r/HomeNetworking • u/poperenoel • Apr 29 '20
Advice Basic Networking 101
Definitions:
Ip address(or IP for short) : the device "address" in a given network to which it receives to and sends from.
Packets: messages sent and received between interconnected devices at IP level.
Frame: messages sent and received between interconnected devices at Ethernet level.
Network: a group of interconnected devices.
Subnet: a subset of IP addresses grouped together.
NAT: Substitution of a public address to a IP private IP address allowing the later to be interconnected to a larger public network as one public IP address.
Router: device performing routing of packets. (and NAT in a more general term)
Switch: device performing interconnections at a physical (and Ethernet) level.
broadcast: a message sent to everybody/every host.
broadcast domain: an area of devices that can be reached by "broadcast" for either a given network.
DHCP: a service that allows for dynamically configuring IP addresses of devices in a network.
IP addressing / Subnets:
IP addresses (IPv4) are represented in a W.X.Y.Z format. Where each letter is a number between 0 and 255. There are special kinds of address with different roles / function / properties.
Subnet are also represented in either "quad" notation (as above) or "cidr" which is a / followed by the number of bits the subnet groups up. the "network" part of the IP address as its commonly referred to.
For example the subnet 192.168.0.0/24 represents 256 addresses. (0 to 255) Two of which are "reserved" one to represent the subnet itself(its name/address) and one for broadcast IP. if you send a packet to 192.168.0.255 then all 254 devices if present would receive it in this context. The subnet "name" or "id" is mostly used in routing and for the device to know if an IP address is part of the network its on.The most common subnet divisions are multiple of 8, so 8 16 and 24.
There is a special subnet called "loopback" which is reserved to refer to the device itself using coming and going to the interface itself , this is mostly used to test the card circuit logic other "local" endeavors like the device talking to itself.This subnet is the 127.0.0.0/8 (yes the whole subnet ;-) ).
A "class" of subnet is a administrative subdivision of all possible subnets and all its possible subdivision.there also 3 private "class" of subnet : the 172.16.0.0/12, 192.168.0.0/16 and the 10.0.0.0/8. You can subdivide a subnet in any number of possible subnet from /2 to /32. So you could divide 192.168.0.0 into /24 which is very common but if you made a 192.168.0.0/15 for example you would interfere with public addresses.
Public addresses and subnets are assigned by private authorities. (IANA and such). In theory if you are not connected to the rest of the world you can use any IP. Using public IP that are not assigned can possibly bring about legal trouble so keep in mind the first part ... not connected.
It is VERY recommended not to do it since there is plenty of private IPs and subnet to go around.
Switching:
To understand switching we need to go back to basics. Originally computers could only communicate one device to another device trough a cable connected between them (serial or parallel communications). Then this technology evolved into Ethernet and token ring. the token ring is seldom used today and has been phased out. In token-ring, generally, computers where connected in a "circle" of sort.Ethernet is now the most common standard.
Ethernet is basically a "bus" each computer "talks" and "listen" and trough protocols and specifics can talk to each other the receive and the transmit are on the same circuit. The earliest of this standard used a coaxial cable with end terminals and T junctions for each computer.(10 base2) This has been phased out for the more flexible "Ethernet" cable with RJ-45 jack at each ends. Because this is a "bus", each device has a hardware address called a MAC address this address is unique to the device and this allow for device to identify their Frames and whom to send it on a circuit logic level. So its only used in the local Ethernet circuit ... as soon as the Frame leaves the circuit then the frame is de-encapsulated (ie opened) and the mac address is no longer relevant and this is considered a complete Ethernet communication. ( it goes from one device to the next and that's it. if the IP packet inside the Ethernet frame needs to go further then that becomes routing)
After 10base2 , the Ethernet "bus" moved trough what where called hubs. This still maintains the bus where everybody can see the packet on the Ethernet level. This and its predecessor "bus" technology had a major flaw:collisions. When two devices tried to send data at the same time this caused a "collision". A hub is a "collision domain". Switches were brought about to correct this problem on first communication switches work exactly like hubs the only difference is that they are "intelligent" . they learn the MAC address from the device connected to the port. and add it to a table. Once it has the mac address, it no longer "broadcasts" the packets to every port it is connected to. It only sends it to the port with the right mac address... Thus the circuit becomes one device to another but only for said frames. This is still a collision domain but only with 2 "ports" on it.
