Lesson 55 - Introduction to IPv6 - Addresses

Network Address Translation I have rambled about in the last four posts, is designed to deal with a rapid IPv4 address depletion. The scope of 32 bits, allows to allocate 4 294 967 296 unique numbers. Even though, it seemed a lot in late 80s, the exponential growth of the Internet in 90s showed us that 4.3 billion addresses are not enough to uniquely identify our devices these days. The solution to the problem, at least for now, is to use IP version 6.

But what happened to IPv5?
I have found the answer to this question at:
http://compnetworking.about.com/b/2008/11/05/what-happened-to-ipv5.htm

IPv6 Header
IPv6 Header has been simplified in order to improve the efficiency on the routers. Fewer header fields to process, allow faster transmissions. Take a look at the comparison between IPv4 and IPv6 headers:

Pic. 1 - IPv4 Header.

 

Pic. 2 - IPv6 Header.

Pic. 3 - IPv4 and IPv6 Header Field Comparison.

Source:
http://www.cisco.com/en/US/tech/tk872/tech_white_papers_list.html
(IPv6 Headers at Glance.pdf)

IPv6 header does not use checksum, the TTL field has been replaced with Hop Limit name, and packets will no longer be fragmented (Path MTU Discover is going to be performed or the minimum MTU must be used: 1280 bytes).

IPv6 uses 128-bit addresses and offers us quite a number of unique identifiers:

3.4 x 10 ^ 38

So the number of addresses available is this:

340,282,366,920,938,463,463,374,607,431,768,211,456

Chances are that we will not run out of these till the end of this century.

In IPv6 designers gave up on broadcast transmissions. They have been replaced with multicast and unicast.

IPv6 Address Notation
Decimal notation has been replaced with hexadecimal using 16 characters (0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f). A=10, B=11, C=12 etc. You can use both upper and lower cases to address your device since the numbers are case insensitive.

IPv6 address consists of eight groups of four characters (2-byte values) delimited with the colon (:). Take a look at this address:

2001:0db8:65a3:0000:0000:5d2e:0370:7134

Addresses still use the hierarchy like we in IPv4. They are divided into two parts. The green one (64 bits) denotes the network portion, and the blue one is a interface identifier. Since it would be tedious to type in all these numbers, we can use few shortcuts. 

• Leading zeros can be omitted
• Groups of four zeros can be abbreviated to a zero
• Multiple contiguous groups (2-byte groups) can be abbreviated to double colon (::) but only once.

Look at these examples below.

Leading zeros omitted: 
2001:0db8:65a3:0000:0000:5d2e:0370:7134 can be abbreviated to:
2001:db8:65a3:0000:0000:5d2e:370:7134

Groups of four zeros can be abbreviated to a zero:
2001:0db8:65a3:0000:0000:5d2e:0370:7134 can be abbreviated to:
2001:0db8:65a3:0:0:5d2e:0370:7134 can be abbreviated to:

Multiple contiguous groups (2-byte groups) can be abbreviated to double colon (::) but only once
2001:0db8:65a3:0000:0000:5d2e:0370:7134 can be abbreviated to:
2001:0db8:65a3::5d2e:0370:7134

Following all these shortcuts:
2001:0db8:65a3:0000:0000:5d2e:0370:7134 will be represented

2001:db8:65a3::5d2e:370:7134

Types of IPv6 addresses
There are few types of addresses w need to know about. These are:

1. Global Addresses - Unique, global addresses used on the Internet. They use the following prefix 2000::/3.
2. Link Local Addresses - Used to communicate with hosts on the same physical or logical network. These addresses start with FE80::/10
3. Site Local Address - The equivalent of RFC1918 (private addresses) but they are being deprecated. They start with FEC0::/10 prefix.
4. Multicast Address - Multicast replaces broadcast (along with unicast). The addresses use the following prefix: FF00::/8.

In my next post, I will show you simple configuration of these addresses on the command line interface.

Lesson 52 - Network Address Translation Part 2

NAT Principles in a Nutshell
Now, that you realize there are not enough addresses for all devices in the global network, we can proceed with the general principles behind NAT.

The idea is quite simple when you think about it. The role of the edge router (the one that connects our private network to ISP) is to replace the original, source address in the IP header (private) with the one that is globally unique.

When the packet comes back, the edge router must have enough information to replace the globally unique address used (which now is the destination address) with the same one that was used by the sender originally (private).

