ferent token is provided each time a remote user dials in, which adds more robustness. Although an improve- ment over PAP, CHAP is still vulnerable. If an attacker were to capture the clear-text challenge and the encrypted response, it is possible to statistically determine the encryption key-which is the password. CHAP is strong when the password is complex or, better, at least 15 characters long. The terminal server resides on a LAN, which is typically a Gigabit Ethernet network today. Besides the terminal server, the ISP POP houses a wide range of other servers. It also contains network management systems that the service pro- viders can use to administer passwords and to monitor and control all the network elements in the POP, as well as to remotely diagnose elements outside the POP. As shown in Figure 8.20, the following are possible elements in the ISP POP architec- ture, and not all POPs necessarily have all these components (e.g., ATM switches are likely to be found only in larger ISPs): E-mail servers-These servers route e-mail between ISPs and house the e-mail boxes of subscribers. Domain name servers-These servers resolve DNS names into IP addresses. Web servers-If an ISP is engaged in a hosting business, it needs a Web server, most likely several. Security servers-Security servers engage in encryption, as well as in authentication and certification of users. Not every ISP has a security server. For example, those that want to offer e-commerce services or the ability to set up storefronts must have them. (Security is discussed in detail in Chapter 9.) Newsgroup servers-Newsgroup servers store the millions of Usenet mes- sages that are posted daily, and they are updated frequently throughout the day. Proxy servers-A proxy server provides firewall functionality, acting as an intermediary for user requests and establishing a connection to the requested resource either at the application layer or at the session or trans- port layer. Proxy servers provide a means to keep outsiders from directly connecting t