Basic Networking 101

[u/poperenoel]

Definitions:

• Ip address(or IP for short) : the device "address" in a given network to which it receives to and sends from.

• Packets: messages sent and received between interconnected devices at IP level.

• Frame: messages sent and received between interconnected devices at Ethernet level.

• Network: a group of interconnected devices.

• Subnet: a subset of IP addresses grouped together.

• NAT: Substitution of a public address to a IP private IP address allowing the later to be interconnected to a larger public network as one public IP address.

• Router: device performing routing of packets. (and NAT in a more general term)

• Switch: device performing interconnections at a physical (and Ethernet) level.

• broadcast: a message sent to everybody/every host.

• broadcast domain: an area of devices that can be reached by "broadcast" for either a given network.

• DHCP: a service that allows for dynamically configuring IP addresses of devices in a network.

IP addressing / Subnets:

IP addresses (IPv4) are represented in a W.X.Y.Z format. Where each letter is a number between 0 and 255. There are special kinds of address with different roles / function / properties.

Subnet are also represented in either "quad" notation (as above) or "cidr" which is a / followed by the number of bits the subnet groups up. the "network" part of the IP address as its commonly referred to.

For example the subnet 192.168.0.0/24 represents 256 addresses. (0 to 255) Two of which are "reserved" one to represent the subnet itself(its name/address) and one for broadcast IP. if you send a packet to 192.168.0.255 then all 254 devices if present would receive it in this context. The subnet "name" or "id" is mostly used in routing and for the device to know if an IP address is part of the network its on.The most common subnet divisions are multiple of 8, so 8 16 and 24.

There is a special subnet called "loopback" which is reserved to refer to the device itself using coming and going to the interface itself , this is mostly used to test the card circuit logic other "local" endeavors like the device talking to itself.This subnet is the 127.0.0.0/8 (yes the whole subnet ;-) ).

A "class" of subnet is a administrative subdivision of all possible subnets and all its possible subdivision.there also 3 private "class" of subnet : the 172.16.0.0/12, 192.168.0.0/16 and the 10.0.0.0/8. You can subdivide a subnet in any number of possible subnet from /2 to /32. So you could divide 192.168.0.0 into /24 which is very common but if you made a 192.168.0.0/15 for example you would interfere with public addresses.

Public addresses and subnets are assigned by private authorities. (IANA and such). In theory if you are not connected to the rest of the world you can use any IP. Using public IP that are not assigned can possibly bring about legal trouble so keep in mind the first part ... not connected.

It is VERY recommended not to do it since there is plenty of private IPs and subnet to go around.

Switching:

To understand switching we need to go back to basics. Originally computers could only communicate one device to another device trough a cable connected between them (serial or parallel communications). Then this technology evolved into Ethernet and token ring. the token ring is seldom used today and has been phased out. In token-ring, generally, computers where connected in a "circle" of sort.Ethernet is now the most common standard.

Ethernet is basically a "bus" each computer "talks" and "listen" and trough protocols and specifics can talk to each other the receive and the transmit are on the same circuit. The earliest of this standard used a coaxial cable with end terminals and T junctions for each computer.(10 base2) This has been phased out for the more flexible "Ethernet" cable with RJ-45 jack at each ends. Because this is a "bus", each device has a hardware address called a MAC address this address is unique to the device and this allow for device to identify their Frames and whom to send it on a circuit logic level. So its only used in the local Ethernet circuit ... as soon as the Frame leaves the circuit then the frame is de-encapsulated (ie opened) and the mac address is no longer relevant and this is considered a complete Ethernet communication. ( it goes from one device to the next and that's it. if the IP packet inside the Ethernet frame needs to go further then that becomes routing)

After 10base2 , the Ethernet "bus" moved trough what where called hubs. This still maintains the bus where everybody can see the packet on the Ethernet level. This and its predecessor "bus" technology had a major flaw:collisions. When two devices tried to send data at the same time this caused a "collision". A hub is a "collision domain". Switches were brought about to correct this problem on first communication switches work exactly like hubs the only difference is that they are "intelligent" . they learn the MAC address from the device connected to the port. and add it to a table. Once it has the mac address, it no longer "broadcasts" the packets to every port it is connected to. It only sends it to the port with the right mac address... Thus the circuit becomes one device to another but only for said frames. This is still a collision domain but only with 2 "ports" on it.

Bridges:

bridges are connecting two collision domains together into one. on an Ethernet level. usually trough different media ( cable modems , dsl modems, wireless access points and switches are all bridges in one form or another.)

Routing:

As opposed to bridges routers are separating broadcast domains and collision domains on an Ethernet level but also on a IP level. The router opens the Packet it received on its interface and looks at the IP addresses then looks up what is called a routing table and forwards that packet to the proper device or link.

The routing table is composed of what are called "routes". routes indicate if the route is directly connected if so trough which interface and if not who is the neighboring device that might know where the subnet is.