NAT Principles - Detailed Explanation
Using our proper terminology, when the IP packet enters the router's inside interface (connected to the LAN), and is sent out the outside interface (connected to the Internet), it removes the inside local address (private, e.g. 192.168.1.1), makes a note what it did in the so called NAT table, and inserts the inside global address (public) in the IP header instead.

So for instance, the original source 192.168.1.1 becomes 86.46.1.10 when the packet is sent towards the Internet (apologies if I use somebody's real IP address here) .

Then, when the destination host sends the reply back to the original sender, this 86.46.1.10 (former source) becomes the destination address. Our edge router receives it on its 'outside interface'. Since, the outbound interface is now our 'inside interface' the router will need to find the appropriate entry in the NAT table which will allow it to identify the original sender's address (our 192.168.1.1). Its address will be now inserted in the destination field of IP header so the packet will be sent to the appropriate host originating this transmission. Check the step-by-step procedure below to see that more clearly.

Step 1
PC (Src=192.168.1.1) is sending packet towards Cisco web server (Dst=72.163.4.161). Since, the destination is not on the same network, the packet is sent towards the default gateway (MAC address of the router's F0/0). If you have problems with this, try to look back at the lessons about TCP/IP traffic flow.

Step 2
The router R1 receives the frame, checks the MAC address and realizes it is the destination for this Layer 2 frame (its MAC address shows in the destination field of the Ethernet header). Layer 2 frame is stripped off and the IP header is read. The destination IP (72.163.4.161) is not listed in the routing table, but the router has a default route (0.0.0.0/0) which tells it to send it to the ISP's router (here:R2). The packet is moved to the outbound interface (S1/0).

Now comes the tricky part. Both interfaces have been assigned special roles in NAT configuration. The interface F0/0 is configured as 'nat inside' which tells the router that packets sourced here belong to the 'inside local' group of addresses (candidates for translation). And the S1/0 interface is configured as 'nat outside'. This interface cannot send packets out with their original 'inside local' numbers (private addresses defined in RFC 1918). The router must perform the translation (address replacement) as per Step 3.

Step 3
R1 is removing 192.168.1.1 address from the IP header (source), and inserts 'inside global' address given to us by our ISP (for example: 86.46.1.10). You're probably waving your hands right now in protest saying: but my ISP does not give me many addresses. Stick with me for now, I will address this issue in my next post. For now, let's just assume that our ISP is generous and gives us a whole bunch of public IP addresses.

After removing 192.168.1.1 and replacing it with 86.46.1.10, the packet is sent out towards its destination (72.163.4.161). R1 creates a special entry in the NAT Table which will allow it to replace it back to 192.168.1.1 when the packet is sent back from www.cisco.com (72.163.4.161). Look at this action below:

Pic. 1 - Inside Local Address Replaced with Inside Global.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Step 4
The Cisco web server (72.163.4.161) is replying back to the sender. So, the IP header has the following addresses:
Src = 72.163.4.161
Dst = 86.46.1.10

The routers on the Internet send it back to our ISP (don't ask how it's done), which in turn, sends this towards S1/0 interface. At this stage, tTake this action for granted. The packet arrives on the 'nat outside' interface of R1 (S1/0). This is where the router is going to look into the NAT table, that should have the proper entry created before, allowing it to remove 86.46.1.10 and inserting the previously used address (192.168.1.1). This action allows to send this packet out its 'nat inside' interface (F0/0) back to the host which originated this transmission and expects to receive the reply.

After translation, the header looks as follows:
Src = 72.163.4.161
Dst = 192.168.1.1

The PC receives the reply packet from 72.168.4.161 as expected.

Pic. 2 - Inside Global Replaced with Inside Local.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

If you have many public addresses (inside global) you can configure this type of translation using two methods:

• Static Translation - one-to-one translation (one inside local is represented by the same inside global address). This allows 24/7 access to that computer (e.g. www, ftp, smtp, etc.) since the entry never ages out.
• Dynamic Translation - computers can use the public addresses from the pool of available ones. Then, after the transmission ends and the entry ages out, this public (inside global) address is sent back to the pool and other computer can use it. There is not permanent one-to-one translation using this method.

The problem is that in 99.999% cases, ISP only gives you a one public address which is applied on the router's interface facing the Internet ('nat outside'). How does NAT handles this problem?

