Network Theory Primer (Obviously a work in progress) Richard Gnall Table of Contents

Transcription

1 Network Theory Primer (Obviously a work in progress) Richard Gnall Table of Contents Intro Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 - Physical Media - MAC Addresses, NICs, Hubs and Switches - CSMA/CD, Collision Domains - Routers and IP Addresses - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments - Routing - Origin of Class A, B, C, D and E Networks - TCP, UDP and Port Numbers Chapter 9 - NAT and PAT Routers (coming soon) Chapter 10 - CIDR and Complex Subnetting (coming soon) Appendix A - Binary Numbers (coming soon) Appendix B - DHCP, APIPA and Static IP Configurations (coming soon) Appendix C - Additional Reading Table of Contents 1/43 Gnall

2 Intro The primary goal of this primer is to discuss the hierarchical relationship between: Hubs, Switches and Routers MAC Addresses, IP Addresses, Host Names and Port Numbers Collision and Broadcast Domains Two types of subnetting will be discussed: Class Based CIDR Protocols discussed will include: Ethernet CSMA/CD TCP/IP DHCP & APIPA ARP DNS ICMP (ping) To support the above, there will also be a discussion of: Physical Media Binary Number Mathematics Although many of the protocols discussed in this primer were developed when co-axial cable was the dominant transmission media, network theory will be discussed within the context of a modern network using Twisted Pair wiring. To facilitate the discussion of various networking concepts, the fictional company ACME will be introduced, along with fictional employees Ann, Bob, Cal and Dan. This tutorial explains IP addressing as a natural evolution resulting from the limitations of a MAC based single level network addressing system. For a historical treatment of how and why TCP/IP was invented, see Minasi "Mastering Windows Server 2008 Networking Foundations", pages Introduction 2/43 Gnall

3 Chapter 1 Physical Media Consider ACME corporation, a small company with only two employees, Ann and Bob. Ann and Bob each have a computer and need to share information between their two computers. One way to do this would be for Ann to copy data onto a floppy disk, carry the disk over to Bob's computer, and then upload the data. Once upon a time, this was known as sneaker-net. 1 2 Obviously, using floppy disks (or CDROMs, flash drives, etc.) is a slow and inefficient means of transferring data between computers. It would be a lot easier if Ann could just transmit the data over a "wire" connecting hers and Bob's computer, instead of having to get up and walk over to Bob's computer. There are four such types of "wire" to consider: co-axial cable 3 twisted-pair (Ethernet cable and NIC) 4 5 optical fiber 6 7 wireless (LinkSys wireless router) 8 (A future edition of this primer will cover these four transmission media types in greater detail.) Chapter 1 - Physical Media 3/43 Gnall

4 Chapter 2 MAC Addresses, NICs, Hubs and Switches Hubs If ACME corporation only needs to transfer data between two computers, then connecting a single wire between the computers is a straightforward matter. For the purposes of this primer, we will consider an Ethernet cable connected to network interface cards (NICs) on each of the computers. Any data which Ann sends out on the wire is sure to reach Bob's computer, and any data which Bob sends out on the wire is sure to reach Ann's computer. Ann Bob But what happens if ACME hires a third employee named Cal and gives Cal his own computer? How should the three computers be wired together so that any one computer can send data to any other computer? One way to do it would be for each computer to be connected to the other two computers as shown in the picture below. With this scenario, if Ann needs to send data to Bob she uses wire AB and if Ann needs to send data to Cal she uses wire AC. AB Ann AC Bob BC Cal With just three computers, this is a workable configuration. But if ACME continues to grow and hire more employees, the proliferation of wires connecting numerous computers together will quickly become unmanageable. For example, consider the following diagram of five computers all connected together: Chapter 2 - MAC Addresses, NICs, Hubs and Switches 4/43 Gnall

5 An easier way to connect three or more computers together is to use a centralized hub, as shown below: A hub is the simplest of the three types of connectivity devices found in computer networks. (The other two are switches and routers). Inside a hub, all of the ports are directly connected together. Any data entering the hub on one wire is sent out on all of the other connected wires. So in the ACME three computer scenario, any data sent from Ann is received by both Bob and Cal. Similarly, any data sent from Bob is received by both Ann and Cal. (However, Ann and Bob can not send data out onto the network at the same time - they must take turns. In the next section on CSMA/CD, we will see how data collisions are handled.) Ann Bob Cal Ann Bob Cal In the above scenario, data sent out by Ann is received by both Bob and Cal. But if Ann is sending data to Bob, Cal really doesn't want to be bothered with it. Having to read data meant for Bob is a waste of time for Cal. The solution to this problem is to assign an address to each computer and to include the address of the destination computer in the outgoing data packet. If the destination address in the data packet matches the address of the computer receiving the packet, then the data packet is read and processed by that computer, otherwise the packet is ignored. In modern networks, the address of each computer is a MAC address assigned to each NIC and the NIC is responsible for determining whether the destination MAC address contained within the incoming data packet matches it's own MAC address. If the MAC addresses match, then the packet is processed by the computer, otherwise the packet is dropped. If Ann were to add an address to the packet indicating it was meant for Bob, then Cal would just read the address and discard the rest of the packet, rather than waste time reading the whole packet. So Ann needs to add a MAC address to the beginning of the data packet matching the MAC address of Bob's NIC. The MAC address is added to the beginning of the packet so that Cal can determine as quickly as possible whether to ignore the rest of the packet or not. When Bob receives a data packet with a destination MAC address matching the MAC address assigned to his NIC, Bob would like to know who sent the packet. So Ann should also add the MAC address assigned to her own NIC. The outgoing data packet now contains two MAC addresses - a destination MAC address matching Bob's NIC and a source MAC address matching Ann's NIC. If Bob needs to reply to the packet sent by Ann, it is now very easy for Bob to add the appropriate MAC addresses (but in the reverse order). Ann Bob Destination MAC Address Bob NIC Source MAC Address Ann NIC Data Ann Bob Destination MAC Address Ann NIC Source MAC Address Bob NIC Data Chapter 2 - MAC Addresses, NICs, Hubs and Switches 5/43 Gnall

