EC312 Lesson 25: Networks, Protocols, Transmission
Objectives:
(a) Describe the TCP/IP model, the functions performed by each layer, and the process of encapsulation.
(b) Define the function of a protocol.
(c) Define the structure of an Ethernet address and frame.
(d) Calculate the bandwidth available to users in various network configurations.
(e) Summarize the principles behind the design of the Internet Protocol.
(f) Define the structure of an IP address and define the purpose of network masking.
(g) Identify and explain the basic fields of the IP header.
(h) Define the process of ARP reply and ARP request.
(i) Define the process of routing packets and routers creating tables.
(j) Be able to follow the process of the TCP/HTTP protocols to handshake and establish the connections for the
packets to be delivered to the correct ports.
You were introduced to the idea and framework of networking in Cyber1, and we used that framework to
talk about the protocols of wireless networking, but in this lesson, we will get into the details of the TCP/IP
model of networking at the bit level and then be able to compare the Controller Area Networks which we will
be delving into for the next 4 lessons. Because the network is built in virtual layers, this model is the same for
wireless or wired networks except at the actual physical layer and data link layers. We will build labs and
discuss wired technologies in this section.
1. Layers
Recall the OSI layer model and its comparison to the TCP/IP model:

Each layer performs only a few specific, well-defined functions. This simplifies the design. For
example, in an email scenario, at the application layer the initial message is formatted using it’s
application protocol (SMTP) and it is only worried about getting the message delivered to the right
application (the email application), then at the transport layer the TCP header is added and segments are
1
formatted to provide correct port addresses and ACK sequences and it only worries that that it arrives
correctly in the right sequence. The transport layer does not worry about routing, that is left to the next
layer down, the network layer, the IP header and format are added with the source and destination IP
addresses to its packets and it doesn’t worry about the framing of the data as bits, it lets the data link
portion of the network interface layer use a specific protocol like Ethernet to add its header (MAC
addresses- hardware addresses, source and destination) and footer (CRC) to create the frames to send.
The connectors and cables are specified at the physical layer, which also decides the voltage level of the
bits that are transferred over the network.


The layers are built, one on top of the next.

Each layer performs a service for the layer above it. However, how a layer does its job is not known by
the layer above. This permits later modifications.
If we decided to try to build one big honking software/hardware contraption that does everything at once (i.e.,
just put the whole kit and kaboodle into one layer), the resulting mess would be extremely difficult to modify
later. Splitting functions into layers simplifies the design. Additionally, it allows us to replace a layer with a
different implementation that accomplishes the same task using a different mechanism, without disturbing the
other layers.
2. Encapsulation So think again… how does a layer do its job? Here's how!

At the sending end, each layer puts a header on the message received from the layer above. The header
contains information necessary for the protocol to do its job.

At the receiving end, each layer strips off the corresponding header and forwards the rest up to the layer
above.
2
The application layer (not shown above) passes its message to the transport layer. The transport layer attaches
some number of bits, shown as TCP Header in the picture above and sends this onward to the network layer.
The network layer then appends some number of bits, shown as IP Header in the picture above, and so on,
down the protocol stack.
The destination physical layer removes any syncing bits from the data and passes the result up to the data link
layer. The data link layer removes the bits from its Ethernet frame header and footer and uses these bits to
implement the data link protocol, checking to see if it matches its MAC address. Then the result is passed to the
network layer which removes the bits marked IP and uses these bits to implement the network layer protocol,
and so forth until the message finally arrives to the application layer whose protocol knows how to interpret the
data.
Example
Suppose an application entity sends 1024 bytes of data and appends 96 bytes of sequencing data. This message
is then sent to the data link layer where the maximum packet size is 256, 32 bytes of which are its header. How
many packets will be used? How many total bytes must be transmitted?
Solution:
3. Protocols It is important to note that actual communication takes place only between the five layers in the
same machine and the physical layers of adjacent machines. In the picture below, the dark black lines signify
the only true transfer of data—i.e., the only real communication. Apart from the physical layer, no data are
actually directly transferred from layer n on one machine to layer n on the other machine. Instead, each layer
passes information/data only to the layer immediately above or below it.
In fact, it seems as if each layer is on the left is communicating with its peer layer on the right. This
communication is termed virtual communication.
3
A protocol is an agreement or a set of rules governing how a task or process should be carried out. One of the
functions of the transport layer is to ensure that data is delivered without errors. The transport layers on both
machines might, for example, use the Hamming code to ensure that errors are detected and corrected. In this
case, the agreed upon protocol for error detection at the transport layer is the Hamming code. If the transport
layer in the machine on the left is using the Hamming code to detect errors, but the machine on the right is using
the CRC algorithm to detect errors, communication will not be successful. The peer entities at each layer must
agree on the protocol.
As another example, one of the functions of the physical layer is to determine how logical 1 and logical 0 are
represented. If the physical layer of the machine on the left is representing logical one by +5 volts and logical
zero as -5 volts, but the machine on the right is doing just the opposite—representing logical one as -5 volts
and logical zero as +5 volts—communication will not be successful. The peer entities at each layer must agree
on the protocol.

Network Architecture. The set of layers and protocols is termed a network architecture.

Protocol Stacks. The protocols used by a system are called the system's protocol stack.
Entities at the same layer must use the same protocol, or communication will not be successful
Think about how layering helps us in this scenario. We can easily replace a layer with a different
implementation that accomplishes the same task using a different mechanism, without disturbing the other
layers
4. Layers and protocols for TCP/IP model:
The Network Interface Layer is
composed of the physical layer
and the data link layer
The physical layer is concerned with sending bits over a channel: i.e., the mechanical and electrical
considerations. Blocks of data at the physical layer are termed bits… so we're not really talking about blocks!
The data link layer is concerned with framing the data to be able to pick out the source and destination
addresses and type of data.
Blocks of data at the data link layer are termed frames. Tasks for the data link layer include:

Setting frame boundaries

Error control (to make a real link into an error-free link)

Link flow control (to stop a fast transmitter from drowning a slow receiver)

Control access to shared channels-the Multiple Access Problem
The network layer
The network layer is concerned with transferring data across a communications network from a source
computer to a destination computer. This is the first layer that recognizes the existence of a network.
Blocks of data at the network layer are termed packets or datagrams Tasks for the network layer include:

Routing
4

Internetworking-interconnecting distinct networks that use different protocols (different addressing
schemes, different packet sizes, etc.)
The transport layer
Ideally, the transport layer is responsible for the end-to-end transfer of data from a process in the source to a
process at the destination, independent of the network. Put another way, ideally the transport layer uses end-toend protocols that do not recognize the existence of an underlying network.
Blocks of data at the transport later are termed segments.
The application layer
The application layer is concerned with general purpose facilities that involve communications:

SMTP for email

HTTP for accessing the web

FTP for file transfer

SSH and TELNET for remote log in

DNS for directory assistance

SNMP for network management
Several other functions are also conceptually placed at the application layer:

Encoding. For example: Are we using EBCDIC or ASCII? Are we using Big Endian or Little Endian?

