Network+ Guide to Networks, Chapter 4 Review
Introduction to TCP/IP Protocols
In this
chapter, you will learn about the most commonly used networking protocols,
their components, and their functions. This chapter is not an exhaustive study
of protocols, but rather a practical guide to applying them. At the end of the
chapter, you will have the opportunity to customize how your networked computer
uses protocols. You will also analyze realistic networking scenarios pertaining
to protocols and devise your own solutions. Because protocols form the
foundation of network communications, you must fully understand them to manage
a network effectively.
In the
networking industry, the term protocol is sometimes used to refer to a group,
or suite, of individual protocols that work together. In the sections that
follow, you will learn about the protocol suite that is used on virtually all
networks today—TCP/IP. As a network professional, you may occasionally
encounter obsolete protocol suites that are not detailed in this chapter. But
you will definitely encounter TCP/IP both on the job and in the Network+ certification
exam. To be successful, you need to understand TCP/IP in depth.
Characteristics
of TCP/IP (Transmission Control Protocol/Internet Protocol)
TCP/IP
(Transmission Control Protocol/Internet Protocol) is not simply one protocol,
but rather a suite of specialized protocols—including TCP, IP, UDP, ARP, and
many others—called subprotocols. Most network administrators refer to
the entire group as “TCP/IP,” or sometimes simply “IP.” For example, a network administrator might say, “Our network only
runs IP” when she means that all of the network’s services rely on TCP/IP subprotocols.
TCP/IP’s
roots lie with the United States Department of Defense, which developed TCP/IP
for its Advanced Research Projects Agency network (ARPANET, the precursor to
today’s Internet) in the late 1960s. UNIX and Linux have always relied
on TCP/IP. The most recent versions of all other network operating systems also
use TCP/IP as their default protocol.
Though other protocol suites exist,
TCP/IP has become the standard thanks to several advantages:
·
It
is open, rather than proprietary—TCP/IP is not owned by a company, which means
you do not need to purchase a license to use it. It costs nothing and its code
can be edited and modified by any programmer.
·
It
is flexible—The TCP/IP suite of protocols can run on virtually any platform and
connect dissimilar operating systems and devices.
·
It
is routable—TCP/IP transmissions carry Network layer addressing information
that can be interpreted by routers to determine the best path for directing
data over a network. Not all protocols are routable. Only
routable protocols are suitable for large networks.
The
TCP/IP Model
TCP/IP is a
broad topic with numerous technical, historical, and practical aspects.
Advanced TCP/IP topics are covered in Chapter 9. If you want to become an
expert on TCP/IP, consider investing in a book or study guide solely devoted to
this suite of protocols. The TCP/IP suite of protocols can be divided into four
layers that roughly correspond to the seven layers of the OSI model, described
in the following list.
·
Application layer—Roughly equivalent to the Application, Presentation,
and Session layers of the OSI model. Applications gain access to the network
through this layer, via protocols such as HTTP (Hypertext Transfer Protocol),
FTP (File Transfer Protocol), Telnet, NTP (Network Time Protocol), DHCP
(Dynamic Host Configuration Protocol), and PING (Packet Internet Groper), to
name only some.
·
Transport layer—Roughly corresponds to the Transport layer of the
OSI model. This layer holds the Transmission Control Protocol (TCP) and User
Datagram Protocol (UDP), which provide flow control, error checking, and
sequencing.
·
Internet layer—Equivalent to the Network layer of the OSI model.
This layer holds the Internet Protocol (IP), Internet Control Message Protocol
(ICMP), Internet Group Management Protocol (IGMP), and Address Resolution
Protocol (ARP). These protocols handle routing and address resolution.
·
Network Interface layer (or Link layer)—Roughly equivalent to the Data
Link and Physical layers of the OSI model. Functions in this layer handle
formatting of data and transmission to the network interface.
Unlike
the OSI model, the TCP/IP model grew to describe how protocols work after the
protocols were widely in use. For this reason, it is sometimes considered more
practical than the OSI model, which is considered more theoretical.
Understanding what functions belong to each layer of the models will come in
handy when you’re troubleshooting problems. For example, a simple test might
indicate that a transmission is breaking down at the Transport layer. Although
you might not know the cause of the problem, narrowing down its scope in this
way will lead you and your colleagues to the next step in assessing and fixing
the problem.
The TCP/IP Core Protocols
Certain
subprotocols of the TCP/IP suite, called TCP/IP core protocols, operate in the
Transport or Network layers of the OSI model and provide basic services to
protocols in other layers. As you might guess, TCP and IP are the most
significant protocols in the TCP/IP suite. These and other core protocols are
introduced in the following sections.
TCP (Transmission Control
Protocol)
TCP (Transmission Control Protocol) operates in the
Transport layer of the TCP/IP and OSI models and provides reliable data
delivery services. TCP is a connection-oriented subprotocol,
which means that a connection must be established between communicating nodes
before this protocol will transmit data. As an analogy, suppose you
were standing by a lake trying to communicate with a friend in a boat floating
100 yards offshore on a foggy afternoon. You need to give her an urgent message
about a storm that’s fast approaching. You could shout at her, but you might
not know whether she heard you correctly, if at all. To be certain she gets
your message, it would be better to call her cell phone and talk. Similar to
completing a phone call and making sure your friend answers and can hear you
before you tell her about the storm, in data communications, TCP is the protocol that ensures a
connection has been made before it allows the message to continue. TCP further
ensures reliable data delivery through sequencing and checksums.
In
the analogy of communicating with a friend offshore, this would be similar to
asking her to confirm that she understood your warning. Without TCP’s
connection and its sequencing and checksum measures, data would be transmitted
indiscriminately. If not for TCP, a host would issue data without knowing
whether the destination node was offline, for example, or whether the data
became corrupt during transmission. This would be like shouting a lot of
warnings to your offshore friend without making sure she understood—and then
walking away. Finally, TCP provides
flow control to ensure that a node is not flooded with data. In the
case of communicating with a friend in a boat, this would be like speaking
slowly enough over the phone so that she can hear every word and understand
your message. Fields belonging to a TCP segment are defined in Table 4-1.
Table
4-1 - Fields in a TCP/IP segment
|
Field
|
Length
|
Function
|
|
Source port
|
16 bits
|
Indicates the port number at the source node. A port number is the address on a host
where an application makes itself available to incoming or outgoing data.
|
|
Destination port
|
16 bits
|
Indicates the port number at the destination node.
|
|
Sequence number
|
32 bits
|
Identifies the data segment’s position in the
stream of data segments already sent.
|
|
Acknowledgment number (ACK)
|
32 bits
|
Confirms receipt of the data via a return message
to the sender
|
|
TCP header length
|
4 bits
|
Indicates the length of the TCP header.
|
|
Reserved
|
6 bits
|
A field reserved for later use.
|
|
Checksum
|
16 bits
|
Allows the receiving node to determine whether the
TCP segment became corrupted during transmission.
|
|
Urgent pointer
|
16 bits
|
Indicates a location in the data field where
urgent data resides.
|
Options
|
0–32 bits
|
Specifies special options, such as the maximum
segment size a network can handle.
|
|
Padding
|
Variable
|
Contains filler information to ensure that the
size of the TCP header is a multiple of 32 bits.
|
|
Data
|
Variable
|
Contains data originally sent by the source node.
The size of the Data field depends on how much data need to be transmitted,
the constraints on the TCP segment size imposed by the network type, and the
limitation that the segment must fit within an IP packet.
|
|
Sliding-window size (or window)
|
16 bits
|
Indicates how many bytes the sender can issue to a
receiver while acknowledgment for this segment is outstanding. This field
performs flow control, preventing the receiver from being deluged with bytes.
For example, suppose a server indicates a sliding window size of 4000 bytes.
Also suppose the client has already issued 1000 bytes, 250 of which have been
received and acknowledged by the server. That means that the server is still
buffering 750 bytes. Therefore, the client can only issue 3250 additional
bytes before it receives acknowledgment from the server for the 750 bytes.
|
|
Flags
|
6 bits
|
A collection of six 1-bit fields that signal
special conditions through flags.
The following flags are available for the
sender’s use:
·
URG—If set to 1, the Urgent
pointer field contains information for the receiver.
·
ACK—If set to 1, the
Acknowledgment field contains information for the receiver. (If set to 0, the
receiver will ignore the Acknowledgment field.)
·
PSH—If set to 1, it indicates
that data should be sent to an application without buffering.
·
RST—If set to 1, the sender
is requesting that the connection be reset.
·
SYN—If set to 1, the sender
is requesting a synchronization of the sequence numbers between the two
nodes. This code is used when TCP requests a connection to set the initial
sequence number.
FIN—If set to 1, the segment is the last in a
sequence and the connection should be closed.
|
In the Chapter 2
discussion of Transport layer functions, you learned how TCP establishes
connections for HTTP requests. You also saw an example of TCP segment data from
an actual HTTP request. However, you might not have understood what all of the
data meant. Now that you know the function of each TCP segment field, you can
interpret its contents. The figure
below
offers another look at the TCP segment.
Figure
4-3 TCP segment data
|
Transmission
Control Protocol, Src Port: http (80), Dst Port: 1958 (1958), Seq:
3043958669, Ack: 937013559, Len: 0
Source
port : http (80)
Destination
port: 1958 (1958)
Sequence
number: 3043958669
Acknowledgment
number: 937013559
Header
length: 24 bytes
Flags:_ 0xx0012 (SYN, ACK)
0...
.... = Congestion Window Reduced (CWR): Not set
.0..
.... = ECN-Echo: Not set
..0.
.... = Urgent: Not set
...1
.... = Acknowledgment: Set
....
0... = Push: Not set
....
.0.. = Reset: Not set
....
..1. = Syn: Set
....
...0 = Fin: not set
window
size: 5840
Checksum:
0x206a (correct)
Options: (4bytes)
Maximum
segment size: 1460 bytes
|
Suppose
the segment in Figure 4-3 was sent from computer B to computer A. Begin interpreting
the segment at the Source port line. Notice the segment was issued from
computer B’s port 80, the port assigned to HTTP by default. It was addressed to
port 1958 on computer A. The sequence number for this segment is 3043958669.
The next segment that computer B expects to receive from computer A will have
the sequence number of 937013559 because this is what computer B has entered in
the Acknowledgment field. By simply having a value, the Acknowledgment field
performs its duty of letting a node know that its last communication was
received. By indicating a sequence number, the Acknowledgment field does
double-duty. Next, look at the Header length field. It indicates that the TCP header
is 24 bytes long—4 bytes larger than its minimum size—which means that some of the
available options were specified or the padding space was used. In the flags
category, notice that there are two unfamiliar flags: Congestion Window Reduced
and ECN-Echo. These are optional flags that can be used to help TCP react to
and reduce traffic congestion. They are only available when TCP is establishing
a connection. However, in this segment, they are not set. Of all the possible
flags in the Figure 4-3 segment, only the ACK and SYN flags are set. This means
that computer B is acknowledging the last segment it received from computer A
and also negotiating a synchronization scheme for sequencing. The window size
is 5840, meaning that computer B can accept 5840 more bytes of data from
computer A even while this segment remains unacknowledged. The Checksum field indicates
the valid outcome of the error-checking algorithm used to verify the segment’s header.
In this case, the checksum is 0x206a. When computer A receives this segment, it
will perform the same algorithm, and if the result is 0x206a, it will know the
TCP header arrived without damage. Finally, this segment uses its option field
to specify a maximum TCP segment size of 1460 bytes. Note that a computer
doesn’t “see” the TCP segment as it’s shown in Figure 4-3. This figure was
obtained by using a data analyzer program that translates each packet into a
user friendly form. From the computer’s standpoint, the TCP segment is encoded
as hexadecimal characters. The computer does not need any labels to identify
the fields because as long as TCP/IP protocol standards are followed, it knows
exactly where each byte of data is located. The TCP segment pictured in Figure
4-3 is part of the process of establishing a connection between computer B and
computer A.
In
fact, it is the second segment of three used to establish a TCP connection. In
the first step of establishing this connection, computer A issues a message to
computer B with its SYN bit set, indicating the desire to communicate and synchronize
sequence numbers. In its message, it sends a random number that will be used to
synchronize the communication.
In
Figure 4-4, for example, this number is 937013558. (Its ACK bit is usually set
to 0.) After computer B receives this message, it responds with a segment whose
ACK and SYN flags are both set. In computer B’s transmission, the ACK field
contains a number that equals the sequence number computer A originally sent
plus 1. As Figure 4-4 illustrates, computer B sends the number 937013559. In
this manner, computer B signals to computer A that it has received the request
for communication and further, it expects computer A to respond with the
sequence number 937013559. In its SYN field, computer B sends its own random
number (in Figure 4-4, this number is 3043958669), which computer A will use to
acknowledge that it received computer B’s transmission. Next, computer A issues
a segment whose sequence number is 937013559 (because this is what computer B
indicated it expects to receive). In the same segment, computer A also
communicates a sequence number via its Acknowledgment field. This number equals
the sequence number that computer B sent plus 1. In the example shown in Figure
4-4, computer A expects 3043958670 to be the sequence number of the next
segment it receives from computer B. Thus, in its next communication (not shown
in Figure 4-4), computer B will respond with a segment whose sequence number is
937013560. The two nodes continue communicating this way until computer A
issues a segment whose FIN flag is set, indicating the end of the transmission.
TCP
is not the only core protocol at the Transport layer. A similar but less
complex protocol, UDP, is discussed next.
UDP (User Datagram
Protocol)
UDP
(User Datagram Protocol), like TCP, belongs to the Transport layer of the
TCP/IP and OSI models. Unlike TCP, however, UDP is a connectionless transport
service. In other words, UDP offers no
assurance that packets will be received in the correct sequence. In
fact, this protocol does not guarantee that the packets will be received at
all.
Furthermore,
it provides no error checking or
sequencing. In the analogy of trying to communicate from shore to a friend
on a boat, this would be like shouting into the fog without making sure she
heard you correctly, if at all. UDP’s
lack of sophistication makes it more efficient than TCP. It can be
useful in situations in which a great volume of data must be transferred
quickly, such as live audio or video transmissions over the Internet. In these
cases, TCP—with its acknowledgments, checksums, and flow-control
mechanisms—would only add more overhead to the transmission. UDP is also more efficient for carrying
messages that fit within one data packet. In contrast to a TCP header’s
10 fields, the UDP header contains only four fields: Source port, Destination
port, Length, and Checksum. Use of the Checksum field in UDP is optional.
Now
that you understand the functions of and differences between TCP and UDP, you
are ready to learn more about IP (Internet Protocol).