6 Using MAC addresses allows Ann to have a data conversation with Bob without bothering Cal too much. Cal still sees the packets, but at least he doesn't have to process the whole packet, just the destination MAC address. Similarly, Ann can have a conversation with Cal without bothering Bob too much, and Bob can have a conversation with Cal without bothering Ann too much. Switches But suppose ACME hires a fourth employee named Dan, and Dan's computer is connected to the same hub as Ann, Bob and Cal. Furthermore, suppose that Cal wants to have a data conversation with Dan while Ann is simultaneously having a conversation with Bob. With a hub, this is not possible as any data sent out by Ann is received not just by Bob, but also by Cal and Dan. A conversation between Ann and Bob prevents Cal and Dan from simultaneously having their own conversation. A hub only allows one conversation at a time. The solution to a hub's inability to support more than one conversation at a time is to replace the hub with a switch. A switch uses internal circuitry to isolate and support multiple simultaneous conversations. Ann Bob Cal Dan Ann Bob Cal Dan Hub Switch The following animated gifs from demonstrate the difference between a hub and a switch. In order for a switch to isolate data conversations, it needs to send data to just the destination computer, and not to the other computers. To do this, it needs to send data out just one of it's ports and not the other ports. This requires the switch to know which port provides access to which computer. How does it know this? Well, initially it doesn't. Incoming data packets are sent out on all of the switch's other ports. Of course, this defeats the purpose of having a switch, which is to isolate data traffic. However, as data enters the switch from all of the computers connected to it, it reads the source MAC address contained in each packet and eventually learns which MAC addresses are connected to which ports. This information is stored in a table inside the switch's memory. In a very short time, the switch is able to isolate data traffic and support multiple simultaneous data conversations. MAC Address Table Port MAC Address(es) 1 Ann's MAC Address 2 Bob's MAC Address 3 Cal's MAC Address 4 Dan's MAC Address Chapter 2 - MAC Addresses, NICs, Hubs and Switches 6/43 Gnall

7 Suppose ACME continues to grow in size and adds many more computers and switches. The MAC tables for each switch must still know how to get to each of the computers. B1 B2 B3 B4 Switch B A1 Switch A Switch C C1 A2 A3 A4 C2 C3 C4 MAC Address Table Switch Port MAC Address(es) 1 A1 2 A2 A 3 A3 4 A4 5 B1, B2, B3, B4, C1, C2, C3, C4 1 B1 2 B2 3 B3 B 4 B4 5 A1, A2, A3, A4 6 C1, C2, C3, C4 1 C1 2 C2 C 3 C3 4 C4 5 A1, A2, A3, A4, B1, B2, B3, B4 As the size of the network grows, so does the size of the MAC address table that each switch must maintain. Eventually, the network may become so large that the switch does not have enough memory to hold all of the MAC addresses on the network. As will be explained in Chapter 4, the solution to this problem is to add another level of addressing (IP address) and a device to process the extra address (router). Routers and IP addresses allow the network to be broken up into network segments, and switches are then required to only maintain tables for the MAC addresses within the network segment to which the switch belongs. IP addresses will then handle getting packets from one network segment to another. (Actually, IP addresses serve two roles, addressing individual computers and addressing the network segments within which the computers reside. Chapter 2 - MAC Addresses, NICs, Hubs and Switches 7/43 Gnall