In such situations we use Port Address Translation (Cisco also calls this method NAT overload). This method I leave for my next post.

Lesson 31 - What is a Router?

We take a lot of things for granted. When it comes to technologies it is not necessarily the best idea. The point is to understand. That is why I am going to start my routing section with fundamentals. Knowing them will allow you to learn more advanced topics on your own later. Make sure you are familiar with my previous posts related to binary numbers and IP addressing before you read this and upcoming ones.

Probably the most appropriate question to start with would be ...

What is a router?
A router is a specialized computer which can connect multiple networks to allow exchange of packets between them. Since a router uses IP header information (layer 3 protocol data unit), to transmit the packets between networks, this ability makes it a layer 3 device. Like switches, routers build a special database which serves as the source of information on what to do with incoming packets. This database is formally called Routing Information Base (RIB). But most often people call it a routing table. How a router constructs a routing table and maintains information in it, will be the topics of quite a few upcoming posts.

A router is in many ways similar to a regular PC. It has RAM and ROM memory chips as well as CPU and motherboard etc. But instead of using hard drive, it uses a flash memory to store files such as the operating system (IOS). Also, what makes it distinct, the operating system and hardware are optimized for fast packet transmissions. Typically the router uses at least two interfaces but more often than not, it has a greater number of them. Cisco operating system is called InternetworkOperating System (IOS). The same name is given to OS used by many Cisco Catalyst switches. Although some of them may also use CatOS.

There is a great variety of interfaces routers can use. For instance, they can connect few Ethernet networks together, but also Ethernet with Wide Area Networks (WANs) such as ATM, Frame-Relay, X.25, ISDN, Broadband etc.

Router Functions
In order for the routers to connect multiple layer 3 networks together, they must be able to do the following:

• Learn which networks/subnets are available
• In case there are multiple paths, choose the the best one
• Keep (routing table) must be up-to-date
• Translate layer 2 headers (disparate network connections)
• Keep loop-free paths
• Make forwarding decisions based on layer 3 headers

Routing is primarily based on hop-by-hop paradigm. This means that if there are multiple routers in the path, a router must find the outbound interface and forward the packet to a next hop router. A router could not care less as to what happens to the packet after it has been expedited.

In order to find the outgoing interface an IP destination address of a packet and a routing table are used. The process whereby destination IP address is the key information to find the outbound interface for a packet is called destination-based routing. However, it is possible to influence that decision making process and choose other criteria such as source of IP transmission, size of the packet, importance of the packet in relation to others or some other parameters rather than destination IP address. When used it is referred to as the traffic engineering. For now though, I am going to focus in on the default behavior.

Before I describe the router's principles of operation, I must make sure we are on the same page with the fundamentals related to the traffic flow.

Let's recall what happens with the packets sent between computers residing in different networks. I will use a simple topology (pic. 1) to review a few facts. Please, get familiar with the picture below first. Pay a special attention to the three headers depicted and numbers in green circles. The numbers refer to the steps below. Of course, this is only a ten thousand foot view of what happens here. Before we jump into the deep water we need to warm up a bit by looking at the process from a high perspective.

Pic. 1 - Traffic Flow and Layer 2/layer 3 Encapsulation/Dencapsulation

Icons designed by: Andrzej Szoblik - http://www.newo.pl

The numbers in green circles mark the important points of the traffic sent from PC1 (left hand side) to the PC2 (on the right side of the picture).

In the explanation presented below I assume that SW1 and SW2 have populated their CAM tables (learned all MAC addresses on the appropriate ports). Here's how it goes.

Step1 

PC1 sends a packet destined to PC2. Since, PC1 has the IP address 192.168.1.1/24, it realizes that the first 24 bits of the destination IP address are different than its own (source: 192.168.1.1, destination: 192.168.3.1). Conclusion: PC2 is NOT in the same layer 3 network, so default gateway (192.168.1.254) must be used to forward the packet to PC2. Knowing it, the IP header is going to use:

• Src IP = 192.168.1.1
• Dst IP = 192.168.3.1
• TTL = 32 (ttl is set by the application, here I use 32 as an example)

IP packet is encapsulation in Ethernet (layer 2) header in order to be put onto the wire. Ethernet header contains source MAC address of the sender, and destination MAC address of R1's F1/0 interface obtained from the computer's arp cache (if not found in the arp cache, arp request is sent):

• Src MAC: 0000.1111.1111
• Dst MAC: 0000.2222.2222

Step 2
SW1 receives the frame on its port F0/1. It locates the outbound port (f0/2) for destination 0000.2222.2222. It sends the frame out towards F1/0 port of R1. Neither of layer 2 or layer 3 headers presented in the pic. 1 change during this transmission (parameters depicted).