IP (Internet Protocol)
IP
(Internet Protocol) belongs to the Internet layer of the TCP/IP model and the
Network layer of the OSI model. It
provides information about how and where data should be delivered, including
the data’s source and destination addresses. IP is the subprotocol that enables TCP/IP to internetwork—that is, to
traverse more than one LAN segment and more than one type of network through a
router. As you know, at the Network layer of the OSI model, data are
formed into packets, also known as datagrams. The IP packet acts as an envelope
for data and contains information necessary for routers to transfer data
between different LAN segments.
Two
versions of the IP protocol are used on networks today. IPv4, which was introduced over 30 years ago, is
still the standard on most networks. IPv4 is an unreliable, connectionless protocol, which means that it
does not guarantee delivery of data. However, higher-level protocols of
the TCP/IP suite, such as TCP, use IPv4 to ensure that data packets are
delivered to the right addresses. The newer version of IP, IPv6, also known as IP
next generation, or IPng, was released in 1998.
Most new applications, servers, clients, and network devices support IPv6.
However, due to the cost of upgrading infrastructure, many organizations have
hesitated to upgrade from IPv4. Switching to IPv6 has advantages. IPv6 offers
better security and better prioritization provisions than IPv4, plus automatic
IP address configuration. But perhaps
the most valuable advantage IPv6 offers is its promise of billions and billions
of additional IP addresses through its new addressing scheme.
IPv4
Packets Due to the added information it carries, IPv6 uses
different packets than IPv4. The following sections describe both types of
packets in detail. The IPv4 packets fields
are explained in the table below.
Figure 4-7 IPv4 packet data
|
Field
|
Length
|
Function
|
|
Version
|
4
bits
|
Identifies
the version number of the protocol—for example, IPv4 or IPv6. The receiving
workstation looks at this field first to determine whether it can read the
incoming data. If it cannot, it will reject the packet.
|
|
Internet
header length (IHL)
|
4
bits
|
Identifies
the number of 4-byte (or 32-bit) blocks in the IPv4 header. The most common
header length is composed of five groupings, as the minimum length of an IPv4
header is 20 4-byte blocks. This field indicates to the receiving node where
data will begin (immediately after the header ends).
|
|
Differentiated
Services (DiffServ)
|
8
bits
|
Informs
routers the level of precedence they should apply when processing the incoming
packet. Differentiated Services allows up to 64 values and a wide range of
priority handling options.
|
|
Total
length
|
16
bits
|
Identifies
the total length of the IP packet, including the header and data, in bytes.
An IP packet, including its header and data, cannot exceed 65,535 bytes.
|
|
Identification
|
16
bits
|
Identifies
the message to which a packet belongs and enables the receiving node to
reassemble fragmented messages. This field and the following two fields,
Flags and Fragment offset, assist in reassembly of fragmented packets.
|
|
Flags
|
3
bits
|
Indicates
whether a message is fragmented and, if it is fragmented, whether this packet
is the last in the fragment.
|
|
Fragment
offset
|
13
bits
|
Identifies
where the packet fragment belongs in the incoming set of fragments.
|
Time
to Live (TTL)
|
8
bits
|
Indicates
the maximum duration that the packet can remain on the network before it is discarded.
Although this field was originally meant to represent units of time, on
modern networks it represents the number of times a packet has been forwarded
by a router, or the number of router hops it has endured. Therefore, TTL is
often called the hop limit. The TTL for packets is variable and configurable,
but is usually set at 32 or 64. Each time a packet passes through a router,
its TTL is reduced by 1. When a router receives a datagram with a TTL equal
to 1, it discards that packet (or more precisely, the frame to which it
belongs).
|
|
Protocol
|
8
bits
|
Identifies
the type of Transport layer protocol that will receive the datagram (for
example, TCP or UDP).
|
|
Header
checksum
|
16
bits
|
Allows
the receiving node to calculate whether the IP header has been corrupted
during transmission. If the checksum accompanying the message does not have
the proper value when the packet is received, the packet is presumed to be
corrupt and is discarded.
|
|
Source
IP address
|
32
bits
|
Identifies
the full IP address of the source node.
|
|
Destination
IP address
|
32
bits
|
Indicates
the full IP address of the destination node.
|
|
Options
|
Variable
|
May
contain optional routing and timing information.
|
|
Padding
|
Variable
|
Contains
filler bits to ensure that the header is a multiple of 32 bits.
|
|
Data
|
Variable
|
Includes
the data originally sent by the source node, plus information added by TCP in
the Transport layer
|
In
the Chapter 2 discussion of the OSI model’s Network layer functions, you were
introduced to IP and the data contained in its packets. You also saw an example
of IPv4 packet data from an actual HTTP request. However, you might not have
understood what all of the data meant. Now that you are familiar with the
fields of an IPv4 packet, you can interpret its contents. Figure 4-7 offers
another look at the IPv4 packet.
|
-
Internet Protocol, Src Addr: 140.147.249.7 (140.147.249.7), Dst Addr:
10.11.11.51 (10.11.11.51)
Version:
4
Header
length: 20 bytes
)00x0
NCE ;tluafeD :00x0 PCSD( 00x0 :dleiF secivreS detaitnereffiD +
Total
Length: 44
Identification:
0x0000 (0)
- Flags: 0x04
.1..
= Don’t fragment: Set
..0.
= More fragments: Not set
Fragment
offset: 0
Time
to live: 64
Protocol:
TCP (0x06)
Header
checksum: 0x9ff3 (correct)
Source:
140.147.249.7 (140.147.249.7)
Destination:
10.11.11.51 (10.11.11.51)
|
Begin
interpreting the datagram in Figure 4-7 with the Version field, which indicates
that this transmission relies on version 4 of the Internet Protocol. Next,
notice that the datagram has a header length of 20 bytes. Because this is the
minimum size for an IP header, you can deduce that the datagram contains no
options or padding. In the Differentiated Services field, no options for priority
handling are set, which is not unusual in routine data exchanges such as
retrieving a Web page. The total length of the datagram is given as 44 bytes.
This makes sense when you consider that its header is 20 bytes and the TCP
segment that it encapsulates is 24 bytes.
Considering
that the maximum size of an IP packet is 65,535 bytes, this is a very small
packet. Next in the IP datagram is the Identification field, which uniquely
identifies the packet. This packet, the first one issued from computer B to
computer A in the TCP connection exchange, is identified in hexadecimal
notation as 0x0000. In the Flags field, which indicates whether this packet is
fragmented, the don’t fragment option is set with a value of 1. So you know
that this packet is not fragmented. And because it’s not fragmented, the
fragment offset field does not apply and is set to 0. This datagram’s TTL (Time
to Live) is set to 64. That means that if the packet were to keep traveling
across a network, it would be allowed 64 more hops before it was discarded. The
Protocol field is next. It indicates that encapsulated within the packet is a
TCP segment. TCP is always indicated by the hexadecimal string of 0x06. The
next field provides the correct header checksum answer, which is used by the
recipient of this packet to determine whether the header was damaged in
transit. Finally, the last two fields in the packet show the logical addresses
for its source and destination.
IPv6 Packets As
you have learned, IPv6 was designed to offer better prioritization, better
security, and a much larger range of IP addresses than IPv4. The fields in an IPv6
packet header, explained in Table 4-3, reflect those enhancements.
Table 4-3 Fields in an IPv6 packet
|
Field
|
Length
|
Function
|
|
Version
|
4 bits
|
Indicates what IP
version the packet uses.
|
|
Traffic class
|
8 bits
|
Identifies the
packet’s priority. It is similar, but not the same as the Type of service
field in IPv4 packets.
|
|
Flow label
|
20 bits
|
Indicates which
flow, or sequence of packets issued from one source to one or multiple
destinations, the datagram belongs to. Routers interpret flow information to
ensure that packets belonging to the same transmission arrive together. Flow
information may also help with traffic prioritization.
|
|
Payload length
|
16 bits
|
Indicates the
size of the payload, or data carried by the packet. Unlike the Total length
field in IPv4 packets, the Payload length in IPv6 packets does not refer to
the size of the whole packet.
|
|
Next header
|
8 bits
|
Identifies the
type of header that immediately follows the IP packet header, usually TCP or
UDP.
|
|
Hop limit
|
8 bits
|
Indicates the
number of times that the packet can be forwarded by routers on the network,
similar to the TTL field in IPv4 packets. When the hop limit reaches 0, the
packet is discarded.
|
|
Source address
|
128 bits
|
Identifies the
full IP address of the transmitting node.
|
|
Destination
address
|
128 bits
|
Identifies the
full IP address of the receiving node.
|
If
you compare the fields and functions listed in Table 4-3 with those listed for
the IPv4 packet in Table 4-2, you’ll notice some similarities and some
differences. For example, both packets begin with a 4-bit Version field. Other
fields, such as the TTL in IPv4 and the Hop limit in IPv6, are similar, but
slightly different. One striking difference between the two versions is that
IPv6 packets accommodate the much longer IPv6 addresses.
Figure
4-9 shows the contents of an actual IPv6 packet header. This packet formed part
of a message issued by PING, a common diagnostic tool that is described in
detail later in this chapter. First in the header comes the Version field,
which indicates that this transmission relies on version 6 of the Internet
Protocol, expressed in binary format as 0110. (Recall from Chapter
2’sdiscussion of binary conversion that 0110 would be 0 x 8 + 1 x 4 + 1 x 2 + 0
x 1, or 6, in decimal format.)
Next,
notice that the Traffic class and Flow label field are both set to 0x0000000.
That means values for these fields have not been specified. Without Traffic class
or Flow label information, routers receiving this packet will not prioritize it
or make any guarantees that it will reach its destination at the same time as
any other packets. For many types of traffic, this is perfectly acceptable. Next
in the IPv6 header comes the Payload field, with a value of 64, which means the
packet carries 64 bits of data. Considering that IPv6 packets may carry
payloads as large as 64 KB, this is a very small packet. The Next header field
in this packet indicates that the data in the payload belongs to an ICMP
transmission. (ICMP is also described later in this chapter.) The IPv6
datagram’s Hop limit is set to 64. That means that if the packet were to keep
traveling across a network, it could be forwarded by routers 64 times before it
was discarded. Finally, the last two fields in the packet show the IP addresses
for the packet’s source and destination, 2001:470:1f10:1a6::2 and
2001:470:1f10:1a6::1, respectively.
It’s
useful to understand the differences between IPv4 and IPv6 transmissions before
learning about other TCP/IP protocols. For example, the protocols described in
the next two sections, IGMP and ARP, are used only on IPv4 networks. The
functions they provide have become part of the IPv6 protocol and no longer need
to be provided by separate Network layer protocols.
IGMP (Internet Group Management Protocol)
Another
core TCP/IP protocol is IGMP (Internet Group Management Protocol or Internet Group
Multicast Protocol). IGMP operates at
the Network layer of the OSI model and manages multicasting on networks running
IPv4. Multicasting is a transmission method that allows one node to
send data to a defined group of nodes. Whereas most data transmission occurs on
a point-to-point basis, multicasting is a point-to-multipoint method. And
unlike a broadcast transmission, a multicast transmission does not necessarily
issue transmissions to every node on a segment. Multicasting can be used for
teleconferencing or videoconferencing over the Internet, for example. Routers
use IGMP to determine which nodes belong to a certain multicast group and to
transmit data to all nodes in that group. Network nodes use IGMP to join or
leave multicast groups at any time.
ARP (Address Resolution Protocol)
ARP
(Address Resolution Protocol) is a Network layer protocol used with IPv4 that
obtains the MAC (physical) address of a host, or node, and then creates a
database that maps the MAC address to the host’s IP address. If one node needs
to know the MAC address of another node on the same network, the first node
issues a broadcast message to the network, using ARP, that essentially says,
“Will the computer with the IP address 1.2.3.4 please send me its MAC address?”
In the context of networking, a broadcast is a transmission that is
simultaneously sent to all nodes on a particular network segment. The node that
has the IP address 1.2.3.4 then broadcasts a reply that contains the physical
address of the destination host. To make ARP more efficient, computers save
recognized MAC-to-IP address mappings on their hard disks in a database known
as an ARP table (also called an ARP cache). After a computer has saved this
information, the next time it needs the MAC address for another device, it
finds the address in its ARP table and does not need to broadcast another
request. Although the precise format
of ARP tables may vary from one operating system to another, the essential
contents of the table and its purpose remain the same. An ARP table can
contain two types of entries: dynamic and static. Dynamic ARP table entries are created when a client makes an ARP
request that cannot be satisfied by data already in the ARP table. Static ARP table entries are those that
someone has entered manually using the ARP utility. The ARP utility,
accessed via the arp command from a Windows command prompt or a UNIX or Linux
shell prompt, provides a way of obtaining information from and manipulating a
device’s ARP table. For example, you can view a Windows workstation’s ARP table
by typing arp -a at the command line and pressing Enter. ARP can be a valuable
troubleshooting tool for discovering the identity of a machine whose IP address
you know, or for identifying the problem of two machines trying to use the same
IP address.
ICMP (Internet Control Message Protocol)
Whereas
IP helps direct data to its correct destination, ICMP (Internet Control Message Protocol) is a Network layer core
protocol that reports on the success or failure of data delivery. It
can indicate when part of a network is congested, when data fails to reach its
destination, and when data has been discarded because the allotted time for its
delivery (its TTL) expired. ICMP announces these transmission failures to the
sender, but ICMP cannot correct any of the errors it detects; those functions
are left to higher-layer protocols, such as TCP. However, ICMP’s announcements
provide critical information for troubleshooting network problems.
IPv6
relies on ICMPv6 (Internet Control Message Protocol version 6) to perform the
functions that ICMP, IGMP, and ARP perform in IPv4. In other words, ICMPv6
detects and reports data transmission errors, discovers other nodes on a
network, and manages multicasting.
IPv4 Addressing
You
have learned that networks recognize two kinds of addresses: logical (or
Network layer) and physical (or MAC or hardware) addresses. Physical addresses
are assigned to a device’s NIC at the factory by its manufacturer. Logical
addresses can be manually or automatically assigned and must follow rules set
by the protocol standards. In the TCP/IP
protocol suite, IP s the protocol responsible for logical addressing.
For this reason, addresses on TCP/IP-based networks are often called IP
addresses. IP addresses are assigned and used according to very specific
parameters.