8 MAC Addresses Before continuing with our discussion of how networks function, lets stop to examine more closely the structure of a MAC address. A MAC address is a 48 bit (binary integer 9 ) number. Example: Although fine for computers, a long string of bits is difficult for humans to read. So MAC addresses are broken up into six groups of eight bits (octets) and then each octet is converted to hexadecimal: A-4B-7C-78-C4 or 00.1A.4B.7C.78.C4 (The dashes or periods are not actually part of the MAC address, they are just there to aid in readability.) Sometime it's necessary to send out a data packet which needs to be read by every computer in the network. So instead of using a specific MAC address which targets a specific NIC, a broadcast MAC address is used which indicates that the packet should be read by all NICs receiving the packet. A broadcast MAC address is written by assigning a value of 1 to all 48 bits: or or FF.FF.FF.FF.FF.FF Since it's important that MAC addresses be unique within the same network segment, MAC addresses are built into a NIC's ROM by the manufacturer. To ensure that no two manufacturers give the same MAC address to a NIC, MAC addresses are built as follows: MAC addresses are divided into two parts, a BlockID and a DeviceID. The BlockID is made up of the first three octets of the MAC address and the DeviceID is made up of the last three octets. Continuing with the above example, the BlockID is 00-1A-4B and the DeviceID is 7C-78-C A.4B.7C.78.C4 BlockID.DeviceID The IEEE is responsible for ensuring that each manufacturer receives a unique BlockID. Manufacturers can purchase a BlockID (also known as a OUI - Organizationally Unique Identifier) directly from the IEEE at the following website: Each manufacturer is then responsible for assigning a unique DeviceID to every NIC it manufactures. So even if two different manufacturers assign the same DeviceID to a NIC, the MAC addresses are guaranteed to be unique since the BlockIDs are unique. Chapter 2 - MAC Addresses, NICs, Hubs and Switches 8/43 Gnall

9 From the IEEE website: BlockIDs can be queried on the IEEE website to determine who manufactured the NIC: The following link provides interesting reading about OUIs and the related IABs: Chapter 2 - MAC Addresses, NICs, Hubs and Switches 9/43 Gnall

10 Chapter 3 CSMA/CD, Collision Domains CSMA - Carrier Sense Multiple Access / Collision Detection Let's consider again the case of ACME corporation, with three employees connected together via a hub (we'll temporarily ignore switches and then add them back to the network after a few pages). The hub and the three Ethernet cables provide equal access to the network for all three computers, in other words they provide "Multiple Access" to the network. Suppose Ann and Cal both send data packets to Bob at the same time, as shown in the following diagram: Ann Bob Cal This is a problem as the signals from Ann and Cal will mix together and Bob will receive an undecipherable jumbled mess of bits. This mixing of signals is known as a "collision". Obviously, there needs to be a way to prevent collisions from happening as much as possible and there also needs to be a way of detecting and then recovering from collisions when they do happen. Preventing Collisions To prevent collisions from happening as much as possible, a NIC will "sense" the wire to determine if there is already a signal out on the network. The NIC performs "Carrier Sensing" by checking if the voltage level on the wire is higher than when there is no traffic on the network. So in the above example, Cal won't send out any data if he detects that a signal from Ann is already out on the network. Cal detects Ann's signal, so he waits before sending out his own signal. Ann Bob Cal Collision Detection Why do collisions happen at all? If Cal is "listening" to the wire for other transmissions, how is it that he might send out a packet after Ann has already started transmitting? Depending on how far away Ann is, when Ann sends out her signal, it takes a certain amount of time for the signal to reach Cal. Cal may start transmitting after Ann starts transmitting, but before Ann's signal reaches Cal. The following four diagrams illustrate this sequence of events. Ann starts transmitting first. Ann Bob Cal Chapter 3 - CSMA/CD, Collision Domains 10/43 Gnall

11 Ann continues transmitting, but her signal has not yet reached Cal. Cal starts transmitting. Ann Bob Cal Ann and Cal both continue to transmit, but neither is aware of the other's transmission. Ann Bob Cal Eventually Ann's signal reaches Cal while Cal is still transmitting and Cal realizes there has been a collision. This is known as "Collision Detection". Ann Bob Cal Collision Recovery After Cal realizes there has been a collision, he sends out a jamming signal to let everyone else know that there has been a collision. This jamming signal informs whoever is currently transmitting on the network that they need to retransmit. Jamming Signal Ann Bob Cal Once the jamming signal has been sent and received, Cal and Ann will both wait before attempting to transmit again. To ensure that they both don't start transmitting again at the same time, which would result in another collision, they each wait a random amount of time, with the expectation that they will retransmit at different times. As the number of computers connected to the hub increases, so does the number of collisions and subsequent retransmission of data packets. At some point, the traffic on a busy network rises to such a level that the number of packets involved in collisions outweighs the number of successful packet transfers. The network is now very inefficient at transmitting data packets. None of the other computers can transmit while computer A is transmitting. A B C D E F G H Chapter 3 - CSMA/CD, Collision Domains 11/43 Gnall

12 Collision Domains One way to reduce the number of collisions is to use switches to divide the computers up into separate collision domains. Consider the following two diagrams. On the left, two groups of computers are separated by a hub, and on the right, the same two groups of computers are separated by a switch. On the left, data sent out by A and addressed to B will be seen by all of the other seven computers - B, C, D, E, F, G and H. On the right, the same data sent out by A will only be seen by B, C, and D. The hub always passes any data it receives out through all of it's ports, but the switch knows from it's switch table not to pass the data onto Hub 2. A E A E B F B F Hub 1 Hub Hub 2 Hub 1 Hub 2 Switch C G C G D H The use of the switch allows two simultaneous conversations to occur. A can have a conversation with B while E has a conversation with F. In general, placing a switch between the two groups of computers allows any two computers in one group (A, B, C, D) to converse while any two computers in the other group (E, F, G, H) converse. D H A E B Hub 1 Hub 2 Switch F C G D What can't happen is for two different pairs of computers within the same group to simultaneously have a conversation, e.g. A can't communicate with B while C communicates with D. Since A, B, C and D always see each other's packets, they are considered to belong to the same "collision domain". Similarly, E, F, G and H also belong to the same collision domain. The left port of the switch also belongs to the A/B/C/D collision domain and the right port of the switch also belongs to the E/F/G/H collision domain. To summarize, switches separate groups of computers into collision domains, while hubs do not. (We will see later that routers also create collision domains.) H Chapter 3 - CSMA/CD, Collision Domains 12/43 Gnall