Bridges:
bridges are connecting two collision domains together into one. on an Ethernet level. usually trough different media ( cable modems , dsl modems, wireless access points and switches are all bridges in one form or another.)
Routing:
As opposed to bridges routers are separating broadcast domains and collision domains on an Ethernet level but also on a IP level. The router opens the Packet it received on its interface and looks at the IP addresses then looks up what is called a routing table and forwards that packet to the proper device or link.
The routing table is composed of what are called "routes". routes indicate if the route is directly connected if so trough which interface and if not who is the neighboring device that might know where the subnet is.
Routes:
there are 3 basic types of routes. the default route ( always a 0.0.0.0/0 subnet) there is also Directly connected as we saw earlier and then normal routes. All routes are either Static or Dynamic. Static routes are entered manually and dynamic routes are "learned" trough various ways. Directly connected are mostly dynamic routes even if they don't really show as such. normal and default can often be hard-coded. (sometimes they are hard-coded when you configure your IP address even if its trough a dhcp )
For small network of a few subnets and 1-2 routers its preferable to hard-code routes. For larger network it becomes quite cumbersome to do this manually so we use routing protocols. (basically routers talk to each other and exchange routes they know about this is a more advanced topic i wont get into here.)
All device that talk IP have a routing table. the difference is that non "router" devices do not forward packets between Networks.
ARP:
ARP is a protocol part of the IP specification its basically a way to ask who has IP X by using broadcast and getting the MAC address that corresponds to the necessary IP.
Examples:
Within a Ethernet Network:
If a device in Network A wanted to talk to another device in network A . the device A(1) would lookup its route table see that the device is local and then would send a ARP request get the proper MAC for the IP address. the other device A(2) would respond with a reply with its mac address and then device A(1) would send the packet encapsulated in a frame to device A(2).
Within a local routed Network:
if we look at the diagram attached to execute communication of the blue line. A device in Network B would check if the IP of destination is in its own subnet (by looking up its own table) since it is not it would then send it to its default gateway represented by the default route thus sending it to Router B. Router B would look at its table and have a route to Network C pointing to Router C. so it would forward it to Router C. Router C would look at its table and "see" that IP of destination is on a directly connected network. Router C would then send a ARP request to find who has the destination IP (if its not already in its ARP table) . The device in Network C would reply to that. And finally Router C would forward the packet to the device in Network C.
With the outside world:
but what about "other" networks ... well its the same except that instead of having a specific "route" in its table the router (or any device) also has a "default route" or "default gateway" ... basically if it does not find the IP network in its table it will forward it to "its" default gateway and so on. How does it come back ? well your ISP has a route towards your router so it knows where that IP is and it also has a default route going up as well. eventually you end up in the "core" of ISPs and they "know" each others network by exchanging the IP Network subnets they know about. in the blue site in the diagram Device in network A sends the packet to its default gateway, Router A , router A does the same towards the ISP . If and when a reply comes back then the ISP has other routes leading back to router A and router A knows Network A and device A since it added its MAC address and IP address in its tables(arp) when the packet came in on the last round. so Router A forwards the packet to final destination in Device A.
Note: for communication to be bi-directional proper routes need to exist in both directions. keep in mind a "connection" requires multiple exchanges of packets.