Each
IP address is a unique 32-bit number, divided into four octets, or sets of 8
bits, that are separated by periods. Because 8 bits equals 1 byte, each octet
is a byte, and an IP address is thus composed of 4 bytes. An example of a valid
IP address is 144.92.43.178. An IP address contains two types of information:
network and host. From the first octet, you can determine the network class. In
traditional IP addressing, three types of network classes are used for LANs:
Class A, Class B, and Class C. (In Chapter 9, however, you’ll learn about developments
that allow networks to circumvent such class designations.) Table 4-4
summarizes characteristics of the three commonly used classes of TCP/IP-based
networks.
In
addition, Class D and Class E addresses do exist, but are rarely used. Class D
addresses, which begin with an octet whose value is between 224 and 239, are
reserved for multicasting. IETF (Internet Engineering Task Force) reserves
Class E addresses, which begin with an octet whose value is between 240 and
254, for experimental use. You should never assign Class D or Class E addresses
to devices on your network. Certain octets in an IP address are reserved for
special functions. The number 0 is reserved to act as a placeholder when
referring to an entire group of computers on a network—for example, 10.0.0.0
represents all of the devices whose first octet is 10. The number 255, when
used in the host portion of an address, indicates a broadcast transmission.
Sending a message to the address 147.82.255.255, for example, sends a message
to all devices connected to the 147.82.0.0 network.
Table 4-4 - Commonly used TCP/IP classes
|
Network class
|
Beginning octet
|
Number of networks
|
Maximum addressable hosts per network
|
|
A
|
1–126
|
126
|
16,777,214
|
|
B
|
128–191
|
>
16,000
|
65,534
|
|
C
|
192–223
|
>
2,000,000
|
254
|
A
portion of each IP address contains clues about the network class. An IP
address whose first octet is in the range of 1–126 belongs to a Class A
network. All IP addresses for devices on a Class A segment share the same first
octet, or bits 0 through 7. For example, nodes with the following IP addresses
may belong to the same Class A network: 23.78.110.109, 23.164.32.97,
23.48.112.43, and 23.108.37.22. In this example, 23 is the network ID. The
second through fourth octets (bits 8 through 31) in a Class A address identify
the host. An IP whose first octet is in the range of 128–191 belongs to a Class
B network. All IP addresses for devices on a Class B segment share the first
two octets, or bits 0 through 15.
For
example, nodes with the following IP addresses may belong to the same Class B
network: 168.34.88.29, 168.34.55.41, 168.34.73.49, and 168.34.205.113. In this
example, 168.34 is the network ID. The third and fourth octets (bits 16 through
31) on a Class B network identify the host. An IP address whose first octet is
in the range of 192–223 belongs to a Class C network. All IP addresses for
devices on a Class C segment share the first three octets, or bits 0 through
23For example, nodes with the following addresses may belong to the same Class
C network204.139.118.7, 204.139.118.54, 204.139.118.14, and 204.139.118.31. In
this example204.139.118 is the network ID. The fourth octet (bits 24 through
31) on a Class C network identifies the host. Internet founders intended the
use of network classes to provide easy organization and sufficient quantity of
IP addresses on the Internet. However, their goals haven’t necessarily been
met. Class A addresses were distributed liberally to large companies and
government organizations who were early users of the Internet, such as IBM.
Some organizations reserve many more addresses than they had devices. Class B
addresses were distributed to midsized organizations and Class C addresses to
smaller organizations, such as colleges. Today, many Internet addresses go
unused, but cannot be reassigned because an organization has reserve them.
Although potentially more than 4.3 billion Internet addresses are available,
the demand for such addresses grows exponentially every year. To respond to
this demand, a new addressing scheme was developed that can supply the world
with enough addresses to last well into this century. IP version 6 (IPv6)
incorporates this new addressing scheme. You will learn more about IPv6
addressing later in this chapter.
In
addition, some IP addresses are reserved for special functions, like
broadcasts, and cannot be assigned to machines or devices. Notice that 127 is
not a valid first octet for any IP address. The range of addresses beginning
with 127 is reserved for a device communicating with itself, or performing
loopback communication. Thus, the IP address 127.0.0.1 is called loopback
address. Attempting to contact this IP number—in other words, attempting to
contact your own machine—is known as a loopback test. (In fact, when you transmit
to any IP address beginning with the 127 octet, you are communicating with your
own machine.) A loopback test can prove useful when troubleshooting problems
with a workstation’s TCP/IP communications. If you receive a positive response
from a loopback test, you know that the TCP/IP core protocols are installed and
in use on your workstation.
The
command used to view IP information on a Windows workstation is ipconfig.
To view your current IP information on a Windows workstation:
1.
Click the Start button, select All Programs, select Accessories, and then select Command Prompt. The Command Prompt
window opens.
2.
At the command prompt, type ipconfig /all
and press Enter. Your workstation’s IP
address information is displayed.
3.
Type exit and press Enter to close the Command Prompt
window.
To
view and edit IP information on a computer running a version of the UNIX or
Linux operating system, use the ifconfig command. (Note that ipconfig and
ifconfig differ by only one letter.) Simply type ifconfig -a at the shell prompt to view all the information about
your TCP/IP connections and addresses.
Now
that you have learned the most important characteristics of IP addresses, you
are ready to learn more about how computers interpret these addresses.
Binary and Dotted Decimal Notation
So
far, all of the IP addresses in this section have been represented in dotted
decimal notation. Dotted decimal notation, the most common way of expressing IP
addresses, refers to the “shorthand” convention used to represent IP addresses
and make them easy for people to read. In dotted decimal notation, a decimal
number between 0 and 255 represents each binary octet, for a total of 256
possibilities. A period, or dot,
separates each decimal. An example of a dotted decimal IP address is
131.65.10.18. Each number in a dotted decimal address has a binary equivalent.
In Chapter 3, you learned how to convert decimal numbers to their binary
equivalents. Converting a dotted decimal address to its binary equivalent is
simply a matter of converting each octet and removing the decimal points. For
example, in the dotted decimal address 131.65.10.36, the binary equivalent of
the first octet, 131, is 10000011; the binary equivalent of the second octet,
65, is 01000001; the binary equivalent of the third octet, 10, is 00001010; and
the binary equivalent of the fourth octet, 36, is 00100100. Therefore, the
binary value for 131.65.10.36 is 10000011 01000001 00001010 00100100.
Subnet Mask
In
addition to an IP address, every device on a network running IPv4 is assigned a
subnet mask. A subnet mask is a special 32-bit number that, when combined with
a device’s IP address, informs the rest of the network about the segment or
network to which the device is attached. That is, it identifies the device’s
subnet. Like IP addresses, subnet masks are composed of four octets (32 bits)
and can be expressed in either binary or dotted decimal notation. Subnet masks
are assigned in the same way that IP addresses are assigned—either manually,
within a device’s TCP/IP configuration, or automatically, through a service
such as DHCP (described in detail later in this chapter). A more common term
for subnet mask is net mask, and sometimes simply mask, as in “a device’s mask.”
You
might wonder why a network node even needs a subnet mask, given that the first octet
of its IP address indicates its network class. The answer lies with subnetting; a process of subdividing a
single class of networks into multiple, smaller logical networks, or segments.
Network managers create subnets to manage and separate network traffic and to
make the best use of a limited number of IP addresses. Methods of subnetting
are discussed in detail in Chapter 9. For now, it is enough to know that
regardless of whether a network is subnetted, its devices are assigned a subnet
mask.
On
networks that use subnetting, the subnet mask varies depending on the way the network
is subnetted. On networks that do not use subnetting, however, the subnet masks
take on a default value, as shown in Table 4-5. To qualify for Network+
certification, you should be familiar with the default subnet masks associated
with each network class
.
Table 4-5 Default subnet masks
|
Network class
|
|
Default subnet mask
|
|
A
|
1–126
|
255.0.0.0
|
|
B
|
128–191
|
255.255.0.0
|
|
C
|
192–223
|
255.255.255.0
|
IPv6 Addressing
Up
to this point, you have learned about IP addressing according to the IPv4
scheme. This section introduces you to addressing in IPv6 and explains the
differences between addressing in IPv4 and addressing in IPv6. For Network+
certification, you will need to understand both addressing schemes. The most
notable difference between IP addresses in IPv4 and IPv6 is their size. Whereas
IPv4 addresses are composed of 32
bits, IPv6 addresses are composed of eight 16-bit fields, for a total of 128
bits. The added fields and the larger address size result in an
increase of 2 (or 4 billion times 4 billion times 4 billion) available IP
addresses in the IPv6 addressing scheme. The addition of more IP addresses not
only allows every interface on every Internet connected device to have a unique
number, but also eliminates the need for IP address conservation. With the
increasing number of network-enabled devices, including handheld computers, telephones,
home security systems, traffic cameras, and even pet-tracking systems, the
limited quantity of IPv4 addresses posed a serious bottleneck.
A
second difference between IPv4 and IPv6 addresses is the way they are
represented. Whereas each octet in an IPv4 address contains decimal numbers
separated by a period (for example, 123.45.67.89), each field in an IPv6
address is typically represented in hexadecimal numbers separated by a colon.
(Keep in mind that the computer still reads the binary version of this address,
and if you wanted, you could also write an IPv6 address in binary format.) An example
of a valid IPv6 address is FE22:00FF:002D:0000:0000:0000:3012:CCE3. Because
many IPv6 addresses will contain multiple fields that have values of 0, two
methods of shorthand for representing these fields have been established. One
method eliminates all leading zeros—that is, zeros that precede another
hexadecimal digit—within a field. For example, the field 00FF could also be
written FF and the field 0000 could be written 0. Thus, FE22:00FF:002D:0000:0000:0000:3012:CCE3
can be written as FE22:FF:2D:0:0:0:3012:CCE3. A second type of shorthand
substitutes :: for any number of multiple, zero-value fields. Thus,
FE22:00FF:002D:0000:0000:0000:3012:CCE3 can also be written as
FE22:FF:2D::3012:CCE3. The substitution of multiple zero-value fields can only
be performed once within an address; otherwise, you cannot tell how many fields
the :: symbol represents. For example, the IPv6 address 2001:0:0:34D0:0:0:9F77:2854
could not be abbreviated 2001::34D0::9F77:2854. It could instead be abbreviated
2001::34D0:0:0:9F77:2854 or 2001:0:0:34D0::9F77:2854. An important address to
memorize is the IPv6 loopback address. Recall that in IPv4 the loopback address
has a value of 127.0.0.1. In IPv6, however, the loopback address has a value of
0:0:0:0:0:0:0:1. Abbreviated, the IPv6 loopback address becomes ::1.
A
third difference between the two types of IP addresses is that in IPv6,
addresses can reflect the scope of a transmission’s recipients—for example, a
single node, a group, or a special kind of group. One type of IPv6 address is a unicast address, or an address that
represents a single interface on a device. A unicast address is the
type of address that would be assigned, for example, to a workstation’s network
adapter. If you wanted to save a file from your laptop onto your company’s
server using IPv6 that transmission would call for a unicast address. Also, the
loopback address is a unicast address a multicast address represents multiple
interfaces (often on multiple devices). Multicast addresses are useful for
transmitting the same data to many different devices simultaneously, as in
point-to-multipoint communications.
IPv6
allows for the specification of several types of multicast groups. For example,
the global multicast group, which directs data to all reachable nodes, is akin
to the broadcast transmission in IPv4. The link-local multicast group includes computers
that share the same link as the transmitting node. An anycast address
represents any one interface from a group of interfaces, any one of which can
accept a transmission. Anycast addresses could be useful for identifying all of
the routers that belong to one ISP, for example. In this instance, an Internet
transmission destined for one of that ISP’s servers could be accepted by the
first available router in the anycast group. The result is that the
transmission finishes faster than if it had to wait for one specific router
interface to become available. At this time, anycast addresses are not designed
to be assigned to hosts, such as servers or workstations.
A fourth significant difference between IPv4 and IPv6
addressing is that in IPv6, each address contains a Format Prefix, or a
variable-length field at the beginning of the address that indicates what type
of address it is—unicast, multicast, or anycast. A link-local unicast address begins
with the hexadecimal string FE80. A site-local unicast address begins with
FEC0. A multicast address begins with the following hexadecimal string: FF0x,
where x is a character that corresponds to a group scope ID. For example, the
Format Prefix for a link-local multicast address is FF02, while the Format
Prefix for a global multicast address is FF0E. Virtually all modern network
devices and operating systems can transmit and receive data using both IPv4 and
IPv6. Using both on one network is known as a dual-stack approach. Dual-stack
networks are common because even as organizations upgrade to IPv6, their
customers, partners, and suppliers with interconnected networks might lag
behind and require IPv4 support. Several methods exist to accommodate IPv6
traffic on IPv4 networks. Although a thorough explanation of each method is
beyond the scope of this book, Chapter 9 will describe IPv6 and IPv4 networking
in greater detail.
Assigning IP Addresses
You
have learned that several government-sponsored organizations—including IANA,
ICANN, and RIRs—cooperate to dole out IP addresses to ISPs and other network
providers around the world. You also learned that most companies and
individuals obtain IP addresses from their ISPs and not directly from the
government’s higher authorities. This section describes how an organization assigns
its group of IP addresses to networked devices so that they can communicate
over the Internet.
Whether
connecting to the Internet or to another computer within a LAN, every node on a
TCP/IP network must have a unique IP address. Suppose client B joins a network
and takes an IP address that is already in use by client A, which is on the
same subnet. In that case, client B will receive an error message and its
TCP/IP services will be disabled, client A may also receive an error message,
but can continue to function normally. You can modify a client’s TCP/IP
properties to assign it an IP address manually. A manually assigned IP address
is called a static IP address because it does not change automatically. It changes
only when you reconfigure the client’s TCP/IP properties. Unfortunately, due to
human error, static IP addressing can easily result in the duplication of
address assignments. So rather than assigning IP addresses manually, most
network administrators rely on a network service to automatically assign them.
An
IP address that is assigned to a device upon request and is changeable is known
as a dynamic IP address. The most
common method for automatically assigning IPv4 addresses is using the Dynamic
Host Configuration Protocol (DHCP).
DHCP (Dynamic Host Configuration Protocol)
DHCP
(Dynamic Host Configuration Protocol) is an automated means of assigning a unique
IP address to devices on a network. In DHCP, a DHCP server manages IP address
assignment. The server maintains information about which addresses are
allowable, which are available, and which have already been associated with a
host. DHCP belongs to the Application
layer of the TCP/IP and OSI models.
Reasons for implementing
DHCP include the following:
·
To reduce the time and planning
spent on IP address management—Central management of IP addresses eliminates the
need for network administrators to edit the TCP/IP configuration on every
network workstation, printer, or other device.
·
To reduce the potential for errors
in assigning IP addresses—With DHCP, almost no possibility exists that a
workstation will be assigned an invalid address or that two workstations will
attempt to use the same IP address. (Occasionally, the DHCP server software may
make a mistake.)