13 In the above network, relacing just the central hub with a switch created just two collision domains which enabled two data conversations to occur simulataneously. If all of the hubs are replaced with switches, additional collision domains will be created, allowing more conversations to occur simultaneously. A E B F Switch Switch Switch C G D H Since switches usually come with may ports, the above configuration can be simplied as follows, while still allowing four simultaneous conversations. A E B F Switch C G D H There are eight collision domains in the above fully switched network. Each switch port creates a collision domain. If a hub is connected to each of the ports, and multiple computers are connected to each hub, then there will still be eight collision domains, with multiple computers in each collision domain. In either of the above two configurations, what happens if A finishes it's conversation with B and decides it wants to begin conversing with C while C is still conversing with D? Will there be a collision? The answer is no. The switch will hold store the data packet and wait until port C is free before sending the packet onto computer C. This functionality is referred to as store-and-forward. Chapter 3 - CSMA/CD, Collision Domains 13/43 Gnall

14 Chapter 4 Routers and IP Addresses At this point, it seems like we have all we need in order to connect computers together in a manner which allows them to communicate with each other - hubs, switches and MAC addresses. So why do computer networks have IP addresses and routers? (Note - from this point forward, the word "host" refers to a computer or any other device, such as a printer, connected to a network.) Eventually a network will grow to a size in which the number of hosts can not be supported with a single level addressing scheme (MAC addresses). Routers will be needed to physically break the network up into smaller networks and a second level of addressing (IP addresses) will be needed to address the smaller networks. For example, there are currently several billion hosts connected to the Internet 10. A network design which uses just MAC addresses and switches to connect several billion hosts together presents two main problems: 1) Each individual switch would be required to know the MAC addresses of over three billion hosts. At 6 bytes per MAC address plus 1 byte for the port number, that's a memory requirement of at least 21 GB for the switch table. Furthermore, in order to support fast switching speeds, all 21 GB would need to be stored in RAM (a hard drive would be too slow). The OS would have to be capable of addressing all 21 GB and the OS would have to be running on a CPU which was fast enough to quickly update and access such a large switch table. All of that is an expensive, and at one time, impossible proposition. 2) It is highly unlikely that the switches would be able to keep up with the constantly changing location of all three billion MAC addresses and would therefore frequently resort to sending packets out all of their ports as opposed to just the single correct port. With so many switches sending so many packets out multiple ports, the network would be overloaded. Either the switches send out the packets as soon as they arrive, which results in too may collisions, or the store-and-forward switches run out of memory as they store data while waiting for the needed port to become free. The solution is to do the following: Divide the large network into many smaller local networks. Have the switches within each local network be responsible for only knowing the MAC addresses within their own local network. Add a new device, called a "router" to each of the local networks. Connect all of the routers together into a network of routers. Make each router be responsible for knowing how to get to any of the other routers (and therefore any of the other local networks). Each router functions as an interface between the hosts within it's local network and the external network of routers. The Internet is an example of such a network of routers. Within each local network, each host will know the address of it's local router. Within each local network, each switch will learn the MAC address of it's local router, just as it learns the MAC addresses for the other hosts within it's network. If a host inside one network needs to send a packet to a host in another network, have the host in the first network send the packet to the first network's router and let the router be responsible for finding and sending the packet to the other network's router. The other router will then be responsible for sending the packet to the other host. The next page explains how IP addresses are used to support this solution. Chapter 4 - Routers and IP Addresses 14/43 Gnall

15 A1 A2 A3 A4 Switch A Router A Router B Router C B1 Switch B Switch C C1 B2 B3 B4 C2 C3 C4 In order for a host in one network to send data to a host in another network, several MAC addresses need to be known: the MAC address of the local router, the MAC address for the router connected to the other network, and the MAC address of the host in the other network. For example, in the above diagram, A1 needs to know the MAC address of RouterA, RouterA needs to know the MAC address of RouterB and RouterB needs to know the MAC address of B1. When the packet first leaves A1, the destination MAC address targets RouterA. (If the destination MAC address didn't target RouterA, then RouterA would ignore it and never realize that it needed to send the packet onto a router in another network.) When RouterA recevies the packet, it must determine whether to send the packet on to RouterB or RouterC. How does RouterA know to send the packet to RouterB and not to RouterC? The only address the packet contains is the MAC address of RouterA. The solution is for A1 to add to the packet a second address containing the address of B1's network. RouterA uses this second address, known as a Network ID, to determine which router to send the packet to. Once RouterA determines RouterB is the desired router, it replaces the destination MAC address in the packet with the MAC address of RouterB. (How RouterA determines the MAC address of RouterB will be explained later, in the section on ARP.) Once the packet reaches RouterB, how does RouterB know which host to send the packet to? When the packet left A1, it did not contain any addressing information specifically targeting B1 - the MAC address targeted RouterA and the NetworkID only targeted the whole B network, and not a specific host. The solution is for A1 to add a third address which refers specifically to B1. RouterB uses this third address, known as a Host ID, to determine which host to send the packet to. RouterB replaces the destination MAC address in the packet with the MAC address of the host corresponding to the HostID contained within the packet. The Network ID and Host ID which A1 assigns to the data packet are combined together into an IP address. In other words, the IP address contains two pieces of information - the specific address of the destination host, and the address of the network within which the destination host resides. The next chapter will discuss IP addresses in greater detail and explain how subnet masks are used to determine which part of the IP address is the Network ID and which part of the IP address is the Host ID. So A1 adds two destination addresses to the outgoing data packet, a MAC address and an IP address; and the IP address contains two sub-addresses, a Network ID and a Host ID. Chapter 4 - Routers and IP Addresses 15/43 Gnall