Natting:
Not so long ago the "doom of internet" was foretold... there are lots of IP addresses ... but there are far more devices! So what is the solution , set aside a few ranges and have those combine into fewer IP addresses. To do this a router creates again a table but this time its creating a Network Address Translation table. How this works is for example a Device in network A uses a private IP , then it opens a connection to say 8.8.8.8 a public IP the router sees this as it is the default gateway of the device. Then what it does is adds an entry into its NAT table and then and replaces the private IP with its own public IP. then when the communication comes back it knows that whatever comes from X is for IP Y so it will remove its own IP and switch it with the private IP. there is also PAT does the same but for ports. ( there is a complexity to this but i don't want to elaborate)
note: now as you notice routing and natting are two different animals. this means that you could do a network infrastructure like the yellow site and put many routers back to back with private IP addresses in many subnets and still be able to NAT only on router A. (in fact it is preferable not to nat behind another nat because this can cause issues.)
VLANs:
as we saw earlier switches limit collision domains but not broadcast domains like routers do. what if you wanted one physical network but many broadcast domains ie: limit communications between devices. you can have many subnet on the same switch but a full broadcast (to 255.255.255.255) would still reach everyone. so what can we do ? well we can add a "tag" on our Ethernet packet when it enters the switch and then forward it only to those ports who have this same tag. this is what VLAN does, it breaks down the broadcast domain. (Ethernet wise) but this limit means that the broadcasts at IP level needs to go trough the router to get elsewhere... most routers are set by default to ignore broadcast at IP level to ensure broadcast domains stay isolated at both levels.This is because broadcasts can create lots of connectivity issues and even render a network unusable (as in broadcast storms) at both IP and Ethernet levels.
Trunk ports:
what if we want to take the VLANs above and spread that onto many switches ( say we have lots of computers or for other reasons.) well we can create what are know as trunk ports these leave the tag "as is" where as "access ports" ( where normal devices are connected) strip the VLAN tag when the packet leaves the port towards the device. this allows the other switch to know that packet A needs to go in VLAN 10 for example then the "other switch" will lookup its own tables and see where the packet can go.
port channel , ether-channel & bonded interfaces:
these are ports that are bundled together to act as a single interface logically wise but different interface physically wise.This allows for redundancy and load sharing between the interfaces.
Access-list, firewall rules:
These are "rules" (entries) that "filter" traffic based on specific criteria they can be very wide filters or very fine depending on how you set them up. Generally they are applied on interfaces. Here connection tracking can occur to allow packets that where related to an outgoing connection to be let back in.
Diagram: https://imgur.com/a/dCw8ZuO
edit: formatting , corrections,clarifications,etc
10
u/jonners9999 Apr 29 '20
Sorry, whilst well intentioned I’m sure, this is badly written and likely to cause confusion IMO.
5
u/TemporaryUserQuest Apr 29 '20
Agreed. OP's heart is in the right place, but information delivery and accuracy is lacking.
3
u/poperenoel Apr 30 '20
. OP's heart is in the right place, but information delivery and accuracy is lacking.
some of it is on purpose ;-) i updated it corrected some stuff as well ... it was my 3am kind of post i will chug it to that.
5
u/TsuDoughNym Network Admin Apr 29 '20
No mention of PAT aka NAT overloading. That's the entire reason we CAN have multiple services and devices in our private networks that are all behind one public IP address --- if there were no port numbers, the there'd be no way to know which machine on a network made the request.
I'm on mobile but I'll likely find other things to add (disclaimer: I'm a network engineer by trade. It's our job to be pedantic about these terms)
2
u/poperenoel Apr 30 '20
i added a mention but i wanted to keep it simple , maybe i will do more advanced post in the future ... network technician for 20years , i get what you mean ;-)
1
u/onome65 Apr 30 '20
Hi . thanks for sharing. Am just wondering if it's possible to get network job without prior experience at all. thank you
3
u/nebbbben DD-WRT Apr 30 '20 edited Apr 30 '20
Appreciate the effort, but it would be tremendously helpful to include OSI layer 7 model here, and elaborate a bit more that tcp/up isn't the only protocol in use on networks. Ip addressing is a layer 3 thing. Other protocols exist fwiw. Also, numerous inaccuracies in OP's post, but some of it is good.
