Chapter 01 - Overview

Editor's Notes

• #18: Purpose: This figure illustrates encapsulation. Emphasize: The protocol data units (PDUs) are the terms used in the industry and in this course to describe data at the different layers. Encapuslation is a key concept that illustrates how data is formatted prior to being sent across a link. This example is an illustration is Ethernet (or token ring) at the data link and physical layer and TCP/IP at the network and transport layers. Transition: The following discusses de-encalsulation.
• #19: Purpose: This figure illustrates de-encapsulation. Emphasize: At the destination, the headers at each layer are stripped off as the data moves back up the stack.
• #20: Emphasize: To reduce the number of collisions, a switch can be split into multiple segments, each in a separate collision domain. Note that all segments are in the same broadcast domain.
• #21: Purpose: This figure compares the switch to a highway.
• #24: Purpose: This figure explains the history of TCP/IP. Emphasize: In the mid-1970s, DARPA established a packet-switched network to provide electronic communication between research institutions in the United States. DARPA and other government organizations understood the potential of packet-switched technology and were just beginning to face the problem virtually all companies with networks now have—how to establish communication between dissimilar computer systems.
• #25: Purpose: This figure shows the protocol layers and compares them with the layers of the OSI reference model. Emphasize: This figure shows the TCP/IP conceptual layer titles. The protocol stack is used several times in this chapter, and the lower two layers may be sometimes called the network interface layer. The terms “packet” and “datagram” are nearly interchangeable. However, a datagram is a unit of data, while a packet is a physical entity that appears on a network. In most cases, a packet contains a datagram. In some protocols, though, a datagram is divided into a number of packets to accommodate a requirement for smaller transmittable pieces. Note: Creation and documentation of the Internet protocols closely resembles an academic research project. The protocols are specified in documents called RFCs. RFCs are published, reviewed, and analyzed by the Internet community.
• #26: Purpose: This figure discusses application-layer protocols. Emphasize: The common network applications today include file transfer, remote login, network management, and e-mail. We focus on TCP/IP in this course for several reasons: TCP/IP is a universally available protocol and you will use it at work. TCP/IP is a useful reference for understanding other protocols, because it includes elements that are representative of other protocols. TCP/IP is important because the router uses it as a configuration tool. The router uses Telnet for remote configuration, TFTP to transfer configuration files and operating system images, and SNMP for network management. Transition: The next section moves down the model to discuss the transport layer.
• #27: Purpose: This figure describes the transport layer. Emphasize: Two transport layer protocols in the IP stack are TCP and UDP. TCP will offer more reliability because it is connection oriented. UDP guarantees no reliability. Sequence Packet Exchange (SPX) is the transport layer protocol used by IPX. It is also connection oriented. Newer versions of IPX support TCP and UDP as well.
• #28: Purpose: This figure introduces the protocols used at the transport layer. Emphasize: TCP is one protocol within the protocol suite of TCP/IP. TCP is an acknowledged transport-layer protocol. However, TCP has a large header so there is much overhead. UDP is unacknowledged. By eliminating all of the acknowledgement mechanisms, UDP is fast and efficient. UDP does not divide application data into pieces. Reliability is assumed to be handled by the upper-layer protocols, by a reliable lower-layer protocol, or by an error-tolerant application. UDP does have a smaller header and less overhead.
• #29: Purpose: This figure illustrates a TCP connection being established. Emphasize: The exchange is sometimes referred to as the “three-way-handshake.” The initiating host requests a synchronization. The receiver acknowledges the synchronization and specify synchronization parameters in the opposite direction. The receiver acknowledges the synchronization and a connection is established.
• #30: Emphasize: This figure summarizes the different collision domains and broadcast domains on various network devices. It is important that students understand the difference between the two domains.
• #31: Purpose: This figure explains what is contained in a TCP segment. Emphasize: Source Port and Destination Port are the connections to the upper-layer protocol. Sequence and Acknowledgment numbers are the position in the user’s byte stream of this segment. Sequence numbers are used for establishing reliability. HLEN is the header length. It tells us where the data begins. Six bits are reserved for future use. Code Bits distinguish session management messages from data. Window is a term we will come back to in a few slides. For now, consider it the size of the receivers buffers. Checksum is a cyclic redundancy check (CRC). It verifies that the datagram arrived intact. Urgent Pointer is used to signify out-of-band data. Options are used by vendors to enhance their protocol offering. The data portion of the frame contains the upper-layer protocol data.