·
To enable users to move their
workstations and printers without having to change their TCP/IP configuration—As long as a workstation is
configured to obtain its IP address from a DHCP server and that server is
available, the workstation can be attached anywhere on the network and receive
a valid address.
·
To make IP addressing transparent
for mobile users—A
person visiting your office, for example, could attach to your network and
receive an IP address without having to change his laptop’s configuration.
DHCP Leasing Process
With DHCP, a device borrows, or leases, an IP address
while it is attached to the network. In other words, it uses the IP address on a
temporary basis for a specified length of time. On most networks, a client
obtains its DHCP-assigned address as soon as it logs on to a network. The
length of time a lease remains in effect depends on DHCP server and client
configurations. Leases that expire must be renegotiated for the client to
remain on the network. Alternatively, users can force a lease termination at the
client, or a network administrator can force lease terminations at the server. Configuring
the DHCP service involves identifying a DHCP scope, or a range of addresses that
can be leased to any network device on a particular segment, plus a list of
excluded addresses, if any exist. As a network administrator, you configure the
duration of the lease to be as short or as long as necessary, from a matter of
minutes to forever. After the DHCP server is running, the client and server
take the following steps to negotiate the client’s first lease. (Note that the
following example applies to a workstation, but devices such as networked printers
may also take advantage of DHCP.)
1. When the client workstation is powered on and its
NIC detects a network connection, it sends out a DHCP discover packet in
broadcast fashion via the UDP protocol to the DHCP server.
2. Every DHCP server on the same subnet as the
client receives the broadcast request. Each DHCP server responds, in broadcast
fashion, to offer an available IP address, while simultaneously withholding
that address from other clients. The response message includes the available IP
address, subnet mask, IP address of the DHCP server, and lease duration.
(Because the client doesn’t have an IP address, the DHCP server cannot send the
information directly to the client.)
3. The client accepts the first IP address that it
receives, responding with a broadcast message that essentially confirms to the
DHCP server that it wants to accept the address. Because this message is
broadcast, all other DHCP servers that might have responded to the client’s
original query see this confirmation and return the IP addresses they had reserved
for the client to their pool of available addresses.
4. When the selected DHCP server receives the
confirmation, it replies to the client with an acknowledgment message. It also
provides more information, such as DNS, subnet mask, or gateway addresses that
the client might have requested.
The
preceding steps involve the exchange of only four packets and, therefore, do
not usually increase the time it takes for a client to log on to the network.
The client and server do not have to repeat this exchange until the lease is
terminated. The IP address remains in the client’s TCP/IP settings so that even
after the client shuts down and reboots, it can use this information and not
have to request a new address. However, if the device is moved to another
network, it will be assigned different IP address information suited to that
network.
Terminating a DHCP Lease
A
DHCP lease may expire based on the period established for it in the server
configuration, or it may be manually terminated at any time from either the client’s
TCP/IP configuration or the server’s DHCP configuration. In some instances, a
user must terminate a lease. For example, if a DHCP server fails and another is
installed to replace it, the clients that relied on the first DHCP server need
to release their old leases (and obtain new leases from the new server).
To
release TCP/IP settings on a client running a Windows operating system:
1.
Click the Start button, click All Programs, click Accessories, and then click Command
Prompt. The Command Prompt window opens.
2.
At the command prompt, type ipconfig
/release and then press Enter.
Your TCP/ IP configuration values are cleared, and both the IP address and
subnet mask revert to 0.0.0.0.
3.
Type exit and press Enter to close the Command Prompt
window.
Releasing
old DHCP information is the first step in the process of obtaining a new IP address.
To obtain a new IP address on a Windows workstation:
1.
If you are not already at a command prompt, click the Start button, click All
Programs, click Accessories, and
then click Command Prompt. The
Command Prompt window opens.
2.
At the command prompt, type ipconfig
/renew and then press Enter. Your
client follows the DHCP leasing process, which reestablishes its TCP/IP
configuration values. These values will be appropriate for the network to which
you are attached.
3.
Type exit and press Enter to close the Command Prompt
window.
Occasionally
your client’s attempt to renew or obtain a new DHCP-assigned address will fail.
For example, you might receive a message indicating that the DHCP server is
unreachable. This error could result from one of many problems: Your client
might be disconnected from the network, whether because a cable is unplugged or
faulty or because its protocols are not installed or configured properly; your
client or server’s DHCP services could be improperly configured; or the DHCP
server might be down.
The type of DHCP used on IPv4 networks can also be
called DHCPv4. The type used with IPv6 is known as DHCPv6, and it operates in
the same way as the version used for IPv4, described previously. However,
because IPv6 comes with automatic addressing capabilities, DHCP addressing
services are optional on IPv6 networks.
DHCP
services run on several types of devices. The installation and configurations
for each type of server vary; for specifics, refer to the DHCP server software or
NOS manual. To qualify for Network+ certification, you need not know the
intricacies of installing and configuring DHCP server software. You do,
however, need to know what DHCP does and how it accomplishes it. You also need
to understand the advantages of using dynamic IP addresses rather than static
addresses.
Private and Link-Local Addresses
You
have already learned about some addresses, such as the loopback address and
broadcast addresses, which are reserved for special uses. In addition to these,
Internet authorities have designated IP address ranges that can be used for
private addresses. Private addresses allow hosts in an organization to
communicate across its internal network. Private addresses cannot be routed on
a public network, such as the Internet. Private addresses differ from public addresses
in that the latter are assigned to an organization by Internet authorities and
can be used to identify hosts on the Internet.
The following IPv4 address
ranges are reserved for private addresses:
10.0.0.0 through 10.255.255.255
172.16.0.0 through 172.31.255.255
192.168.0.0 through 192.168.255.255
With
private addressing, Company A can assign its workstations the IP addresses
10.5.5.2 through 10.5.5.22; meanwhile, across town, Company B might assign its
workstations IP addresses 10.5.5.5 through 10.5.5.15. Although the companies
are using some of the same IP addresses internally, because these addresses are
not used beyond the companies’ networks, no conflicts will occur as a result.
When
the workstations at either company need to communicate over the Internet, each
is assigned a different, Internet-routable IP address.You will learn more about
why and how this is accomplished in Chapter 9.
Using
private addresses can extend the number of available IPv4 addresses on an
organization’s network. Private addresses also allow computers on an
organization’s network to communicate if a DHCP server is unavailable to assign
routable addresses. Operating systems come equipped with a way to automatically
assign each node a provisional IP address if this occurs. This provisional address,
capable of transmitting and receiving data only on a local network segment, is known
as the link-local address. A link-local address is a special kind of private address. With a link-local
address, a computer can communicate across a LAN segment or communicate
directly with another computer when the two are connected with a cable, for
example. However, link-local
addresses are not routable and do not allow nodes to communicate beyond their
segments. In other words, clients with link-local addresses separated by a
router could not exchange data. Were they connected to the same switch, they
could. Even though their use is restricted, link-local addresses must still
follow standards to avoid network transmission trouble. IANA (Internet Assigned
Numbers Authority) has designated ranges of IP addresses for use as link-local
addresses. For IPv4, the range is 169.254.0.0 through 169.254.254.255.
Link-local addresses in IPv6 always begin with FE80.
Zeroconf
(Zero Configuration) is the collection of protocols that assigns link-local
addresses, performs DNS functions (described later in this chapter), and
discovers services, such as print services, available to the node. Because
Zeroconf is part of a computer’s operating software, the assignment happens
without the need to register or check with a central authority. In the case of
a network whose DHCP is temporarily unavailable, when the DHCP server is
available once again, Zeroconf services release its assigned IP address and
allow the client to receive a DHCP-assigned address. With Zeroconf, IPv4
addresses are assigned through IPv4LL (IP version 4 Link Local), a protocol
that manages automatic address assignment among locally connected nodes. In
IPv4LL, when computer A joins the network, it randomly chooses an IP address in
the range from 169.254.1.0 to 169.254.254.255. Before using its chosen address
to communicate, computer A sends a message, via the ARP protocol, to the rest
of its subnet indicating its desire to use that IP address. But suppose
computer B is already using the address. In that case, computer B will respond
to computer A’s message with a broadcast that alerts every other node on the subnet
that the IP address is already in use. Computer A will then randomly select a
different IP address. However, if, after a brief period of time, no other node
responds to the first node’s announcement, computer A will issue a broadcast
message that informs the rest of the subnet that it has assigned itself the
address it chose initially.
Zeroconf
is especially useful with network printers. Some printers don’t come with
interfaces that enable a network administrator to easily configure TCP/IP
variables. If they support Zeroconf, printers can connect to the network and be
ready to communicate with no human intervention. Virtually all modern printers
come with Zeroconf support. Zeroconf is also part of modern client and network
operating systems. The version of Zeroconf services used by most Linux operating
systems is known as Avahi. Apple’s version of Zeroconf is called Bonjour. The
service that provides link-local addressing on Windows clients is known as
APIPA (Automatic Private IP Addressing).
To check whether a computer
running a Windows operating system is using APIPA:
1.
Click the Start button, click All Programs, click Accessories, and then select Command
Prompt.
The Command Prompt window opens.
2.
At the command prompt, type ipconfig /all
and then press Enter. If the
Autoconfiguration Enabled option is set to Yes, your computer is using APIPA.
Even
if your network does not need or use APIPA, leaving it enabled is not
necessarily problematic because APIPA is designed to first check for the
presence of a DHCP server and allow the DHCP server to assign addresses. In
addition, if a computer’s IP address has been assigned statically, APIPA does
not reassign a new address. It only works with clients configured to use DHCP.
APIPA can be disabled, however, by editing the Windows operating system’s Registry.
Sockets and Ports
Just
as a device requires a unique address to send and receive information over the
network, a process also requires a
unique address. Every process on a machine is assigned a port number. If you compare IP addressing with the
addressing system used by the postal service, and you equate a host’s IP
address to the address of a building, a port number is similar to an apartment
number within that building.
A
process’s port number plus its host machine’s IP address equals the process’s
socket. For example, the standard port
number for the Telnet service is 23. On a host whose IPv4 address is 10.43.3.87, the socket address for
Telnet is 10.43.3.87:23. In other words, the host assumes that any
requests coming into port number 23 are Telnet requests (that is, unless you
reconfigure the host to change the default Telnet port). Notice that a port
number is expressed as a number following a colon after an IP address. In this
example, 23 is not considered an additional octet, but simply a pointer to a
port. Sockets form virtual connections between a process on one computer and
the same process running on another computer.
Because port numbers are used by Transport layer
protocols, they apply whether your network uses IPv4 or IPv6.
The
use of port numbers simplifies TCP/IP communications and ensures that data are
transmitted to the correct application. When a client requests communications
with a server and specifies port 23, for example, the server knows immediately
that the client wants a Telnet session. No extra data exchange is necessary to
define the session type, and the server can initiate the Telnet service without
delay. The server will connect to the client’s Telnetport—by default, port
23—and establish a virtual circuit. Port numbers range from 0 to 65535 and are
divided by IANA into three types: Well Known Ports, Registered Ports, and
Dynamic and/or Private Ports. Well Known Ports are in the range from 0 to 1023
and are assigned to processes that only the operating system or an administrator
of the system can access. These were the first ports assigned to processes, and
so the earliest TCP/IP protocols, such as TCP, UDP, Telnet, and FTP, use Well
Known Ports. Table 4-6 lists some of these Well Known Ports.
Registered Ports are in the range from 1024 to 49151. These ports are accessible to
network users and processes that do not have special administrative privileges.
Default assignments of these ports (for example, by a software program) must be
registered with IANA. Dynamic Ports and/or Private Ports are those ranging from
49152 to 65535 and are open for use without restriction.
Although you do not need to memorize every port
number for the Network+ certification exam, you may be asked about the port numbers
associated with common services, such as Telnet, FTP, and HTTP. Knowing them
will also help you in configuring and troubleshooting networks using TCP/IP.
Port
numbers are assigned either by the operating system or by software programs
that rely on them. Servers maintain an editable, text-based file of port
numbers and their associated services. If you have administrative
privileges—that is, if you know the logon id and password that allows you to
modify any aspect of a system—you can change which port number a service uses. For
example, you could change the default port number for Telnet on your server
from 23 to 2330. Changing a default port number is rarely a good idea, however,
because it violates the standard and means that processes programmed to use a
standard port will not be able to communicate with your machine. Nevertheless,
some network administrators who are preoccupied with security may change their
servers’ port numbers in an attempt to confuse people with malicious intent who
try connecting to their devices through conventional sockets.
Table 4-6: Commonly used TCP/IP port numbers
|
Port number
|
Process name
|
Protocol
used
|
Description
|
|
20
|
FTP-DATA
|
TCP
|
File
transfer—data
|
|
21
|
FTP
|
TCP
|
File
transfer—control
|
|
22
|
SSH
|
TCP
|
Secure Shell
|
|
23
|
TELNET
|
TCP
|
Telnet
|
|
25
|
SMTP
|
TCP
|
Simple Mail
Transfer Protocol
|
|
53
|
DNS
|
TCP and UDP
|
Domain Name
System
|
|
67 (client to
server) and
68 (server to
client)
|
DHCPv4
|
UDP
|
Dynamic Host
Configuration Protocol version 4
|
|
69
|
TFTP
|
UDP
|
Trivial File
Transfer Protocol
|
|
80
|
HTTP
|
TCP and UDP
|
Hypertext Transfer
Protocol
|
|
110
|
POP3
|
TCP
|
Post Office
Protocol 3
|
|
123
|
NTP
|
TCP
|
Network Time
Protocol
|
|
143
|
IMAP
|
TCP
|
Internet Message
Access Protocol
|
|
443
|
HTTPS
|
TCP
|
Secure
implementation of HTTP
|
|
546 (client to
server) and
547 (server to
client)
|
DHCPv6
|
UDP
|
Dynamic Host
Configuration Protocol version 6
|
|
3389
|
RDP
|
TCP
|
Remote Desktop
Protocol
|
Host Names and DNS (Domain Name System)
Much
of TCP/IP addressing involves numbers—often long, complicated numbers.
Computers can manage numbers easily. However, most people can remember words
better than numbers. Imagine if you had to identify your friends’ and families’
Social Security numbers whenever you wanted to write a note or talk to them.
Communication would be frustrating at the very least, and perhaps even
impossible—especially if you’re the kind of person who has trouble remembering even
your own Social Security number. Similarly, people prefer to associate names
with networked devices rather than remember IP addresses. For this reason, the
Internet authorities established a naming system for all nodes on the Internet.