Encryption

Compression
Blocks of data at the application layer are termed messages.
Practice Problem
For the boxes below, fill in the names of the layers for the TCP/IP - 5 layer reference model and then place the
appropriate letter in the blank associated with the layer for the proper description of its services.
Layer 5
_____
Layer 4
_____
Layer 3
_____
Layer 2
_____
Layer 1
_____
5
a) Provides a definition of mechanical and electrical standards for communication system
b) Concerned with transferring packets across a communication network
c) Responsible for end to end transfer of data
d) Primary function is to format and transfer files between communication message and the user’s software
e) Frames of data are transferred across a single link
Solution:
The Ethernet protocol (one of the protocols used at the Data link layer)
1. Introduction. In the late 1960's and into the early 1970's, computers were stand-alone devices. A computer
at, say, Stanford, had no way of communicating with a computer at, say, the Naval Academy. Research teams
(largely funded by the DoD) began to explore methods for linking computers together, allowing them to
transmit information back and forth.
A breakthrough occurred when Robert Metcalfe proposed a technique for joining computers together. At heart,
the computers were joined together by a wire allowing bits to flow between computers. The sketch below (from
Metcalfe's 1976 conference paper) shows four computers (in red) joined together by a wire (in yellow). (Note
that one of the four computers is drawn to be larger than the other three in order to show some internal details).
Metcalfe, an Electrical Engineer, called his proposal "Ethernet." His company, Xerox (yes, Xerox, the same
company that said "No Thank-you" to the first computer with a GUI that it had developed in-house three years
before Apple, and the same company that saw no future in the first computer mouse that it had developed inhouse) was not interested in doing anything with the Ethernet proposal, so Metcalfe formed his own company in
1979 and named it 3Com. 3Com went on to sell hundreds of millions of Ethernet adapter cards as a Fortune
500 Company (3Com was purchased by HP in 2009). Network World reported that by 2010, approximately $16
billion in Ethernet equipment had been sold per year. 1
You may be wondering: Just run a wire between the computers?…there's got to be more to it than that! There
are indeed four considerations.

1
First, if one computer sends data to another, there has to be a mechanism to allow the intended recipient
to know where the block of data begins and ends. In other words, the recipient must be able to look at
In 1996, Steve Jobs stated that "'Xerox could have owned the entire computer industry today."
6

the collection of received bits—called a frame—and determine where the frame begins and ends. This
is called the framing problem.
Second, in order to send a frame to a specific device, every device will need a unique address. This is
the address problem.

Third, the receiver should be able to determine if the received frame has errors. This is called the errorcontrol problem.

Fourth, we have to consider the possibility that more than one computer may place their frame on the
wire at the same time. This will cause the electrical signals to collide, and both frames will be
destroyed. This is called the multiple access problem.
Metcalfe's breakthrough proposal—Ethernet—handles these four issues. Other competing proposals to join
computers together into a local area network (Token Ring, Token Bus, ATM, FDDI) have since fizzled and
died, leaving Ethernet as the only game in town for wired local area networks.
The original Ethernet transmitted at a bit rate of 10 mega-bits per second (Mbps). In 1995, a 100 Mbps Ethernet
standard was introduced, dubbed Fast Ethernet. This was followed in 1998 by Gigabit Ethernet (with a data
rate of 1 Gbps) and in 2002 by a 10 Gbps standard (10-Gigabit Ethernet). A 100 Gbps Ethernet standard was
recently approved (2010), but commercial products have not yet reached the market.
Note that we are dealing exclusively with transmitting data over a single link. Stated another way and with
reference toFigure
the TCP/IP
reference
we are dealing with data link-layer concerns. Additionally, note that
13.4
802.3model:
MAC frame
Ethernet is implemented in a computer's Network Interface Card (NIC).
2. Ethernet's Solution to the Framing Problem All Ethernet variants (10 Mbps, 100 Mbps, 1 Gbps and 10
Gbps) use the same data link frame format, shown below.
From, Forouzan, Data Communications and Networking, McGraw Hill, 2007
The fields are:

Preamble: The preamble is not formally part of the Ethernet frame. It is added by the physical layer. It
consists of the byte 10101010 repeated 7 times. The preamble allows the receiver to synchronize to
the beginning of the frame.
13.7

Start Frame Delimiter (SFD): The SFD is not formally part of the Ethernet frame. It is added by the
physical layer. It is the single byte: 10101011 Notice that the start frame delimiter follows the same
pattern of alternating ones and zeroes as the preamble, except that it concludes with two consecutive 1's.
7

These two consecutive 1's indicate that synchronization is over, and the real stuff is about to start: the
next item will be the destination address.
The Destination and the Source Ethernet Addresses: Much more on this to follow!

Length or Type: This field usually specifies the kind of data the frame carries (e.g.: Is the data an IP
packet?). In rare implementations, this field is used instead to serve as a Length Field, providing the
number of bytes in the data field.

Data and padding: This holds the data that was received from the network layer. The minimum size
of the "Data and Padding" field must be 46 bytes, and the maximum size of this field is 1500 bytes.