• #32: Purpose: This figure explains how TCP uses port numbers to connect applications. Emphasize: These port numbers were standardized in RFC 1340. This RFC has been obsoleted by RFC 1700. However, many of the port numbers outlined in RFC 1340 are still being used as standards. It is possible to filter on TCP port numbers. The TCP port number, combined with other information, is what UNIX C language developers call a socket. However, work sockets have different meanings in XNS and Novell, where they are service access point abstractions or programming interfaces rather than service access point identifiers.
• #33: Purpose: This figure continues to explain how TCP uses port numbers. Emphasize: In most cases the TCP port number on one side of a conversation is the same on the other side. For example, when a file transfer takes place, the software on one host is communicating with a peer application on another host. In this example we see a Telnet (TCP port 23) session. It is possible to have multiple Telnet sessions running simultaneously on a host or router. Telnet selects an unused port number above 1023 to represent the source port for each independent session. Notice that the destination port is still 23. Port numbering is important to understand in order to configure IP extended access lists. The lack of symmetry in port number use is a critical factor in establishing effective security.
• #34: Layer 1 of 3: Host A begins by sending a SYN segment indicating that host A will use sequence numbers starting with sequence number 100. Emphasize: TCP is a simple protocol in terms of connection establishment. Some protocols have dozens of negotiation messages that are transmitted prior to session initialization. TCP implements a strategy that is both necessary and sufficient.
• #35: Layer 2 of 3: Host B sends an ACK and acknowledges the SYN it received from host A. Host B also sends a SYN. Note that the acknowledgment field indicates host B is now expecting to hear sequence 101, acknowledging the SYN that occupied sequence 100.
• #36: Layer 3 of 3: In the next segment, host A sends some data. Note that the sequence number of the segment in step 3 is the same as as the ACK in step 2. Emphasize: This sequence is like two people talking. The first person wants to talk to the second, so she says, “I would like to talk with you.” (SYN.) The second person responds, “Good. I want to talk with you.” (SYN, ACK.) The first person then says, “Fine—let us talk. Here is what I have to say.” (SYN, ACK, DATA.) At this point either side can begin communicating and either side can break the connection. TCP is a peer-to-peer (balanced) communication method (no primary/secondary). Note: This figure explains TCP connection establishment. For more information regarding the three-way handshake in establishing a TCP connection, refer to RFC 793.
• #38: Layer 1 of 7: The window size is the number of messages transmitted before the sender must wait for an acknowledgment. Window size was presented earlier in the course, so this slide is a review. The initial state, no messages being sent.
• #39: Layer 2 of 7: Data message 1 sent. (Send 1, Receive 1)
• #40: Layer 3 of 7: Acknowledgment message 2 sent. (Send ACK 2, Receive ACK 2)
• #41: Layer 4 of 7: Data message 2 sent. (Send 2, Receive 2)
• #42: Layer 5 of 7: ACK for message 2. (Send ACK 3, Receive ACK 3)
• #43: Layer 6 of 7: Send 3, Receive 3.
• #44: Layer 1 of 7: ACK for message 3. (Send ACK 4, Receive ACK 4) This sequence helps to convey the delay associated with a window size of one. Note: TCP acknowledgments are expectational and are sometimes called forward referenced, which means that they refer to the segment they are expecting to receive, not the one just sent. Acknowledgment field sizes can become an issue when transmitting data at FDDI and ATM speeds.
• #45: Layer 1 of 4: Layer 1 shows the Sequence number is 10.
• #46: Layer 2 of 4: Layer 2 shows the acknowledgment number is 11.
• #47: Layer 3 of 4: Layer 3 shows the next sequence number is 11.
• #48: Layer 4 of 4: Layer 4 shows the acknowledgment number is 12. Emphasize: The Sequence and Acknowledgment numbers are directional. The slide highlights the communication going in one direction. The sequence and acknowledgments take place with the sender on the right. TCP provides full-duplex communication.
• #49: Layer 1 of 5: This figure points out the benefit of a larger window size. Layer 1 is in the initial state, no messages being sent.
• #50: Layer 2 of 5: Layer 2 illustrates how the sending device defines its window buffer as 3 and sends three bytes.
• #51: Layer 3 of 5: In layer 3, the receiving device acknowledges the two first bytes, drops 3, and advertises its window size as 2.
• #52: Layer 4 of 5: In layer 3 the sending device transmits 2 bytes but maintains a window size of 2.
• #53: Layer 5 of 5: In layer 5, the receiving device acknowledges the 2 bytes and still advertises its window size as 2.