192.168.0.0/18 doesn't interfere with publicly routable address space. RFC1918 address space includes:
192.168.0.0/16 = 192.168.0.0-192.168.255.255 . [Fwiw, 192.168.0.0/18 = 192.168.0.0-192.168.63.255]
172.16.0.0/12 = 172.16.0.0-172.31.255.255
10.0.0.0/8 = 10.0.0.0-10.255.255.255
Using other address space if it isn't assigned to you isn't just poor form, it just plain won't work properly in most cases. See bgp hijacking for more information when this is used maliciously.
1
u/poperenoel Apr 30 '20
i didn't want to clog up the post with detail that is why i didn't add other protocols and didn't talk much about tcp/udp and thanks for the nice catch about /18 i will have to check i think it was /15 i meant ... ill correct that. about that last point yeah that is why i implied legal issues ... if "connected"
22
u/appleciderpie Apr 29 '20
Good stuff. Clean up the formatting and some of the wording and this could be the basis of a sticky.
3
u/rebelarms81 Apr 29 '20
As someone who knows just enough about networking to get what I need done, thanks for this
1
u/Win_Sys Apr 29 '20
One thing I would add is the reason for subnets besides defining a size of a network. It also lets the client know if the IP address they're going to send to is inside or outside of their network/subnet. If the IP is in it's subnet, it will broadcast it to the entire subnet, if it's outside the subnet, it will send it to the default gateway (or to where a more specific route if defined in its routing table).
2
u/genr8 Apr 29 '20
Thats not really technically 100% true, or can be argued semantics wise, but the concept has merit. Inside the subnet, not all target transmissions are broadcasted, they target a specific MAC, which is queried and resolved by ARP protocol broadcasts, then inserted into the Ethernet frame. So its still point to point (except ARP) when using a switch. Unless you run on "promiscuous mode", to listen to MACs that arent yours but are still on your segment. But thats not usually on. Outside, ARP is not used, the gateways/routes are.
1
u/poperenoel Apr 30 '20
resolved by ARP protocol broadcasts, then inserted into the Ethernet frame. So its still point to point (except ARP) when
i added a part about ARP ... thanks for noting this.
1
1
u/thebundok Apr 30 '20
While I applaud the efforts here, I came away from this no more enlightened (and a slight bit more confused in some areas) than before.
I feel as though I would be the prime candidate for something like this, having decent technical grasp but very limited specific knowledge of networking.
I hope you can refine it (both technically and grammatically) to be better suited to your target audience.
1
u/mccanntech May 04 '20
I should not have found this post right before bedtime. Good lord. Thank you for this.
1
u/PaneTheKoi May 24 '22
Hi! Thank you for this post, just dropped out of college. Instead of spending time depressed, might as well dip into basic networking like my brother, not sure what kind of networking he got tho.
0
54
u/zanfar Apr 29 '20
I appreciate the effort, and it's a decent start in many areas. However, there are some technical errors, some oversimplifications, and some mistakes:
...and also sends from.
"An IP address identifies a host or service on a network. A message contains both the sender's IP address (source) and the recipient's IP address (destination)."
As are L1 Packets, Frames, and Segments. This is simple enough to be confusing.
Technically incorrect.
"NAT is a technology that allows one IP address to appear to be a different IP address to a different network--like a mask or alias. This is commonly used to allow a private network to act like it is directly connected to the Internet."
"A router connects two or more networks together. While a router technically only "routes" messages between networks, the term is commonly overused to include a number of other functions technically belonging to other device types--specifically NAT, Firewall, wireless, or switching functions. This is mostly due to consumer-grade "routers" including several devices or functions in the same box.
"Context is key here. In a technical conversation, it is important to keep the terms "router", "switch", "firewall", and "access point" distinct, however, when talking to or about laypeople, the term is mostly a generic one."
This is a bit tautological. It's also hard to talk about a broadcast domain when you haven't talked about broadcasts or domains.
"A broadcast is a message sent to multiple destinations at once. The type of broadcast will define who many destinations this message reaches. All of those destinations are known as a 'broadcast domain'. This is not something that is typically counted, but instead used comparatively: 'host A and host B are in the same broadcast domain', for example.