CRC: Cyclic Redundancy Code used for error detection ( Lesson 23).
Example
What is the minimum size of an Ethernet frame? (Do not include the physical layer preamble in your
calculation.)
Solution:
Example
What is the maximum size of an Ethernet frame? (Do not include the physical layer preamble in your
calculation.)
Solution:
Example
Why would padding ever be used in the field marked Data and padding?
Solution:
So, Ethernet frames must be at least 64 bytes and are not permitted to exceed 1518 bytes. Which raises the
question: Why these size limitations?
The maximum Ethernet frame size is easy to appreciate. We limit the maximum frame to 1518 bytes for three
reasons:

To prevent a single user from hogging the network. Recall the picture on page one that shows four users
sending their data over the same wire. Suppose you are one of those users, and you want to send a
frame. With Ethernet, a user who wants to transmit a frame first listens on the wire to make sure no one
else is already transmitting. If someone else is already transmitting, then it would make no sense for you
to transmit at the same time: You would garble the transmission in progress, and your transmission
would also garble. So, you patiently wait for the wire to go idle before you transmit. Since Ethernet
users always politely wait for the shared wire to go idle before transmitting, a greedy user who starts
transmitting could keep transmitting forever, never allowing others an opportunity to transmit their
frames. To avoid this, a user is allowed to transmit at most 1518 bytes before they must stop and give
other users an opportunity to transmit their frames.
8

Error control. With Ethernet, if a single bit arrives in error, the entire frame is thrown away by the
receiver. Since each bit represents an opportunity for error, the fewer bits we have, the fewer
opportunities for error we have.

Historical reasons. Data that arrives at the NIC must be buffered before it is sent to main memory.
Although memory is very cheap today, memory was very expensive in the 1970s and 1980s when the
Ethernet standard was developed.
The minimum Ethernet frame size—64 bytes—is based on technical considerations that are far less intuitive.
We mentioned that when a host using Ethernet wants to transmit a frame, it first listens to see if anyone else is
transmitting. Only if a host senses that the medium is "quiet" does it proceed with the transmission of its frame.
But even if a host takes care to ensure that the medium is quiet, collisions can still occur! For example, suppose
two hosts want to transmit an Ethernet frame at the same time and both first listen to ensure the medium is not
in use. Both stations will detect that the medium is not in use and both will start transmitting! These sorts of
collisions are unavoidable.
Since collisions are unavoidable, we want to ensure that a user can tell if his transmission was involved in a
collision. When Ethernet users start transmitting, they continue to listen to the channel to detect a collision. It
is important for a user to know if his frame was involved in a collision since any frames involved in collisions
will need to be retransmitted. Thus, we need to ensure that User-1 is still transmitting under the condition that
the furthest away station (say, User-2) listens to the channel just before User-1's frame arrives, senses it idle and
starts transmitting also.
Based on the maximum allowed separation between users and the speed of light, it can be shown (we skip the
derivation) that if the minimum frame size is set to 64 bytes (512 bits) a user will be able to tell if it was his
frame that was involved in a collision.
An
Aside
Ethernet users share access to the channel. For that reason, Ethernet is termed a
Multiple Access (MA) scheme.
In addition, Ethernet users listen to (i.e., sense) the channel before transmitting.
This way they do not start transmitting their frame while another frame
transmission from some other user is already in progress. For that reason,
Ethernet is termed a Carrier Sense Multiple Access (CSMA) scheme. 2
Finally, even after an Ethernet user starts transmitting, she continues to sense the channel for collisions.
Collisions can occur if two users sense the channel idle at the same time and start transmitting. When a host
detects that her frame is colliding, she immediately stops transmitting (what's the point of continuing to transmit
a frame if we already know it's garbled?). For this reason, Ethernet is termed a Carrier Sense Multiple Access
with Collision Detection (CSMA/CD) scheme.
3. Ethernet's Solution to the Address Problem
Each Network Interface Card (NIC) is assigned a globally unique address—an Ethernet address—that is burned
into the card's Read Only Memory (ROM). ROM is non-volatile memory whose contents cannot be altered by
2
Since a signal in this context is carrying our data, it is referred to as a carrier signal, when we sense the channel we are sensing to
detect the presence or absence of the carrier signal. Thus, CSMA is most often called Carrier Sense Multiple Access.
9
the user. All machines on an Ethernet LAN are guaranteed to have unique addresses. Moreover, no two hosts
anywhere in the world have the same Ethernet address.
So, when you buy a NIC (or, as is most often the case, a computer that contains a NIC), you are also buying a
globally unique Ethernet address that only you possess.
Ethernet Addresses are 6 bytes. It is important to realize that Ethernet addresses are also commonly referred to
as physical addresses, hardware addresses and Medium Access Control (MAC) addresses—these terms are all
synonyms!
Example
(a) How many bits are in an Ethernet address?
(b) How many hexadecimal digits are needed to express an Ethernet address?
Solution: (a)
(b)
Ethernet addresses are usually expressed in hexadecimal notation (sometimes with colons between the bytes).
For example, an Ethernet address might be 06:01:03:02:2A:3D.
Example
Two of these 48 bits in an Ethernet address are used for special purposes. Disregarding these two bits, how
many possible Ethernet addresses exist?
Solution:
You should be convinced that we are in no danger of "running out" of Ethernet addresses!
The uniqueness of Ethernet addresses is assured by the fact that the first 3 bytes of the address are assigned to a
given manufacturer (or vendor), and this vendor must use these three bytes as the first three bytes in every NIC
that the vendor manufactures. (The Institute of Electrical and Electronics Engineers—IEEE—is the group that
actually does this assignment). For instance, all NICs manufactured by 3COM have Ethernet addresses starting
with 02608C, all NICs manufactured by Cisco have Ethernet addresses starting with 00000C, etc.
Sometimes, a host may want to transmit a frame to every other user on the Ethernet LAN. A special address is
reserved for this purpose. A host may send a frame to everyone by sending the frame to the broadcast address,
which is the address consisting of all ones; i.e., a string of 48 consecutive 1’s.
Example
Express the Ethernet broadcast address in hexadecimal.
Solution:
Referring back to the Ethernet picture, any frame transmitted by any user arrives at the NIC of all other directly
connected users! Stated another way, the NIC receives all frames that are sent on the wire. But it only forwards
some of the frames up to the host's network layer.
Specifically, the NIC only forwards to the network layer:
 Frames addressed to its own unique address. When a frame arrives at the NIC, the NIC checks the
frame to see the destination address. If the destination address of the frame matches its NIC address,
10
then the NIC “realizes” that this data is intended for itself, and passes the frame to the network layer. If
the destination address in the frame does not match its NIC address, the frame is discarded.

Frames addressed to the broadcast As mentioned, a frame sent to the broadcast address (48 ones) will
be accepted by every NIC.