16 Note: It would be possible to design a network which relies on just MAC addresses and network addresses (in fact, IPX/SPX works something like this). But instead, the inventors of the IP protocol did something different. They included two addresses in the IP address, the address of the network to which the host belongs, and a unique address specific to that host. ARP - Address Resolution Protocol The previous section skipped over a few details in explaining how a packet made it's way from A1 to B1. Once A1 determined B1 was in a different network, i.e. that B1 had a different Network ID than A1, it realized the packet had to be sent to it's local router, RouterA. (How this determination was made will be explained in the next chapter.) All hosts in the A network are configured with the IP address of RouterA, but they do not know RouterA's MAC address. In order to avoid clogging the local network with packets containing broadcast MAC addresses (which a switch will send out on all ports) every time it needs to send a packte to RouterA, A1 needs a way of acquiring the MAC address for RouterA (and then storing it for repeat use). This requires the use of ARP, the Address Resolution Protocol. A1 will send out an ARP query packet which asks "Which host has this IP address and can you tell me what your MAC address is?". Obviously, the destination MAC address inside the ARP query packet must be a broadcast address so that any NIC which receives it will read the packet and pass it on up to the IP software for further processing. In this case, RouterA will send back an ARP response packet containing it's MAC address. Once A1 has received the ARP response containing RouterA's MAC address, it sends the packet which needs to get to B1 to RouterA. ARP is used once again when RouterA needs to determine the MAC address for RouterB and when RouterB needs to determine the MAC address for B When one host needs to send a packet to another host it must first determine whether the host is in it's own network or in a different network. If the destination host is in it's own network, then the destination MAC address and destination IP address is that of the destination host. If the destination host is in a different network, then the destination MAC address is that of the local network's router while the destination IP address is still that of the destination host. The local router will forward the packet to the router of the destination host's network. The destination router will then use the ARP protocol to determine the MAC address corresponding to the destination Host ID embedded in the destination IP address. This will all be explained in greater detail in chapter 6. Chapter 4 - Routers and IP Addresses 16/43 Gnall

17 Chapter 5 IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments Network and Host Portions of an IP Address IP addresses consist of 32 bits (binary integers 11 ). For example: Since a string of 32 bits is difficult to read, the bits in an IP address are usually written as four groups of eight, with each group of eight referred to as an "octet". The octets are separated by periods. It should be emphasized however that the periods are not actually part of the IP address, they are merely added to increase readability. The above IP address with it's bits grouped into octets is written as: Even after grouping the bits together into octets, the above binary number is still difficult to read. To further enhance readability, each octet is converted into it's equivalent decimal value. 12 However, to fully comprehend the role that IP addresses play in computer networks, one must keep in mind that IP addresses are really binary numbers, and not decimal numbers. The above binary IP address in decimal form is written as: Network ID, Host ID IP addresses serve two roles: 1) Identify which network a host (PC, printer, ) belongs to 2) Identify the individual host within the network To do this, IP addresses must contain two pieces of information: 1) Network ID of the network to which a host belongs 2) Host ID for the host within the network (Each host within the network has a unique Host ID. However, the same Host ID may appear in multiple networks.) The Network ID is contained within the leftmost portion of the IP address and the Host ID is contained within the right-most portion of the IP address. For the IP address given above, the network and host portions might be: Network ID: Host ID: 5 Why the left three octets belong to the Network ID and the single rightmost octet belongs to the Host ID will be explained later when subnet masks and class-based subnetting are discussed. In the above example, the three leftmost octets defined the network ID and the single rightmost octet defined the host ID. This 3/1 division does not apply to all IP addresses. For other IP addresses, a 2/2 or 1/3 split might apply (the split between network and host ID can even occur within an octet - see Chapter 7 on CIDR). For example: Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 17/43 Gnall