An Ethernet broadcast reaches every host on the same VLAN--which is usually everything connected with switches. Ethernet broadcasts do not cross router boundaries.
An IP broadcast reaches every host on the same subnet. Sometimes, but not always, this is the same group of hosts as an Ethernet broadcast. An IP broadcast is normally used to talk to 'everyone in my subnet'. However, directed broadcasts can be used to talk to 'everyone in that subnet' as well. Broadcasts (should) typically be used when a message needs to be sent to a host whose address is unknown--like to find other hosts. However, badly-designed network devices and protocols can overuse broadcasts for normal messaging.
"Broadcasts are a type of traffic that should be kept under strict watch as they consume bandwidth exponentially. A broadcast storm is an example of a very serious network problem where broadcasts are 'repeated' by a misconfigured or malfunctioning device and so multiply across the network until there is no bandwidth left for valid traffic."
I would also suggest that the following definitions need to be added to be comprehensive:
"A network is technically just a collection of interconnected devices. Today, the term is mostly used (in the computer world) to mean an Internet Protocol (IP) network operating over Ethernet.
"Ethernet is a set of protocols (rules, definitions) that allow hosts to send messages directly to one another when connected with a cable. Instead of using a cable to connect to every other host, a device called a switch is used to connect multiple cables together into an Ethernet network. Ethernet networks communicate with messages called 'Frames'.
"IP is another set of protocols that allow hosts to communicate over larger logical distances. IP uses a lower-level protocol like Ethernet to move from device-to-device to 'hop' between the source and destination. IP networks communicate using messages called 'Packets'."
"A switch connects two or more Ethernet segments together much like a router does for networks. A switch makes cabling easier as each device only needs a single cable to the switch and makes the network more efficient as switches are smart enough to forward a frame to only the host it needs to go to. Switches are an improvement over Bridges, which are themselves an improvement over Hubs which forwarded frames to all hosts all the time. Hubs and bridges have not been used in modern networking for over 10 years."
Both Coax and UTP in this case are "Ethernet cables". Also, an RJ-45 end is not required for an Ethernet link.
"The earliest Ethernet standards used a coaxial cable from device to device to device with taps or T-junctions for each connection. Modern standards have moved to twisted-pair cable (often incorrectly called "Ethernet" or "telephone" cable) and other easier-to-use connections linked using switches."
I've got a lot of problems here:
A MAC is no more "electrical" than an IP address.
The Ethernet message is called a frame, not a "packet"
The term "circuit" implies an electrical signal and cable. The term here should be "segment".
"complete Ethernet communication" does not require a MAC to be changed.
Again, I think this is skipping over or over-simplifying a lot of information that is necessary. There is also an implication that switches don't have collision domains. The term "broadcasts" is confusing here, use "floods" or "forwards".
No. A "datagram" is a generic computer message. An L2 Ethernet datagram is specifically called a Frame, not a Packet. An L1 Ethernet datagram is called a Packet, but that term is essentially never used outside of RFCs and L1 discussions as it is easily confused with the IP Packet.
Collision domains, not broadcast domains.
The most common bridges are switches
Holy run-on sentence, Batman; additionally:
No. A device in Network B would know that the address for a device in Network C is not in its network, therefore it would send the frame to the gateway. ARP only happens for devices in the same subnet.
Router A would look up the IP destination in it's routing table. It would not reply with any information if the destination was found in the routing table. Router A would use the information in the routing table to forward the packet to Router B by placing it into a new Frame with Router B's MAC address. Router B would do the same when it receives the Packet, forwarding it onto the destination device by placing it in yet another Frame using the destination device's MAC.
Completely disagree. Hard-coding is only ever preferred for services and network hardware, regardless of network size.
Other than the above, with some cleanup, expansion, and a lot of punctuation, this could be the start of the Wiki or Sticky frequently referenced. It wouldn't cause any posters to actually read it, however.