be limited to multicast addresses.