• #54: Purpose: This graphic explains the format of UDP. Emphasize: UDP is simple and efficient but not reliable. The UDP segment format includes a source port, a destination port, a length field, and an optional checksum field. It has no sequencing, acknowledgments, or windowing. Example: TFTP uses a checksum. At the end of the transfer if the checksum does not match then the file did not make it. The user is notified and must type in the command again. As a result, the user has become the reliability mechanism. Transition: The next section discusses the network layer of the OSI model and how it corresponds to the TCP/IP internet layer.
• #55: Purpose: This figure maps the lower layers to the network layer. Emphasize: Routing occurs at the network layer. Most of this course uses the IP network layer protocol. It supports multiple lower layer protocols. IPX will also be covered in a single chapter in this course. Routers are network layer devices.
• #56: Emphasize: Route determination occurs at this layer so a packet must include a source and destination address. Network layer addresses have two components, a network component for internetwork routing and a node number for a device specific address. The example in the figure is an example of an IP packet and address.
• #57: Purpose: This slide gives students enough information about IP addresses until it is covered in-depth in Chapter 8, “Interconnecting Networks with TCP/IP.” Emphasize: IP address format is dotted-decimal. Dotted-decimal makes it easy to work with IP addresses. Students should be familiar with binary. In this course we will work with the addresses on the bit level, so we will convert these addresses into binary, make changes to them, and convert them back. Let students know that the IP address is a 32 bit address. It has a network portion and host portion. The subnet mask is a 32 bit mask that divides the address into the two portions. Note: Students should understand this format presented so they can successfully perform the laboratory exercises in this course. They will learn about classes of I P addresses later in the course.
• #58: Purpose: This figure presents a list of the protocols operating at the Internet layer. Emphasize: Review the protocols briefly. They are covered in detail on the coming pages. Routing protocols are usually considered layer-management protocols that support the network layer.
• #59: Purpose: This figure explains what is contained in an IP datagram. Emphasize: Discuss the format of the IP datagram. The current generation of IP is version 4. We need the Header Length (HLEN) and the Total Length in this example because the IP Options field allows a variable length. Time-To-Live (TTL) is a countdown field. Every station must decrement this number by one or by the number of seconds it holds onto the packet. When the counter reaches zero, the time to live expires and the packet is dropped. TTL keeps packets from endlessly wandering the internet in search of nonexistent destinations. The next generation of IP (called IPng) is IP version 6. It is covered in RFC 1752. Good references for this topic are Douglas Comer’s books on TCP/IP.
• #60: Purpose: This figure explains the use of the protocol field. Emphasize: Protocol numbers connect, or multiplex, IP to the transport layer. These numbers are standardized in RFC 1700. Cisco uses these numbers in filtering with extended access lists.
• #61: Purpose: This figure explains which messages are ICMP messages. Emphasize: Describe ICMP messages and ping.
• #62: Layer 1 of 4: Purpose: This figure shows how ARP is used to determine an IP address. In layer 1, host 172.16.3.1 needs the MAC address of host 172.16.3.2. It sends an ARP request message.
• #63: Layer 2 of 4: In layer 2, host 172.16.3.2 is on the same wire and receives the ARP request message.
• #64: Layer 3 of 4: In layer 3, host 172.16.3.2 sends an ARP reply with its MAC address to host 172.16.3.1.
• #65: Layer 4 of 4: In layer 4, the bulleted items at the bottom of the slide appear. Emphasize: ARP provides translation between network and data link layers. Discuss why it is necessary to have a mechanism like ARP. Describe ARP operation. Not all protocols use ARP. Some use other methods for address translation. Note: For the message to be transmitted uniquely to a single interface on the multiaccess link, it is necessary to build a frame with the unique MAC address of the interface
• #66: Layer 1 of 4: Purpose: This figure explains how RARP works. In layer 1, the host on the left needs its IP address. It sends a RARP request with its MAC address.
• #67: Layer 2 of 4: In layer 2, the host on the right, functioning as a RARP server, maps the MAC address to an IP address.
• #68: Layer 3 of 4: In layer 3, the host on the right sends the IP address to the requester in a RARP reply message.
• #69: Layer 4 of 4: In layer 4, the bulleted items appear at the bottom of the slide. Emphasize: RARP is used to boot diskless workstations over a network.
• #70: Purpose: This is an introduction slide to the IP addressing section. Emphasize: Stations with internetwork access must have unique addresses.
• #71: Layer 1 of 3: Purpose: This figure show the general format of an IP address. In layer 1, the address is 32 bits with a network and host portion.
• #72: Layer 3 of 3: In layer 2, one can convert the address to binary.