Every device on the Internet is technically known as a host. Every host can
take a host name, a name that describes the device. For example, someone named
Jasmine McDonald might name her workstation “Jasmine.” If the computer is
reserved for a specific purpose, you may want to name it accordingly. For
example, a company that offers free software downloads through the FTP service
might call its host machine “ftpserver.”
Domain Names
Every
host is a member of a domain, or a group of computers that belongs to the same
organization and has part of their IP addresses in common. A domain is
identified by its domain name. Usually, a domain name is associated with a
company or other type of organization, such as a university, government
organization, or company. For example, IBM’s domain name is ibm.com, and the
United States Library of Congress’s domain name is loc.gov. Often, when
networking professionals refer to a machine’s host name, they in fact mean its local
host name plus its domain name—in other words, its fully qualified host name,
also known as its fully qualified domain name or FQDN. For example, the fully qualified host name for the
Library of Congress’s blog Web site is blogs.loc.gov. A domain name is represented by a series of character strings, called
labels, separated by dots. Each label represents a level in the domain
naming hierarchy. In the domain name
www.google.com, com
is
the top-level domain (TLD), google is the second-level domain, and www is the
third-level domain.
Each second-level domain can contain multiple third-level domains. For
instance, in addition to www.google.com, Google also owns the following
domains: news.google.com, maps.google.com, and mail.google.com.
Domain
names must be registered with an Internet naming authority that works on behalf
of ICANN. ICANN has established conventions for domain naming so that certain
TLDs apply to every type of organization that uses the Internet. Table 4-7
lists some well-known ICANN approved TLDs. The first eight TLDs listed in this
table were established in the mid-1980s. Of these, no restrictions exist on the
use of the .com, .org, and .net TLDs, but ICANN does restrict what type of
hosts can be associated with the .arpa, .mil, .int, .edu, and .gov TLDs. In
addition to those listed in Table 4-7, ICANN has approved over 240 country code
TLDs to represent different countries and territories across the globe. For
example, .ca is the country code TLD assigned to Canada and .jp is the country
code TLD assigned to Japan. Organizations are not required to use country code
TLDs. For example, although Cisco’s headquarters are located in the United
States, the company’s domain name is www.cisco.com, not www.cisco.us. On the
other hand, some United States organizations do use the .us suffix.
For
example, the domain name for the Garden City, New York, public school district
is www.gardencity.k12.ny.us. A complete list of current TLDs can be found at www.iana.org/domains/root/db/.
In 2011, ICANN decided to loosen its restrictions on
TLD names and allow organizations to apply for a new TLD composed of almost any
alphanumeric string, including one that uses characters not found in the
English language. Applying for a new TLD costs $185,000, and each application
will undergo a rigorous evaluation.
Table 4-7 Some well-known top-level domains
|
Domain suffix
|
Type of organization
|
|
ARPA
|
Reverse lookup domain
(special Internet function
|
|
COM
|
Commercial
|
|
EDU
|
Educational
|
|
GOV
|
Government
|
|
ORG
|
Noncommercial
organization (such as a nonprofit agency)
|
|
NET
|
Network (such as
an ISP)
|
|
INT
|
International
Treaty Organization
|
|
MIL
|
United States
military organization
|
|
BIZ
|
Businesses
|
|
INFO
|
Unrestricted use
|
|
AERO
|
Air-transport
industry
|
|
COOP
|
Cooperatives
|
After
an organization reserves a domain name, the rest of the world’s computers know
to associate that domain name with the organization to which it is assigned,
and no other organization can legally use it. For example, you might apply for
a domain name made up of your first and last names. If your name is Evgeny
Simonovsky, you might request the domain name evgenysimonovsky.com. After you
have reserved the domain, hosts across the Internet would associate that name
with your network. No other parties in the world could use evgenysimonovsky.com
in naming computers that they allow to connect to the Internet. Host and domain
names are subject to some restrictions. Domain names may consist of any alphanumeric
combination up to a maximum of 253 characters, and can include hyphens, underscores,
or periods in the name, but no other special characters. The interesting part
of host and domain naming relates to how all Internet-connected machines in the
world know which names belong to which machines. Before tackling the entire
world, however, you can start by thinking about how one company might deal with
its local host names, as explained in the following section.
Host Files
The
first incarnation of the Internet (ARPAnet) was used by fewer than 1000 hosts.
The entire network relied on one ASCII text file called HOSTS.TXT to associate
host names with IP addresses. This file was generically known as a host file.
Growth of the Internet soon made this simple arrangement impossible to
maintain—the host file would require constant changes, searching through one
file from all over the nation would strain the Internet’s bandwidth capacity,
and the entire Internet would fail if the file were accidentally deleted.
However, in rare cases you may
still encounter this older system of using a text file to associate internal
host names with their IP addresses. Figure 4-16 provides an example of such a file.
Notice that each host is matched by one line identifying the host’s name and IP
address. In addition, a third field, called an alias, provides a nickname for
the host. An alias allows a user within an organization to address a host by a
shorter name than the full host name. Typically, the first line of a host file
begins with a pound sign and contains comments about the file’s columns. A
pound sign may precede comments anywhere in the host file. In addition to
identifying hosts on other networks, each host file indicates the local host’s
address.
In Figure 4-16, the local host
is presumed to exist on the cengage.com domain. Note that
the local host’s address points
to the loopback address, first for IPv6 and in the next line,
for IPv4.
Figure 4-16 Sample host file
|
# Host database
#
# This file
contains the mappings of IP addresses to host names and the
# aliases for
each host name. In the presence of the domain name service,
# this file may
not be consulted.
#
# Comments (such
as these) may be inserted on individual lines or
# following the
machine name denoted by a '#' symbol.
#
#
# Address Host
name Alias
::1 localhost.cengage.com localhost
127.0.0.1 localhost.cengage.com localhost
69.32.133.79
www.cengage.com Web
69.32.134.163
ftp.cengage.com FTP
69.32.146.63
gale.cengage.com Gale
69.32.132.117
poweron.cengage.com TechSupport
|
On
a computer running UNIX or Linux, a host file is called hosts and is located in
the /etc directory. On a Windows computer, a host file is also called hosts
(with no file extension) and is located in the Windows\system32\drivers\etc
folder. A simple host file can satisfy the needs of a small organization;
however, it is not sufficient for large organizations, much less for the
Internet. Instead, an automated solution is mandatory.
DNS (Domain Name System)
In
the mid-1980s, computer scientists responsible for the Internet’s growth
devised a hierarchical way of associating domain names with IP addresses,
called the DNS
(Domain Name System or Domain Name Service). DNS refers to both the
Application layer service that accomplishes this association and also to the
organized system of computers and databases that makes this association
possible.
The DNS service does not rely on one file or even one server,
but rather on many computers across the globe. These computers are related in
a hierarchical manner, with 13 computers, known as root servers, acting as the
ultimate authorities. Because it is distributed, DNS will not fail
catastrophically if one or a handful of servers experience errors. To direct traffic
efficiently, the DNS service is divided into three components: resolvers, name servers,
and namespace. Resolvers are any hosts
on the Internet that need to look up domain name information. The
resolver client is built into TCP/IP applications such as HTTP. If you point
your Web browser to http://www.loc.gov, your HTTP client software initiates the
resolver service to find the IP address for www.loc.gov. If you have visited
the site before, the information may exist in a local DNS cache, a
database stored on your computer that indicates what IP address is associated
with the www.loc.gov host name. If the information is not stored locally, the
resolver service queries your machine’s designated name server to find the IP
address for www.loc.gov. Name servers,
or DNS servers, are servers that contain databases of associated names and IP
addresses and provide this information to resolvers on request. If one
name server cannot resolve the domain name to its IP address, it passes the
query to a higher-authority name server. For example, suppose you are trying to
open the www.loc.gov Web page from a workstation on your company’s network.
Further, suppose this is the first time you’ve visited the Library of Congress
online. Upon discovering it does not have the information saved locally, your
client’s resolver service queries the closest name server for the IP address
associated with www.loc.gov. That name server is probably connected to your
LAN. If your LAN’s name server cannot supply the IP address for www.loc.gov, it
queries a higher-level name server. In other words, your company’s name server
sends a request to the name server at the company’s Internet service provider (ISP).
If that name server does not have the information in its database, it queries a
name server elsewhere on the Internet that acts as the ISP’s naming authority.
This process, continues until the request is granted.
The term namespace refers to the database of Internet IP addresses and
their associated names.
Namespace is not a single file that you can open and view like a store’s
inventory database. Rather, it is an abstract concept that describes how the
name servers of the world share DNS information. You can think of DNS namespace
as a giant, distributed address book for every computer in the world. Just as
you might keep an address book of close friends and family on your computer,
but rely on a different source, such as an Internet lookup service, to find
contact information for people you don’t know, the DNS namespace does not store
every piece of information in one place. Instead, it relies on multiple sources
to resolve host names and IP addresses. The structure of the namespace reflects
DNS’s hierarchical nature. It is divided into DNS zones, or portions for which
one organization is assigned authority to manage. For example, network
administrators at the Library of Congress are responsible for managing the
namespace for all hosts in the loc.gov domain. If you obtained your own domain
name, you would be responsible for managing its namespace. A zone may consist
of only one domain. Higher-level zones, such as those associated with TLDs,
however, may contain several domains. For example, the .gov zone contains every
domain name that ends in .gov. Information about hosts in a DNS zone is
contained in a zone file. Each zone file contains resource records that
describe one piece of information in the DNS database.
In
the address book analogy, a zone file would be similar to the contact list you
keep on your computer (your zone) and a resource record would contain the phone
number, address, and e-mail address for one of your friends. By storing
resource records in its zone file, every name server holds a piece of the DNS
namespace. Resource records come in many different types, depending on their
function. For example, an address resource record is a type of resource record
that maps the IP address of an Internet connected device to its domain name.
Each record contains a name field to identify the domain name of the machine to
which the record refers, a type field to identify the type of resource record
involved, a class field to identify the class to which the record belongs
(usually “IN” or “Internet”), a Time to Live field to identify how long the
record should be saved in temporary memory, a data length field to identify how
much data the record contains, and the actual record data. Approximately 20
types of resource records are currently used. Table 4-8 lists the types of DNS
records you will encounter most often. In the following address resource
record, gmail.com is the host domain name, IN stands for the Internet record
class, A identifies the record type as “address,” and 74.125.225.22 is the host’s
IP address: gmail.com. IN A 74.125.225.22 At one time, network administrators
manually maintained resource records for their networks’ hosts. Now, however,
modern clients update their resource records dynamically.
Table 4-8: Common DNS
record types
|
Type
|
Name
|
Description
|
|
A
|
Address record
|
A host’s IPv4
address
|
|
AAAA
|
Address record
|
A host’s IPv6
address
|
|
CNAME
|
Canonical name
record
|
Another name for
the host
|
|
MX
|
Mail exchange
record
|
Identifies a mail
server
|
|
PTR
|
Pointer record
|
Points to a
canonical name
|
This
saves time and eliminates the possibility for human error in modifying DNS information.
Clients can be configured to trigger a DNS update when they receive a new IP
address (for example, through DHCP), when their host names change, or when they
connect to a network. Alternatively, a user can force a DNS record update by
issuing a command. For example, typing ipconfig
/registerdns at a Windows operating system command prompt while logged on
as an administrator forces an update of the client’s registered DNS information.
Configuring DNS
Any
host that must communicate with other hosts on the Internet needs to know how
to find its name server. Although small organizations might use only one name
server, most organizations rely on two name servers—a primary and a secondary name server—to help ensure Internet connectivity.
The secondary name server relies on the primary name server as its authority.
To ensure that records between the servers match, the secondary server
initiates a zone transfer, copying
the primary name server’s zone file to the secondary name server. If the primary
name server experiences a failure, devices on the network attempt to use the
secondary name server. Assuming the zone transfer was successful, the secondary
name server should operate just as the primary name server would, and clients
will not notice the difference. Each device on the network relies on the name
servers and, therefore, must know how to find them. On most networks, the DHCP
service automatically assigns clients the appropriate addresses for their
primary and secondary name servers.
However,
occasionally you might want to manually configure these values. For example,
specifying your preferred DNS server address when connecting to a public
network, such as a wireless network at a café, can protect your computer from attempts to assign a rogue DNS server—that
is, one operated by a hacker who could take advantage of your computer’s trust
to steal private information.
To
view or change the name server information on a Windows 7 workstation:
1.
Click the Start button, type ncpa.cpl in the Search programs and
files text box, and then press Enter.
The Network Connections window opens.
2.
Right-click the icon that represents
your network adapter, and click Properties
on the shortcut menu. A User Account Control dialog box may appear, asking if
you want to allow the following program to make changes. Click Yes to proceed. Your adapter’s Network
Connection Properties window appears.
3.
Under the “This connection uses the following items” heading, select Internet Protocol Version 4 (TCP/IPv4),
and then click Properties. The
Internet Protocol version 4 (TCP/IPv4) Properties dialog box opens.
4.
If you want to specify the DNS server your workstation relies on, rather than
allowing DHCP to supply the DNS server address, verify that the General tab is
still selected, and then click the Use
the following DNS server addresses button.
5.
Enter the IP address for your primary DNS server in the Preferred DNS server
space and the address for your secondary DNS server in the Alternate DNS server
space.
6.
Click OK, click Close to save your changes, and then close the Network Connections window.
DDNS (Dynamic DNS)
DNS
is a reliable way of locating a host as long as the host’s IP address remains
relatively constant over time—that is, if it’s static. However, many Internet
users subscribe to a type of Internet service in which their IP address changes
periodically. For a user who only wants to send and receive e-mail and surf the
Web, frequently changing IP addresses is not problematic. But for a user who
wants to host a Web site, for example, it can be. To maintain the association
between his Web site’s host or domain name and an IP address, such a user must
change his computer’s DNS record and propagate this change across the Internet
each time the IP address changes. When IP addresses change frequently, manually
changing DNS records becomes unmanageable. A solution is to use DDNS (Dynamic DNS). In DDNS, a
service provider runs a program on the user’s computer that notifies the
service provider when the user’s IP address changes. Upon notification, the
service provider’s server launches a routine that automatically updates the DNS
record for that user’s computer. The DNS record update becomes effective
throughout the Internet in a matter of minutes. Note that DDNS does not take
the place of DNS, but is an additional service, available for a small fee. DDNS
is a good option for home or small office users who maintain Web sites but do
not want to pay the additional (often high) cost of reserving a static IP
address.