Step 3
R1 receives frame on F1/0 port. Layer 2 header is inspected by R1. Since the destination MAC address (0000.2222.2222) is the address of F1/0, R1 concludes it is the destination for the frame. Layer 2 header is removed and the content of the message (packet) is processed by the router.R1 processes IP header, reads the destination IP address (192.168.3.1) and compares it with the entries in its routing table trying to find the longest match. More on this in the upcoming post. Once the best path has been found, the routing table points to the outbound interface (F1/1) and the next-hop router's IP address (192.168.2.2) that should be used to expedite the packet.

Step 4
The packet is moved to F1/1 port and the TTL number is decremented by 1 (now TTL=31). Then, the packet is encapsulated in the layer 2 header.The following source and destination MAC addresses are used now:

• Scr MAC: 0000.3333.3333
• Dst MAC: 0000.44444.4444

The destination MAC address is obtained from R1's arp cache. If R1 does not know the MAC address for 192.168.2.2 (next-hop router), arp request is sent asking for its MAC address.

Step 5
R2 receives the frame on F1/0 port. It performs the same job R1 has done. It reads the destination MAC address. Since it is the recipient (0000.4444.4444), it dumps the layer 2 frame and processes IP header. It performs layer 3 lookup in its routing table and finds the outbound interface for destination 192.168.3.1. In our example it turns out that the destination network is connected directly to F1/1 interface. In such case, R2 checks arp cache for MAC address of the destination (192.168.3.1) if one is not found, arp request is sent (who's 192.16.8.3.1 ?, I need you MAC address!).

Step 6
The packet is moved to F1/1 interface and before it gets encapsulated, the TTL number is decremented by 1 (TTL=30). The packet is encapsulated in an Ethernet frame header using the following addresses:

• Src MAC: 0000.5555.55555
• Dst MAC: 0000.6666.66666

The frame is sent out F1/1 interface.

Step 7
SW2 receives the frame and finds the outbound interface for the MAC address: 0000.6666.6666 int its MAC address table. It is port is F0/2.

Step 8
The frame is sent out F0/2 towards PC2. Fields in the layer 2 and layer 3’s headers remain the same.

The above is just a quick review in case you've forgotten that.

The interesting bit for us now is the router's process of finding the outgoing interface and layer 2 addresses of the next hop device. I'm going to elaborate on this in my next post. Now, let me quickly present the routing table components that are essential in this traffic flow.

Pic. 2 - Routing Table Components.

Components of Routing Table:

• C and S - point how a router obtained the information (C = connected, S=static route)
• 192.168.3.0/24 - Example of prefix (destination network/subnet)
• [1/0] - square brackets show two numbers. First (1) is Administrative Distance, second (0) is Metric
• via 192.168.2. - the next-hop-router address

How router populates the routing table, what these terms in red mean and how router uses these parameters to pick the longest match and as a result of that the best path, are going to be the main topics of my next post.

Lesson 9 - Bridging/Switching Learning Process

In the previous lesson we looked at the Ethernet and a hub operation. We classified hub to be a layer 1 device as it does not understand any headers used by upper layers of our networking model. It simply forwards the bits it receives out all remaining ports. Even though, they do provide basic connectivity to our hosts, they also reveal a lot of weaknesses. For details look at the lesson 8.

A more intelligent and robust device that can replace a hub is a layer 2 switch. You've already learned how to navigate in IOS, and provide the switch with a simple configuration. With this lesson we begin a more serious exploration of layer 2 through layer 4 functions starting with Layer 2. This is good enough excuse to brush upon encapsulation/de-encapsulation process, and the structure of the headers.

Enapsulation Process Re-Visited
This is a quick review of encapsulation process I would present to my nine year old son (if he wanted to learn more).

1. Assuming that TCP session is already complete, the application is forming the request (data) which is sent down to the layer 4. Layer 4 process places source and destination port numbers in the header (Pic. 1).