All frames if the NIC is placed in "promiscuous" mode. A vulnerability of Ethernet is the ease with
which an Ethernet card can be programmed to accept all frames, even frames addressed to other users.
So, any user who sets their NIC to promiscuous mode can examine the traffic sent by all other users.
4. Ethernet's Solution to the Error Control Problem
Recall from the picture of the Ethernet frame shown on page two that the last four bytes are used for the Cyclic
Redundancy Code (CRC). The CRC is used for error detection. Ethernet can only detect errors; it cannot
correct errors. If a frame arrives with errors, it is simply discarded. (Higher-layer protocols may later recognize
the loss of data and take action to remedy the problem, such as by requesting retransmission. Ethernet, though,
simply discards frames containing errors without giving the matter a second thought.)
An
Aside
Ethernet's CRC algorithm hinges on a special number that mathematicians have
devised. This number, given the name CRC-32, is special because it almost never
divides evenly into other numbers, i.e., it almost always leaves a remainder when it
is divided into another number. When the NIC crafts a frame to transmit, it fills the
four byte CRC field with the specific bits that will make the total frame (including
the CRC field) perfectly divisible (with no remainder) by CRC-32.
When this frame is received by the destination, the destination NIC divides the received frame by CRC-32. If
the frame arrives without errors, the result of the division will be zero and the frame will be accepted. If any
bits were flipped en-route from source to destination the resulting division will leave a remainder and the frame
will be discarded.
5. Ethernet's Solution to the Multiple Access Problem
We have already outlined the mechanism by which Ethernet users share a channel. They listen first before
transmitting (so as not to collide with the transmissions of other users).
Suppose we have 4 users on a 10 Mbps Ethernet. The 4 users share the 10 Mbps capacity of the network. If all
4 users have a lot to say, then each user will, on average, get to use the network ¼ of the time. As a rough
approximation, we can say that each of the 4 users will get to send at 2.5 Mbps. From each user’s perspective,
they are on a 2.5 Mbps network, not a 10 Mbps network.
Make sure you are clear on why things work this way: In Ethernet, users might share a medium, and any user’s
transmission will prevent all others on that same shared medium from transmitting. When one of the four users
in our scenario above transmit, the other three users will be prevented from transmitting because they will first
sense the channel and will not intentionally collide with another user.
We say that the four users in this example share a “collision domain.” If users have the ability to collide with
each other, they are in the same collision domain.
11
As a back-of-the-envelope calculation, we can say that the bandwidth 3 available to a user is given by:
Figure 13.15 A network
with
andinwithout
a domain
bridge
Total BW
available
the collision
BW per user =
Number of users sharing the collision domain
Example
What is the bandwidth available to each of the users on the 10 Mbps Ethernet shown below?
Solution:
An
Aside
Fast Ethernet (1995) Fast Ethernet uses the same frame format as
“standard Ethernet”, i.e., it still uses 48-bit data link addresses and uses the
same frame fields as shown on page 2 of these notes.
Fast Ethernet is backward-compatible with standard Ethernet. And, perhaps
surprisingly, it uses the same minimum and maximum frame lengths as standard
Ethernet. Also, it has the same maximum physical length as standard Ethernet (100
meters for UTP). There is a big difference: Fast Ethernet operates at 100 Mbps.
So…how do we raise the data rate? The details are rather technical, and have to do with the improvements in
technology over the years. The original Ethernet operates at 10 Mbps, but required a special type of signaling
called Manchester encoding. Advances in transmission media allowed for a signaling scheme that supported
13.25
higher data rates. Better clock circuitry allowed us to raise the transmission speed without worrying about loss
of synchronization. Instead of using one twisted pair, we use four twisted pairs: 1 to the switch, 1 from the
switch, and 2 that are switchable to support the current direction of traffic flow.
TWISTED PAIR 1:Always to the network
TWISTED PAIR 2:Always from the network
TWISTED PAIR 3 and TWISTED PAIR 4
Can be switched from one direction to the other, to
support the current desired direction of traffic flow
Finally, 3-level signaling is used at the physical layer. Instead of sending a 0 or 1, we can send 0, -1 or +1.
3
In networking, the term bandwidth has two meanings. One meaning of bandwidth is data rate, measured in bits per second. That is
the meaning which we use in this chapter. In the Wireless Module, we encountered the other meaning of the term bandwidth.
12
Practice Problem
If an entire IP packet has 8096 bytes, how many Ethernet frames are required to transmit this packet?
Solution:
Practice Problem
Answer True or False to the following statements:
(a)
An Ethernet address is normally expressed in decimal.
(b)
An Ethernet address is burned into hardware and never changes
(c)
An Ethernet address is used at the network layer to address packets.
(d)
An Ethernet address, MAC address, and Hardware address are all the same thing.
(e)
When I log on to different networks my Ethernet Address can change every time.
Solution:
The Internet Protocol (one of the main protocols at the internet/ network layer)
1. The Problem of interconnecting . As computer networking took off in the 1970's, many different
competing companies developed many different network architectures, each using different protocols at each
layer. Each company advertised its own approach as "the best." This explosion of different approaches was
beneficial in that it fostered competition, with each company vying to make their own network architecture
better. But, all the while, this presented a problem when people on different networks wanted to connect to
each other.
Originally, computers could only talk to other computers on the same network—but, at the same time, there was
a strong desire to allow any two computers on any two networks to be able to communicate. This seemed
infeasible: Different networks have different frame formats at the data link layer, different physical layer
characteristics, different addressing schemes, etc. Consider the internet shown below, which consists of a token
ring (RIP), an Ethernet network and an IBM network (RIP) connected together. Each of these networks uses
different frame formats, as shown. Could we just plop an Ethernet frame on a token ring network or an SNA
network and have it work?
13
Token Frame Format
Data Frame Format
1
1
1
SD
AC
2 or 6
Destination
Address
FC
Starting
delimiter
SD
4
2 or 6
Source
Address
J K 0 J K 0
ED
AC
Information FCS
0
1
ED
1
FS
IBM(line
SNA
J, K non-data symbols
code)
0
Ethernet
Access
control
Frame
control
PPP
T
M
PPP Priority; T Token bit
R
R R Ring M Monitor bit; RRR Reservation
Token
FF
frame type
ZZZZZZ control bit
Z Z Z Z Z Z
FF
High-Level Data Link Control
Ending
delimiter
Figure 13.4 802.3 MAC frame
Frame
status
J K 1 J K 1
A
Copyright ©2000 The McGraw Hill Companies
C
xx
A
I
C
I
E
E
x x
intermediate-frame bit
error-detection bit
A address-recognized bit
xx undefined
C frame-copied bit
Leon-Garcia & Widjaja: Communication Networks
Figure 6.61
The answer is, of course: No. The frame formats on one network will be completely unrecognizable on a
Frame format for bit-oriented protocols.
different network!
13.7
A frame from one network will look like garbage on a different network.
Note that, aside from the frame format, different networks have “structural” differences also. For example,
Ethernet has a maximum frame size of 1500 bytes, token ring has a maximum frame size of 5000 bytes and
SNA has no maximum frame size. Consider also: Ethernet addresses are always 6 bytes. Token ring addresses
can be 2 or 6 bytes, and SNA addresses are 1 byte. And, furthermore, we’ve shown only three networks
connected above. Throw in an ATM network, a Token Bus network, some Novell and AppleTalk crap, an
FDDI optical network and a couple of wireless LANs and things go to hell in a handbasket.
To summarize, then, we need protocols that can implement internetworking, i.e., we need protocols that can
overcome the differences in networks. These protocols should "conceal" the underlying network differences so
that users are unaware that different networks even exist. From the user's perspective, everyone should be on
one monolithic network.
14
2. The Solution: The Kahn/Cerf Protocols
A revolutionary solution to the internetworking problem was proposed in the early 70's by Vinton Cerf and
Robert Kahn. The two protocols they proposed, later christened the Internet Protocol (IP) and the Transmission
Control Protocol (TCP) quickly became the most popular suite of protocols for internetworking and were
subsequently adopted as the protocols used by the Internet.
These two protocols—IP and TCP—are truly a work of genius. These protocols were intended to allow
internetworking for small networks (in 1975 the Internet had a mere 61 nodes). These protocols have
successfully scaled to support networks of billions of users. It is estimated that two billion videos are watched
on YouTube each day. Trillions of emails are sent each year. Think about all the things you use the Internet
for—and then think that it all works because of protocols that were designed in 1975 for a small system, and
never intended to scale to large networks.
Stated another way: It is amazing that the Internet actually works at all!
However, the fact that the Internet uses protocols originally designed to be used on a small network of nerdy
academics means that security was never baked into the cake. Security was not needed on a network of 61
nodes, all of whom were friends. With one billion nodes on the network today, well… things are different.
The Premises. Kahn and Cerf reasoned that to internetwork efficiently, everyone must agree on three things:

A standard for service

A global addressing scheme

A uniform packet format
Regarding the first item above—the standard for service—IP provides connectionless unreliable best-effort
packet delivery.

Connectionless: Every packet is an independent entity, possibly traveling over different paths from
source to destination. Stated another way, there is no network connection that is set up in advance along
which all packets will subsequently flow from source to destination.

Unreliable: Packets can be lost, delivered out of order, or delivered multiple times; IP will not detect
this.

Best-effort: There are no guarantees packet delivery will be successful. Basically, IP says: "I'll try, but
no guarantees."
The standard of service provided by IP can be likened to the Post Office, but without the shootings. To see this,
suppose that you mail three letters to your family back in Los Angeles, California. Each letter is mailed from
the same location in Bancroft Hall. You mail Letter #1 on Monday, Letter #2 on Tuesday and Letter #3 on
Wednesday.
It is quite possible that the letters follow different routes from Annapolis to Los Angeles. For instance, two of
the letters might be delivered on a direct flight, while the third might be placed in a bag that has to change
planes in Chicago. Letter delivery is connectionless.
It is quite possible that your family receives the letters out of order, perhaps receiving Letter 3 before Letter 2.
One of your letters might never be delivered—the Post Office estimates that slightly over 1% of all mail is
never delivered to the destination (for varying reasons). Letter delivery is unreliable.
Unless you pay a premium, there are no guarantees that a letter you place in the mail will actually be delivered.
Letter delivery is provided on a best-effort basis.
15
We now address the other two requirements for internetworking. The global addressing scheme will be
discussed below, and the uniform packet format will be discussed last.
The IP Address
1. A Software Address: To make a group of networks "appear" to be a single network, we must use a single
global addressing scheme for all hosts on all networks. IP assigns to each computer a unique 32-bit IP address.
This is a "software address"; it is not a hardware address. To send a packet over a TCP/IP network, we must
use the destination's IP address.
IP addresses have two parts: a Network ID, which is the same for all hosts on particular network, and Host ID,
which is a unique suffix for each individual host on this particular network.
Network ID
Host ID
Same for all computers
on a particular network
Unique suffix for each individual computer
on this particular network
2. Dotted Decimal Notation for Reading IP addresses. Let's momentarily gloss over the separation of the IP
address into a Network ID and a Host ID, and simply focus on how the 32-bit address is represented. For
historical reasons, IP addresses are expressed as decimal numbers (as opposed to a more sensible hexadecimal
scheme).
The 32-bit IP address is separated into 8-bit chunks (octets). Each octet is then expressed as a decimal value,
separated by periods. This is termed the dotted-decimal notation for IP addresses.
For example, to express the IP address 10000001000010010100000111001111 in dotted decimal
notation, it is first split into four octets:
10000001
00001001
01000001
11001111
and the four octets are each individually converted to a decimal (base-10) number:
10000001
00001001
129
9
01000001
65
11001111
207
We then write the four decimal numbers separated by periods: the IP address is 129.9.65.207.
Example
Express each of the following IP addresses in dotted-decimal notation.
(a)
00001011
00000010
00000000
00100111
(b)
10000000
10000000
11111111
00000000
Solution:
(a)
(b)
16
Every computer on the Internet must have a unique IP address. That is, no two devices on the Internet cannot
have the same IP address at the same time. In theory, since IP addresses are 32 bits, we have 232 (more than 4
billion) IP addresses available. Thus, in theory, more than 4 billion devices could be simultaneously connected
to the Internet.
3. The Network Mask Now, let's revisit the notion that the 32 bits in an IP address are divided into a Network
ID and a Host ID. To view the Network ID portion of an IP address, we use a network mask. A network mask
(which we will just call a mask, since the context is understood) is a 32-bit number consisting of a string of
contiguous 1’s followed by contiguous 0’s, where the ones designate the network bits and the zeroes designate
the host bits. The mask can be written in slash notation as well. So /12 can be written as 11111111.
11110000.000000000.00000000 or 255.240.0.0.
Example
Which of the following can serve as masks?
(a)
(b)
(c)
(d)
255.2.0.0
255.255.0.0
255.255.0.23
255.255.64.0
Solution: (a)
(b)
(c)
(d)
Example
Show that the address 255.254.0.0 is a mask by writing out the address as 32 bits.
Solution:
Example
Write the following masks in slash notation.
(a) 255.0.0.0.
(b) 255.255.255.0
(c) 255.240.0.0
Solution: (a)
(b)
(c)
Example
Write the following masks in dotted decimal notation.
(a) /16
(b) /9
Solution: (a)
(b)
17
4. Use of Masks
Recall that IP addresses have two parts.
Network ID
Host ID
We design masks so that if we bitwise AND the mask with an IP address, we extract the network ID.
For example, suppose we are examining a Navy site that is using a mask of /17. Suppose we see that a host on
this network has the IP address: 131.122.220.30. What is the network ID?
To solve this problem, we first express the mask as a 32-bit IP address:
1 1 1 1 1 1 1 1 . 1 1 1 1 1 1 1 1 . 1 0 0 0 0 0 0 0 . 0 0 0 0 0 0 0 0
We then express the IP address as a 32-bit quantity:
1 0 0 0 0 0 1 1 . 0 1 1 1 1 0 1 0 . 1 1 0 1 1 1 0 0 . 0 0 0 1 1 1 1 0
We then bitwise AND the mask with the IP address. Recall the table for the bitwise AND operation:
A
0
0
1
1
B
0
1
0
1
A AND B
0
0
0
1
1 1 1 1 1 1 1 1 . 1 1 1 1 1 1 1 1 . 1 0 0 0 0 0 0 0 . 0 0 0 0 0 0 0 0
1 0 0 0 0 0 1 1 . 0 1 1 1 1 0 1 0 . 1 1 0 1 1 1 0 0 . 0 0 0 1 1 1 1 0
- - - - - - - - - - - - - - - . - - - - - - - - . - - - - - - - 1 1 1 1 1 1 1 1 . 1 1 1 1 1 1 1 1 . 1 0 0 0 0 0 0 0 . 0 0 0 0 0 0 0 0
Now, converting the result to dotted decimal notation, we have the network ID: 131.122.128.0
Recall the significance of this network address and the mask: Since the mask was given as /17, every host on
this network will have the same first 17 bits in common. The network ID—131.122.128.0—specifies the
exact values of these first 17 bits. Thus, every host on this network has an IP address that begins:
1 0 0 0 0 0 1 1 . 0 1 1 1 1 0 1 0 . 1 ...
The remaining bits (shown as the three dots above) are used to constitute the host ID.
Example
Suppose an organization has been given a mask /24. One of its machines has IP address 200.137.34.56.
What is the network ID?
Solution:
18
Example
Suppose an organization has been given a mask /13. One of its machines has IP address 200.137.34.56.
What is the network ID?
Solution:
5. Obtaining an IP Address Each host on the Internet must have a unique IP address. It would be very bad
for two (or more) people to have the same IP address. This latter (bad) event is termed an address conflict. So,
we must ensure there are no address conflicts.
When an organization needs IP addresses, it is given a block of addresses. So… how does an organization get a
block of IP addresses to dole out to its hosts?
To ensure there are no address conflicts, (i.e., to ensure uniqueness) an organization—the Internet Assigned
Numbers Authority (IANA)—gives out network addresses.
So…bottom line…when an organization needs IP addresses, it is given a network address (usually from an
ISP). The organization then uses the remaining bits in the IP address (corresponding to the host bits) to
distribute unique IP addresses to its hosts.
Summary of what you need to know: Given that you have a host with address W.X.Y.Z / n determine the
number of addresses you have in your block, as well as the first address (i.e., the network address) and last
address (i.e., the broadcast address).
Example
(a) Can more than one organization assign the number 172.18.3.1 to one of its machines?
(b) If no, why not? If yes, does this violate the cardinal rule: No two machines on the Internet can have the
same IP address at the same time?
(c) What happens if I try to launch a packet with the destination address 172.18.3.1 onto the Internet?
Solution:
(a)
(b)
(c)
The Uniform IP Packet Format
We mentioned that IP was developed with the idea that to internetwork efficiently, we must have an agreed
upon packet format. The Internet Protocol defines a hardware-independent packet format.
19
The IP packet has the basic structure:
Header
Data
The
size of the20.5
header can
varydatagram
from 20 to 60
bytes. The maximum allowed total size of an IP packet (header +
Figure
IPv4
format
data) is: 64 KB = 65,535 bytes.
The IP packet format:
Forouzan, Data Communications and Networking, McGraw Hill, 2007
We offer a brief explanation for the various fields:
20.11
 Version: Current version IP version 4

HLEN: length of the header (in 4 byte increments): Minimum: 5, Maximum 15 (Note: In
practice, the vast majority of IP packets contain no options and thus have the minimum header
length of 5.)

Type of service: This isn’t used much in practice. We'll ignore it.

Total length: Total number of bytes in the packet. Max is 65,535

Time to live: Hop-counter. This is a number decremented by one on each hop. When the time to
live (hop-counter) reaches zero, the packet is discarded.

Protocol: TCP or UDP or other?

Header checksum: A checksum of the header only.

Addresses. If you don't know what these are, you've been asleep for the past hour!

Options: (See text if you wish; these options will not be covered in class.)
20
The Address Resolution Protocol (ARP) (another protocol in the internet /network layer)
The Address Resolution Protocol (ARP) has two message types:

A request message containing an IP address for which we want a data link layer address. An ARP
request is broadcast to all computers on the network.