• #73: Layer 3 of 3: In layer 3, an example of dotted-decimal format and binary are displayed. Emphasize: IP address format is dotted-decimal. Dotted-decimal makes it easy to work with IP addresses. However, in this course we will work with the addresses on the bit level, so we will convert these addresses into binary, make changes to them, and convert them back. The central authority for addresses is the Internet Assigned Numbers Authority. Note: This most common form of addressing reflects the widely used IP version 4. Faced with the problem of depleting available addresses, Internet Engineering Task Force (IETF) work is under way for a backward-compatible next generation of IP (IPng, also called IP 6). IP 6 will offer expanded routing and addressing capabilities with 128-bit addresses rather than the 32-bit addressing shown on the graphic. Addresses from both IP versions will coexist. Initial occurrences will probably be at locations with address translator software and firewalls.
• #74: Purpose: This graphic describes the three most common classes of IP address. Emphasize: Discuss classes of addresses. Each address contains information about the network number and the host number of the device. Class A addresses are for very large organizations. Class B addresses are for smaller organizations, and Class C addresses for even smaller ones. As the number of networks grows, classes may eventually be replaced by another addressing mechanism, such as classless interdomain routing (CIDR). RFC 1467, Status of CIDR Deployment in the Internet, presents information about CIDR. RFC 1817, CIDR and Classful Routing, also presents CIDR information.
• #75: Emphasize: Highlight the fixed values that start each class address. The first octet rule states that when an address falls into a specified range, it belongs to a certain class. Students should soon be able to recognize the address class of any IP address on sight. Note: If time or interest permits, you can use the initial bit patterns in the first octet and show how a class of IP network derives the range of network numbers for that IP address class.
• #76: Purpose: This figure presents an overview of host and network address conventions. Emphasize: In the example, 172.16.0.0 and 10.0.0.0 refer to the wires at each end of the router. Explain how the routing table is used. Entries in the routing table refer to the network only. The router does not know the location of hosts—it knows the location of networks. .
• #77: Purpose: This figure explains how to calculate the number of available hosts in a network. Emphasize: 2N-2 is the calculation to determine available hosts. N is the number of binary digits in the host field. Subtract 2 because a host cannot be all 0s or 1s. The same principal applies when determining the number of available networks.
• #78: Purpose: This figure explains what networks look like without subnets. Without subnets, use of network addressing space is inefficient. The Class B network is like a highway with no exits—there is no place to exit, so all of the traffic is in one line.
• #79: Purpose: This figure describes network structure when subnets are used. Emphasize: The host bits of an IP address can be subdivided into a subnetwork section and a host section. The subnetwork section in this example is the full third octet. Point out the difference in the addressing between the previous slide and this slide. A subnetted address space is like a highway with exits. A network device uses a subnet mask to determine what part of the IP address is used for the network, the subnet, and the device ID. A subnet mask is a 32-bit value containing a number of one bits for the network and subnet ID and a number of zero bits for the host ID. Given its own IP address and subnet mask, a device can determine if an IP packet is destined for 1) a device on its own subnet, 2) a device on a different subnet on its own network, or 3) a device on a different network. A device can determine what class of address the device has been assigned from its own IP address. The subnet mask then tells the device where the boundary is between the subnet ID and the host ID.
• #80: Layer 1 of 2: Purpose: This figure shows what would happen if there were no subnetting. Emphasize: If networks could not be broken down into more granular, subnetworks few networks could exist, each with a capacity for many hosts.
• #81: Layer 1 of 2: Emphasize: By turning on more bits in the mask, we reserve some bits as network information and can use these bits to describe subnetworks. Describe how the router makes use of this technique. Point out that there is more information in the routing table now. Note: As you enter the discussion about subnet masks, a question might arise about whether it is legal to define a discontiguous subnet mask. A discontiguous subnet mask consists of intervening zeros, as in 101111011000, rather than all ones followed by zeros, as in 1111111100000000. The question has two answers. According to RFC 950 that describes IP, a discontiguous subnet mask is legal. However, the hardware expense to produce an interface that supports discontiguous masking is cost-prohibitive. Thus in practice it is not supported on most vendors’ equipment, including Cisco. Also, discontiguous masking has no benefit, and it is much more difficult to maintain a network based on this design. Later RFCs make noncontiguous subnet masks illegal because they are incompatible with future addressing schemes such as CIDR.
• #82: Emphasize: Turn on more bits to represent subnets. Compare the default or standard subnet mask with the subnet mask in the slide. These are the rules for IP addressing: An address is 32 bits, divided into three components: First octet rule bits Network bits (path selection bits) Node bits The first octet rule states that the most significant bit pattern in the first octet determines the class of the address. Path selection bits cannot be all ones or zeros. Certain addresses are reserved. RFC 1918 defines some of those. Prefix or mask one bits are path selection significant; zero bits are host bits and therefore not significant. Use the logical AND to combine the address and mask bits to get the subnet address. The maximum number of available subnets equals 2 prefix bits - 2; the maximum number of available hosts equals 2 32- prefix bits - 2.