Pic. 1 - Application sends data to the Transport layer.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

2. Transport layer sends the segment down to the layer 3 for processing. This payload ends up encapsulated in an IP header with the source and destination IP addresses added in the header (Pic. 2).

Pic. 2 - Transport layer sends the segment to the Internet layer.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

3. The layer 3 sends the packet down to the layer 2 (Data-Link) for processing. Layer 2 adds its own header (here the Ethernet header) with the source and the destination MAC addresses (Pic. 3).

Pic. 3 - Internet layer sends packet down to Data-Link layer.

Then, this whole 'thing' is converted into bits and put onto the wire.

Now, we can see what happens when the bits are sent to the port of the switch to reach the destination computer. Let's bring back the Ethernet header to see what we find in it (Pic. 4).

Pic. 4 - Ethernet Header

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In this header there are two pieces of information that switches use to build their mac-address-table (CAM) and make forwarding decisions. Those are: source and destination MAC addresses. And here is how it works.

Initially, the mac-address-table (aka CAM) is completely empty (Pic. 5).

Pic. 5 - Content Addressable Memory (CAM) initially is empty.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Sooner or later, some computers begin to transmit something across the network. In my example, the PC1 (source MAC address: 1111.1111.1111) begins transmission to PC3 (destination MAC address: 3333.3333.3333). Below is the sequence of events.

1. PC1 with the source MAC address of 1111.1111.1111 sends the Ethernet frame to the destination MAC address of 3333.3333.3333 (PC3).

2. SW1 receives the frame on port F0/1. It 'reads' the source MAC address and maps it to the receiving port in its CAM (like shown in the Pic. 6).

---

NOTICE
Switches learn MAC addresses by reading the SOURCE MAC from the INCOMING frames (going towards the switch) only. They do not learn anything when the frame leaves the switch.

---

Pic. 6 - SW1 learns dynamically 1111.1111.1111 by reading the source MAC address from the incoming frame.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

3. SW1 then, reads the destination MAC address and will try to find the outbound port for that destination. Since 3333.3333.3333 has not yet been mapped to any port, the switch will performflooding (Pic. 7).

Flooding is the act of sending a frame out of all active ports except the port where the frame arrived. 

There are few reasons why switch decides to flood a frame:

• Switch does not know where the destination host is = unknown MAC address.
• The destination MAC address is broadcast: FFFF.FFFF.FFFF.
• The destination MAC address is multicast.

 Pic. 7 - SW1 Floods unknown destination MAC address 3333.3333.3333.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

4. Computer with MAC address other than 3333.3333.3333 drop the incoming frames. PC3 is the destination of the frame so it further processes it (de-encapsulation). Meanwhile, the SW2 learns the source MAC address on the receiving port F0/12 and maps it in its CAM. Since, as of right now, it does not know where 3333.3333.3333 resides, it also floods the frame (Pic. 8).

Pic. 8 - SW2 is learning 1111.1111.1111 on F0/12 and flooding the frame.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

5. PC3 (3333.3333.3333) responds the PC1 (1111.1111.1111). SW2 receives the frame sourced with 3333.3333.3333 on port F0/2. It puts this in its mac-address-table (CAM), mapping it to the inbound port F0/2. Next, it will read the destination MAC address in the frame (1111.1111.1111) and consults it with its CAM entries. It finds the outbound port F0/12 where this address has already been learned from the incoming frame. This time, the transmission is not flooded as SW2 has the mapping in the table. SW1 receives the frame on its port F0/12. It reads the source MAC address (3333.3333.3333) and maps it to the receiving port F0/12 in its CAM table. Then it looks at the destination MAC address (1111.1111.1111) and finds the outbound port which is F0/1. NO FLOODING THIS TIME on either switch! All illustrated in the Pic. 9.

Pic. 9 - Port-to-Port transmission in the reply as all MAC addresses in question have already been learned.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Since all computers 'speak' now and then, the switches will learn their MAC addresses from the incoming frames by reading the source MAC address field in the headers. They will populate the CAM and like depicted in Pic. 10.

---

NOTICE
All entries in the CAM table (mac-address-table) have a default aging timer which is 300 seconds (5 minutes). If the host do not refresh those entries by sending frames toward the port, the entries will be removed after 5 minutes. Of course, if the host transmits the frames again the incoming ports will map them again.