A response message, which contains the IP and matching data link layer address. Only the computer
that corresponds to the IP address sends a response with its data link layer address. The response is not
broadcast, it is sent addressed only to the user that sent the request.
The main use of ARP is to associate a logical software address with a hardware address; that is: find the
hardware address of a node when its IP address is known. Since these days most hardware addresses are
Ethernet, ARP finds most use in associating 32 bit IP addresses to 48 bit Ethernet addresses.
Let's refine the pictures above, in terms of ARP. Suppose we have a network with User A, User B and three
other unnamed users. User A wants to send a packet to a user with IP address 141.23.56.23. To send the
information, User A must learn the Ethernet address for the user with IP address 141.23.56.23. User A sends an
ARP request to all users in the local network.
Forouzan, Data Communications and Networking, McGraw Hill, 2007
Example
How can an ARP request be sent to all users in the local network?
Solution:
This ARP request is received by all users. Each of the users examines the IP address in the ARP request to see
if that matches their IP address. Let's say that User B has IP address 141.23.56.23. User B (and only User B)
would send an ARP reply containing his Ethernet address. This reply is not broadcast; it is sent in a frame
addressed to User A's Ethernet address.
21
Forouzan, Data Communications and Networking, McGraw Hill, 2007
Note that ARP allows the seamless addition of new hosts while avoiding the need for a centralized database
containing IP address to Ethernet address pairings.
3. ARP Caching Most computer network communication involves a series of packet exchanges. During the
first exchange, a host learns the target host’s Ethernet address. But, what does it do for the second exchange?
Suppose, in the picture above, that User A has to send more data to IP address 141.23.56.23 a moment after the
first exchange. It would be wasteful to have to go through the whole ARP Request/ARP Reply rigmarole all
over again.
To avoid excess ARP traffic, each user maintains a table of recently received IP address – Ethernet Address
associations in a table called an ARP cache. In the example above, User A would make the following entry in
its ARP cache:
141.23.56.23
:
A4:6E:F4:59:83:AB
Before sending an ARP request, a user first checks its ARP cache to see if it already has the Ethernet address
that it needs (i.e., the Ethernet address for a specific IP address).
ARP table entries can become incorrect without warning. For this reason, each entry in the ARP cache has a
timer associated with it. When the timer expires, the entry is deleted from the cache. Typical values for this
timeout are 10 minutes.
Example
The Address Resolution Protocol works at which two layers?
Solution:
4. ARP Packet
Figure 21.3 Encapsulation of ARP packet
An ARP request is encapsulated in an Ethernet frame as shown below.
Forouzan, Data Communications and Networking, McGraw Hill, 2007
This frame is identified as an ARP message by a specific entry in the Ethernet frame's Type field. The ARP
packet format is shown below:
21.5
22
Figure 21.2 ARP packet
Forouzan, Data Communications and Networking, McGraw Hill, 2007
21.4
Example
How many bytes are in an ARP Request packet? How many bytes are in an ARP reply packet?
Solution:
Several of the fields in the ARP Request and ARP Reply will always be the same.

The first field is the hardware type: for Ethernet, this will always be 1.

Second field is the network layer protocol type: for IP this is always 080016

The third field is the length of the hardware address in bytes: for Ethernet, this will be 6