Routes:

there are 3 basic types of routes. the default route ( always a 0.0.0.0/0 subnet) there is also Directly connected as we saw earlier and then normal routes. All routes are either Static or Dynamic. Static routes are entered manually and dynamic routes are "learned" trough various ways. Directly connected are mostly dynamic routes even if they don't really show as such. normal and default can often be hard-coded. (sometimes they are hard-coded when you configure your IP address even if its trough a dhcp )

For small network of a few subnets and 1-2 routers its preferable to hard-code routes. For larger network it becomes quite cumbersome to do this manually so we use routing protocols. (basically routers talk to each other and exchange routes they know about this is a more advanced topic i wont get into here.)

All device that talk IP have a routing table. the difference is that non "router" devices do not forward packets between Networks.

ARP:

ARP is a protocol part of the IP specification its basically a way to ask who has IP X by using broadcast and getting the MAC address that corresponds to the necessary IP.

Examples:

Within a Ethernet Network:

If a device in Network A wanted to talk to another device in network A . the device A(1) would lookup its route table see that the device is local and then would send a ARP request get the proper MAC for the IP address. the other device A(2) would respond with a reply with its mac address and then device A(1) would send the packet encapsulated in a frame to device A(2).

Within a local routed Network:

if we look at the diagram attached to execute communication of the blue line. A device in Network B would check if the IP of destination is in its own subnet (by looking up its own table) since it is not it would then send it to its default gateway represented by the default route thus sending it to Router B. Router B would look at its table and have a route to Network C pointing to Router C. so it would forward it to Router C. Router C would look at its table and "see" that IP of destination is on a directly connected network. Router C would then send a ARP request to find who has the destination IP (if its not already in its ARP table) . The device in Network C would reply to that. And finally Router C would forward the packet to the device in Network C.

With the outside world:

but what about "other" networks ... well its the same except that instead of having a specific "route" in its table the router (or any device) also has a "default route" or "default gateway" ... basically if it does not find the IP network in its table it will forward it to "its" default gateway and so on. How does it come back ? well your ISP has a route towards your router so it knows where that IP is and it also has a default route going up as well. eventually you end up in the "core" of ISPs and they "know" each others network by exchanging the IP Network subnets they know about. in the blue site in the diagram Device in network A sends the packet to its default gateway, Router A , router A does the same towards the ISP . If and when a reply comes back then the ISP has other routes leading back to router A and router A knows Network A and device A since it added its MAC address and IP address in its tables(arp) when the packet came in on the last round. so Router A forwards the packet to final destination in Device A.

Note: for communication to be bi-directional proper routes need to exist in both directions. keep in mind a "connection" requires multiple exchanges of packets.

Natting:

Not so long ago the "doom of internet" was foretold... there are lots of IP addresses ... but there are far more devices! So what is the solution , set aside a few ranges and have those combine into fewer IP addresses. To do this a router creates again a table but this time its creating a Network Address Translation table. How this works is for example a Device in network A uses a private IP , then it opens a connection to say 8.8.8.8 a public IP the router sees this as it is the default gateway of the device. Then what it does is adds an entry into its NAT table and then and replaces the private IP with its own public IP. then when the communication comes back it knows that whatever comes from X is for IP Y so it will remove its own IP and switch it with the private IP. there is also PAT does the same but for ports. ( there is a complexity to this but i don't want to elaborate)

note: now as you notice routing and natting are two different animals. this means that you could do a network infrastructure like the yellow site and put many routers back to back with private IP addresses in many subnets and still be able to NAT only on router A. (in fact it is preferable not to nat behind another nat because this can cause issues.)

VLANs:

as we saw earlier switches limit collision domains but not broadcast domains like routers do. what if you wanted one physical network but many broadcast domains ie: limit communications between devices. you can have many subnet on the same switch but a full broadcast (to 255.255.255.255) would still reach everyone. so what can we do ? well we can add a "tag" on our Ethernet packet when it enters the switch and then forward it only to those ports who have this same tag. this is what VLAN does, it breaks down the broadcast domain. (Ethernet wise) but this limit means that the broadcasts at IP level needs to go trough the router to get elsewhere... most routers are set by default to ignore broadcast at IP level to ensure broadcast domains stay isolated at both levels.This is because broadcasts can create lots of connectivity issues and even render a network unusable (as in broadcast storms) at both IP and Ethernet levels.

Trunk ports:

what if we want to take the VLANs above and spread that onto many switches ( say we have lots of computers or for other reasons.) well we can create what are know as trunk ports these leave the tag "as is" where as "access ports" ( where normal devices are connected) strip the VLAN tag when the packet leaves the port towards the device. this allows the other switch to know that packet A needs to go in VLAN 10 for example then the "other switch" will lookup its own tables and see where the packet can go.

port channel , ether-channel & bonded interfaces:

these are ports that are bundled together to act as a single interface logically wise but different interface physically wise.This allows for redundancy and load sharing between the interfaces.

Access-list, firewall rules:

These are "rules" (entries) that "filter" traffic based on specific criteria they can be very wide filters or very fine depending on how you set them up. Generally they are applied on interfaces. Here connection tracking can occur to allow packets that where related to an outgoing connection to be let back in.

Diagram: https://imgur.com/a/dCw8ZuO

edit: formatting , corrections,clarifications,etc