---

Pic. 10 - Content Addressable Memory (CAM) full.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In the next lesson we will look at Cisco Discovery Protocol.In lesson 11, we're going to put all the pieces together to show you the practical applications of what you have learned.

Lesson 6 - Example of TCP/IP Traffic Flow

In the lesson 4 I discussed the TCP/IP model and the terminology that is commonly used in the networking field. Lesson 5, focused on explaining the process of encapsulation and de-encapsulation that computers apply in order to send and receive data across a network. Those concepts are the minimum knowledge we need to posses to understand this lesson.

In this lesson, you will get to see the bare bones. I am going to show you more details regarding the headers used in encapsulation and de-encapsulation process. Also, we will consider a typical transmission to shed more light on somewhat 'dry' content of the previous two lessons.

As mentioned before, the application layer on the client computer is sending some data (request that will look differently depending on the applications used) destined to the application on the server computer. A detailed explanation of what happens during the transmission can be found in the free, on-line 'TCP/IP Guide' book. The link is available below. However, the above guide is a hefty book. If you want to stick to the basics please, keep on reading.

http://www.tcpipguide.com/free/t_toc.htm

All transmissions use similar process so, as an example, I'm going to show you a typical web client to web server transmission step-by-step. The methodology is almost identical for all other types of data exchange. Before I do that though, please familiarize yourself with the headers that will be used during the encapsulation (sender) and de-encapsulation (receiver) process. Do NOT dwell on those, or try to understand all the mentioned fields. Instead, take a brief look, and refer to them while reading the lesson.

Transport Layer Headers (layer 4)

Pic. 1 - UDP Header (used mostly in voice/video transmissions/dns queries, etc.)

Pic. 2 - TCP Header (used when reliable transport is required)

Internet Layer Header (layer 3)

Pic. 3 - IP Header

Data-Link Layer Header (layer 2)

Pic. 4 Ethernet Header (most commonly used technology in our LAN networks)

Click on the pictures to enlarge them.

---

NOTICE!
The following discussion has been simplified in order to help you understand the general process. Keep in mind that in reality, it is much more complex process than the explanation presented below.

---

Web Client to Web Server Transmission Step-by-Step

The best way to learn the theory is to see things working in practice. That is why, I am going to capture the web traffic initiated by my client computer destined to my web server. Before you delve into analyzing the details, please familiarize yourself with my client and server addresses first.

Web Client Details:
IP Address: 192.168.1.13 255.255.255.0
MAC Address: 00:24:e8:fa:07:1a

Web Server Details:
IP Address: 192.168.1.1 255.255.255.0
MAC Address: 00:50:bf:9c:45:6a

Step 1
In the URL field of my web browser I'm typing in the address of the server using HTTP protocol (Layer 5 protocol used as an example). This will tell the application what the address of the server is. I accept it by hitting the 'Enter' key.

Pic. 5 - URL Address of the web server

Step 2
The client computer realizes that the address of the recipient (web server) is in the same layer 3 network (the first 24 bits of the both source and destination address are the same). More on this, you will learn in the upcoming lessons. As a result of that, the client needs to obtain the MAC address of the web server first. Recall from the previous lesson that IP packet is encapsulated in layer 2 header, which in our case uses source and destination MAC addresses. Normally, the client computer is going to check the local 'arp cache' to find out if the mapping of the destination IP address to its MAC address is there. If not, like in my example, the client is going to issue 'ARP Request' message (Address Resolution Protocol) to learn the destination's computer MAC address. This request is propagated to ALL local machines in the network 192.168.1.0/24. Pay attention to the highlighted lines in the picture. The destination MAC address in the query is the Ethernet broadcast address: FF:FF:FF:FF:FF:FF. In the ARP request the client computer asks 192.168.1.1 for its MAC address (which, as of right now, is all 0s; see the below pic. 6).

Pic. 6 - ARP Request

---

NOTICE!
The ARP request is considered a layer 2 protocol. It is directly encapsulated in the Ethernet II frame. Its header is presented in the second line in the middle panel (under the 'Frame 3').

---

Step 3
There is only one computer with its unique address of 192.168.1.1 in the network. This one replies to the query with the 'ARP Reply' message back to the sender of the request, telling it what the MAC address it uses. The address is seen in the middle of the pic. 7 (highlighted) belongs to web server. The address reads:
00:50:bf:9c:45:6a

Pic. 7 - ARP Reply

Step 4
The MAC address of the web server was the missing piece of information the client needed to proceed with the TCP session establishment. TCP, being a session-oriented and reliable transport protocol, must establish the mutual communication with the web server first, before it is allowed to send the data from the web browser. This is known as the 3-way handshake. Let us look at the details of the first TCP segment in this session establishment phase.