• #83: Purpose: This figure explains how subnet masks are converted to decimal addresses. Emphasize: Review binary-to-decimal conversion, bit weighting, and conversion. Explain logical AND. One possible explanation of logical AND follows: We will need to be able to perform a logical AND on the binary numbers. Just take two binary numbers and place one above the other. The ones in the bottom are like a pipe—the number above it just drops through. The zeros are like a clogged pipe, so nothing comes out in the answer. Presenting a truth table will help some students understand. You might need to give more than one explanation. Note: You might want to hand out a binary-to-decimal conversion sheet if you have not already done so. We have not included one in the lab section. It is more useful to have one that is on a separate page from the labs.
• #84: Purpose: This graphic explains how routers use addresses that have no subnet mask. Emphasize: Explain how masking works at the bit level. Zero bits mask host information. Note: This is an easy place to lose students. At this point, they need to learn several abstract mathematical concepts before we can show them how to lay out an IP-addressed network. To the novice these techniques may seem unrelated, making the presentation confusing. To a more experienced audience, these techniques will be familiar.
• #85: Purpose: This figure shows how the router determines an address when subnetting is used. Emphasize: This example makes a Class B address space look like a collection of Class C address spaces. Now the logical AND allows us to extract the subnet number as well as the assigned network number. An exercise follows that tests the students’ understanding of subnet masks.
• #86: Purpose: This figure shows how the router determines an address when subnetting is used. Emphasize: This example is different from the previous example in that the the subnet and host are divided within an octet. Transition: An exercise follows that tests the students’ understanding of subnet masks.
• #87: Layer 1 of 2: Purpose: This exercise is for the students to take the given IP addresses and associated subnet masks and perform a logical AND to extract the subnet number. Provide time in class and review the answers after the majority of students have finished. The answers are given in the following figure.
• #88: Layer 2 of 2: Purpose: This answers to the exercise are given in the figure. Note: Students can also find the answers to this exercise in the “Answers” appendix.
• #89: Purpose: This figure explains how broadcast addresses work. Emphasize: A range of addresses is needed to allocate address space. A valid range of addresses is between subnet zero and the directed broadcast. These RFCs provide more information about broadcasts: RFC 919, Broadcasting Internet Datagrams RFC 922, Broadcasting IP Datagrams in the Presence of Subnets Cisco’s support for broadcasts generally complies with these two RFCs. It does not support multisubnet broadcasts that are defined in RFC 922.
• #90: Layer 1 of 9: Purpose: This example summarizes The IP addressing that was covered earlier in this chapter. Emphasize: In layer 1, convert the address to a binary host address.
• #91: Layer 2 of 9: Emphasize: In layer 2, write the subnet mask in binary.
• #92: Layer 3 of 9: Emphasize: In layer 3, draw a line after the recursive ones in the subnet mask.
• #93: Layer 4 of 9: Emphasize: In layer 4, fill in zeros beyond the vertical line for the subnet.
• #94: Layer 5 of 9: Emphasize: In layer 5, fill in ones beyond the vertical line for the broadcast address.
• #95: Layer 6 of 9: Emphasize: In layer 6, fill in 0s beyond the vertical line except for the last bit. Make that bit a 1. This is the first usable host address.
• #96: Layer 7 of 9: Emphasize: In layer 7, fill in 1s beyond the vertical line except for the last bit. Make that bit a 0. This is the last usable host address.
• #97: Layer 8 of 9: Emphasize: In layer 8, copy the binary network and subnetwork address from the top row into the lower rows.
• #98: Layer 9 of 9: Emphasize: In layer 9, convert binary back to dotted decimal.
• #99: Purpose: This figure shows an example of a Class B network with a subnet.
• #100: Purpose: This figure explains how to plan subnet numbers. Emphasize: What if this were a Class B address? How many bits would we have for subnetting then? Where do you want to draw the line now? Alternatives to review: Creating the subnet at the octet boundary is easier to work with—more host bits and more subnet bits. Explain that the decision is really a guess on how you think your network will grow—will it have more subnets or more hosts? RFC 1219 Mirroring: Mirroring hedges the subnetting decision by buying time. Do not use mirroring if you intend to use route summarization or variable-length subnet masking (VLSM); they are incompatible with mirroring.
• #101: Purpose: This figure shows an example of a Class C network with a subnet. Emphasize: Contrast the Class C network subnet mask with the previous Class B example.