However,
because of the slight delay in DNS record propagation caused each time an IP
address changes, larger organizations typically prefer to pay more for a
statically assigned IP address. Associating host and domain names with
computers on a TCP/IP-based network is performed by the Application layer
protocol DNS. The following section describes other important Application layer
protocols.
Application Layer Protocols
In
addition to the core Transport and Internet layer protocols, the TCP/IP suite encompasses
several Application layer protocols. These protocols work over TCP or UDP plus
IP, translating user requests into a format the network can read. In Chapter 2,
you learned about an Application layer protocol central to using the Web, HTTP.
And earlier in this chapter, you learned about an Application layer protocol
used for automatic address assignment, DHCP. The following sections describe
some additional Application layer protocols. Throughout this book, and
especially in Chapter 9, you’ll encounter even more TCP/IP Application layer protocols.
Telnet
Telnet is a terminal emulation protocol used to log on to
remote hosts using the TCP/IP protocol suite. Using Telnet, a TCP
connection is established via port 23 and keystrokes on the user’s machine act
like keystrokes on the remotely connected machine. Often, Telnet is used to connect two dissimilar systems, such as PCs
and UNIX machines. Through Telnet, you can control a remote host over a
network. For example, network managers can use Telnet to log on to a router
from a computer elsewhere on their LAN and modify the router’s configuration. Telnet, however, is notoriously insecure
(meaning that someone with malicious intent could easily falsify the
credentials Telnet requires to log on to a device successfully), so
telnetting to a router across a public network would not be wise. Other, more
secure methods of remotely connecting to a host have replaced Telnet for that
reason. A popular alternative, known as SSH, is described in Chapter 11, which
focuses on security.
FTP (File Transfer Protocol)
FTP (File Transfer Protocol) is an Application layer
protocol used to send and receive files via TCP/IP using ports 20 and 21. In FTP exchanges, a host
running the FTP server portion accepts commands from another host running the
FTP client portion. FTP clients come with a set of simple commands that make up
their user interfaces. To exchange data, the client depends on an FTP server
that is always waiting for requests. After a client connects to the FTP server,
FTP data are exchanged via TCP, which means that FTP provides some assurance of
delivery.
FTP
commands will work from your operating system’s command prompt; they do not require
special client software. As a network professional, you may need to use these
commands to download software (such as NOS patches or client updates) from
hosts. For example, if you need the latest version of the Fedora Linux
distribution, you can use FTP from your workstation’s command prompt to
download the compressed software from a Fedora authorized FTP server to your
hard disk. To do so, you can start the FTP utility by typing ftp from your
operating system command (or shell) prompt.
The
command prompt turns into the FTP prompt, FTP>. From there, you can run FTP
commands. Alternatively, if you know what operation you want to perform, you
can connect directly to an FTP server. For example to connect directly to the
Fedora FTP server at Boston University (one of several that provides the
software via FTP), type ftp fedora.bu.edu, and then press Enter. If the host is
running, it responds with a greeting and a request for you to log on. Many FTP
hosts, especially those whose purpose is to provide software updates accept anonymous
logons. This means that when prompted for a username, you need only type the word
anonymous (in lowercase letters) and press Enter. When prompted for a password
on an anonymous FTP site, you can typically use your e-mail address. The host’s
logon screen should indicate whether this is acceptable. On the other hand, if
you are logging on to a private FTP site, you must obtain a valid username and
password from the site’s network administrator to make a successful connection.
After you have successfully connected to a host, additional commands allow you
to manage the connection and manipulate files. To view a list of the variables
you can use with FTP, type ftp help and press Enter.
Graphical
FTP clients, such as WS_FTP, CuteFTP, and FileZilla, have rendered the command-line
method of FTPing files less common. In many cases, you can also accomplish FTP
file transfers directly from a modern Web browser. To do this, you need only
point your browser to the FTP host. From there, you can move through
directories and exchange files just as you would navigate the files and
directories on your desktop or LAN server. As with Telnet, a more secure
version of the FTP protocol has been developed. This protocol, known as SFTP,
is discussed in Chapter 11.
FTP and Telnet share some similarities, including
their reliance on TCP and their ability to log on to a remote host and perform commands
on that host. However, they differ in that, when you use Telnet, the commands
you type require a syntax that is relative to your local workstation. When you
use FTP, the commands you type require a syntax that is relative to the remote
host to which you have logged on. Also, Telnet has no built-in commands for
transferring files between the remote host and your workstation.
TFTP (Trivial File Transfer Protocol)
TFTP (Trivial File Transfer Protocol) is another TCP/IP
Application layer protocol that enables file transfers between computers, but
it is simpler (or more trivial) than FTP. TFTP communicates via port 69. A significant
difference between FTP and TFTP is that TFTP relies on UDP at the Transport
layer. Its use of UDP means that TFTP is connectionless and does not guarantee
reliable delivery of data. Also, TFTP does not require users to log on to the remote
host with an ID and password in order to gain access to a directory and transfer
files. Instead, when you enter the
TFTP command, your computer issues a simple request to access the host’s files.
The remote host responds with an acknowledgment, and then the two computers begin
transferring data. Each time a packet of data is transmitted to the host, the local
workstation waits for an acknowledgment from the host before issuing another
packet. In this way, TFTP overcomes some of the limitations of relying on a
connectionless Transport layer protocol. A final difference between FTP and
TFTP is that the latter does not allow directory browsing. In FTP, you can
connect to a host and navigate through all the directories you’ve been granted
access to view.
TFTP
is useful when you need to load data or programs on a computer that lacks a hard
drive—that is, on a diskless workstation. For example, suppose a TFTP server
holds Microsoft Excel. When a client issues a TFTP request for that program,
the server would transmit the program files to the workstation’s memory. After
the user completes his Excel work, the program files would be released from his
workstation’s memory. In this situation, the fact that TFTP does not require a
user to log on to a host is an advantage. It makes the transfer of program
files quick and easy. As you can imagine, however, not requiring a logon also presents
a security risk, so TFTP servers must be carefully placed and monitored on a network.
NTP (Network Time Protocol)
NTP (Network Time Protocol) is a simple but important
Application layer protocol used to synchronize the clocks of computers on a
network.
NTP communicates via port 123 and depends on UDP for Transport layer services.
Time is critical in routing to determine the most efficient path for data over
a network. Time synchronization across a network is also important for
time-stamped security methods and maintaining accuracy and consistency between
multiple storage systems. NTP is a protocol that benefits from UDP’s quick,
connectionless nature at the Transport layer. NTP is time sensitive and cannot
wait for the error checking that TCP would require.
PING (Packet Internet Groper)
PING (Packet Internet Groper) is a utility that can
verify that TCP/IP is installed, bound to the NIC, configured correctly, and
communicating with the network. It is often employed simply to determine whether a
host is responding (or “up”). PING uses ICMP services to send echo request and
echo reply messages that determine the validity of an IP address. These two
types of messages work in much the same way that sonar operates. First, a
signal, called an echo request, is sent out to another computer. The other
computer then rebroadcasts the signal, in the form of an echo reply, to the
sender. The process of sending this signal back and forth is known as pinging. You
can ping either an IP address or a host name. For example, to determine whether
the www.loc.gov site is responding, you could type ping www.loc.gov and press
Enter. Alternately, you could type ping 140.147.249.7 (the IP address of this
site at the time this book was written) and press Enter. If the site is
operating correctly, you receive a response that includes multiple replies from
that host. If the site is not operating correctly, you will receive a response
indicating that the request timed out or that the host was not found. You could
also receive a “request timed out” message if your workstation is not properly
connected to the network, or if the network is malfunctioning. Your ping test
might also be unsuccessful if the organization whose host you tried to contact
prevents its network devices from accepting or responding to PING commands for
security reasons. By pinging the loopback address, 127.0.0.1, you can determine
whether your workstation’s TCP/IP services are running. By pinging a host on
another subnet, you can determine whether the problem lies with a connectivity
device between the two subnets. For example, suppose that you have recently
moved your computer from the Accounting Department to the Advertising
Department, and now you cannot access the Web. The first test you should
perform is pinging the loopback address. If that test is successful, then you know
that your workstation’s TCP/IP services are running correctly.
Next,
you might try pinging your neighbor’s machine. If you receive a positive response,
you know that your network connection is working. You should then try pinging a
machine on another subnet that you know is connected to the network—for
example, a computer in the IT Department. If this test is unsuccessful, it is
possible that you do not have the correct settings in your TCP/IP configuration
or that something is wrong with your network’s connectivity (for example, a router
may be malfunctioning). As with other TCP/IP commands, PING can be used with a
number of different options, or switches, and the syntax of the command may
vary depending on the operating system. But a ping command always begins with
the word ping followed by a hyphen (-) and a switch, followed by a variable
pertaining to that switch.
The following are some
useful PING switches:
-?—Displays the help text for the
ping command, including its syntax and a full list of switches.
-a—When used with an IP address,
resolves the address to a host name.
-n—Allows you to specify a number
of echo requests to send. For example, if you want to ping the Library of
Congress site with only two echo requests (rather than the standard four that a
Windows operating system uses), you could type the following command:
ping -n 2 www.loc.gov.
-r—When used with a number from 1
to 9, displays the route taken during ping hops.
To
view the proper syntax and a list of switches available for PING, type ping at
the command prompt on a Windows-based computer or at the shell prompt on a UNIX
or Linux system. The PING utility as described previously works with networks
running IPv4. On IPv6 networks, you must use a different version of the command
that operates similarly. On Linux computers running IPv6, the ping6 utility
will issue ICMP packets to determine whether a host is available.
For
Windows computers, the command is ping -6 followed by the host or IP address.
If the destination host does not run IPv6, however, your attempt will be
unsuccessful. For example, typing ping -6 ipv6.google.com and pressing Enter at
the command prompt on a Windows computer running IPv6 would result in the reply
in a successful ping. Typing ping -6 www.google.com, a host not running IPv6, would
result in an error message.
Chapter Summary
■
Protocols define the standards for communication between nodes on a network.
The term protocol can refer to a group, or suite, of individual protocols that
work together to accomplish data translation, data handling, error checking,
and addressing.
■
Protocols vary by transmission efficiency, utilization of resources, ease of
setup, compatibility, and ability to travel between one LAN segment and
another. Protocols that can span more than one LAN are routable, which means
they carry Network layer addressing information that can be interpreted by a
router.
■ TCP/IP
is the most popular protocol suite because of its low cost, open nature,
ability to communicate between dissimilar platforms, and the fact that it is
routable. It is a defacto standard on the Internet and is the protocol of
choice on LANs.
■
The TCP/IP model is a practical way of categorizing protocols and services used
on a TCP/IP network. Its Application layer roughly translates to the
Application, Presentation, and Session layers of the OSI model. Its Transport
layer is equivalent to the OSI model’s Transport layer. Its Internet layer is
analogous to the OSI model’s Network layer. Its Network Interface layer, or
Link layer, roughly equals the OSI model’s Data Link and Physical layers.
■
TCP (Transmission Control Protocol) belongs to the Transport layer of the
TCP/IP and OSI models. TCP is a connection-oriented subprotocol; it requires a
connection to be established between communicating nodes before it will
transmit data. TCP provides reliability through checksum, flow control, and
sequencing information.
■
UDP (User Datagram Protocol), like TCP, is a Transport layer protocol. UDP is a
connectionless service and offers no delivery guarantees. But UDP is more
efficient than TCP and useful in applications that require fast data
transmission, such as videoconferencing.
■
IP (Internet Protocol) belongs to the Internet layer of the TCP/IP model and
the Network layer of the OSI model. It provides information about how and where
data should be delivered.
■
ARP (Address Resolution Protocol) belongs to the Internet layer of the TCP/IP
model and the Network layer of the OSI model. It obtains the MAC (physical)
address of a host, or node, and then creates a local database that maps the MAC
address to the host’s IP (logical) address.
■
In IPv4, each IP address is a unique 32-bit number, divided into four octets
(or bytes). Every IP address contains two types of information: network and
host.
■
In traditional IPv4 addressing, all nodes on a Class A network share the first
octet of their IP numbers, a number between 1 and 126. Nodes on a Class B
network share the first two octets, and all their IP addresses begin with a
number between 128 and 191. Class C network IP numbers share the first three
octets, with their first octet being a number between 192 and 223.
■ Although
computers read IPv4 addresses in binary form, humans usually read them in dotted
decimal notation, in which a decimal number represents each octet and every number
is separated by a period.
■ A
subnet mask is a 32-bit number that indicates whether and how a network has
been subnetted—that is, subdivided into multiple smaller networks—and indicates
the difference between network and host information in an IPv4 address.
Subnetting is implemented to more easily manage network traffic and conserve a
limited number of IPv4 addresses.
■
IPv6 (IP version 6) is the latest version of IP. Its addresses are composed of
eight 16-bit fields and total 128 bits. The larger address size results in an
additional 2 available IP addresses compared with the earlier version, IPv4.
IPv6 provides several other benefits over IPv4, including a more efficient
header, better overall security, better prioritization allowances, and
automatic IP address configuration.
■
IP addresses assigned manually are called static IP addresses; however, using
static IP addresses allows for the possibility of assigning the same address to
more than one device.
■
Dynamic IP address assignment can be achieved using DHCP (Dynamic Host Configuration
Protocol). DHCP essentially eliminates duplicate-addressing problems.
■
The IPv4 addresses in the ranges 10.0.0.0 through 10.255.255.255, 172.16.0.0 through
172.31.255.255, and 192.168.0.0 through 192.168.255.255 are reserved for private
addresses, or those used only within an organization’s network. These addresses
cannot be used to identify hosts on the Internet.
■ A
link-local address is a special kind of private address automatically assigned
by an operating system to allow a node to communicate over its local subnet if
a routable IP address is not available. ICANN has established the range of
169.254.0.0 through 169.254.254.255 as potential link-local IPv4 addresses.
IPv6 link-local addresses begin with FE80. Zeroconf is a collection of
protocols that manages link-local addressing.
■ A
socket is a logical address assigned to a specific process running on a host.
It forms a virtual circuit between the processes on two networked hosts. The
socket’s address represents a combination of the host’s IP address and the port
number associated with a process.
■
Every host is identified by a host name and belongs to a domain. A domain is a
group of hosts that share a domain name and have part of their IP addresses in
common.
■
Every domain is identified by its domain name. Usually, a domain name is
associated with a company or other type of organization, such as a university
or military unit. Domain names must be reserved with an ICANN-approved domain
registrar.
■
DNS (Domain Name System or Domain Name Service) is a hierarchical way of tracking
domain names and their addresses. The DNS database does not rely on one file or
even one server, but rather is distributed over several key computers across
the Internet to prevent catastrophic failure if one or a few computers go down.