1. The client (192.168.1.13) sends an 'empty' TCP segment (i.e. with no data from the application included in it).

• It chooses a random source port number first. In the transmission presented the TCPSrc-Port: 51504 is chosen. Also it uses the Dst-Port: 80 which identifies web server destination application. This pair of ports will uniquely identify this particular transmission, as the client can initiate multiple transmissions at the same time. Those two ports (source and destination port numbers) allow multiple transmissions without a risk of 'mixing up' which reply from the servers should be sent back to which inititiating that request process. This way, the process that initiated transmission is going to receive the right reply. I need to add here that TCP and UDP ports are divided into two major groups: 'well-known ports' which are ports between 1-1023 (always destination ports for the client initiating transmissions), and 'ephemeral ports' between 1024-65535numbers. The latter ones, clients choose randomly to mark the source process for their transmissions.
• Sequence Number in the segment = 0. If the web server (destination) receives this segment and replies to it, it will put a value of 1 in the Acknowledgment field. That is an indication for the client, that the first segment did arrive successfully at the server.
• The SYN flag = 1, and all the rest of the flags are set to 0. It means,that this is the first handshake in the exchange. It is the client's request to establish session with the server.
 

---

NOTICE!
The layer 4 segment has been encapsulated in the layer 3 header (pic. 8: 'Internet Protocol') and further encapsulated in the Ethernet frame (pic. 8: Ethernet II). The first line in the middle section of the picture, is what is seen on the wire.

---

Pic. 8 -  TCP Syn Segment

 

2. The next segment captured (pic. 9) comes from the web server and is the reply for the 'SYN' message sent by the web client. Now, please compare both pictures (pic. 8 and pic. 9). Pay attention to the source and the destination TCP port numbers, and the source and destination addresses used in the layer 3 (IP header) and the layer 2 (Ethernet header). Did you notice they are reversed now?

• TCP port numbers are now reversed (TCP Src-port=80, Dst-port=51504) in order to send the reply directly to the port that initiated the request).
• The server's segment has the Sequence number=0, but the Acknowledgement number=1. It is what we expected. This means that the delivery of the client's first segment was successful).
• The flag ACK=1, which is the acknowledgement for the SYN flag from the client.
• The server also wants to synchronize the transmission with the client. That is why it sets its own SYN=1 in this segment.

Pic. 9 - Server's response SYN, ACK

3. The client needs to reply to the server's SYN message with its ACK=1 to finalize the session establishment (see the pic. 10). Here's what you find in the third handshake from the web client:

• Src-port=51504, Dst-port=80.
• Acknowledgement=1, which is to tell the server that its segment sequence=0 has arrived successfuly.
• Sequence=1, which means that it is the second segment sent to the server. That's what the server expects to receive (in the next reply from the server, it should seeAcknowledgment=2).
• The flag ACK=1, which is the response to the SYN=1 flag received from the server.

This way, the 3-way handshake is complete!

Pic. 10 - Final ACK from the server

Step 5
The client has established session with the server, so now it sends the first DATA packet (GET request), asking the server for its main page (look at pic. 11).

Pic. 11 - Request from the client web browser 

---

NOTICE!
The data from the client (GET) is encapsulated in the layer 4 header, this in turn is encapsulated in the layer 3 header, and the whole thing further encapsulated in the layer 2 header. It is what I described in the lesson 5. See the details in the pic. 11.

---

Step 6
Finally, the reply comes back from the server to the client with the html page (see the pic. 12).

Pic. 12 - Reply from the web server

One last thing, I would like to bring up here. Since the appropriate layer understands its header (TCP-talks-to-TCP, IP-talks-to-IP, Ethernet-talks-to-Ethernet), we have two different inter-layer communications taking place:

1. Vertical communication occurs when the upper layer is sending something to the lower layer and vice versa.
2. Horizontal (virtual) communication between hosts when the destination host reads the appropriate header encapsulated by the sender. 

Both are depicted in the picture below:

Pic. 13 - Horizontal and vertical inter-layer communication.