18 IP Address: Network ID : Host ID : IP Address: Network ID : 10 Host ID : Before proceeding, recall that IP addresses are just decimal representations of binary numbers. The binary equivalents for the above IP address, Network and Host IDs are: IP Address: Network ID : Host ID : IP Address: Network ID : Host ID : IP Address: Network ID : Host ID : Network Address PCs and routers don't use Network IDs, which are just partial IP addresses containing less than a full set of 32 bits. Instead they use a Network Address, which is a full 32-bit number derived from a Network ID. The Network Address is created by assigning a value of 0 to the remaining bits which are not part of the Network ID. For the IP address, the three leftmost octets provide the Network ID, If the Network Address is to be written as a full set of four octets, then the fourth octet needs to filled in with eight 0 bits. Binary Form: Network ID: Network Address: Decimal Form: Network ID: Network Address: Properly writing the network addresses with four octets by filling in a 0 for the remaining non-network ID bits transforms the above table as follows: IP Address: Network ID : Network Address: IP Address: Network ID : Network Address: IP Address: Network ID : Network Address: Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 18/43 Gnall

19 Broadcast Address All networks need a Broadcast Address which can be used to send a packet to all the hosts within the network. A packet with a broadcast IP address will be processed by any computer receiving it, provided the data packet also contains a broadcast MAC address - the packet needs to make it past the NIC and into the IP software. Just as with a Network Address, a Broadcast Address is written as a full set of four octets. A Broadcast Address is derived by taking the network portion of the IP address (Network ID) and assigning a value of 1 to the remaining bits, as opposed to a 0 for the Network Address. Recall that for the IP address, the three leftmost octets provide the Network ID, The Broadcast Address for this network is created by assigning a 1 to each of the remaining eight bits in the last octet. (Recall that converts to 255 in decimal.) Binary Form: Network ID: Broadcast Address: Decimal Form: Network ID: Broadcast Address: Adding a broadcast address to the previous table gives: IP Address: Network ID : Network Address: Broadcast Address: IP Address: Network ID : Network Address: Broadcast Address: IP Address: Network ID : Network Address: Broadcast Address: Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 19/43 Gnall

20 Subnet Masks In modern networks, it is impossible to tell from just the IP address which bits of the address belong to the Network ID and which bits belong to the Host ID. To make that determination, additional information is needed. That information is provided in the form of a subnet mask. To fully determine the Network Address, both an IP address and a subnet mask must be stated. The subnet mask indicates the dividing line between the network and host portions of the address. (Prior to 1993, networks were class based and it was possible to determine the network/host delineation just by looking at the value of the first four bits of the IP address. With the change-over to class-less networks, this is no longer possible. See chapters 6 and 7.) Subnet masks are used to indicate which of the bits in an IP address belong to the network portion of the address and which of the bits belong to the host portion of the address. Since an IP address has 32 bits, a subnet mask must also have 32 bits. Each bit in the subnet mask indicates whether the corresponding bit in the IP address belongs to the Network ID or the Host ID. For every bit in the IP address which is part of the Network ID, the corresponding bit in the subnet mask has a value of 1. For every bit in the IP address which is part of the Host ID, the corresponding bit in the subnet mask has a value of 0. For the IP address, the three leftmost octets provide the Network ID and the single rightmost octet provides the Host ID NNNNNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH A subnet mask which correctly denotes which bit(s) belong to the Network ID and which bit(s) belong to the Host ID for the IP address would be: There is a 1 for every bit which belongs to the network portion of the IP address and a 0 for every bit which belongs to the host portion of the IP address. Just as IP addresses are written in decimal form to improve readability, subnet masks are also converted to decimal form. The above binary subnet mask is written in decimal form as: Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 20/43 Gnall

21 Adding a subnet mask to the previous table gives: IP Address: Subnet Mask : Network ID : Host ID : Network Address: Broadcast Address: IP Address: Subnet Mask : Network ID : Host ID : Network Address: Broadcast Address: IP Address: Subnet Mask : Network ID : Host ID : Network Address: Broadcast Address: Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 21/43 Gnall

22 CIDR Notation CIDR stands for Classless Inter-Domain Routing and is the successor to class based subnetting (Class A, B, C, D and E networks - to be explained in chapter 7). Without understanding how CIDR works it is still possible to borrow a notation from CIDR which provides an alternate way of writing a subnet mask. CIDR notation counts the number of bits which belong to the network portion of an IP address and expresses that number in base 10 proceeded by a forward slash '/'. For the IP address, the subnet mask was given as: Since there are 24 bits dedicated to the network portion of this address, the subnet mask can also be written as /24. Adding CIDR notation to the previous table gives: IP Address: Subnet Mask : CIDR : /24 Network ID : Host ID : Network Address: Broadcast Address: IP Address: Subnet Mask : CIDR : /16 Network ID : Host ID : Network Address: Broadcast Address: IP Address: Subnet Mask : CIDR : /8 Network ID : Host ID : Network Address: Broadcast Address: CIDR notation makes it very easy to include the subnet mask along with the Network ID: / / /8 What is a subnet? A subnet is a collection of IP addresses which all have the same Network ID. If a group of hosts (PCs, printers, ) all belong to the same subnet, then the hosts' IP addresses all have the same Network ID. Since subnets are mathematically based, and can easily be reconfigured, subnets are also referred to as logical networks. Subnets are usually, but not necessarily bounded by routers. (More on this later.) Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 22/43 Gnall