■
Name servers or DNS servers contain databases of names and their associated IP addresses.
If one name server cannot resolve the IP address, the query passes to a higher-level
name server. Each name server manages a group of machines called a zone. DNS
relies on the hierarchical zones and zone files to distribute naming information.
■
Some key TCP/IP Application layer protocols include Telnet (for logging on to
hosts), FTP and TFTP (for transferring files between hosts), NTP (for
synchronizing time between hosts), and PING (for sending echo requests and echo
replies that can indicate whether a host is responding).
Key Terms
Address Resolution Protocol
See ARP.
address resource record
A type of DNS data record that maps
the IP address of an Internet-connected device to its domain name.
alias
A nickname for a node's host name.
Aliases can be specified in a local host file.
anycast address
A type of address specified in IPv6
that represents a group of interfaces, any one of which (and usually the first
available of which) can accept a transmission. At this time, anycast addresses
are not designed to be assigned to hosts, such as servers or workstations, but
rather to routers.
APIPA (Automatic Private IP
Addressing)
A service available on computers
running one of the Windows operating systems that automatically assigns the
computer's network interface a link-local IP address.
ARP (Address Resolution Protocol)
A core protocol in the TCP/IP suite
that belongs in the Network layer of the OSI model. ARP obtains the MAC
(physical) address of a host, or node, and then creates a local database that
maps the MAC address to the host's IP (logical) address.
ARP cache
See ARP table.
ARP table
A database of records that maps MAC
addresses to IP addresses. The ARP table is stored on a computer's hard disk
where it is used by the ARP utility to supply the MAC addresses of network
nodes, given their IP addresses.
Automatic Private IP Addressing
See APIPA.
Avahi
A version of Zeroconf available for
use with the Linux operating system.
Bonjour
Apple's implementation of the
Zeroconf group of protocols.
country code TLD
A top-level domain that corresponds
to a country. For example, the country code TLD for Canada is .ca, and the
country code TLD for Japan is .jp.
datagram
See data packet.
DDNS (Dynamic DNS)
A method of dynamically updating DNS
records for a host. DDNS client computers are configured to notify a service
provider when their IP addresses change, then the service provider propagates
the DNS record change across the Internet automatically.
DHCP (Dynamic Host Configuration
Protocol)
An Application layer protocol in the
TCP/IP suite that manages the dynamic distribution of IP addresses on a
network. Using DHCP to assign IP addresses can nearly eliminate
duplicate-addressing problems.
DHCP scope
The predefined range of addresses
that can be leased to any network device on a particular segment.
DHCP server
A server that manages IP address
assignment, maintaining information about which addresses are allowable, which
are available, and which have already been associated with a host.
DHCPv4
The version of DHCP used with IPv4.
DHCPv4 uses port number 67 for clientto- server communications and port number
68 for server-to-client communications.
DHCPv6
The version of DHCP used with IPv6.
DHCPv6 uses port number 546 for clientto- server communications and port number
547 for server-to-client communications.
diskless workstation
A workstation that doesn't contain a
hard disk, but instead relies on a small amount of read-only memory to connect
to a network and to pick up its system files.
DNS (Domain Name System or Domain
Name Service)
A hierarchical way of tracking
domain names and their addresses, devised in the mid-1980s. The DNS database
does not rely on one file or even one server, but rather is distributed over
several key computers across the Internet to prevent catastrophic failure if
one or a few computers go down. DNS is a TCP/IP service that belongs to the
Application layer of the OSI model.
DNS cache
A database on a computer that stores
information about IP addresses and their associated host names. DNS caches can
exist on clients as well as on name servers.
DNS server
See name server.
DNS zone
A portion of the DNS namespace for
which one organization is assigned authority to manage.
domain
A group of computers that belong to
the same organization and have part of their IP addresses in common.
domain name
The symbolic name that identifies a
domain. Usually, a domain name is associated with a company or other type of
organization, such as a university or military unit.
Domain Name Service
See DNS or Domain Name System.
Domain Name System
See DNS or Domain Name Service.
dotted decimal notation
The shorthand convention used to
represent IPv4 addresses and make them more easily readable by humans. In
dotted decimal notation, a decimal number between 0 and 255 represents each
binary octet. A period, or dot, separates each decimal.
dual-stack
A type of network that supports both
IPv4 and IPv6 traffic.
dynamic ARP table entry
A record in an ARP table that is
created when a client makes an ARP request that cannot be satisfied by data
already in the ARP table.
Dynamic DNS
See DDNS.
Dynamic Host Configuration Protocol
See DHCP.
Dynamic Host Configuration Protocol
version 4
See DHCPv4.
Dynamic Host Configuration Protocol
version 6
See DHCPv6.
dynamic IP address
An IP address that is assigned to a
device upon request and may change when the DHCP lease expires or is terminated.
BOOTP and DHCP are two ways of assigning dynamic IP addresses.
Dynamic Ports
TCP/IP ports in the range of 49,152
through 65,535, which are open for use without requiring administrative
privileges on a host or approval from IANA.
echo reply
The response signal sent by a device
after another device pings it.
echo request
The request for a response generated
when one device pings another device.
File Transfer Protocol
See FTP.
flow
A sequence of packets issued from
one source to one or many destinations. Routers interpret flow information to
ensure that packets belonging to the same transmission arrive together. Flow
information may also help with traffic prioritization.
Format Prefix
A variable-length field at the
beginning of an IPv6 address that indicates what type of address it is (for
example, unicast, anycast, or multicast).
FQDN (fully qualified domain name)
A host name plus domain name that
uniquely identifies a computer or location on a network.
FTP (File Transfer Protocol)
An Application layer protocol used
to send and receive files via TCP/IP.
fully qualified domain name
See FQDN or fully qualified host
name.
fully qualified host name
See FQDN or fully qualified domain
name.
hop
A term used to describe each trip a
unit of data takes from one connectivity device to another. Typically, hop is
used in the context of router-to-router communications.
hop limit
See TTL
host file
A text file that associates TCP/IP
host names with IP addresses.
host name
A symbolic name that describes a
TCP/IP device.
hosts
The name of the host file used on
UNIX, Linux, and Windows systems. On a UNIXor Linux-based computer, hosts is
found in the /etc directory. On a Windows-based computer, it is found in the
%systemroot%system32driversetc folder.
ICMP (Internet Control Message
Protocol)
A core protocol in the TCP/IP suite
that notifies the sender that something has gone wrong in the transmission
process and that packets were not delivered.
ICMPv6
The version of ICMP used with IPv6
networks. ICMPv6 performs the functions that ICMP, IGMP, and ARP perform in
IPv4. It detects and reports data transmission errors, discovers other nodes on
a network, and manages multicasting.
ifconfig
A TCP/IP configuration and
management utility used with UNIX and Linux systems.
IGMP (Internet Group Management
Protocol or Internet Group Multicast Protocol)
A TCP/IP protocol used on IPv4
networks to manage multicast transmissions. Routers use IGMP to determine which
nodes belong to a multicast group, and nodes use IGMP to join or leave a
multicast group.
Internet Control Message Protocol
See ICMP.
Internet Control Message Protocol
version 6
See ICMPv6.
Internet Group Management Protocol
See IGMP or Internet Group Multicast
Protocol.
Internet Group Multicast Protocol
See IGMP or Internet Group
Management Protocol.
internetwork
To traverse more than one LAN
segment and more than one type of network through a router.
IP datagram
See IP packet.
IP next generation
See IPv6.
IP packet
The IP portion of a TCP/IP frame
that acts as an envelope for data, holding information necessary for routers to
transfer data between subnets.
IP version 4 Link Local
See IPv4LL.
ipconfig
The utility used to display TCP/IP
addressing and domain name information in the Windows client operating systems.
Ipng
See IPv6.
IPv4
IP version 4, the Internet Protocol
standard released in the 1980s and still commonly used on modern networks. It
specifies 32-bit addresses composed of four octets. It lacks the security,
automatic addressing, and prioritization benefits of IPv6. It also suffers from
a limited number of addresses, a problem that can be resolved by using IPv6
instead.
IPv4LL (IP version 4 Link Local)
A protocol that manages automatic
address assignment among locally connected nodes. IPv4LL is part of the
Zeroconf group of protocols.
IPv6 (IP version 6)
A newer standard for IP addressing
that is gradually replacing the current IPv4 (IP version 4). Most notably, IPv6
uses a newer, more efficient header in its packets and allows for 128-bit
source and destination IP addresses. The use of longer Key Terms 183 addresses
will allow for many more IP addresses to be in circulation. IPv6 also provides
automatic addressing, better security, and prioritization features.
label
A character string that represents a
domain (either top-level, second-level, or third-level).
lease
The agreement between a DHCP server
and client on how long the client can use a DHCP-assigned IP address. DHCP
services can be configured to provide lease terms equal to any amount of time.
link-local address
An IP address that is automatically
assigned by an operating system to allow a node to communicate over its local
subnet if a routable IP address is not available. ICANN has established the
range of 169.254.0.0 through 169.254.254.255 as potential link-local IPv4
addresses. IPv6 link-local addresses begin with FE80.
loopback address
An IP address reserved for
communicating from a node to itself (used mostly for troubleshooting purposes).
The IPv4 loopback address is always cited as 127.0.0.1, although in fact,
transmitting to any IP address whose first octet is 127 will contact the
originating device. In IPv6, the loopback address is represented as ::1.
loopback test
An attempt to contact one's own
machine for troubleshooting purposes. In TCP/IP-based networking, a loopback
test can be performed by communicating with an IPv4 address that begins with an
octet of 127. Usually, this means pinging the address 127.0.0.1.
mask
See subnet mask or net mask.
multicast address
A type of address in the IPv6 that
represents multiple interfaces, often on multiple nodes. An IPv6 multicast
address begins with the following hexadecimal field: FF0x, where x is a
character that identifies the address's group scope.
multicasting
A means of transmission in which one
device sends data to a specific group of devices (not necessarily the entire
network segment) in a point-to-multipoint fashion.
name server
A server that contains a database of
TCP/IP host names and their associated IP addresses. A name server supplies a
resolver with the requested information. If it cannot resolve the IP address,
the query passes to a higher-level name server.
namespace
The database of Internet IP
addresses and their associated names distributed over DNS name servers
worldwide.
net mask
See subnet mask or mask.
network class
A classification for TCP/IP-based
networks that pertains to the network's potential size and is indicated by an
IP address's network ID and subnet mask. Network Classes A, B, and C are
commonly used by clients on LANs; network Classes D and E are reserved for
special purposes.
network ID
The portion of an IP address common
to all nodes on the same network or subnet.
Network Time Protocol
See NTP.
NTP (Network Time Protocol)
A simple Application layer protocol
in the TCP/IP suite used to synchronize the clocks of computers on a network.
NTP depends on UDP for Transport layer services.
octet
One of the 4 bytes that are
separated by periods and together make up an IPv4 address.
Packet Internet Groper
See PING.
ping
To send an echo request signal from
one node on a TCP/IP-based network to another, using the PING utility. See also
PING.
PING (Packet Internet Groper)
A TCP/IP troubleshooting utility
that can verify that TCP/IP is installed, bound to the NIC, configured
correctly, and communicating with the network. PING uses ICMP to send echo
request and echo reply messages that determine the validity of an IP address.
ping6
The version of the PING utility used
on Linux computers that run IPv6.
port number
The address on a host where an
application makes itself available to incoming data.
private address
An IP address used only on an
organization's internal network. Certain IP address ranges are reserved for
private addresses. Private addresses cannot be used to communicate over the
Internet.
Private Port
See Dynamic Ports.
public address
An IP address that is valid for use
on public networks, such as the Internet. An organization assigns its hosts
public addresses from the range of addresses assigned to it by Internet
numbering authorities.
Registered Ports
The TCP/IP ports in the range of
1024 to 49,151. These ports are accessible to network users and processes that
do not have special administrative privileges. Default assignments of these
ports must be registered with IANA.
resolver
Any host on the Internet that needs
to look up domain name information.
resource record
The element of a DNS database stored
on a name server that contains information about TCP/IP host names and their
addresses.
root server
A DNS server maintained by ICANN and
IANA that is an authority on how to contact the top-level domains, such as
those ending with .com, .edu, .net, .us, and so on. ICANN oversees the
operation of 13 root servers around the world.
routable
The protocols that can span more
than one LAN because they carry Network layer and addressing information that
can be interpreted by a router.
socket
A logical address assigned to a
specific process running on a computer. Some sockets are reserved for operating
system functions.
static ARP table entry
A record in an ARP table that
someone has manually entered using the ARP utility. Static ARP table entries
remain the same until someone manually modifies them with the ARP utility.
static IP address
An IP address that is manually
assigned to a device and remains constant until it is manually changed.
subnet
A part of a network in which all
nodes shares a network addressing component and a fixed amount of bandwidth.
subnet mask
In IPv4 addressing, a 32-bit number
that, when combined with a device's IP address, indicates what kind of subnet
the device belongs to.
subnetting
The process of subdividing a single
class of network into multiple, smaller networks.
subprotocols
The specialized protocols that work
together and belong to a protocol suite.
switch
The letters or words added to a
command that allow you to customize a utility's output. Switches are usually
preceded by a hyphen or forward slash character.
TCP (Transmission Control Protocol)
A core protocol of the TCP/IP suite.
TCP belongs to the Transport layer and provides reliable data delivery
services.
TCP/IP (Transmission Control
Protocol/Internet Protocol)
A suite of networking protocols that
includes TCP, IP, UDP, and many others. TCP/IP provides the foundation for data
exchange across the Internet.
TCP/IP core protocols
The major subprotocols of the TCP/IP
suite, including IP, TCP, and UDP.
Telnet
A terminal emulation protocol used
to log on to remote hosts using the TCP/IP protocol. Telnet resides in the
Application layer of the OSI model.
TFTP (Trivial File Transfer
Protocol)
A TCP/IP Application layer protocol
that enables file transfers between computers. Unlike FTP, TFTP relies on UDP
at the Transport layer and does not require a user to log on to the remote
host.
Time to Live
See TTL.
TLD (top-level domain)
The highest-level category used to
distinguish domain names-for example, .org, .com, and .net. A TLD is also known
as the domain suffix.
top-level domain
See TLD.
Transmission Control Protocol
See TCP.
Transmission Control
Protocol/Internet Protocol
See TCP/IP.
Trivial File Transfer Protocol
See TFTP.
TTL (Time to Live)
A number that indicates the maximum
duration that a packet can remain on the network before it is discarded.