The fourth field is the length of the network layer protocol address in bytes: for IP this is always 4
An ARP Request is differentiated from an ARP Reply by the entry in the Operation field: A 1 is placed in this
field for ARP Request packets, and a 2 is placed in this field for ARP reply packets.
Let's look at an example in gory detail. Suppose, in the picture below, User A has IP address N1 and Ethernet
address L1 and that User System B has IP address N2 and Ethernet address L2.
23
Suppose User A wants to send important information to his friend, who he happens to know has IP address N2.
But User A does not know the proper Ethernet address. (Recall that User A cannot just put his information in
an IP packet, and just transmit the IP packet. User B's Network Interface card (NIC) expects to see an Ethernet
frame. It will not know what to make of an IP packet.)
User A would encapsulate an ARP request inside an Ethernet frame as shown below.
L1
Note that in the picture above, the letter M is used to denote the Ethernet broadcast address
FF:FF:FF:FF:FF:FF. The broadcast address is placed in the field for the destination address in the
Ethernet frame. Thus all other users—User B, User X, User Y and User Z—will received this frame and pass it
up to the network layer for examination.
Note that User A has included his own Ethernet address and IP address (L1 and N1) in the ARP request
message. Why would he do this, if his goal is simply to determine the Ethernet address for the user with IP
address N2?
The reason is this: If User A needs to send data to User B, it will very often mean that User B will have to send
data to User A soon thereafter. Most data exchanges are, after all, interactive. Thus, User B will likely need to
know User A's IP address-Ethernet address association. To save User B the trouble of having to send her own
ARP request (for A's information) in the future, User A will include its IP-Ethernet address pairing in its request
for B's information.
Notice that all hosts on the network immediately learn IP address – Ethernet address association for User A.
Thus all users make the following entry in their ARP cache:
N1 : L1
Now, User B recognizes that the target IP address in the ARP Request is her IP address. Thus, it is User B's
Ethernet address that is being requested. This, User B will craft an ARP Reply packet as shown below.
L1
24
L2
To complete the story: After User A receives the ARP Reply from User B, User A will send the IP packet to
User B by placing the IP packet in the data field of an Ethernet frame.
Example
In the protocol layering model of TCP/IP, how is a host identified:
(a) At the Network Layer
(b) At the Data Link Layer
Solution:
Example
What are the two types of messages used by the Address Resolution Protocol?
Solution:
Example
When a sender wants to find out what MAC address corresponds to an IP address, to which MAC address
would she send an ARP request? (Circle the appropriate answer(s))
(a) 0.0.0.0
(b) ff:ff:ff:ff:ff:ff
(c) 255.255.255.255
(d) 00:00:00:00:00:00
Solution:
Example
Can an ARP Reply be sent without an ARP request?
Solution:
5. ARP Spoofing
A major flaw with ARP is that an ARP Reply message can be sent without a preceding
ARP Request. To see what problems might ensue, consider again our local network, for which we now know
User A and User B's IP address and Ethernet address pairing. We also indicate the IP address-Ethernet address
pairing for User X, who is actually Evil Jose!
25
Suppose User X (Evil Jose) sends an ARP Reply that, for practical purposes, says: IP address N2 is paired with
Ethernet address L3. Notice that this ARP Reply is not preceded by an ARP Request from any user.
Nevertheless, all other users—trusting souls that they are—will update their ARP cache with the entry:
N2
:
L3
Note that this information pairing is not correct: the correct Ethernet address for User B (who has IP address
N2) is L2, not L3. So this is sent to all users on this local network, corrupting everyone's ARP cache?
Suppose User A now wants to send an IP packet to his friend (User B) with IP address N2. User A will check
his ARP cache and see that the packet should be encapsulated in an Ethernet frame addressed to … L3 (Evil
Jose). Thus the IP packet intended for User B will instead be routed to Evil Jose.
Sending an ARP Reply with an incorrect IP address–Ethernet address pairing with the intent to misdirect traffic
is termed ARP spoofing. If an attacker with Ethernet address Attacker's Ethernet Address wants
to steal traffic from a user with IP address Victim's IP address, he sends an ARP Reply saying:
IP address Victim's IP address is associated with Ethernet
address Attacker's Ethernet Address.
Example
One of your crewmembers has downloaded ARP-spoofing software.
(a) What does ARP spoofing software do?
(b) What is one malevolent purpose he could use this for?
Solution:
Routing
If the destination IP address is not in our same network (i.e., if it does not have the same network ID), we
cannot directly deliver the IP packet. We must route the IP packet using routers: The source computer sends
the IP packet to the first router, who passes the IP packet to the next router, and so forth, until the final router
delivers the IP packet to the destination.
Routers operate at the network layer; a key network layer functions is routing: choosing an appropriate path for
packet flow.
26
2. Routing Tables We route IP packets by using a routing table, which must (somehow) convey the route to
the final destination. Each entity—host or router--maintains an IP routing table which provides information on
how to reach possible destinations. A host or router consults a routing table when making routing decisions.
Consider this naïve proposal for the use of a routing table: Maintain in each entity a routing table which lists
every possible destination IP address, and the full path needed from the entity to reach each possible
destination. In this scheme, a routing table might have billions of entries (since there might be billions of IP