23 What is a network segment? One definition of a network segment is a collection of hosts bounded by a router 13. Usually all of the hosts within a network segment all belong to the same subnet, but not always. In the first example below, a router separates two network segments. Each network segment contains only one subnet. In the second example, a router also separates two network segments. But in this case, the network segment on the right contains two subnets, not one (observe the third octet). (Later, we will learn that in this case, computers on the /24 network can only communicate with each other and not with any of the computers on the /24 network, including the router. Since the router is on a different network, this also prevents communication with the /24 network.) A /24 MAC 21 X /24 MAC 31 B /24 MAC 22 C /24 MAC 23 H MAC 2 R MAC 3 H Y /24 MAC 32 Z /24 MAC 33 D /24 MAC 24 W /24 MAC 34 Figure 1 A /24 MAC 21 X /24 MAC 31 B /24 MAC 22 C /24 MAC 23 H MAC 2 R MAC 3 H Y /24 MAC 32 Z /24 MAC 43 D /24 MAC 24 W /24 MAC 44 Figure 2 Subnets are defined logically (via software settings) and network segments are defined physically. Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 23/43 Gnall

24 What is a logical segment? What is a physical segment? What is a network? One definition of a network is a collection of hosts which all belong to the same subnet. A second definition of a network is a collection of hosts which all belong to the same network segment. The term network may also refer to a collection of connected subnets or network segments. What is a LAN? One definition of a LAN (Local Area Network) is a collection of hosts which all belong to the same subnet. A second definition of a LAN is a collection of hosts which all belong to the same network segment. A third definition of a LAN is a collection of hosts which are geographically close to one another, such as in the same building or on the same campus. Chapter 5 - IP Addresses, Subnet Masks, CIDR Notation, Logical Networks and Network Segments 24/43 Gnall

25 Chapter 6 Routing This chapter will explain how packets are routed between computers which are in the same subnet and between computers which are in different subnets. Consider the following network diagram. It consists of three computers, two hubs and a router. The router serves as a physical boundary between two network segments and a logical boundary between two subnets/logical networks. The network segment on the left is comprised of two computers and a hub. The network segment on the right is comprised of one computer and a hub. (The router's ports are also considered to belong to their respective network segments.) The two computers on the left share the same Network ID (determined by the computer's IP address and subnet mask) and therefore belong to the same logical network or subnet. The left port of the router also belongs to this subnet. The single computer on the right and the router's right port share a different Network ID and belong to a different subnet. A /24 MAC 21 B /24 MAC 22 H MAC 2 R MAC 3 H X /24 MAC 31 Figure 3 Applying Subnet Masks to IP Addresses to determine Packet Routing PC A -> PC B (direct) Suppose A wants to send a packet to B. A must first determine if B is in the same subnet or in a different subnet. A does this by applying it's own subnet mask, , to it's own IP address and then to the IP address of B. In this case, applying A's subnet mask to the IP addresses belonging to both A and B gives the same Network ID, Since A determines that A and B belong to the same subnet, A will send it's packet directly to B. PC A -> PC X (via Router) Suppose A wants to send a packet to X. A must first determine if X is in the same network as itself. A does this by applying it's subnet mask, to it's own IP address and then to the IP address of X. In this case, applying A 's subnet mask to the IP addresses belonging to both A and X gives different network addresses, and Since A determines that X belongs to a different subnet, A will send it's packet to the router. The router will then forward the packet on to X. (A knows the address of the router because the address is "usually" defined as the Default Gateway Address (DGA) in A's IP configuration. The DGA is the address to which to send all packets which are destined for an IP address outside one's own subnet. More on this later, including the meaning of the word "usually".) Chapter 6 - Routing 25/43 Gnall

26 Exchanging Packets Within the Same Subnet Sending a packet to a host within one's own subnet is a relatively simple matter. Suppose in Figure 3, A wants to ping B. Assume that A already knows the IP address for B and executes the following command: ping Although A may know the IP address for B, it does not know the MAC address for B. A must determine the MAC address for B. The steps for A to ping B are as follows: 1) A applies it's subnet mask to it's own IP address and the IP address for B and determines that B belongs to the same subnet and therefore is most likely in the same network segment. 2) A sends out an ARP packet requesting the MAC address corresponding to the IP address for B. 3) A receives an ARP response from B containing the MAC address for B. 4) A sends out an ICMP ping packet. The destination MAC address for the packet corresponds to the MAC address for B. 5) B receives the ping request and sends back a ping reply packet to A, following the same process as outlined in steps st Packet: Destination MAC Address 22 Source MAC Address 21 L3 Protocol Source IP Address Destination IP Address Data Exchanging Packets Between Different Subnets Sending a packet to a host within one's own subnet is a relatively simple matter, but sending a packet through a router to a host in another subnet is more complicated. Suppose in Figure 3, A wants to ping X, which involves sending a packet through the router R. Assume that A already knows the IP address for X and executes the following command: ping Although A may know the IP address for X, it does not know the MAC address for X. Even if A did know the MAC address for X, it couldn't use it, as any packet it sends out with X's MAC address as the destination MAC address would be ignored by the router, since X's MAC address does not match the router's MAC address. Instead, A must determine the MAC address for the router, and send the ping request to the router, and depend on the router to relay the ping packet to X. So A must send out an ARP query packet requesting the MAC address of the router. To do this, A must know the IP address of the router, which is stated in the IP configuration for A's NIC (either as the Default Gateway Address or as another route in the NIC's routing table). Chapter 6 - Routing 26/43 Gnall