Although this field was originally meant to represent units of time, on modern
networks it represents the number of router hops a datagram has endured. The
TTL for datagrams is variable and configurable, but is usually set at 32 or 64.
Each time a datagram passes through a router, its TTL is reduced by 1.When a
router receives a datagram with a TTL equal to 1, the router discards that
datagram.
UDP (User Datagram Protocol)
A core protocol in the TCP/IP suite
that sits in the Transport layer of the OSI model. UDP is a connectionless
transport service.
unicast address
A type of IPv6 address that
represents a single interface on a device.
User Datagram Protocol
See UDP.
Well Known Ports
The TCP/IP port numbers 0 to 1023,
so named because they were long ago assigned by Internet authorities to popular
services (for example, FTP and Telnet), and are, therefore, well known and
frequently used.
Zero configuration
See Zeroconf.
Zeroconf (Zero configuration)
A collection of protocols that
assigns link-local addresses, performs DNS functions, and discovers services,
such as print services, available to the node.
zone file
A text file associated with a DNS
zone that contains resource records identifying domains and their IP addresses.
zone transfer
In DNS, the act of copying a primary
name server's zone file to the secondary name server to ensure that both
contain the same information.
Review Questions
1. Which
of the following occurs at
the
Network Access
layer of the TCP/IP model?
a. Routing
b. Address translation
c. Password authentication
d. Signaling
2. What field
in an IPv4 packet can
be
used to indicate that
a packet should be routed before any other
packets?
a. Flags field
b. Identification
field
c. Differentiated Services field
d. Fragment offset
field
3. What happens to
an
IPv6 packet
when
its
hop limit reaches
0?
a. It is retransmitted
by
the connectivity device
that last received
it.
b. It is
bounced back to its source node.
c. It is discarded.
d. It is
assigned a new hop
limit.
4. Before you
connect to your office network, you want to
verify that your workstation’s
TCP/IPv6
protocols are functioning. Which
of the following addresses do you ping?
a. ::1
b. FE08::0
c. 0::0
d. 1::1
5. What is
the function of ARP?
a. To acknowledge that a
data frame
was
received
b. To
obtain the IP address of a host,
then map that IP address
to a
registered domain name
c. To measure the number of
dropped packets
in a
single transmission
d. To obtain the MAC address of
a host, and then map that MAC address to
the
host's IP address
6. Which
of the following applications would
be best suited
to multicasting?
a. Sending e-mail to your coworker
b. Participating
in a company-wide video
conference via
the Internet
c. Updating an
inventory database
d. Logging on
to a host over the Internet
7. Suppose you
have a workstation
that uses
the IP address
203.12.176.55 on a traditional IPv4 network. To
what
network class does
the workstation belong?
a. A
b. B
c. C
d. D
8. How
many bytes are used for
an IPv4 address?
a. 4
b. 16
c. 31
d. 64
9. Suppose your computer's IP address
is 155.61.9.188, and your
network administrator
has not subnetted the network
to which you're connected.
What
is your
computer's subnet
mask?
a. 255.0.0.0
b. 255.255.0.0
c. 255.255.255.0
d. 255.255.255.255
10. Suppose you send
data
to the 11111111 11111111 11111111 11111111 IP address on an IPv4 network.
To what device(s) are you transmitting?
a. Your own device
b. All
devices that are reachable
c. All devices on your network segment
d. Your domain name
server
11. Suppose you send
data
to an
address that
begins
with the Format Prefix FF0E
on a network running IPv6. To
what device(s) are you transmitting?
a. All devices on your network segment
b. All devices that are reachable
c. Your own device
d. Your domain name
server
12. If you
are connected to a
network that uses
DHCP, and you
need
to terminate your Windows
workstation's DHCP lease, which
of the following commands
would
you use?
a. ipconfig /term
b. ipconfig /exit
c. ipconfig /release
d. ipconfig
/stop
13. At a minimum,
what fields would you find in a hosts file?
a. IP address and MAC
address
b. IP address and host name
c. IP address and subnet mask
d. Host name
and MAC address
14. What devices
are the highest authorities in the domain
name system
hierarchy?
a. Root servers
b. Top-level domain routers
c. IANA-operated
gateways
d. Authoritative hosts
15. Which of
the following DNS records identifies a mail
server?
a. mail1 IN A 178.99.201.12
b. mailserver
IN AAAA 178.99.201.12
c. mail1 IN MX 178.99.201.12
d. mailserver
IN PTR 178.99.201.12
16. On a client/server
network running TCP/IPv4, what computer initiates
the process of assigning an IP address
through DHCP?
a. The DHCP server
b. The gateway
c. The client's primary authentication
server
d. The client
17. You
issue a transmission from your workstation
to the following socket
address
on your LAN:
10.1.1.145:110. Assuming your
network uses standard
port designations, what
Application layer
protocol are you
using?
a. FTP
b. POP
c. Telnet
d. HTTP
18. You
are
the network manager for a computer
training center that allows
clients
to bring their own laptops
to class for learning and
taking notes. Clients
need access
to the Internet, so you
have configured your
network's DHCP server to issue them IP addresses automatically. What
DHCP option should you
modify to make sure you are not wasting addresses that were used
by
clients who have completed a class and no longer need
them?
a. The number
of available addresses in the DHCP pool
b. The subnet
mask
for client computers, to isolate their
group of IP addresses
c. The priority with
which DHCP address
requests are handled
by
the server
d. The lease duration for client
computers
19. Which of the following IP addresses might have been
assigned
by
APIPA?
a. 169.180.23.5
b. 255.254.254.0
c. 192.285.128.3
d. 255.127.0.0
20. You have just set up a new
wireless
network in your
house, and you
want
to determine whether your Linux laptop has
connected to it
and obtained a valid IP address. Which
of the following commands will allow you to find the information you need?
a. ifconfig /all
b. ifconfig -a
c. ifconfig -n
d. ifconfig /net
Sample Quiz
1. The TCP/IP model described how protocols
work even before the protocols were widely in use.
a. True
b.
False
2. A(n) ________ is associated with a company
or other type of organization, such as a university, government organization,
or company.
a.
domain name
b. network address
c. host name
d. unicast address
3. What protocol provides an automated means
of assigning a unique IP address to devices on a network?
a. Internet Control Message Protocol (ICMP)
b. Automatic Private IP Addressing (AIPA)
c. Domain Name System (DNS)
d.
Dynamic Host Configuration Protocol (DHCP)
4. What protocol allows a user to log on to
remote hosts using the TCP/IP protocol suite?
a. File Transfer Protocol (FTP)
b.
Telnet
c. Network Time Protocol (NTP)
d. Packet Internet Groper (PING)
5. TCP/IP is a suite of specialized
protocols.
a.
True
b. False
6. ________ is the process of subdividing a
single class of networks into multiple, smaller logical networks, or segments.
a. Multiplexing
b. Segmenting
c. Masking
d.
Subnetting
7. How does TCP provide reliable data
delivery?
a. TCP uses flow control.
b. TCP uses loopback addressing.
c. TCP
uses sequencing and checksums.
d. TCP uses a connectionless transport
service.
8. A process's port number plus its host
machine's IP address equals the process's socket.
a.
True
b. False
9. The ________ subprotocol allows TCP/IP to
internetwork.
a. Transmission Control Protocol (TCP)
b. User Data Protocol (UDP)
c. Internet Control Message Protocol (ICMP)
d.
Internet Protocol (IP)
10. The ________ subprotocol reports on the
success or failure of data delivery.
a. Address Resolution Protocol (ARP)
b.
Internet Group Management Protocol (IGMP)
c. User Data Protocol (UDP)
d. Internet Control Message Protocol (ICMP)
11. IPv4 guarantees delivery of data.
a. True
b.
False
12. In IPv6, the loopback address has a value
of ________ .
a. 127.0.0.1
b. 0:0:0:1
c. 0:0:0:0:0:0:0:127
d. ::1
13. Every device on the Internet is
technically known as a host.
a.
True
b. False
14. Which statement is true with regard to
IPv4 and IPv6?
a. IPv4 offers better prioritization
provisions than IPv6.
b.
IPv6 offers billions of additional IP addresses over IPv4.
c. IPv6 has a much lower cost of
implementation than IPv4.
d. IPv4 offers better security than IPv6.
15. What TCP/IP and OSI model layer includes
TCP?
a. Data Link
b. Application
c. Network Access
d.
Transport
Practice Quiz
1. All
protocols are routable.
a.
True
b.
False
2. Dynamic ARP table entries are those that
someone has entered manually using the ARP utility.
a.
True
b.
False
3. ____ Ports are in the range of 1024 to 49151.
Registered
4. The
FTP command ____ transfers a file from the host machine to the client.
TFTP
5. ____ is the precursor to today's Internet.
a.
DNS
b.
BOOTP
c.
ARPANET
d.
DHCP
6. TCP/IP
is a ____ of protocols.
a.
series
b.
set
c.
selection
d.
suite
7. Which
IPv6 address type represents a single interface on a device?
a.
Unicast
b.
Multicast
c.
Anycast
d.
Singlecast
8. Telnet
is generally considered to be insecure.
a.
True
b.
False
9. The
FTP command ____ provides a directory listing of files and subdirectories.
a.
ls
b.
mget
c.
mput
d.
open
10. A(n)
____ can contain two types of entries: dynamic and static.
ARP table
11. On
an IP datagram, the ____ field informs routers what level of precedence they
should apply when processing the incoming packet.
a.
Differentiated Services (DiffServ)
b.
total
length
c.
version
d.
Time
to Live
12. ____ is a process of subdividing a single
class of networks into multiple, smaller logical networks, or segments.
Subnetting
13. The
range of addresses beginning with ____ is reserved for a device communicating
with itself, or performing loopback communication.
a.
60
b.
80
c.
127
d.
145
14.
________________ are in the range of 0 to 1023 and are assigned to processes
that only the operating system or an administrator of the system can access.
a.
Registered
Ports
b.
Dynamic
Ports
c.
Static
Ports
d.
Well Known Ports
15. Host
files are the best automated solution for assigning IP addresses.
a.
True
b.
False
16. Most
FTP hosts, especially those whose purpose is to provide software updates, do
not accept anonymous logons.
a.
True
b.
False
17. The
command used to view IP information on a Windows XP or Windows Vista
workstation is ipconfig.
a.
True
b.
False
18. It
is unacceptable to leave APIPA enabled if it is not needed.
a.
True
b.
False
19. Resolvers
are any hosts on the Internet that need to look up domain name information.
a.
True
b.
False
20. _
____ is a de facto standard on the Internet and has become the protocol of
choice on LANs and WANs.
a.
TCP/IP
b.
Transmission
Control Protocol/Internet Protocol
21. A
domain name is represented by a series of character strings, called ____,
separated by dots.
a.
labels
b.
features
c.
echo
replies
d.
hosts
22. IPv6
addresses are composed of ____ bits.
a.
32
b.
64
c.
128
d.
256
23. The term ____ refers to the database of
Internet IP addresses and their associated names.
namespace
24. Port
numbers are assigned either by the operating system or by software programs
that rely on them.
a.
True
b.
False
CHAPTER QUIZ
1. Whether
connecting to the Internet or to another computer within a LAN, every node on a
network must have a unique ____________________.
IP address
2. Protocols
that can span more than one LAN (or LAN segment) are ____________________,
because they carry Network layer addressing information that can be interpreted
by a router.
routable
3. ____
is a simple Application layer protocol used to synchronize the clocks of
computers on a network.
a.
NNTP
b.
PING
c.
NTP
d.
ARP
4. If your network does not need or use APIPA,
it must be uninstalled to avoid conflicts.
a.
True
b.
False
5. ____ is a terminal emulation protocol used to
log on to remote hosts using the TCP/IP protocol suite.
a.
FTP
b.
Telnet
c.
NTP
d.
NNTP
6. In IPv6, each address contains a_________,
or a variable-length field at the beginning of the address that indicates what
type of address it is.
a.
Format Prefix
b.
Address
Prefix
c.
Field
Prefix
d.
Variable
Prefix
7. ____________________
is a process of subdividing a single class of networks into multiple, smaller
logical networks, or segments.
Subnetting
8. In
IPv4 addressing, a node with an IP address of 168.34.88.29 belongs to a Class
____ network.
a.
A
b.
B
c.
C
d.
D
9. TCP
is a____ subprotocol.
a.
connection-oriented
b.
connectionless
c.
open-ended
d.
indiscriminating
10. In
dotted decimal notation, a ____ separates each decimal.
a.
period
b.
colon
c.
slash
d.
dash
11. In IPv4 addressing, each IP address is
a unique ____ number.
a.
12-bit
b.
32-bit
c.
64-bit
d.
128-bit
12. TCP
ensures reliable data delivery through sequencing and ____________________.
checksums
13. In
IPv4 addressing, an IP address whose first octet is in the range of 192–223
belongs to a Class ____ network.
a.
A
b.
B
c.
C
d.
D
14. The
command used to view IP information on a Windows workstation is ipconfig.
a.
True
b.
False
15. ____ ARP table entries are created when a
client makes an ARP request that cannot be satisfied by data already in the ARP
table.
a.
Temporary
b.
Dynamic
c.
On-demand
d.
Static
16. If
the standard port number for the Telnet service is 23, a host whose IPv4
address is 10.43.3.87 has a socket address for Telnet of ____.
a.
10.43.3.87:23
b.
10.43.3.87-23
c.
23:10.43.3.87
d.
10.43.3.87/23
17. The
subprotocol that enables TCP/IP to internetwork - that is, to traverse more
than one LAN segment and more than one type of network through a router is
____.
a.
TCP
b.
IP
c.
ICMP
d.
UDP
18. A
UDP header contains ____fields.
a.
four
b.
six
c.
eight
d.
ten
19. In
the TCP/IP protocol suite, ____ is the core protocol responsible for logical
addressing.
a.
UDP
b.
ARP
c.
IP
d.
TCP
20. The
format of ARP tables is the same from one operating system to another.
a.
True
b.
False
21. ____ operates at the Network layer and manages
multicasting.
a.
ICMP
b.
UDP
c.
IP
d.
IGMP
22. A ____ number is the address on a host where
an application makes itself available to incoming or outgoing data.
a.
application
b.
destination
c.
port
d.
source
23. ICMP
(Internet Control Message Protocol) reports on the success or failure of data
delivery.
a.
True
b.
False
24. ____
is a utility that can verify that TCP/IP is installed, bound to the NIC,
configured correctly, and communicating with the network.
a.
FTP
b.
Telnet
c.
PING
d.
ARP
25. In
the domain name www.google.com, ____ is the top-level domain (TLD).
a.
www
b.
google
c.
http
d.
com