addresses in use at any time), and each of these entries would have multiple pieces of data associated with it
(the full route to the destination for this entry in the table).
This approach is not practical; the resulting routing tables would be gargantuan. Think of how slow routing
would be if the decision on where to send each and every packet required consultation with a table of billions of
entries. Moreover, think of the problem of constantly updating these huge tables as IP addresses are reassigned
to different hosts throughout the Internet.
So, early on, three clever ideas were employed to make routing tables as small as possible.
First clever idea: For each destination IP address, only store in the routing table the IP address of the next
hop.
Second clever idea: Instead of having routing table entries for each and every destination host, store routing
table entries for destination networks.
Third clever idea: Default Routing
So, let's summarize the decisions that are made in routing, and show the form of the routing table.
Step 1. A packet shows up at a router X, needing to be routed to its final destination.
Figure 22.5 Simplified forwarding module in classless address
Step 2. Router X examines the destination's IP address and extracts the network address. In order to
extract the network address, the routing table for each network address must have the associated
mask. So, a column for the mask is included as the first column in the routing table for Router
X, shown below.
Figure 22.5 Simplified forwarding module in classless address
So, Router X applies the mask in the first line of the table to the destination IP address:
22.8
and checks to see if the extracted network ID matches the Network address show on the first
line:
27
igure 22.5 Simplified forwarding module in classless address
If it matches … Joy! … send the packet to the Next-hop address which is on this Interface:
gure 22.5 Simplified forwarding module in classless address
If it does not match, repeat the process for the second line of the routing table.
Example
Figure 22.6 Configuration for Example 22.1
The router R1 in the figure below connects the four different networks shown. The four networks connect to
the router’s four interfaces, labeled m0, m1, m2 and m3.
180.70.65.128/26
180.70.65.135/26
m3
(a)
Why does the router R1 have 4 different IP addresses?
28
22.11
Solution:
(b)
How would you verify that the router address 180.70.65.135/26 on the m0 interface is indeed on
the network 180.70.65.128/26 ?
Solution:
(c)
Your friend says: "Wait just a minute! The two different networks 180.70.65.128/26 and
180.70.65.192/26 look very similar. Are these really two different networks…i.e., are these really
two non-overlapping blocks of addresses?" How would you reply?
Solution:
(d)
Construct the routing
table.
Table
22.1 Routing table for router R1 in Figure 22.6
/26
We will see later that it is best to order the table by decreasing mask value…but let's proceed.
(e)
Suppose an IP packet with destination IP address 180.70.65.140 arrives at router R1. Explain how
the routing table is used to make a routing decision.
Solution:
22.12
(f)
Suppose an IP packet with destination IP address 201.4.22.35 arrives at router R1. What does it do?
Solution:
The packet-switching concept showing nodes (routers) in the backbone of the network and the routes they take
to send the packets to their destinations.
29
The next layer provides a means for those packets to be collected and sent to the correct application processes.
The Transmission Control protocol (a protocol used at the transport layer)
As your computer uses many applications that will transmit something across the network at the same
time, the system must know how to mark those request such that they are delivered to the right receiver
applications. And once the replies are coming back, they should be delivered back to the same process that
initiated them. The concept of the port number is introduced to deal with that. Source and destination ports
ensure that all requests and replies are delivered to the appropriate processes on the computers exchanging data.
TCP also takes care of the sequence of the packets so they are placed in the correct order.
A 3 way handshake occurs so that the sender and receiver acknowledge the establishment of the socket or
transfer to the established ports.
The TCP header includes the port addresses and the synchronization scheme.
30
Finally, the packets are assembled into messages into the correct applications at the application layer.
The HTTP (a protocol in the application layer to access a webserver)
The best way to see the interaction of these protocols and layers is to walk through a specific example using a
GUI-based application called Wireshark, which is a packet sniffer. A packet sniffer is, in essence, a wiretap
that allows you to monitor the traffic passing a particular point in a computer network. A packet sniffer not
only allows you to analyze or inspect individual packets as binary or hexadecimal symbols, but also attempts,
where possible, to convert binary packets into a human-readable format.
Packet sniffers allow the user to determine who is communicating with whom, and what they are saying, topics
of great concern to network security specialists and the people who keep them busy.
Packet sniffing, as with most things, can be used for good purposes or for malicious purposes. A hacker can
certainly use a packet sniffer to detect who is communicating with whom, and the nature of the communication
(so-called metadata). Any unencrypted content (to include unencrypted passwords) can also be read.
ITSD does not encourage us to download Wireshark, so our lab exercise will be a walkthrough of a Cisco
Wireshark lesson.
Click on the link below and read the details of the walkthrough and then watch as a powerpoint
slide show the progression of the Wireshark capture of packets on the network:
http://ciscoiseasy.blogspot.com/2010/08/lesson-6-example-of-tcpip-traffic-flow.html
31