27 The steps for A to ping X are as follows: 1) A applies it's subnet mask to it's own IP address and the IP address for X and determines that X belongs to a different subnet and therefore is most likely in a different network segment. 2) A retrieves the IP address for the default gateway from it's IP configuration. The default gateway is the router to which all packets should be sent if the destination IP address is in another subnet. 3) A sends out an ARP packet requesting the MAC address corresponding to the IP address for the default gateway (router R). 4) A receives an ARP response from router R with the MAC address for R. 5) A sends out an ICMP ping packet. The destination MAC address for the packet corresponds to the MAC address for router R, but the destination IP address for the packet corresponds to the IP address for X. 6) Router R receives the packet and processes it since the destination MAC address matches the router's MAC address. 7) The IP software in the router R reads the destination IP address in the packet and determines that the router is not the final destination for the packet and that the packet needs to be forwarded on to another host. 8) Although the original packet contains the IP address for X, it does not yet containt the MAC address for X, which the router needs in order to send the packet to X. The router R sends out an ARP packet requesting the MAC address corresponding to the IP address for X. 9) X responds to the ARP query with a packet containing it's own MAC address. 10) The router R is now able to forward the ping request packet to X, replacing the destination MAC address with the MAC address for X. The router also substitutes it's own MAC address for the return MAC address in the ping request. 11) X receives the ping request and sends back a ping reply packet to A through the router R, following the same process as outlined in steps st Packet: Destination MAC Address 2 Source MAC Address 21 L3 Protocol Source IP Address Destination IP Address Data In General 1) The sender uses it's own IP address and subnet mask to determine it's own Network ID/subnet. 2) The sender then applies it's own subnet mask to the recipient's IP address and determines if the recipient has the same Network ID and is therefore in the same subnet. 4) If the recipient is in the same subnet, the packet is sent directly (possibly through a hub or switch) to the recipient without going through a router. 3) If the recipient is in a different subnet (and most likely a different network segment), the sender directs the packet to a router (usually the default gateway). The router then forwards the packet to the recipient in the other subnet. Chapter 6 - Routing 27/43 Gnall

28 Routers and Broadcast Domains By now, it may be apparent that another advantage of using a router is to restrict the range of broadcast packets. Consider the much larger network in Figure 4 consisting of two network segments separated by a router. A /24 MAC 21 X /24 MAC 31 B /24 MAC 22 C /24 MAC 23 H MAC 2 R MAC 3 S Y /24 MAC 32 Z /24 MAC 33 D /24 MAC 24 W /24 MAC 34 Figure 4 As the different hosts in the /24 network communicate with each other, they will occasionally have to send out broadcast ARP packets. They will also have to send out other types of broadcast packets as well. To prevent the entire network from becoming overwhelmed with broadcast packets, the router will block most broadcast packets, and only allow through point-to-point packets with specific destination MAC and IP addresses. The same logic holds true for the hosts in the /24 network. Containing broadcast packets within a network segment helps to reduce overall congestion on the network. The collection of hosts which see each other's broadcast packets is known as a broadcast domain. So routers create broadcast domains. Chapter 6 - Routing 28/43 Gnall

29 What is a Default Gateway and Default Gateway Address (DGA)? The Default Gateway Address is the address of the router to which a source host sends packets if the destination host is not a member of the source host's own subnet. The router is known as the default gateway. The IP Address, Subnet Mask and Default Gateway Address is either acquired from a DHCP server 14 or can be assigned statically. The following screenshot is from the IP configuration GUI of a Windows XP machine with a static IP configuration. MAC Address Placement Within a Data Packet Recall from chapter 4 that Ethernet packets contain both MAC addresses and IP addresses. When a NIC receives a data packet, it reads the value of the Destination MAC Address inside the packet. If the Destination MAC Address is either a broadcast address or matches the NIC's own MAC address, the NIC will pass the packet on to the IP software. If the Destination IP Address inside the data packet is either a broadcast IP address or matches the host's own IP address, the host will continue to process the packet, otherwise it will be discarded. Since the MAC address is read before the IP address, it is placed at the front of an Ethernet data packet, as shown in this diagram: Destination MAC Address Source MAC Address L3 Protocol Source IP Address Destination IP Address Data Chapter 6 - Routing 29/43 Gnall

30 The address for the Default Gateway is stored in the computer's routing table, which can be displayed on a Windows machine with the "route print" DOS command. In the above screenshot, three NICs (interfaces) are listed - a physical Intel NIC and two virtual VMware NICs. If a computer has two or more NICs, each of which are connected to different networks, then the routing table will contain entries indicating which NICs to use to access specific subnets. If the computer needs to send a packet to a host on a different subnet, it will first check to see if there is a specific entry for the subnet. In the above example, there are specific entries for two other subnets: Network Destination Netmask Gateway Interface Metric If there is no specific entry for a specific subnet, then the default gateway entry will be used: Network Destination Netmask Gateway Interface Metric Chapter 6 - Routing 30/43 Gnall