The content of this lesson is very simplified, just to get the juices flow. Below I present a short video which walks you through the whole process again. You might find it useful to fully understand the content of this lesson. If you caught the idea, please proceed to the next lesson.

Lesson 5 - Encapsulation and De-enapsulation Process

Assuming that you have read my previous lesson about TCP/IP Layers, it's a good idea to take a closer look at the vertical transmissions between layers occurring on the sender host and the reverse process occurring at the receiving end.

So, the main topic of this lesson, is going to be encapsulation and de-encapsulation process.

---

NOTICE!
The terminology used in this and subsequent lessons is defined in Lesson 4.

---

Remember that TCP/IP model does not follow OSI model exactly. OSI model is now used as a reference. What's described in this blog is TCP/IP model, not OSI or IPX/SPX model. Look at the comparison below:

Application Layer ==> Transport Layer
All transmissions start at the application Layer (layer 5; keep in mind, that here we're talking about TCP/IP model NOT OSI model which uses 7 layers; just the answer to a comment I got). The application on the local computer (client) initiates a request destined for the application installed on some other remote host (server). That request CANNOT be sent directly on to the wire (layer 1). Instead, it must be processed by ALL the layers in between (layers 4 through 2) before it reaches the media. This way, the request from the application is sent down to the transport layer (layer 4) for processing. Application will choose one of the two common protocols used in the layer 4: either TCP, for reliable connections, or UDP for un-reliable connections.

Transport Layer ==> Internet Layer
The transport layer, upon receiving the request from the application layer, will process it according to what it has been designed to do, and is going to stick a so called header to the incoming data (for the details regarding all headers please, see the next lesson). This header will be understood and processed by the layer 4 at the receiving host (remote computer). This segment (as we call it a 'segment' now), is sent down to layer 3 for processing.

Internet Layer ==> Network Interface (Data-Link Layer) 
The internet layer will process the incoming data from the layer 4 (which now consists of data or payload from layer 5 + layer 4 header) and will stick its own, layer 3 header, to the payload coming from the upper layers. Once it's done, it will send the packet (as we call it a 'packet' at this layer) down to the layer 2 for processing.

Data-Link Layer ==> Network Interface (Physical Layer)
The Layer 2, similarly to the previous layers (layer 4 and layer 3), is going to process the incoming packet according to the functions designed for this layer. Then, it will attach its own layer 2 header, and is going to send the frame (the name given to the layer 2 protocol data unit) down to the layer 1. 

Physical Layer = Signaling
The layer 1 is going to transmit bits, 1s and 0s. Bits is the name given to protocol data unit at this layer according to the OSI model which is the reference for all models). Technically, Layer 1 is common for any networking model and follows IEEE specifications.

The process described above, attaching the controlling information in the forms of the headers, is called encapsulation.


Once the bits arrive at the destination computer (host), the reverse process takes place which is called de-encapsulation.

Network Interface (Physical Layer) ==> Data-Link Layer
The layer 1 is going to accept incoming bits and send them up to the layer 2 for processing.

Network Interface (Data-Link Layer) ==> Internet Layer
The layer 2 piece of software can properly interpret the header information (control information) initially attached by the sender's layer 2 process. So, it reads the layer 2 header, then strips this off, and the content of the frame (without the layer 2 header it's called a packet now), is sent up to the layer 3 for processing.

Internet Layer ==> Transport Layer
The layer 3 is going to perform similar actions that the layer 2 just did. It reads and processes thelayer 3 header in the packet. Notice, that only layer 3 process understands the layer 3 header. Then, it removes the layer 3 header and sends the content of the packet (data without layer 2 and layer 3 headers is called a segment) up to the layer 4.

Transport Layer ==> Application Layer
I'm sure you have already guessed what is going to happen next. Yes, the transport layer will readthe layer 4 header, which consists of the instructions what to do next. Then, uppon stripping off the layer 4 header it will send what was originally created (data request from the client software) to the appropriate process/application at the receiving host (server application).

When the server sends the reply back to the client, the whole encapsulation process will occur again. The client receives the reply from the server, and de-encapsulates the incoming data like explained above.

And this whole process is repeated back and forth until all data has been exchanged.

This process is presented with the below graphics for better understanding of this lesson.

Click the picture to enlarge it.

In the next lesson, we will take a look at the content of those headers and go over and discuss few important fields. This will help us understand the basic communication process using TCP/IP model.